Sharing information between nexuses that use different classification schemes for information access control

• US 9,081,975 B2
• Filed: 10/22/2012
• Issued: 07/14/2015
• Est. Priority Date: 10/22/2012
• Status: Active Grant

• Current Assignee: Palantir Technologies Incorporated
• Original Assignee: Palantir Technologies Incorporated
• Inventors: Ducott, Richard Allen III, Garrod, John Kenneth, Tasinga, Khan
• Primary Examiner(s): Chbouki, Tarek
• Application Number:
  US13/657,684
• Publication Number:
  US 20140114972A1
• Time in Patent Office: 995 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/1837 Management specially adapted to peer-to-peer storage networks topology management mechanisms of peer-to-peer networks H04L67/1042
• CPC Class Codes: G06F 16/213 with details for schema evolution support
• CPC Class Codes: G06F 16/24578 using ranking
• CPC Class Codes: G06F 16/27 Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
• CPC Class Codes: G06F 16/273 Asynchronous replication or reconciliation
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/8358 Query translation
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6236 between heterogeneous systems
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

Systems and methods for sharing information between distributed computer systems connected to one or more data networks. In particular, a replication system implementing methodologies for sharing database information between computer systems where the databases use different classification schemes for information access control is disclosed.

Claims

1. A computer-implemented method, comprising:

at one or more computing devices operatively coupled to a first database;

obtaining export data representing a classification to be imported into the first database, the export data including information representing a set of one or more origin classifications;

wherein the export data is obtained as part of other export data that represents an update to an access control list in a second database;

obtaining, from the first database, first version information representing a version of the access control list in the first database after an update to the access control list in the first database;

obtaining, from the other export data, second version information representing a version of the access control list in the second database after the update to the access control list in the second database;

determining that the update to the access control list in the second database happened after the update to the access control list in the first database based on a comparison between the first version information and the second version information;

performing a first iteration over the set of one or more origin classifications using the information representing the set of one or more origin classifications;

completing the first iteration;

in response to completing the first iteration, performing a second iteration over one or more origin classifications in the set of one or more origin classifications using the information representing the set of one or more origin classifications;

completing the second iteration upon identifying a first origin classification, in the set of origin classifications, having a first set of one or more classification markings that, according to a translation map, can be translated to a second set of classification markings based on a classification scheme used by the database; and

importing the classification into the database, the classification imported into the first database having the second set of classification markings.

2. The method of claim 1, wherein completing the first iteration includes determining that none of the origin classifications, in the set of one or more origin classifications, has a classification scheme identifier matching a classification scheme identifier of the classification scheme used by the first database.

3. The method of claim 1, wherein performing the first iteration includes determining, for each origin classification in the set of origin classifications, whether the origin classification has a classification scheme identifier that matches a classification scheme identifier of the classification scheme used by the first database.

4. The method of claim 1, wherein performing the second iteration includes determining, for each of the one or more origin classifications in the set of origin classification over which the second iteration iterates, whether the origin classification has a set of classification markings that, according to the translation map, can be translated to a set of classification markings based on the classification scheme used by the first database.

5. The method of claim 1, wherein the translation map has a set of translation rules, each translation rule mapping a set of classification markings under a source classification scheme to a set of classification markings under a target classification scheme.

6. The method of claim 1, wherein the translation map is a plugin providing an invoke-able interface that accepts, as parameters, a set of classification markings to be translated, a source classification scheme identifier, and a target classification scheme identifier.

7. The method of claim 1, wherein the classification imported into the first database includes the first origin classification.

8. A computer system comprising:

one or more first computing devices operatively coupled to a first database;

one or more second computing devices operatively coupled to a second database;

one or more first non-transitory computer-readable media storing instructions which, when executed by the one or more first computing devices, cause the one or more first computing devices to perform the steps of;

obtaining a classification to be exported from the first database;

wherein the classification has a set of one or more classification markings and a set of one or more origin classifications;

generating a new origin classification;

wherein the new origin classification includes the set of one or more classification markings;

adding the new origin classification to the set of one or more origin classifications to produce a new set of a plurality of origin classifications;

wherein the new set of origin classifications includes the new origin classification;

exporting the classification as export data;

wherein the export data includes the new set of origin classifications; and

one or more second non-transitory computer-readable media storing instructions which, when executed by the one or more second computing devices, cause the one or more second computing devices to perform the steps of;

obtaining the export data;

wherein the export data is obtained as part of other export data that represents an update to an access control list in the first database;

obtaining, from the second database, first version information representing a version of the access control list in the second database after an update to the access control list in the second database;

obtaining, from the other export data, second version information representing a version of the access control list in the first database after the update to the access control list in the first database;

determining that the update to the access control list in the first database happened after the update to the access control list in the second database based on a comparison between the first version information and the second version information;

performing a first iteration over the new set of origin classifications;

completing the first iteration;

in response to completing the first iteration, performing a second iteration over one or more origin classifications in the new set of origin classifications;

completing the second iteration upon identifying a first origin classification, in the new set of origin classifications, having a first set of one or more classification markings that, according to a translation map, can be translated to a second set of classification markings based on a classification scheme used by the second database; and

importing a classification into the second database, the classification imported into the second database having the second set of classification markings.

9. The system of claim 8, wherein the step of completing the first iteration includes the step of determining that none of the origin classifications, in the set of one or more origin classifications, has a classification scheme identifier matching a classification scheme identifier of the classification scheme used by the second database.

10. The system of claim 8, wherein the step of performing the first iteration includes the step of determining, for each origin classification in the set of origin classifications, whether the origin classification has a classification scheme identifier that matches a classification scheme identifier of the classification scheme used by the second database.

11. The system of claim 8, wherein the step of performing the second iteration includes the step of determining, for each of the one or more origin classifications in the set of origin classification over which the second iteration iterates, whether the origin classification has a set of classification markings that, according to the translation map, can be translated to a set of classification markings based on the classification scheme used by the second database.

12. The system of claim 8, wherein the translation map has a set of translation rules, each translation rule mapping a set of classification markings under a source classification scheme to a set of classification markings under a target classification scheme.

13. The system of claim 8, wherein the translation map is a plugin providing an invoke-able interface that accepts, as parameters, a set of classification markings to be translated, a source classification scheme identifier, and a target classification scheme identifier.

14. The system of claim 8, wherein the classification imported into the second database includes the first origin classification.

15. One or more non-transitory computer-readable media storing instructions which, when executed by the one or more computing devices operatively coupled to a first database, cause the one or more computing devices to perform the steps of:

obtaining export data representing a classification to be imported into the first database, the export data including information representing a set of one or more origin classifications;

wherein the export data is obtained as part of other export data that represents an update to an access control list in a second database;

obtaining, from the first database, first version information representing a version of the access control list in the first database after an update to the access control list in the first database;

obtaining, from the other export data, second version information representing a version of the access control list in the second database after the update to the access control list in the second database;

determining that the update to the access control list in the second database happened after the update to the access control list in the first database based on a comparison between the first version information and the second version information;

performing a first iteration over the set of one or more origin classifications using the information representing the set of one or more origin classifications;

completing the first iteration;

in response to completing the first iteration, performing a second iteration over one or more origin classifications in the set of one or more origin classifications using the information representing the set of one or more origin classifications;

completing the second iteration upon identifying a first origin classification, in the set of origin classifications, having a first set of one or more classification markings that, according to a translation map, can be translated to a second set of classification markings based on a classification scheme used by the database; and

importing the classification into the database, the classification imported into the first database having the second set of classification markings.

16. The one or more non-transitory computer-readable media of claim 15, wherein completing the first iteration includes determining that none of the origin classifications, in the set of one or more origin classifications, has a classification scheme identifier matching a classification scheme identifier of the classification scheme used by the first database.

17. The one or more non-transitory computer-readable media of claim 15, wherein performing the first iteration includes determining, for each origin classification in the set of origin classifications, whether the origin classification has a classification scheme identifier that matches a classification scheme identifier of the classification scheme used by the first database.

18. The one or more non-transitory computer-readable media of claim 15, wherein performing the second iteration includes determining, for each of the one or more origin classifications in the set of origin classification over which the second iteration iterates, whether the origin classification has a set of classification markings that, according to the translation map, can be translated to a set of classification markings based on the classification scheme used by the first database.

19. The one or more non-transitory computer-readable media of claim 15, wherein the translation map has a set of translation rules, each translation rule mapping a set of classification markings under a source classification scheme to a set of classification markings under a target classification scheme.

20. The one or more non-transitory computer-readable media of claim 15, wherein the translation map is a plugin providing an invoke-able interface that accepts, as parameters, a set of classification markings to be translated, a source classification scheme identifier, and a target classification scheme identifier.

21. The one or more non-transitory computer-readable media of claim 15, wherein the classification imported into the first database includes the first origin classification.