Palantir Technologies Inc.

Lam Tran

Robert Kruszewski

Lili Yang

Mark Elliot

James Baker

Hannah Korus

Brian Schimpf

Divyanshu Arora

Christopher Yu

Thomas Playford

Patrick Koenig

Sebastian Brueckner

Katherine Carras

Yin Lin

Kevin Lowe

Computing systems and methods are provided for defining, within a data platform, a segment having constraints at a level of the segment, implementing the constraints or the classification rules within the segment while insulating resources within the segment from inheriting the constraints, and controlling an ingestion of an external resource into the segment based on the constraints.

Enforcing security within a data platform

Methods, systems, and apparatus, including computer programs encoded on computer storage media for data security protection are provided. One of the methods includes: receiving a job associated with a project, wherein the project is associated with one or more data sources; identifying a plurality of inputs and a plurality of outputs associated with the job; determining a plurality of required permissions associated with the job, wherein each of the required permissions comprises an operation on a required data source, the operation corresponding to at least one of the inputs or the outputs; verifying that the one or more data sources associated with the project comprise the required data source associated with each of the required permissions; and generating a token associated with the job, the token encoding the required permissions associated with the job, wherein the token is required for execution of the job.

Project-based permission system

A system and method for authenticating users of a data processing platform stores a mapping of a unique user platform identifier to multiple user identity provider identifiers associated with multiple realms for a same user. In some examples, the method includes receiving a request from a client device to establish an access session to perform one or more actions on data of the data processing platform and receiving, from at least one of the first external identity provider of the first realm or the second external identity provider of the second realm, a user identity provider identifier associated with the request. In certain examples, the method includes granting permission to perform the one or more actions on the data of the data processing platform based at least in part on the received user identity provider identifier.

Systems and method for authenticating users of a data processing platform from multiple identity providers

Systems and methods generate a first security node hash identifier by performing a first hash operation, such as a one-way hash, on a first data resource identifier associated with a first data resource, such as a data set, produced by a data resource platform. The systems and methods generate a dependent second security node hash identifier by performing a second hash operation on a second data resource identifier associated with a dependent second data resource produced by the data resource platform and on the first security node hash identifier, receive an access request for access to the dependent second data resource; and in response to the access request, grant permission to access the dependent second data resource to a user associated with the access request based on the dependent second security node hash identifier.

Systems and methods for providing network-based permissioning using security node hash identifiers

Growing community of inventors

Menlo Park, CA, United States of America

Lam Tran