USRE47546E1 - Techniques for replicating changes to access control lists on investigative analysis data - Google Patents
Techniques for replicating changes to access control lists on investigative analysis data Download PDFInfo
- Publication number
- USRE47546E1 USRE47546E1 US15/235,440 US201615235440A USRE47546E US RE47546 E1 USRE47546 E1 US RE47546E1 US 201615235440 A US201615235440 A US 201615235440A US RE47546 E USRE47546 E US RE47546E
- Authority
- US
- United States
- Prior art keywords
- data
- access control
- database
- control list
- component
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/101—Access control lists [ACL]
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/23—Updating
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/24—Querying
- G06F16/245—Query processing
Definitions
- Computer-implemented techniques are disclosed which generally relate to replication of database data, and more particularly to computer-implemented techniques for replicating changes to access control lists on investigative analysis data.
- One possible solution for sharing investigative data between investigative teams is to use a multimaster database system.
- investigative data is stored in a group of databases which may be geographically distributed and interconnected by one or more data networks. Data changes may be made to any database of the group. Data changes made to one database are propagated over a data network by a software process to the rest of the group.
- Multimaster database systems typically employ either a “synchronous” or an “asynchronous” replication scheme for propagating database changes.
- each change is applied to all databases in the group immediately or to none of the databases if one or more of the databases in the group cannot accept the change.
- one of the databases may be offline or unavailable.
- a change made to a database is immediately accepted by the database but propagation of the change to other databases in the group may be deferred. Because propagation of changes may be deferred, if a database in the group is unavailable, the available databases can still accept changes, queuing the changes locally until they can be propagated. For this reason, multimaster database systems employing an asynchronous replication strategy are considered to be more highly available than multimaster database systems employing a synchronous replication strategy.
- asynchronous replication raises the possibility of “concurrency conflicts” that occur as a result of concurrent database changes to multiple database databases of the group
- multimaster database systems employing an asynchronous replication scheme are generally considered to be more complex to design, maintain and operate than those employing a synchronous replication scheme.
- asynchronous replication is often preferred in the investigative analysis context where investigative analysis teams can be dispersed throughout the world and connected to one another by unreliable network connectivity.
- Using an asynchronous replication scheme allows an investigative team to update investigative data in their local database even if network connectivity is not currently available. When network connectivity becomes available, the team can share their updates with other teams and receive the other teams' updates made in the interim.
- a concurrency conflict can occur in a multimaster system employing an asynchronous replication scheme when the same data is changed in two databases before either one of those data changes can be propagated to the other. For example, assume that at database A, data representing a particular person's eye color is changed to “brown”, and after that data change but before that data change can be propagated to database B, data at database B representing the same particular person's eye color is changed to “green”. Without additional information, it is unclear which data change is the “correct” change that should be adopted by database A and database B.
- a multimaster system employing an asynchronous replication scheme provides a mechanism for “deconflicting” concurrency conflicts.
- deconflicting a concurrency conflict involves detecting and resolving the concurrency conflict such that the resolution of concurrency conflict is adopted at all databases in the group.
- the multimaster system may be able to deconflict a concurrency conflict automatically without requiring user intervention. In other cases, user intervention is required to decide which of the concurrent data changes should be adopted as the “correct” data change.
- version vectors sometimes referred to as vector clocks.
- a version vector is a mechanism for ordering changes to database data that works by tracking “causality” relationships between changes.
- version vectors allow the system to determine if one change “happened before”, “happened after”, or “happened concurrently with” another change, even if the two changes were made to different databases at different times. Further information on using version vectors to track causality relationships between database changes in a multimaster database system is available on the Internet at wiki/Version_vector in the en.wikipedia.org domain, the entire contents of which is hereby incorporated by reference.
- “Revisioning” adds an additional layer of complexity to multimaster asynchronous replication on top of the complexity of detecting concurrency conflicts.
- “revisioning” databases in the replication group may each maintain an online history of database changes. Maintaining a historical record of changes as opposed to just the latest changes is useful in the investigative analysis context because it allows investigators to determine “what was known when”, where the “when” can be a point in time in the past.
- a revisioning database may store two change records CR1 and CR2 for a suspect of a criminal investigation where initially it was thought the suspect is residing in Los Angeles, Calif., USA as indicated by change record CR1 but it is now thought that the suspect resides in Sacramento, Calif., USA as indicated by change record CR2.
- Access control adds yet another layer of complexity to multimaster asynchronous replication.
- change records in a revisioning database can be associated with an access control list that governs access to the change records.
- Such access may include reading the change records.
- an access control list ACL1 associated with the change records CR1 and CR2 for the criminal suspect in revisioning database D1 may specify that both user Alice and user Bob currently have read access to the change records C1 and C2 CR1 and CR2.
- both Alice and Bob can determine from the change records C1 and C2 CR1 and CR2 in database D1 that the prior value for the “current possible location” property was “Los Angeles, Calif., USA” and the current value for the property is “Sacramento, Calif., USA”.
- an access control list associated with a set of change records is changed in one database and that change is replicated to another database, it may be desirable for security purposes that the access control list resulting from the change apply to all change records, including historical ones, in the other database. For example, if the access control list ACL1 is changed in database D1 to remove Bob and that change is replicated to database D2, it may be desirable, for security purposes, that after the change is applied to database D2, user Bob can no longer read change records C1 or C2 CR1 or CR2 in database D2.
- FIG. 1 is a flowchart of a software-implemented process performed by an exporting nexus according to an embodiment of the present invention.
- FIG. 2 is a flowchart of a software-implemented process performed by an importing nexus according to an embodiment of the present invention.
- FIG. 3 is a block diagram illustrating an object-centric data model according to an embodiment of the present invention.
- FIG. 4 is a block diagram illustrating an example access control list according to an embodiment of the invention.
- FIG. 5 is a block diagram illustrating an example revisioning database table storing change records according to an embodiment of the invention.
- FIG. 6 is a block diagram illustrating a computer system on which embodiments of the invention may be implemented.
- an “exporting nexus” sends an ACL change network message (hereinafter just “ACL change message”) to an “importing nexus”.
- ACL change message an ACL change network message
- the exporting nexus may send the ACL change message to the importing nexus as part of an asynchronous data replication process.
- the term “nexus” is more formally defined below but generally refers to software or other computer-executable logic that operates on a database, for example, as part of database management software or an application thereof.
- the database that the exporting nexus operates on and from which the change to the ACL is exported as the ACL change message is referred to hereinafter as the “exporting database” and the database that the importing nexus operates on and to which the ACL change message is applied to is referred to hereinafter as the “importing database”.
- the ACL change message includes information that the importing nexus can use to apply the ACL change to the importing database. Applying the ACL change message includes using the information in the ACL change message to determine which secured components of the data object in the importing database that the ACL change should be applied to.
- the terms “data object” and “secured component” are defined in greater detail below. However, a data object generally refers to data that represents a thing in the real word such as a person, place, or event and a secured component represents data associated with a data object and to which access is governed by an access control list.
- Examples of a secured component include a property (e.g., a person's hair color) of a data object, a note (e.g., a piece of text) associated with a data object, and a piece of media (e.g., video or audio) associated with a data object.
- a property e.g., a person's hair color
- a note e.g., a piece of text
- a piece of media e.g., video or audio
- the exporting database and the importing database can be revisioning databases. That is, both databases may maintain histories of changes to secured components in the form of change records for each of the secured components.
- applying the ACL change message includes using the information in the ACL change message to determine which secured components of the data object in the importing database the ACL change should be applied to.
- This applying includes using the information in the ACL change message to determine which change records for which secured components of the data object in the importing database the ACL change should be applied to.
- user access to all change records in the importing database to which the ACL change is applied is governed by the new ACL, thereby preventing unauthorized access to the change records, including historical change records.
- Computer databases are a common mechanism for storing information on computer systems at replication sites while providing access to the stored information to users.
- a typical database is an organized collection of information stored as “objects” or “records” having “properties” or “fields”.
- objects or “records” having “properties” or “fields”.
- a database of criminal suspects may have an object for each suspect where each object contains properties designating specifics about the suspect, such as eye color, hair color, height, sex, etc.
- DBMS software-based database management system
- Users may interact indirectly with the DBMS through a database application that in turn interacts directly with the DBMS to provide high level database operations to users, such as analyzing, integrating, and visualizing database information.
- database application is not clear cut and functionality provided by one may be provided by the other. Consequently, in this description, the term “nexus” is used to refer broadly to any software that operates directly or indirectly on the actual database itself.
- a nexus may include a DBMS, a database application or applications, or components thereof.
- FIG. 1 is a flowchart 100 of a software-implemented process performed by an exporting nexus according to an embodiment of the present invention.
- the process may be performed after an ACL associated with a secured component of a data object has been changed in the exporting database.
- the ACL change may be made by a user or a computing process.
- the ACL change may involve creating a new ACL for the secured component or modifying an existing ACL for the secured component.
- the process may be performed by the exporting nexus to inform an importing nexus about the ACL change so that the importing nexus can appropriately apply the ACL change to the importing database.
- the exporting nexus process generally involves collecting information pertaining to the ACL change from the exporting database and sending the information in an ACL change message to the importing nexus.
- the information collected is information that the importing nexus can use to identify which change records in the importing database to apply the ACL change to.
- the process does not require the importing database and the exporting database to have corresponding identifiers or external identifiers for change records or secured components.
- the importing database and the exporting database may use different internal identifiers for change records and secured components. In other words, the internal identifiers are not required to have inherent correspondence between the databases.
- steps of the exporting nexus process are depicted and described as being performed in a certain order, some or all of the steps are performed in a different order and/or performed concurrently with one another in other embodiments.
- the current value and one or more historical values of the secured component are obtained from the change records in the exporting database for the secured component. In some embodiments, all available historical values of the secured component are obtained from the exporting database.
- the current ACL and one or more historical ACLs associated with the secured component are obtained from the exporting database.
- all available historical ACLs associated with the secured component are obtained from the exporting database.
- the ACL associated with a secured component may change more frequently than the value of the secured component.
- the value of the secured component may change more frequently that than the ACL associated with the secured component.
- the current component type of the secured component and one or more historical component types of the secured component are obtained from the exporting database. Over time, the component type associated with a secured component may change more frequently than the value of the secured component. Thus, there may be more historical component types obtained at optional step 106 then than historical values obtained at step 102 . Similarly, over time, the value of the secured component may change more frequently that than the component type of the secured component. Thus, there may be more historical values obtained at step 102 than historical component types obtained at step 106 .
- a component type is expressed in the form of a Uniform Resource Indicator (URI).
- URI Uniform Resource Indicator
- a component type URI may identify the data type of the secured component according to a data type ontology used by the exporting nexus.
- a component type URI may be used for value transformations if the exporting nexus and the importing nexus support cross-ontology replication. Further information on using component type URIs for cross-ontology multimaster replication can be found in related U.S. patent application Ser. No. 13/076,804, entitled “Cross-Ontology Multi-Master Replication”, and filed Mar. 31, 2011, the entire contents of which is hereby incorporated by reference as if fully set for herein.
- a “data source” is a single source of data for a secured component.
- a data source can be a person who manually enters the secured component data or a document, spreadsheet, database, or other digital information from which the secured component data was extracted, parsed, or derived from.
- a secured component can have multiple data sources.
- the global identifiers of the data source may be meaningful to both the exporting nexus and the importing nexus. That is, the global data source identifiers may unambiguously identify data source records in both the exporting system and in the importing system. Such data source records may be associated in the importing system with their own ACLs separate from the ACLs associated with secured components.
- the importing nexus uses the global data source identifiers to identify data source ACLs in the importing database to which ACL change should be applied.
- additional information about how the secured component data was obtained from the data sources is also obtained from the exporting database.
- the additional information may include a page number or index of a document from which the secured component data was obtained, if the secured component is a document type, or a video frame number from which secured component video data was obtained, if the secured component is a video type. The additional information can be used to prevent false positive matches when importing the ACL change into the importing database.
- the information collected in steps 102 , 104 , 106 (if performed), and 108 (if performed) is sent to the importing nexus over a data network in an ACL change message.
- the ACL change message may be sent as part of a periodic asynchronous replication process performed by the exporting nexus.
- the exporting nexus may perform the replication process to inform the importing nexus of changes, including ACL changes, to the exporting database that have occurred since the exporting nexus last performed the replication process with the importing nexus.
- the ACL change message and the information contained therein is formatted according to the eXtensible Markup Language (XML).
- the ACL change message can be formatted with a protocol buffer. Further information on protocol buffers can be found on the Internet at wiki/Protocol_Buffers in the en.wikipedia.org domain, the entire contents of which is hereby incorporated by reference.
- FIG. 2 is a flowchart 200 of a software-implemented process performed by an importing nexus according to an embodiment of the present invention.
- the process may be performed by the importing nexus after the exporting nexus has sent an ACL change message to it, the ACL change message pertaining to an update to an ACL on a secured component in the exporting database.
- the secured component in the exporting database to which the ACL change message pertains is referred to in this section as the “exported” secured component and the data object that the exported secured component is a part of or associated with is referred to in this section as the “target” data object (or target data objects).
- Each of the exporting database and the importing database may use internal non-corresponding identifiers for identifying secured components so that assignment of identifiers to secured component does not require coordination between nexuses and so that the internal identifiers are not required to have a minimum data (byte) length to ensure uniqueness across the databases.
- steps of the importing nexus process are depicted and described as being performed in a certain order, some or all of the steps are performed in a different order and/or performed concurrently with one another in other embodiments.
- the importing nexus receives the ACL change network message sent to it by the exporting nexus.
- the received ACL change network message contains a global identifier of the target data object.
- the ACL change messages contains a set of values of the exported secured component including a current value and one or more historical values of the exported secured component (“exported values”).
- the exported values may be ordered or arranged by age with the current value being first (or last) in the order and the oldest value in the set of exported values being last (or first) in the order.
- the ACL change message also contains a set of ACLs associated with the exported secured component including a current ACL and one or more historical ACLs associated with the exported secured component (“exported ACLs”).
- the exported ACLs may be ordered or arranged by age with the current ACL being first (or last) in the order and the oldest ACL in the set of exported ACLs being last (or first) in the order.
- the ACL change message may also contain a set of component types associated with the exported secured component including a current component type and one or more historical component types associated with the exported secured component (“exported component types”).
- the exported component types may be ordered or arranged by age with the current component type being first (or last) in the order and the oldest component type in the set of exported component types being last (or first) in the order.
- the ACL change message may also contain a set of data source identifiers associated with the exported secured component (“exported data source identifiers”).
- the importing nexus obtains, from the importing database, all values, current and historical, for all secured components of the target data object in the importing database (“candidate values”).
- the importing nexus obtains, from the importing database, all ACLs current and historical, associated with all secured components of the target data object in the importing database (“candidate ACLs”).
- the importing nexus obtains, from the importing database, all component types, current and historical, of all secured components of the target data object in the importing database (“candidate component types”).
- the target secured component from all secured components of the target data object in the importing database is identified in the importing database.
- this identification process proceeds by iterating over all secured components of the target data object in the importing database one-by-one until the target secured component is identified (at which point the remaining secured components need not be iterated over because the target data object has been identified).
- a comparison is performed for each secured component iterated over. The comparison involves comparing the exported values to the candidate values of the current secured component. If there is a match, then the comparison further involves comparing the exported ACLs to the candidate ACLs of the current secured component. If there is still a match, then the current secured component may be identified as the target secured component. In some embodiments, the current secured component is not identified as the target secured component unless also there is a match between the exported component types and the candidate component types of the current secured component.
- the ACLs, current and historical, associated with target secured component in the importing database are updated in the importing database.
- This updating may include replacing, in the importing database, all of the ACLs, current and historical, associated with the target secured component in the importing database with the current ACL from the exported ACLs. By doing so, all values, current and historical, of the target secured component in the importing database are protected in the importing database by the current ACL from the exported ACLs.
- step 214 if the ACL change message contains the exported data source identifiers, then all ACLs in the importing database associated with the identified data source records are replaced with the current ACL from the exported ACLs. By doing so, all of the identified data source records are also protected in the importing database by the current ACL from the exported ACLs.
- FIG. 3 illustrates an object-centric conceptual data model 300 .
- Model 300 is centered on the notion of a data object 310 .
- the particulars of the data model 300 are not to be confused with the particulars of how the investigative analysis data is stored in the exporting database or the importing database which may be varied and depend on the type of the database according to the requirements of the particular implementation at hand.
- the importing database and the exporting database are relational databases, then data organized according to data model 300 may be stored in the exporting database and the importing database as one or more rows of one or more database tables.
- a data object 310 is a container for information representing things in the world.
- a data object 310 can represent an entity such as a person, a place, an organization, or other noun.
- a data object 310 can represent an event that happens at a point in time or for a period of time.
- a data object 310 can represent a document or other unstructured data source such as an e-mail message, a news report, or a written paper or article. These are just some example examples of what a data object 310 can represent.
- a data object 310 may be associated with a unique identifier that uniquely identifies the data object within the exporting database and the importing database.
- a data object 310 may also have a type (e.g., Person, Event, or Document) and a display name which may be the value of a particular property of the data object 310 .
- a data object 310 can have or be associated with a number of secured components including one or more properties 312 , one or more links 314 , a linkset 316 , a note 318 , and media 320 .
- a property 312 may have a type, name, and a value. Different types of data objects 310 may have different types of properties 312 . For example, a Person data object 310 might have an Eye Color property 312 and an Event data object 310 might have a Date property 312 .
- the set of data object types and the set of property types for each type of data object 310 supported by the exporting database and the importing database are defined according to a pre-defined, user-defined, or dynamically-defined ontology or other hierarchical structuring of knowledge through sub-categorization of object types and property types according to their relevant and/or cognitive qualities.
- the importing database and the exporting database use different ontologies and replication between the exporting nexus and the importing nexus is accomplished across the differing ontologies.
- cross-ontology multi-master replication may be accomplished using the techniques described in related U.S. patent application Ser. No. 13/076,804, entitled “Cross-Ontology Multi-Master Replication”, and filed Mar. 31, 2011, the entire contents of which is hereby incorporated by reference as if fully set for forth herein.
- data model 300 supports property multiplicity.
- a data object 310 may be allowed to have more than one property 312 of the same type.
- a Person data object 310 might have multiple Address properties 312 or multiple Name properties 312 .
- a link 314 represents a connection between two data objects 310 .
- the connection is either through a relationship, an event, or through matching properties 312 .
- a relationship connection may be asymmetrical or symmetrical.
- Person data object A 310 may be connected to Person data object B 310 by a Child Of relationship (where Person data object B 310 has an asymmetric Parent Of relationship to Person data object A 310 ), a Kin Of symmetric relationship to Person data object C 310 , and an asymmetric Member Of relationship to Organization data object X 310 .
- the type of relationship between two data objects 310 may vary depending on the types of the data objects 310 .
- Person data object A 310 may have an Appear In relationship with Document data object Y 310 or have a Participate In relationship with Event data object E 310 .
- two Person data objects 310 may be connected by an Airline Flight data object 310 representing a particular airline flight if they traveled together on that flight, or by a Meeting data object 310 representing a particular meeting if they both attended that meeting.
- they are also connected by relationships, in which each data object 310 has a specific relationship to the event, such as, for example, an Appears In relationship.
- a matching properties 312 connection two Person data objects 310 representing a brother and a sister, may both have an Address property 312 that indicates where they live. If the brother and the sister live in the same home, then their Address properties 312 likely contain similar, if not identical information.
- a link 214 between two data objects 310 may be established based on similar or matching properties 312 of the data objects 310 .
- the above are just some examples of the types of connections that may be represented by a link 314 and other types of connections may be represented. Thus, it should be understood that embodiments of the invention are not limited to any particular types of connections between data objects 310 . For example, a document might contain two different tagged entities. A link 314 between two data objects 310 may represent a connection between these two entities through their co-occurrence within the same document.
- a data object 310 can have multiple links 314 with another data object 310 to form a link set 316 .
- two Person data objects 310 representing a husband and a wife could be linked through a Spouse Of relationship, a matching property (Address) 312 , and an event (Wedding).
- a note 318 is a piece of text associated with a data object 310 .
- a note 318 may be free-form text entered by an investigator that is associated with a data object 310 .
- Media 320 is arbitrary binary data such as an image, a video, or audio associated with a data object 310 .
- Each secured component may be associated with a data source 322 .
- each property 312 , each media 320 , each note 318 , and each link 314 in the exporting database and the importing database may be associated with a data source 322 through a data source record.
- a data source 322 is the source of the data of the associated secured component.
- Example data sources 322 include user entered data, a document, and a database.
- FIG. 4 is a block diagram illustrating an example access control list (ACL) 400 according to an embodiment of the invention.
- ACL 400 may be associated with a secured component of a data object in the exporting database or the importing database.
- the exporting database and the importing database may store change records for an ACL 400 as well as storing change records for the secured component the ACL 400 is associated with. By doing so, the current ACL 400 for a secured component can be determined as well as previous versions of the ACL 400 associated with the secured component.
- a data source 322 is also associated with its own ACL 400 separate from the ACLs 400 associated with the secured components that are associated with the data source 322 .
- an ACL 400 may include a set of zero or more access control items (ACI) 420 and zero or one classification 430 .
- ACI access control items
- an ACL 400 will include at least one ACI 420 or a classification 430 or include at least one ACI 420 and a classification 130 .
- Each ACI 420 specifies a group 421 and a permission 422 of that group 421 .
- a group 121 may also be referred to a role.
- the group 421 of an ACI 420 identifies a set of users.
- the permission 422 of the ACI 420 identifies an operation a user in the group can perform on the associated secured component or an operation the user can perform on the ACL 400 .
- Non-limiting examples of a permission 422 include read, write, owner, create, delete, etc.
- an ACL 400 has a classification 430
- a user must be authorized for each and every classification marking in the set of classification markings of the classification 430 to have any access to the associated secured component or the ACL 400 .
- the classification 430 overrides any permission 422 granted to the user that would otherwise allow the user to access the associated secured component or the ACL 400 .
- a classification marking is data associated with sensitive information in a database that indicates a necessary classification marking a user must be authorized for in order to access the sensitive information.
- the possible classification markings are typically specific to a particular classification scheme and may be hierarchical according to authorization level. For example, one classification scheme may have as the highest classification marking, Top Secret (TS), followed by Secret (S), followed by Confidential (C), followed by Restricted (R), and finally Unclassified (U).
- TS Top Secret
- S Confidential
- R Restricted
- U Unclassified
- the exporting nexus and the importing nexus may use or implement a revisioning database system for tracking changes made to investigative analysis data stored in the exporting database and the importing database respectively.
- the exporting database and the importing database may each be considered to be a revisioning database.
- the revisioning database system is implemented as an application on top of a conventional database management system (not shown).
- the database management system may be a relational database management system such as those commercially available from the Oracle Corporation of Redwood Shores, Calif. and the Microsoft Corporation of Redmond, Wash.
- the revisioning database system differs from other types of database systems in that the revisioning database system is capable of answering a query about the state of investigative analysis data stored in a revisioning database at a point in time in the past as opposed to only being able to answer a query about the current state of the investigative analysis data.
- the revisioning database system With the revisioning database system, investigative analysts can determine when a particular piece of data was added or edited in a revisioning database.
- the revisioning database system as a result of its capability to track changes to investigative analysis data stored in a revisioning database, enables investigative analysts to determine what was known when.
- revisioning database system is capable of tracking all changes made to investigative analysis data over a period of time. To do so, the revisioning database system creates a new database change record in a revisioning database for every creation, edit, or deletion of a secured component (e.g., a property 312 , a link 314 , a note 318 , and media 320 ), an ACL 400 , and a data source 322 .
- a secured component e.g., a property 312 , a link 314 , a note 318 , and media 320
- ACL 400 e.g., an ACL 400
- revisioning database system employs an always increasing logical clock that models all of the changes as a linear sequence of database events.
- the logical clock provides a total ordering for all changes.
- the logical clock provides atomicity for changes as multiple changes can occur at the same point in the linear sequence of database events represented by the logical clock (and hence be associated with the same logical clock value).
- FIG. 5 is a block diagram a illustrating an example database table 500 in a revisioning database for tracking changes made data objects 310 according to an embodiment of the invention.
- a change record indicates the change operation performed (e.g., create, edit, or delete), the secured components, ACL, or data source that was changed, and data representing the result of the change (e.g., the value created, edited, or deleted).
- each change record 518 , 520 , 522 , 524 , and 526 in table 500 represents a creation, edit, or deletion of a data object 310 or a creation, edit, or deletion of a property 312 of a data object 310 .
- each change record includes a ‘obj_comp_id’ field identifying the data object 310 or property 312 that was created, edited, or deleted by the change, an ‘obj_id’ field identifying the data object 310 that was created, edited, or deleted by the change, a ‘logical_clk’ field that identifies the order of the change in a total ordering of all changes made to the revisioning database containing table 500 , a ‘deleted’ field indicating whether the change was a deletion of a data object 310 or a property 312 , and a ‘ ⁇ values’> field indicating, for changes that create or edit a value, the value that resulted from the change or, for changes that delete a value, the value that was deleted.
- a data object 310 of type “Person” was created. Also at logical clock event 1, a “Name” property 312 of the Person data object 310 was created and given the value “John Smith”. Later, at logical clock event 2, a “Phone #” property 312 of the object was created and given the value “415-222-1234”. At logical clock event 3, the “Name” property 312 of the Person data object 310 that was created at logical clock event 2 was edited with the value “Jonathan Smith”. At logical clock event 4, the “Phone #” property 312 that was created at logical clock event 3 was deleted. As a result of the changes at logical clock events 1, 2, and 3, the state of the object at logical clock event 4 is an object 310 of type “Person” with the property “Name” 312 having a value “Jonathan Smith”.
- the revisioning database system is able to provide the state of an object 310 at a point in time in the past.
- table 500 contains change records for only one data object 310 with an identifier of 10
- table 310 could contain change records for multiple data objects.
- FIG. 5 illustrates but one example scheme that the revisioning database system could employ to track changes to a revisioning database.
- the invention should not be construed as being limited to only the one example scheme or be construed as requiring all details of the one example scheme.
- the change records instead of storing change records for all data objects 310 in a single table as depicted in FIG. 5 , the change records might be stored across multiple tables. Further, the change records may contain other fields that are not depicted in FIG. 5 .
- each change record may have an additional version field that serves as a single primary key for the change record as opposed to using a combination of the ‘obj_comp_id’ and the ‘logical_clk’fields as the primary key.
- the techniques described herein are implemented by one or more special-purpose computing devices.
- the special-purpose computing devices may be hard-wired to perform the techniques, or may include digital electronic devices such as one or more application-specific integrated circuits (ASICs) or field programmable gate arrays (FPGAs) that are persistently programmed to perform the techniques, or may include one or more general purpose hardware processors programmed to perform the techniques pursuant to program instructions in firmware, memory, other storage, or a combination.
- ASICs application-specific integrated circuits
- FPGAs field programmable gate arrays
- Such special-purpose computing devices may also combine custom hard-wired logic, ASICs, or FPGAs with custom programming to accomplish the techniques.
- the special-purpose computing devices may be desktop computer systems, portable computer systems, handheld devices, networking devices or any other device that incorporates hard-wired and/or program logic to implement the techniques.
- FIG. 6 illustrates a computer system upon which one or more embodiments may be implemented.
- Computer system 600 includes a bus 602 or other communication mechanism for communicating information, and a hardware processor 604 coupled with bus 602 for processing information.
- Hardware processor 604 may be, for example, a general purpose microprocessor.
- Computer system 600 also includes a main memory 606 , such as a random access memory (RAM) or other dynamic storage device, coupled to bus 602 for storing information and instructions to be executed by processor 604 .
- Main memory 606 also may be used for storing temporary variables or other intermediate information during execution of instructions to be executed by processor 604 .
- Such instructions when stored in non-transitory storage media accessible to processor 604 , render computer system 600 into a special-purpose machine that is customized to perform the operations specified in the instructions.
- Computer system 600 further includes a read only memory (ROM) 608 or other static storage device coupled to bus 602 for storing static information and instructions for processor 604 .
- ROM read only memory
- a storage device 610 such as a magnetic disk, optical disk, or solid-state drive is provided and coupled to bus 602 for storing information and instructions.
- Computer system 600 may be coupled via bus 602 to a display 612 , such as a cathode ray tube (CRT), for displaying information to a computer user.
- a display 612 such as a cathode ray tube (CRT)
- An input device 614 is coupled to bus 602 for communicating information and command selections to processor 604 .
- cursor control 616 is Another type of user input device
- cursor control 616 such as a mouse, a trackball, or cursor direction keys for communicating direction information and command selections to processor 604 and for controlling cursor movement on display 612 .
- This input device typically has two degrees of freedom in two axes, a first axis (e.g., x) and a second axis (e.g., y), that allows the device to specify positions in a plane.
- Computer system 600 may implement the techniques described herein using customized hard-wired logic, one or more ASICs or FPGAs, firmware and/or program logic which in combination with the computer system causes or programs computer system 600 to be a special-purpose machine. According to one embodiment, the techniques herein are performed by computer system 600 in response to processor 604 executing one or more sequences of one or more instructions contained in main memory 606 . Such instructions may be read into main memory 606 from another storage medium, such as storage device 610 . Execution of the sequences of instructions contained in main memory 606 causes processor 604 to perform the process steps described herein. In alternative embodiments, hard-wired circuitry may be used in place of or in combination with software instructions.
- Non-volatile media includes, for example, optical disks, magnetic disks, or solid-state drives, such as storage device 610 .
- Volatile media includes dynamic memory, such as main memory 606 .
- storage media include, for example, a floppy disk, a flexible disk, hard disk, solid-state drive, magnetic tape, or any other magnetic data storage medium, a CD-ROM, any other optical data storage medium, any physical medium with patterns of holes, a RAM, a PROM, and EPROM, a FLASH-EPROM, NVRAM, any other memory chip or cartridge.
- Storage media is distinct from but may be used in conjunction with transmission media.
- Transmission media participates in transferring information between storage media.
- transmission media includes coaxial cables, copper wire and fiber optics, including the wires that comprise bus 602 .
- transmission media can also take the form of acoustic or light waves, such as those generated during radio-wave and infra-red data communications.
- Various forms of media may be involved in carrying one or more sequences of one or more instructions to processor 604 for execution.
- the instructions may initially be carried on a magnetic disk or solid-state drive of a remote computer.
- the remote computer can load the instructions into its dynamic memory and send the instructions over a telephone line using a modem.
- a modem local to computer system 600 can receive the data on the telephone line and use an infra-red transmitter to convert the data to an infra-red signal.
- An infra-red detector can receive the data carried in the infra-red signal and appropriate circuitry can place the data on bus 602 .
- Bus 602 carries the data to main memory 606 , from which processor 604 retrieves and executes the instructions.
- the instructions received by main memory 606 may optionally be stored on storage device 610 either before or after execution by processor 604 .
- Computer system 600 also includes a communication interface 618 coupled to bus 602 .
- Communication interface 618 provides a two-way data communication coupling to a network link 620 that is connected to a local network 622 .
- communication interface 618 may be an integrated services digital network (ISDN) card, cable modem, satellite modem, or a modem to provide a data communication connection to a corresponding type of telephone line.
- ISDN integrated services digital network
- communication interface 618 may be a local area network (LAN) card to provide a data communication connection to a compatible LAN.
- LAN local area network
- Wireless links may also be implemented.
- communication interface 618 sends and receives electrical, electromagnetic or optical signals that carry digital data streams representing various types of information.
- Network link 620 typically provides data communication through one or more networks to other data devices.
- network link 620 may provide a connection through local network 622 to a host computer 624 or to data equipment operated by an Internet Service Provider (ISP) 626 .
- ISP 626 in turn provides data communication services through the world wide packet data communication network now commonly referred to as the “Internet” 628 .
- Internet 628 uses electrical, electromagnetic or optical signals that carry digital data streams.
- the signals through the various networks and the signals on network link 620 and through communication interface 618 which carry the digital data to and from computer system 600 , are example forms of transmission media.
- Computer system 600 can send messages and receive data, including program code, through the network(s), network link 620 and communication interface 618 .
- a server 630 might transmit a requested code for an application program through Internet 628 , ISP 626 , local network 622 and communication interface 618 .
- the received code may be executed by processor 604 as it is received, and/or stored in storage device 610 , or other non-volatile storage for later execution.
Landscapes
- Engineering & Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Databases & Information Systems (AREA)
- Data Mining & Analysis (AREA)
- Computational Linguistics (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
Description
Claims (20)
Priority Applications (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US15/235,440 USRE47546E1 (en) | 2013-07-31 | 2016-08-12 | Techniques for replicating changes to access control lists on investigative analysis data |
US16/525,306 US20190356667A1 (en) | 2013-07-31 | 2019-07-29 | Techniques for replicating changes to access control lists on investigative analysis data |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US13/956,326 US8838538B1 (en) | 2013-07-31 | 2013-07-31 | Techniques for replicating changes to access control lists on investigative analysis data |
US15/235,440 USRE47546E1 (en) | 2013-07-31 | 2016-08-12 | Techniques for replicating changes to access control lists on investigative analysis data |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US13/956,326 Reissue US8838538B1 (en) | 2013-07-31 | 2013-07-31 | Techniques for replicating changes to access control lists on investigative analysis data |
Related Child Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US16/525,306 Continuation US20190356667A1 (en) | 2013-07-31 | 2019-07-29 | Techniques for replicating changes to access control lists on investigative analysis data |
Publications (1)
Publication Number | Publication Date |
---|---|
USRE47546E1 true USRE47546E1 (en) | 2019-07-30 |
Family
ID=51493500
Family Applications (3)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US13/956,326 Active US8838538B1 (en) | 2013-07-31 | 2013-07-31 | Techniques for replicating changes to access control lists on investigative analysis data |
US15/235,440 Active USRE47546E1 (en) | 2013-07-31 | 2016-08-12 | Techniques for replicating changes to access control lists on investigative analysis data |
US16/525,306 Abandoned US20190356667A1 (en) | 2013-07-31 | 2019-07-29 | Techniques for replicating changes to access control lists on investigative analysis data |
Family Applications Before (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US13/956,326 Active US8838538B1 (en) | 2013-07-31 | 2013-07-31 | Techniques for replicating changes to access control lists on investigative analysis data |
Family Applications After (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US16/525,306 Abandoned US20190356667A1 (en) | 2013-07-31 | 2019-07-29 | Techniques for replicating changes to access control lists on investigative analysis data |
Country Status (1)
Country | Link |
---|---|
US (3) | US8838538B1 (en) |
Families Citing this family (43)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US8515912B2 (en) | 2010-07-15 | 2013-08-20 | Palantir Technologies, Inc. | Sharing and deconflicting data changes in a multimaster database system |
US8688749B1 (en) | 2011-03-31 | 2014-04-01 | Palantir Technologies, Inc. | Cross-ontology multi-master replication |
US8554719B2 (en) | 2007-10-18 | 2013-10-08 | Palantir Technologies, Inc. | Resolving database entity information |
US8984390B2 (en) | 2008-09-15 | 2015-03-17 | Palantir Technologies, Inc. | One-click sharing for screenshots and related documents |
US8782004B2 (en) | 2012-01-23 | 2014-07-15 | Palantir Technologies, Inc. | Cross-ACL multi-master replication |
US9081975B2 (en) | 2012-10-22 | 2015-07-14 | Palantir Technologies, Inc. | Sharing information between nexuses that use different classification schemes for information access control |
US9501761B2 (en) | 2012-11-05 | 2016-11-22 | Palantir Technologies, Inc. | System and method for sharing investigation results |
US10140664B2 (en) | 2013-03-14 | 2018-11-27 | Palantir Technologies Inc. | Resolving similar entities from a transaction database |
US8924388B2 (en) | 2013-03-15 | 2014-12-30 | Palantir Technologies Inc. | Computer-implemented systems and methods for comparing and associating objects |
US8903717B2 (en) | 2013-03-15 | 2014-12-02 | Palantir Technologies Inc. | Method and system for generating a parser and parsing complex data |
US8886601B1 (en) | 2013-06-20 | 2014-11-11 | Palantir Technologies, Inc. | System and method for incrementally replicating investigative analysis data |
US8601326B1 (en) | 2013-07-05 | 2013-12-03 | Palantir Technologies, Inc. | Data quality monitors |
US8938686B1 (en) | 2013-10-03 | 2015-01-20 | Palantir Technologies Inc. | Systems and methods for analyzing performance of an entity |
US9569070B1 (en) | 2013-11-11 | 2017-02-14 | Palantir Technologies, Inc. | Assisting in deconflicting concurrency conflicts |
US10579647B1 (en) | 2013-12-16 | 2020-03-03 | Palantir Technologies Inc. | Methods and systems for analyzing entity performance |
US9483546B2 (en) | 2014-12-15 | 2016-11-01 | Palantir Technologies Inc. | System and method for associating related records to common entities across multiple lists |
US20160314155A1 (en) | 2015-04-22 | 2016-10-27 | Palantir Technologies Inc. | Data integration pipeline |
US10277601B1 (en) | 2015-05-11 | 2019-04-30 | Google Llc | System and method for recursive propagating application access control |
US10103953B1 (en) | 2015-05-12 | 2018-10-16 | Palantir Technologies Inc. | Methods and systems for analyzing entity performance |
RU2606315C1 (en) * | 2015-06-08 | 2017-01-10 | Федеральное государственное казенное военное образовательное учреждение высшего образования " Академия Федеральной службы охраны Российской Федерации" (Академия ФСО России) | Method of processing user requests by distributed information system |
US10127289B2 (en) | 2015-08-19 | 2018-11-13 | Palantir Technologies Inc. | Systems and methods for automatic clustering and canonical designation of related data in various data structures |
US9984428B2 (en) | 2015-09-04 | 2018-05-29 | Palantir Technologies Inc. | Systems and methods for structuring data from unstructured electronic data files |
US9514414B1 (en) | 2015-12-11 | 2016-12-06 | Palantir Technologies Inc. | Systems and methods for identifying and categorizing electronic documents through machine learning |
US9760556B1 (en) | 2015-12-11 | 2017-09-12 | Palantir Technologies Inc. | Systems and methods for annotating and linking electronic documents |
US10621198B1 (en) | 2015-12-30 | 2020-04-14 | Palantir Technologies Inc. | System and method for secure database replication |
US10530776B2 (en) | 2016-06-29 | 2020-01-07 | International Business Machines Corporation | Dynamic cognitive access control list management |
US10324609B2 (en) | 2016-07-21 | 2019-06-18 | Palantir Technologies Inc. | System for providing dynamic linked panels in user interface |
US11106692B1 (en) | 2016-08-04 | 2021-08-31 | Palantir Technologies Inc. | Data record resolution and correlation system |
US10133588B1 (en) | 2016-10-20 | 2018-11-20 | Palantir Technologies Inc. | Transforming instructions for collaborative updates |
US10262053B2 (en) | 2016-12-22 | 2019-04-16 | Palantir Technologies Inc. | Systems and methods for data replication synchronization |
US10068002B1 (en) | 2017-04-25 | 2018-09-04 | Palantir Technologies Inc. | Systems and methods for adaptive data replication |
US11074277B1 (en) | 2017-05-01 | 2021-07-27 | Palantir Technologies Inc. | Secure resolution of canonical entities |
US10430062B2 (en) | 2017-05-30 | 2019-10-01 | Palantir Technologies Inc. | Systems and methods for geo-fenced dynamic dissemination |
US11030494B1 (en) | 2017-06-15 | 2021-06-08 | Palantir Technologies Inc. | Systems and methods for managing data spills |
EP3418919A1 (en) | 2017-06-23 | 2018-12-26 | Palantir Technologies Inc. | User interface for managing synchronization between data sources and cache databases |
US10235533B1 (en) | 2017-12-01 | 2019-03-19 | Palantir Technologies Inc. | Multi-user access controls in electronic simultaneously editable document editor |
US10380196B2 (en) | 2017-12-08 | 2019-08-13 | Palantir Technologies Inc. | Systems and methods for using linked documents |
US11061874B1 (en) | 2017-12-14 | 2021-07-13 | Palantir Technologies Inc. | Systems and methods for resolving entity data across various data structures |
US10915542B1 (en) | 2017-12-19 | 2021-02-09 | Palantir Technologies Inc. | Contextual modification of data sharing constraints in a distributed database system that uses a multi-master replication scheme |
US10838987B1 (en) | 2017-12-20 | 2020-11-17 | Palantir Technologies Inc. | Adaptive and transparent entity screening |
US11061542B1 (en) | 2018-06-01 | 2021-07-13 | Palantir Technologies Inc. | Systems and methods for determining and displaying optimal associations of data items |
US10795909B1 (en) | 2018-06-14 | 2020-10-06 | Palantir Technologies Inc. | Minimized and collapsed resource dependency path |
US11341257B1 (en) | 2018-09-21 | 2022-05-24 | Palantir Technologies Inc. | Query indexing with permissions integration and federated search |
Citations (7)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6216140B1 (en) | 1997-09-17 | 2001-04-10 | Hewlett-Packard Company | Methodology for the efficient management of hierarchically organized information |
US20030182313A1 (en) * | 2002-03-19 | 2003-09-25 | Federwisch Michael L. | System and method for determining changes in two snapshots and for transmitting changes to destination snapshot |
US20040111390A1 (en) | 2002-12-09 | 2004-06-10 | Yasushi Saito | Replication and replica management in a wide area file system |
US7437664B2 (en) | 2002-06-18 | 2008-10-14 | Microsoft Corporation | Comparing hierarchically-structured documents |
US20090199090A1 (en) | 2007-11-23 | 2009-08-06 | Timothy Poston | Method and system for digital file flow management |
US20120016849A1 (en) | 2010-07-15 | 2012-01-19 | John Kenneth Garrod | Sharing and Deconflicting Data Changes In A Multimaster Database System |
US20130191338A1 (en) * | 2012-01-23 | 2013-07-25 | Palantir Technologies, Inc. | Cross-acl multi-master replication |
-
2013
- 2013-07-31 US US13/956,326 patent/US8838538B1/en active Active
-
2016
- 2016-08-12 US US15/235,440 patent/USRE47546E1/en active Active
-
2019
- 2019-07-29 US US16/525,306 patent/US20190356667A1/en not_active Abandoned
Patent Citations (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6216140B1 (en) | 1997-09-17 | 2001-04-10 | Hewlett-Packard Company | Methodology for the efficient management of hierarchically organized information |
US20030182313A1 (en) * | 2002-03-19 | 2003-09-25 | Federwisch Michael L. | System and method for determining changes in two snapshots and for transmitting changes to destination snapshot |
US7437664B2 (en) | 2002-06-18 | 2008-10-14 | Microsoft Corporation | Comparing hierarchically-structured documents |
US20040111390A1 (en) | 2002-12-09 | 2004-06-10 | Yasushi Saito | Replication and replica management in a wide area file system |
US20090199090A1 (en) | 2007-11-23 | 2009-08-06 | Timothy Poston | Method and system for digital file flow management |
US20120016849A1 (en) | 2010-07-15 | 2012-01-19 | John Kenneth Garrod | Sharing and Deconflicting Data Changes In A Multimaster Database System |
US20130191338A1 (en) * | 2012-01-23 | 2013-07-25 | Palantir Technologies, Inc. | Cross-acl multi-master replication |
US20130191336A1 (en) | 2012-01-23 | 2013-07-25 | Richard Allen Ducott, III | Cross-acl multi-master replication |
Non-Patent Citations (1)
Title |
---|
U.S. Appl. No. 12/836,801, filed Jul. 15, 2010, Notice of Allowance dated Apr. 16, 2013. |
Also Published As
Publication number | Publication date |
---|---|
US8838538B1 (en) | 2014-09-16 |
US20190356667A1 (en) | 2019-11-21 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
USRE47546E1 (en) | Techniques for replicating changes to access control lists on investigative analysis data | |
US10762102B2 (en) | System and method for incremental replication | |
US10936573B2 (en) | Cross-ACL multi-master replication | |
CA2826905C (en) | Sharing information between nexuses that use different classification schemes for information access control | |
US11709878B2 (en) | Enterprise knowledge graph | |
US11327641B1 (en) | Data collaboration between different entities | |
US11770450B2 (en) | Dynamic routing of file system objects | |
US11194840B2 (en) | Incremental clustering for enterprise knowledge graph | |
US11914741B2 (en) | Data security | |
Casey et al. | Crowdsourcing forensics: Creating a curated catalog of digital forensic artifacts | |
US20220147651A1 (en) | Data management method, non-transitory computer readable medium, and data management system |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: MORGAN STANLEY SENIOR FUNDING, INC., AS ADMINISTRATIVE AGENT, NEW YORK Free format text: SECURITY INTEREST;ASSIGNOR:PALANTIR TECHNOLOGIES INC.;REEL/FRAME:051713/0149 Effective date: 20200127 Owner name: ROYAL BANK OF CANADA, AS ADMINISTRATIVE AGENT, CANADA Free format text: SECURITY INTEREST;ASSIGNOR:PALANTIR TECHNOLOGIES INC.;REEL/FRAME:051709/0471 Effective date: 20200127 |
|
AS | Assignment |
Owner name: PALANTIR TECHNOLOGIES INC., CALIFORNIA Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:ROYAL BANK OF CANADA;REEL/FRAME:052856/0382 Effective date: 20200604 Owner name: MORGAN STANLEY SENIOR FUNDING, INC., NEW YORK Free format text: SECURITY INTEREST;ASSIGNOR:PALANTIR TECHNOLOGIES INC.;REEL/FRAME:052856/0817 Effective date: 20200604 |
|
AS | Assignment |
Owner name: PALANTIR TECHNOLOGIES INC., CALIFORNIA Free format text: CORRECTIVE ASSIGNMENT TO CORRECT THE ERRONEOUSLY LISTED PATENT BY REMOVING APPLICATION NO. 16/832267 FROM THE RELEASE OF SECURITY INTEREST PREVIOUSLY RECORDED ON REEL 052856 FRAME 0382. ASSIGNOR(S) HEREBY CONFIRMS THE RELEASE OF SECURITY INTEREST;ASSIGNOR:ROYAL BANK OF CANADA;REEL/FRAME:057335/0753 Effective date: 20200604 |
|
MAFP | Maintenance fee payment |
Free format text: PAYMENT OF MAINTENANCE FEE, 8TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1552); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY Year of fee payment: 8 |
|
AS | Assignment |
Owner name: WELLS FARGO BANK, N.A., NORTH CAROLINA Free format text: ASSIGNMENT OF INTELLECTUAL PROPERTY SECURITY AGREEMENTS;ASSIGNOR:MORGAN STANLEY SENIOR FUNDING, INC.;REEL/FRAME:060572/0640 Effective date: 20220701 Owner name: WELLS FARGO BANK, N.A., NORTH CAROLINA Free format text: SECURITY INTEREST;ASSIGNOR:PALANTIR TECHNOLOGIES INC.;REEL/FRAME:060572/0506 Effective date: 20220701 |