Access controls through node-based effective policy identifiers

• US 10,432,469 B2
• Filed: 06/14/2018
• Issued: 10/01/2019
• Est. Priority Date: 06/29/2017
• Status: Active Grant

• Current Assignee: Palantir Technologies Incorporated
• Original Assignee: Palantir Technologies Incorporated
• Inventors: Rickards, Neil, Baker, James, Gelmi, Marco, Balan, Radu-Cosmin, Sguera, Savino
• Primary Examiner(s): Algibhah, Hamza N
• Application Number:
  US16/009,120
• Publication Number:
  US 20190007271A1
• Time in Patent Office: 474 Days
• Field of Search: 709225
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 65/65 Network streaming protocols, e.g. real-time transport protocol [RTP] or real-time control protocol [RTCP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Techniques for implementing a node-based access control system are described herein. In an embodiment, a server computer stores a node based policy system wherein each node identifies a resource and a policy for the resource. The server computer identifies a policy for a first node and an identifier of a second node wherein the second node is a parent node to the first node. The server computer maps an effective policy identifier to the policy for the first node and the identifier of the second node. The server computer stores data associating the effective policy identifier with the first node. The server computer identifies a policy for a third node and an identifier of the second node, wherein the second node is a parent node to the third node and wherein the policy for the third node is equivalent to the policy for the first node. The server computer then stores data associating the effective policy identifier with the third node.

Claims

1. A data processing method comprising:

receiving an update to a first node that changes a policy of the first node, the first node initially comprising an effective policy identifier mapped to the policy of the first node and an identifier of a second node that is a parent node of the first node;

in response to receiving the update, generating a new effective policy identifier for the changed policy of the first node and the identifier of the second node;

invalidating data associating user identifiers with effective policy identifiers corresponding to nodes that are descendant nodes of the first node.

2. The method of claim 1, further comprising:

identifying a policy for a third node and an identifier of the second node, wherein the second node is a parent node to the third node and wherein the policy for the third node is equivalent to the policy for the first node;

in response to the second node being a parent node to the third node and the policy for the third node being equivalent to the policy for the first node, storing data associating the effective policy identifier with the third node.

3. The method of claim 1, further comprising:

storing data associating one or more user identifiers with the effective policy identifier;

receiving a request for a particular resource identified by the first node from a client computing device, wherein the request includes a particular user identifier;

determining that the one or more user identifiers include the particular user identifier;

in response to determining, responding to the request for the particular resource with the particular resource.

4. The method of claim 1, further comprising:

identifying a null policy for a third node;

in response to identifying the null policy for the third node, traversing through one or more parent nodes of the third node until a particular node is identified with a non-null policy;

mapping a second effective policy identifier to the policy for the particular node and an identifier of a fourth node, wherein the fourth node is a parent node of the particular node;

storing data associating the second effective policy identifier with the third node.

5. The method of claim 1, further comprising:

identifying a policy for a third node;

identifying a null policy for a fourth node, wherein the fourth node is a parent of the fourth node;

in response to identifying the null policy for the fourth node, traversing through one or more parent nodes of the fourth node until a particular node is identified with a non-null policy;

mapping a second effective policy identifier to the policy for the third node and an identifier of the particular node;

storing data associating the second effective policy identifier with the third node.

6. The method of claim 1, further comprising:

identifying a null policy for a third node;

in response to identifying the null policy for the third node, traversing through one or more parent nodes of the third node until a first particular node is identified with a non-null policy;

identifying a null policy for a fourth node, wherein the fourth node is a parent of the first particular node;

in response to identifying the null policy for the fourth node, traversing through one or more parent nodes of the fourth node until a second particular node is identified with a non-null policy;

mapping a second effective policy identifier to the policy for the first particular node and an identifier of the second particular node;

storing data associating the second effective policy identifier with the fourth node.

7. A system comprising:

one or more processors;

one or more storage media;

one or more instructions stored in the storage media which, when executed by the one or more processors, cause performance of;

receiving an update to a first node that changes a policy of the first node, the first node initially comprising an effective policy identifier mapped to the policy of the first node and an identifier of a second node that is a parent node of the first node;

in response to receiving the update, generating a new effective policy identifier for the changed policy of the first node and the identifier of the second node;

invalidating data associating user identifiers with effective policy identifiers corresponding to nodes that are descendant nodes of the first node.

8. The system of claim 7, wherein the instructions, when executed by the one or more processors, further cause performance of:

identifying a policy for a third node and an identifier of the second node, wherein the second node is a parent node to the third node and wherein the policy for the third node is equivalent to the policy for the first node;

in response to the second node being a parent node to the third node and the policy for the third node being equivalent to the policy for the first node, storing data associating the effective policy identifier with the third node.

9. The system of claim 7, wherein the instructions, when executed by the one or more processors, further cause performance of:

storing data associating one or more user identifiers with the effective policy identifier;

receiving a request for a particular resource identified by the first node from a client computing device, wherein the request includes a particular user identifier;

determining that the one or more user identifiers include the particular user identifier;

in response to determining, responding to the request for the particular resource with the particular resource.

10. The system of claim 7, wherein the instructions, when executed by the one or more processors, further cause performance of:

identifying a null policy for a third node;

in response to identifying the null policy for the third node, traversing through one or more parent nodes of the third node until a particular node is identified with a non-null policy;

mapping a second effective policy identifier to the policy for the particular node and an identifier of a fourth node, wherein the fourth node is a parent node of the particular node;

storing data associating the second effective policy identifier with the third node.

11. The system of claim 7, wherein the instructions, when executed by the one or more processors, further cause performance of:

identifying a policy for a third node;

identifying a null policy for a fourth node, wherein the fourth node is a parent of the fourth node;

in response to identifying the null policy for the fourth node, traversing through one or more parent nodes of the fourth node until a particular node is identified with a non-null policy;

mapping a second effective policy identifier to the policy for the third node and an identifier of the particular node;

storing data associating the second effective policy identifier with the third node.

12. The system of claim 7, wherein the instructions, when executed by the one or more processors, further cause performance of:

identifying a null policy for a third node;

in response to identifying the null policy for the third node, traversing through one or more parent nodes of the third node until a first particular node is identified with a non-null policy;

identifying a null policy for a fourth node, wherein the fourth node is a parent of the first particular node;

in response to identifying the null policy for the fourth node, traversing through one or more parent nodes of the fourth node until a second particular node is identified with a non-null policy;

mapping a second effective policy identifier to the policy for the first particular node and an identifier of the second particular node;

storing data associating the second effective policy identifier with the fourth node.

13. One or more non-transitory computer-readable media storing instructions which, when executed by one or more processors, cause performance of:

receiving an update to a first node that changes a policy of the first node, the first node initially comprising an effective policy identifier mapped to the policy of the first node and an identifier of a second node that is a parent node of the first node;

in response to receiving the update, generating a new effective policy identifier for the changed policy of the first node and the identifier of the second node;

invalidating data associating user identifiers with effective policy identifiers corresponding to nodes that are descendant nodes of the first node.

14. The one or more non-transitory computer-readable media of claim 13, wherein the instructions, when executed by the one or more processors, further cause performance of:

identifying a policy for a third node and an identifier of the second node, wherein the second node is a parent node to the third node and wherein the policy for the third node is equivalent to the policy for the first node;

in response to the second node being a parent node to the third node and the policy for the third node being equivalent to the policy for the first node, storing data associating the effective policy identifier with the third node.

15. The one or more non-transitory computer-readable media of claim 13, wherein the instructions, when executed by the one or more processors, further cause performance of:

storing data associating one or more user identifiers with the effective policy identifier;

receiving a request for a particular resource identified by the first node from a client computing device, wherein the request includes a particular user identifier;

determining that the one or more user identifiers include the particular user identifier;

in response to determining, responding to the request for the particular resource with the particular resource.

16. The one or more non-transitory computer-readable media of claim 13, wherein the instructions, when executed by the one or more processors, further cause performance of:

identifying a null policy for a third node;

in response to identifying the null policy for the third node, traversing through one or more parent nodes of the third node until a particular node is identified with a non-null policy;

mapping a second effective policy identifier to the policy for the particular node and an identifier of a fourth node, wherein the fourth node is a parent node of the particular node;

storing data associating the second effective policy identifier with the third node.

17. The one or more non-transitory computer-readable media of claim 13, wherein the instructions, when executed by the one or more processors, further cause performance of:

identifying a policy for a third node;

identifying a null policy for a fourth node, wherein the fourth node is a parent of the fourth node;

in response to identifying the null policy for the fourth node, traversing through one or more parent nodes of the fourth node until a particular node is identified with a non-null policy;

mapping a second effective policy identifier to the policy for the third node and an identifier of the particular node;

storing data associating the second effective policy identifier with the third node.

18. The one or more non-transitory computer-readable media of claim 13, wherein the instructions, when executed by the one or more processors, further cause performance of:

identifying a null policy for a third node;

in response to identifying the null policy for the third node, traversing through one or more parent nodes of the third node until a first particular node is identified with a non-null policy;

identifying a null policy for a fourth node, wherein the fourth node is a parent of the first particular node;

in response to identifying the null policy for the fourth node, traversing through one or more parent nodes of the fourth node until a second particular node is identified with a non-null policy;

mapping a second effective policy identifier to the policy for the first particular node and an identifier of the second particular node;

storing data associating the second effective policy identifier with the fourth node.