Sharing information between nexuses that use different classification schemes for information access control

• US 9,836,523 B2
• Filed: 05/29/2015
• Issued: 12/05/2017
• Est. Priority Date: 10/22/2012
• Status: Active Grant

• Current Assignee: Palantir Technologies Incorporated
• Original Assignee: Palantir Technologies Incorporated
• Inventors: Ducott, III, Richard Allen, Garrod, John Kenneth, Tasinga, Khan
• Primary Examiner(s): Chbouki, Tarek
• Application Number:
  US14/726,204
• Publication Number:
  US 20150261847A1
• Time in Patent Office: 921 Days
• CPC Class Codes: G06F 16/1837 Management specially adapted to peer-to-peer storage networks topology management mechanisms of peer-to-peer networks H04L67/1042
• CPC Class Codes: G06F 16/213 with details for schema evolution support
• CPC Class Codes: G06F 16/24578 using ranking
• CPC Class Codes: G06F 16/27 Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
• CPC Class Codes: G06F 16/273 Asynchronous replication or reconciliation
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/8358 Query translation
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6236 between heterogeneous systems
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

Systems and methods for sharing information between distributed computer systems connected to one or more data networks. In particular, a replication system implements methodologies for sharing database information between computer systems where the databases use different classification schemes for information access control.

Claims

1. A computer-implemented method performed via a plurality of processors, the method comprising:

obtaining, from a source database, via at least one of the plurality of processors, an identifier of an access control list, at least one access control item of the access control list, and one or more classification markings of the access control list;

generating, via at least one of the plurality of processors, an origin classification comprising an identifier of a classification scheme used for classifying information in the source database and comprising the one or more classification markings of the access control list;

wherein the classification scheme used for classifying information in the source database comprises a set of classification markings, each of the one or more classification markings of the access control list belonging to the set of classification markings of the classification scheme;

exporting, via at least one of the plurality of processors, export data to a peer database system;

wherein the export data comprises the identifier of the access control list, the at least one access control item, and the origin classification;

the peer database system receiving the export data via at least one of the plurality of processors; and

the peer database system storing, via at least one of the plurality of processors, in a target database at the peer database system, in association with the identifier of the access control list;

the at least one access control item, and

one or classification markings belonging to a target classification scheme used for classifying information in the target database.

2. The method of claim 1, wherein the at least one access control item and the origin classification are associated with the identifier of the access control list in the export data.

3. The method of claim 1, wherein the access control list governs access to associated information in the source database.

4. The method of claim 1, wherein the origin classification comprises a representation of the one or more classification markings in a form of a classification string.

5. The method of claim 1, wherein the export data is formatted in an eXtensible Markup Language (XML) format.

6. The method of claim 1, wherein exporting the export data comprises sending, via at least one of the plurality of processors, one or more network messages comprising the export data to the peer database system via one or more data networks.

7. The method of claim 1, wherein the at least one access control item comprises a specification of a permission and a user, one or more users, or a group of users that have that permission.

8. The method of claim 1, further comprising:

obtaining, from the source database, via at least one of the plurality of processors, an origin classification associated with the identifier of the access control list in the source database; and

wherein the export data comprises, in addition to the origin classification, the origin classification associated with the identifier of the access control list in the source database.

9. The method of claim 8, wherein the origin classification and the origin classification associated with the identifier of the access control list in the source database are ranked in the export data;

and wherein the origin classification associated with the identifier of the access control list in the source database has a lower rank in the export data than the origin classification.

10. A computer-implemented method performed via one or more processors, the method comprising:

obtaining, via at least one of the one or more processors, export data from a source database system representing at least creation, or modification, of an access control list in a source database of the source database system;

wherein the export data comprises an identifier of the access control list, at least one access control item of the access control list, and a plurality of ranked origin classifications associated with the identifier of the access control list in the export data;

wherein each ranked origin classification of the plurality of ranked origin classifications comprises one or more classification markings and comprises an identifier of a classification scheme to which the one or more classification markings of the each ranked origin classification belongs;

identifying, via at least one of the one or more processors, a lowest ranked translatable origin classification, of the plurality of ranked origin classifications, where the one or more classification markings represented in the lowest ranked translatable origin classification can be translated, according to a translation rule, to one or more corresponding classification markings belonging to a target classification scheme used for classifying information in a target database;

wherein the target classification scheme used for classifying information in the target database is not the classification scheme identified in the lowest ranked translatable origin classification;

translating, via at least one of the one or more processors, the one or more classification markings in the lowest ranked translatable origin classification, according to the translation rule, to the one or more corresponding classification markings belonging to the classification scheme used for classifying information in the target database; and

storing, via at least one of the one or more processors, in the target database in association with the identifier of the access control list, the at least one access control item and the one or more corresponding classification markings belonging to the target classification scheme used for classifying information in the target database.

11. The method of claim 10, wherein identifying the lowest ranked translatable origin classification comprises iterating over at least one of the plurality of ranked origin classifications in rank order from lowest rank to highest rank until an origin classification, of the plurality of ranked origin classifications, is identified where the one or more classification markings of the origin classification can be translated, according to a translation rule, to one or more corresponding classification markings belonging to the target classification scheme used for classifying information in the target database.

12. The method of claim 10, wherein the translation rule maps the identifier of the classification scheme of the lowest ranked translatable origin classification and the one or more classification markings of the lowest ranked translatable origin classification to the one or more corresponding classification markings belonging to the target classification scheme used for classifying information in the target database.

13. The method of claim 10, wherein the translation rule is one of a plurality of translation rules of a translation map;

and wherein the translation map accepts, as input, an identifier of a source classification scheme, a set of one or more classification markings belonging to the source classification scheme, and an identifier of a target classification scheme; and

wherein translating the one or more classification markings in the lowest ranked translatable origin classification comprises;

providing, as input to the translation map, the identifier of the classification scheme of the lowest ranked translatable origin classification, the one or more classification markings of the lowest ranked translatable origin classification, and an identifier of the target classification scheme used for classifying information in the target database; and

obtaining, as output from the translation map, the one or more corresponding classification markings belonging to the target classification scheme used for classifying information in the target database.

14. The method of claim 10, further comprising:

storing, via at least one of the one or more processors, in the target database in association with the identifier of the access control list, the lowest ranked translatable origin classification.

15. One or more non-transitory computer-readable media storing one or more computer programs which, when executed via a plurality of processors, causes performance of the steps of:

obtaining, from a source database, via at least one of the plurality of processors, an identifier of an access control list, at least one access control item of the access control list, and one or more classification markings of the access control list;

generating, via at least one of the plurality of processors, an origin classification comprising an identifier of a classification scheme used for classifying information in the source database and comprising the one or more classification markings of the access control list;

wherein the classification scheme used for classifying information in the source database comprises a set of classification markings, each of the one or more classification markings of the access control list belonging to the set of classification markings of the classification scheme;

exporting, via at least one of the plurality of processors, export data to a peer database system;

wherein the export data comprises the identifier of the access control list, the at least one access control item, and the origin classification;

the peer database system receiving the export data via at least one of the plurality of processors; and

the peer database system storing, via at least one of the plurality of processors, in a target database at the peer database system, in association with the identifier of the access control list;

the at least one access control item, and

one or classification markings belonging to a target classification scheme used for classifying information in the target database.

16. The one or more non-transitory computer-readable media of claim 15, wherein the at least one access control item and the origin classification are associated with the identifier of the access control list in the export data.

17. The one or more non-transitory computer-readable media of claim 15, wherein the one or more computer programs, when executed via the plurality of processors, further causes performance of the step of obtaining, from the source database, via at least one of the plurality of processors, an origin classification associated with the identifier of the access control list in the source database;

and wherein the export data comprises, in addition to the origin classification, the origin classification associated with the identifier of the access control list in the source database.

18. The one or more non-transitory computer-readable media of claim 17, wherein the origin classification and the origin classification associated with the identifier of the access control list in the source database are ranked in the export data;

and wherein the origin classification associated with the identifier of the access control list in the source database has a lower rank in the export data than the origin classification.