System and procedure for sharing investigation results data

Abstract

A computer-implemented method for accessing a database (150) from multiple locations (101A-C) via an application server (120) hosting a charting application (130), wherein the charting application (130) drives an interactive user interface for sharing charts, which is displayed on a screen at at least one user location (101) operationally connected to the application server (120) via one or more communication links (111A-C), the user interface enabling a user to perform a discovery involving data objects stored in the database (150), to make changes to a subset of data in the discovery that are not visible to other users at other user locations (101), and to make changes made during the discovery visible to other users at other user locations (101).by publishing the changes in a shared data repository (160) of the database (150), the procedure comprising the following: , Storing at a first user location of the multiple user locations of first diagram state data, representing a diagram (164) before redaction, which has nodes and edges, wherein the diagram before redaction represents results of a determination by a first user, which include a plurality of data objects (154) and links (156) between them, wherein the plurality of data objects (154) and the links (156) between them include a subset of data in a shared data repository in the database and are associated with access control lists (158) that govern access to the data objects (154) and the links (156); Determining a common access control level; wherein determining the common access control level comprises one of the following, namely (a), (b) or (c): (a) Determining the common access control level from a template file provided by a user; (b) Receiving a listing of a set of users in order to obtain a result of identifying the first user; determining, for each user in the listed set of users, a set of one or more access control groups to which the user belongs, and determining the common access control level by determining an intersection of the determined sets of one or more access control groups to which the majority of users belong; or (c) Determine, for each user from a listed set of users, a set of one or more access control groups to which the user belongs; determine a first intersection of the determined sets of one or more access control groups to which the majority of users belong; and determine the common access control level by determining a second intersection between the first intersection and a set of one or more access control groups of an investigation authorization associated with the investigation of the first user; Generating, based on the specified common access control level and the access control lists that govern access to the data objects and the links, second diagram state data representing an edited diagram (161) in which one or more nodes or edges of the diagram (164) are edited prior to editing; where one or more nodes or edges are created or modified during the discovery of the first user; Receiving user input to toggle a display between the first chart status data and the second chart status data, and causing the display of a corresponding indicator; Receiving confirmation of the second chart status data or an instruction to further redact the second chart status data to prevent an information leak; Resolving conflicts in access control information with the shared diagram repository due to the shared access level from the second diagram status data; Publish after resolving the second diagram status data to the shared diagram repository (160) of the database (150), while each edited part of the pre-edited diagram remains visible only on the first user page; Retrieving third-party chart status data at the first user location, representing an edited chart stored in the shared chart repository and published by a second user location out of a multi-user location; Consolidating the first chart status data with the third chart status data to advance the identification of the first user.

Description

[0001] The present disclosure relates generally to computer systems for investigative analysis, and more particularly to the design and use of computer systems to communicate investigative results generated by one user to other users.

[0002] The ongoing advancement of electronic data processing, including artificial intelligence, data mining, statistics, machine learning, and database systems, requires a better model for computer-based investigative analysis. The shortcomings of data mining—the use of statistical algorithms to extract patterns and insights from raw data—are a key catalyst for the new demands placed on investigative analysis systems. With data mining, using computers to detect credit card fraud, recommend the next movie to rent, or find a good place to eat in a new city has become part of our daily lives.

[0003] However, data mining has limitations for use as an investigative analysis method. From a technical perspective, automated data mining techniques are well suited when the nature and composition of the underlying data does not change over time, the data is complete and accurate, and the queryer has some idea of ​​what they are looking for.

[0004] Unfortunately, many of the most difficult, complex, and critical data problems encountered today lack data properties that are well-suited to data mining techniques. These problems tend to involve data that comes from many disparate sources, is incomplete and inconsistent, and is created by people trying to avoid leaving an easily traceable trail. Further complicating matters is that these problems are often intertwined with concerns about societal issues and privacy. People generally feel uncomfortable with a computer being the final arbiter when lives or livelihoods are at stake. Examples of where such problems are encountered include areas such as intelligence analysis and police investigations.For these types of data problems, solutions based on automated algorithms are suboptimal because they do not require human involvement in critical steps.

[0005] Accordingly, there is still a need in this field of technology for an investigative analysis system that addresses these and other problems.

[0006] US 2006 / 0 053 170 A1 relates to a system and method for parsing and / or exporting data from one or more multi-relational ontologies. US 2010 / 0 313 239 A1 relates to information access control, in particular to automated access control for rendered output.

[0007] The above-described shortcomings and other problems associated with using data mining methods for certain investigative analyses are reduced or eliminated by the disclosed investigative analysis system, in particular by the computer-implemented method of claim 1 and the system of claim 11.

[0008] In some embodiments, a user of the system may communicate results of a determination regarding a data volume to other users in a manner that allows the communicating user to visualize how the results will be communicated to the other users before the results are communicated.

[0009] In some embodiments, the results of the determination are communicated in the form of a pictorial diagram comprising nodes and edges.

[0010] In some embodiments, the pictorial diagram also includes additional presentation elements (e.g., non-node and non-edge components) in addition to nodes and edges. These additional presentation elements may include textual annotations, property boxes, audio content, video content, audio / video content, documents, or other displayable information.

[0011] In some embodiments, the nodes of the graph represent data objects that are subject to discovery, and the edges represent connections between the data objects.

[0012] In some embodiments, the diagram is distributed to the other users in the form of an automatically generated, redacted diagram that omits nodes, edges, and / or other presentation elements that the other users do not have permission to view.

[0013] In some embodiments, a visual representation of the automatically generated, redacted diagram is presented to the sharing user before it is made available to other users, providing the sharing user with an opportunity to confirm that sharing the redacted diagram with other users will not constitute an information leak and to confirm that the redacted diagram is meaningful to the other users' investigations. Thus, a pattern-matching and intervention mechanism in the form of the human brain is involved in deciding whether it is appropriate for results of a user's investigation to be shared with other users.

[0014] For a better understanding of the aforementioned embodiments of the invention, as well as additional embodiments thereof, reference is made to the following description of the embodiments taken in conjunction with the following drawings, in which like reference numerals refer to corresponding parts throughout the figures. Fig. Figure 1A is a block diagram of an investigative analysis system with graph sharing. Fig. Figure 1B is a block diagram of a graph passing application of the detecting analysis system. Fig. 1C is a block diagram of a diagram sharing database of the investigating analysis system. Fig. Figure 2 is a flowchart of a methodology for distributing discovery results that can be performed using the diagram sharing application of the discovery analysis system. Fig. 3A-D are examples of diagram sharing user interface dialogs for publishing a redacted diagram to a shared diagram repository of the investigating analytics system. Fig. Figure 4 is an example of a diagram sharing user interface dialog to retrieve a redacted diagram from the shared diagram repository of the investigating analytics system. Fig. 5 is a block diagram of a sample computer system on which embodiments of the invention may be implemented.

[0015] In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the invention. It should be understood, however, that the invention may be practiced without these specific details. In other instances, well-known structures and devices are presented in block diagram form to avoid unnecessarily obscuring the invention.

[0016] It should be understood that while the terms first, second, etc., may be used herein to describe various elements, these elements are not intended to be limited by these terms. These terms are used merely to distinguish one element from another. For example, a first diagram could be referred to as a second diagram, and similarly, a second diagram could be referred to as a first diagram without departing from the scope of the invention. The first diagram and the second diagram are both diagrams, but they are not the same diagram.

[0017] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, the singular forms "a," "an," and "another," and "the," are intended to include the plural forms as well, unless the context clearly indicates otherwise. Use of the term "criteria" may refer to the singular form of the term "criterion" and / or the plural form "criteria."

[0018] It is also understood that the term "and / or," as used herein, refers to and includes any and all possible combinations of one or more of the associated listed elements. It is further understood that the terms "comprises" and / or "comprising," when used herein, indicate the presence of listed features, integers, steps, operations, elements, components, and / or groups, but do not preclude the presence or addition of one or more additional features, integers, steps, operations, elements, components, and / or groups.

[0019] As used herein, the term "when" may be understood to mean "whenever" or "after" or "responsive to determining" or "responsive to detecting," depending on the context. Similarly, the phrase "when it is determined" or "when [a specified condition or event] is detected" may be understood to mean "after it has been determined" or "responsive to determining" or "after [the specified condition or event] has been detected" or "responsive to detecting [the specified condition or event]," depending on the context. overview

[0020] Generally, the present disclosure relates to a computer-based discovery analysis system in which a user can communicate results of a discovery to other users in a manner that allows the communicating user to visually represent how the results will be communicated to the other users before they are communicated. In some embodiments, the results of the discovery are communicated in the form of a visually represented graph comprising nodes and edges.

[0021] In some embodiments, the visually represented diagram includes additional presentation elements (e.g., non-node and non-edge components) in addition to nodes and edges. These additional presentation elements may include textual annotations, property boxes, audio content, video content, audio / video content, documents, or other presentable information.

[0022] In some embodiments, the nodes of the graph represent data objects that are the subject of the discovery, and the edges represent connections between the data objects.

[0023] In some embodiments, the diagram is passed to the other users in the form of an automatically generated, redacted diagram, omitting nodes, edges, and / or other presentation elements for which the other users do not have permission to view.

[0024] In some embodiments, a visual representation of the automatically generated, redacted diagram is presented to the sharing user before it is shared with other users, providing the sharing user with an opportunity to confirm that sharing the redacted diagram with other users will not constitute an information leak and to confirm that the redacted diagram is meaningful to the other users' investigations. Thus, a sophisticated pattern-matching and intervention mechanism in the form of the human brain is involved in deciding whether it is appropriate for the results of a user's investigation to be shared with other users. Investigative analysis system with diagram sharing

[0025] In some embodiments, the present disclosure relates to a computer-based discovery analysis system in which a user can share results of a discovery with other users in a manner that allows the sharing user to visualize how the results will be shared with the other users before sharing them. Thus, the system allows the sharing user to confirm that sharing the diagram would not constitute an information leak while simultaneously providing meaningful information to the other users.

[0026] An example of a detecting analysis system 100 is shown in Fig. 1A. As shown, the system 100 includes one or more user sites 101A-C (collectively, "user site 101"), each connected by one or more network communication links 111AC to an application server 120 hosting a diagram application 130. The diagram application 130, as part of the application server 120, accesses a database 150 via a database management system 140. The user sites 101A-C and the server 120 may include one or more computers hosting or executing logic or stored programs configured to perform the processes further described herein.

[0027] A user at site 101, using a computing device at site 101, performs an investigation involving data objects stored in database 150. In general, an investigation is a separate line of query or analysis concerning a subset of shared database data retrieved from a shared data repository in database 150. Investigations enable users at sites 101 to explore competing hypotheses. For example, if the user at site 101A has a first hypothesis regarding a subset of database data, and the user at site 101B has a second competing hypothesis regarding the same subset of database data, the investigations enable both analysts to pursue their own hypothesis regarding the subset without interfering with or contradicting each other.

[0028] During a discovery, changes made to the discovery subset of data are not visible to other users at other user locations 101 and do not conflict with changes made to the subset by other users at other user locations 101, either in another discovery or to the base copy of the subset in the shared data repository of the database 150 from which the discovery subset was obtained.

[0029] Changes made during an investigation are made visible to other users at other locations 101 by publishing the changes to the shared data repository of the database 150. Publishing changes to the shared data repository may require reconciliation with other changes made outside the context of the investigation. In some cases, reconciliation occurs automatically. In other cases, manual reconciliation is required.

[0030] In some embodiments, a user at location 101, using charting application 130, in the context of an investigation the user is conducting, may generate results of the investigation in the form of a chart reflecting changes made during the investigation. The chart may be generated using charting application 130 and stored in the memory of a computer. Among other functions, charting application 130 drives an interactive user interface presented on an image display at user location 101 (e.g., a computer monitor).Among other features, the user interface allows a user at user location 101 to visualize data objects that are the subject of the investigation by plotting each data object as a separate node of the graph and displaying any known connections between each data object as edges connecting the nodes. For example, an edge of the graph connecting the two nodes may represent a shared property, a personal relationship, or a shared participation in an event. As another possible feature, the user interface may allow the user at user location 101 to create a new association between two data objects in the investigation by (e.g.,using a pointing device or a finger or stylus placed on a touch screen) to draw a line between the two nodes of the diagram that represent the two data objects.

[0031] In some embodiments, a user at a user site 101 can publish a graph generated during an investigation to a graph repository in database 150, from which other users at other sites 101 can retrieve the published graph and incorporate it into their own investigations for further analysis. In this way, a user at a user site 101 can communicate results of an investigation to other users at other sites 101. This process can be continued by passing the analysis back and forth between investigation workgroups.

[0032] As a specific example, a user at user location 101A may publish a first diagram to the diagram repository. Another user at user location 101B may contribute the first diagram to another discovery, after which a second diagram based on the first diagram is published back to the diagram repository. From there, the user at user location 101A may retrieve the second diagram and contribute it to their discovery to continue the analysis based on the second diagram generated by the user at user location 101B. Publishing, contributing, and receiving require network data communication between the computers involved in the described interactions.

[0033] In some embodiments, diagram application 130 controls an interactive diagram sharing user interface, presented on an image display at user site 101, that enables a user at user site 101 to publish a diagram generated during a discovery to the diagram repository. In some embodiments, the diagram sharing user interface enables the user to designate additional users to receive the diagram. Based on the specified users, diagram application 130 automatically generates a redacted version of the diagram, in which nodes and edges for which the specified users do not have viewing permission are redacted.The diagram application 130 displays the edited diagram on the image display to allow the publishing user to approve the contents of the edited diagram before publishing the edited diagram to the diagram repository. If the publishing user is satisfied with the contents of the edited diagram, the publishing user can instruct the diagram instruction 130 via the user interface to publish the edited diagram to the diagram repository.

[0034] As a specific example, an intelligence analyst at user location 101A in one country or state A may wish to share results of an investigation with an intelligence analyst at user location 101B in another country or state B. Using chart application 130, the intelligence analyst of jurisdiction A can visually confirm that contents of a redacted chart to be shared with the intelligence analyst of jurisdiction B do not represent an information leak, while also representing investigation results useful to the intelligence analyst of jurisdiction B.

[0035] At each user location 101, there is a client computing device used by a user at that location, which communicates with and exchanges data with the application server 120 via a network communication connection 111. The client computing device can be virtually any client computer, such as a workstation, laptop, tablet computer, mobile phone, or other client computing device that has or is operatively connected to an image display. Although only three user locations 101 are shown in Fig. 1A, however, the system 100 may include more than three or fewer than three user locations 101.

[0036] A network communication connection 111 may span one or more data networks (e.g., LANs (Local Area Networks) and WANs (Wide Area Networks)). A network communication connection 111 may be based on a reliable network transport protocol, such as TCP / IP or the like. A network communication connection 111 between a user site 101 and the application server 120 may be established as and when required, for example, when the application server 102 or the client computing device at the user site 101 needs to send data to the other(s). Alternatively, the network communication connection 111 may last for the duration of a session, during which data is sent back and forth between the application server 120 and the user site 101 in multiple communication exchanges.Either the application 120 or the client computing device at the user location 101 may initiate establishment of the network communication connection 111. A network communication connection 111 may span a number of intermediate devices (e.g., web servers, cache servers, proxy servers, content delivery network servers, etc.) between an application server 120 and the client computing device at the user location 101. In this case, the network communication connection 111 may be considered a logical network communication connection consisting of a number of sub-network communication connections that connect the client computing device to the application server 120 across the intermediate devices in a network.

[0037] The client computing device at user location 101 is configured with a web browser application or other client application to perform client functions of the charting application 130. Among other things, the client functions include presenting various user interfaces of the charting application 130 on the image display of the client computing device, as instructed by the charting application 130 via one or more network communication connections 111. The client functions may also include receiving user input from the user of the client computing device and transmitting data representing user input to the charting application 130 via one or more network communication connections 111.The diagramming application 130 may instruct the client application to render the various diagramming application user interfaces using standardized web instructions sent to the client computing device over one or more network communication connections 111. Such web instructions may involve standardized web protocols (e.g., HTTP, HTTPS, etc.) and include instructions from a standardized markup language (e.g., XML, HTML, XHTML, etc.), instructions from a standardized stylesheet language (e.g., CSS, etc.), and instructions from a standardized client-side scripting language (e.g., JavaScript, ActionScript, JScript, etc.). Acceptance of data representing user input by the diagramming application 130 may also involve standardized web protocols and standardized web instructions.

[0038] The application server 120 contains the diagram application 130 and is run on one or more server computing devices. The server computing devices on which the diagram application 130 is run can be considered to be operatively connected to the image displays at the user locations 101 and the client computing devices at the user locations 101 via network communication links 111. The application server 120 provides basic application data services to the diagram application 130, such as handling network communications with user locations 101 and providing an interface for the diagram application 130 to communicate with the database management service 140. According to some aspects of the invention, the diagram application 130 is implemented using the Java programming language. However, implementation using other programming languages ​​or a hardware implementation is also possible (e.g.,hard-wired logic, one or more ASICs or FPGAs, firmware, etc.). Diagram sharing application

[0039] Fig. 1B is a block diagram of one embodiment of the diagram application 130. As illustrated, the diagram application 130 includes a number of logic elements that may be implemented in software or hardware, or a combination of the two. A diagram distribution logic element 131 includes a redacted diagram generation logic element 132 for generating a redacted diagram, a redacted diagram visualization logic element 133 for displaying a redacted diagram on an image display at a user location 101 operatively connected to the diagram application 130 by a network communication link 111, and a redacted diagram publishing logic element 134 for publishing a redacted diagram to the diagram repository of the database 150.The chart application 130 also includes an instruction handling logic element 135 for receiving an announcement of commands entered by a user using user interface controls presented on the image display at the user location 101 and for sending received commands to the appropriate logic element of the chart application 130 for processing the command. The chart application 130 may include these and other logic elements.

[0040] While in some embodiments, the functions of generating the edited diagram, visualizing it, and publishing it are performed at least partially by a diagram application hosted by an application server, some or all of these functions may be performed by the computing devices at the user site. For example, the computing devices may be configured with a diagram application that performs some or all of these functions.

[0041] In one embodiment, interaction with the database 150 (i.e., the organized information actually stored on a storage device) is performed by a database management service (DBMS) 140, which, among other information, processes requests from the application server 120 for access to information in the database 150. The diagram application 130 may interact indirectly with the database 150 through the DBMS 140, which in turn interacts directly with the database 150 to provide the diagram application 130 with high-level database operations, such as retrieving and storing information in the database 150. No particular type of database management service is required, and any database management service capable of supporting the diagram propagation techniques described herein may be used.For example, in some embodiments, DBMS 140 is a relational database management system, such as those commercially available from Oracle Corp., Redwood Shores, California, and Microsoft Corp., Redmond, Washington. Other embodiments may utilize open source databases.

[0042] In some embodiments, the database 150 (or one or more portions thereof) is stored in volatile memory for faster access to database data. In this case, the database 150 may be backed up by a shadow copy of the database 150 stored in non-volatile memory in the event that the volatile memory experiences a power failure. Diagram sharing database

[0043] Fig. 1C is a block diagram of information stored in database 150 and involved in diagram sharing operations in one embodiment. Conceptually, database 150 is divided into user information 151, user access control level information 158, shared data repository 153 (data warehouse), shared diagram repository 160 (diagram warehouse), and discovery data 162. No specific type of database is required, and any database capable of supporting the diagram sharing techniques described herein may be used. As a purely non-limiting example, database 150 is a relational database.The information stored in database 150 may also be stored as a result of performing diagram sharing operations in the computer memory of the server computing devices on which the diagram sharing application 130 is operating and in the computer memory of client computing devices at user locations 101.

[0044] User information 151 includes data that identifies individual users of the chart sharing application 130. Such data may include user identification information that uniquely identifies individual users and login information for authenticating individual users. Login information may include, for example, username and password information and / or cryptographic digital certificate information. The user information 151 may also include workgroup data. A workgroup is a set of one or more users identified by a workgroup name. Workgroups allow reference to a set of one or more individual users by a single identifier, similar to email message groups.

[0045] User access control level information 152 includes information indicating which access control level users have. In some embodiments, there are two types of access control levels: groups and classifications. Groups may also be referred to as roles. The access control groups to which a user belongs determine which operations the user can perform on which data in the shared data repository 153. The access control groups to which a user belongs also determine which data in the shared data repository 153 the user can contribute to a discovery 162. The access control classifications a user has determine which data in the shared data repository 153 the user has access to and which data in the shared data repository 153 the user can contribute to a discovery 162.

[0046] A user can belong to more than one access control group and can have more than one access control classification. Access control groups and access control classifications can be hierarchical, such that if a user belongs to an access control group or has an access control classification that is higher in the hierarchy, then the user implicitly belongs to all groups and has all classifications that are below that group or classification in the hierarchy.

[0047] Access control groups and access control classifications can be associated with properties 155, links 156, and other presentation elements 166 through access control lists 158. An access control list 158 ​​comprises a set of one or more access control elements 159. An access control element 159 can designate an access control group or a classification.

[0048] When designating an access control group, an access control element 159 includes an access control group name or identifier, as well as a permission of that access control group. In some embodiments, there are four permission levels: discover, read, write, and owner. With discover permission, a user can be notified of data and become aware that data exists, but cannot view the data. With read permission, a user can locate and read the data, but cannot modify the data. With write permission, a user can locate, read, and modify the data. With owner permission, a user can locate, read, modify, and adjust permissions related to the data. Thus, permissions can be cumulative.For example, a user who has write permission to data also implicitly has read and discover permission to that data. Embodiments are not limited to these four permission levels, and additional sets of permission levels may be used.

[0049] When designating an access control classification, an access control element 159 includes a classification label designating the classification. Examples of classification labels include 'top secret' (TS), 'secret' (S), 'confidential' (C), 'restricted access' (R), and 'unrestricted' (U). In one embodiment, a user is not permitted access to data in the shared data repository 153 unless the user has all of the classification labels designated in the access control list 158 ​​associated with the data. Thus, in such an embodiment, classification access control elements 159 of an access control list 158 ​​override any permissions granted to a user by group access control elements 159 of the access control list 158. The aforementioned classification labels are merely hypothetical and exemplary.As will be explained in more detail later, access control information 157 associated with the data objects 154 and links 156 under investigation may be used when propagating a graph to determine which nodes and edges of the graph are to be edited.

[0050] In some embodiments, investigation data stored in shared data repository 153 is conceptually structured according to an object-centric data model. At the highest level of abstraction, there are data objects 154. A data object 154 is a container for information that represents things in the world. For example, a data object 154 may represent an entity, such as a person, place, organization, or other noun, or an event that occurs at a time or during a duration, a document or other unstructured data source, such as an email message, a news story or piece of writing, or an article, or a digital media item, such as an audio or video item. A data object 154 may have a type (e.g., person, event, or document) and a display name, which may be values ​​of certain properties 155 of the data object 154.

[0051] Each data object 154 can have one or more properties 155. Properties 155 are attributes of the data object 154 that represent individual data elements. Each property 155 of a data object 154 has a type and a value. Different types of data objects 154 can have different types of properties 155. For example, a person data object 154 could have an eye color property 155, and an event object 154 could have a date property 155.

[0052] In some embodiments, the set of data object types and the set of property types for each data object type are defined according to a predefined or user-defined ontology or other hierarchical structuring of knowledge, by subcategorizing object types and property types according to their relevant and / or cognitive properties. A data object 154 may also have more than one property 155 of the same type. For example, a person data object 154 could have multiple address properties 155 or multiple name properties 155.

[0053] A link 156 represents a connection between two data objects 154. In some embodiments, the connection is either through a relationship, an event, or matching properties.

[0054] A relationship connection can be asymmetric or symmetric. For example, a Person data object A can be related to a Person data object B through a child relationship (where Person data object B has an asymmetric parent relationship to Person data object A), a symmetric family relationship to Person data object C, and an asymmetric member relationship to an Organization data object X. The type of relationship between two data objects can vary depending on the types of the data objects. For example, a Person data object A can have an 'appear in' relationship to Document data object Y or can have an 'attend in' relationship to Event data object E.

[0055] As an example of an event connection, two person data objects 154 may be connected by a commercial flight data object 154, representing a particular commercial flight if they traveled together on that flight, or by a conference data object 154, representing a particular conference if they both attended that conference. In one embodiment, when two data objects 154 are connected by an event, they are also connected by relationships in which each object 154 has a particular relationship to the event, for example, an 'appears at' relationship.

[0056] As an example of a connection through matching properties, two person data objects 154 representing a brother and a sister may both have an address property 155 indicating where they live. If the brother and sister live in the same house, then their address properties 155 are likely to contain similar, if not identical, information. In one embodiment, a link 156 may be established between two data objects 154 based on similar or matching properties 155 of the data objects 154.

[0057] The above only provides some examples of the types of connections that may be represented by a link 156, and other types of connections may be represented. Thus, it should be understood that embodiments are not limited to any particular types of connections between data objects 154. For example, a document data object 154 could contain two differently named entities. A link 156 between two data objects 154 may represent a connection between these two entities based on their co-occurrence within the same document.

[0058] In some embodiments, additional presentation elements 166 other than data objects 154, properties 155, or links 156 are stored in the shared data repository 153. These additional presentation elements 156 may include textual annotations, property boxes, audio content, video content, audio / video content, documents, or other presentable information. These additional presentation elements 156 are referred to as "presentation" elements because they may be presented in a diagram in addition to nodes and edges representing data objects 154 and links 156, respectively. It should be understood that presentation elements 166 and data objects 154 are not required to represent different types of information. Information represented by a presentation element 166 may instead be represented by a data object 154, and vice versa.For example, a document may be represented by a presentation element 166 and / or a data object 154.

[0059] In some embodiments, a property 155, a link 156, or a presentation element 166 may be associated with an access control list 158 ​​that governs the access users have to the property 155, the link 156, or the presentation element 166. In some embodiments, the level of access a user has to a property 155 or a link 156 also influences the level of access the user has to a data object 154 associated with the property 155 or the link 156. In particular, to view a data object 154, a user must have viewing access to at least one property 155 of that data object 154.If the user has viewing access to a link 156 from one data object 154 to another data object 154, but does not have viewing access to any properties 155 of the data object 154, then the user may view the data object 154, but in a general form that does not reveal details of the data object 154. In some embodiments, to view a property 155 of a data object 154, a user must have at least read-level access to that property 155. In some embodiments, to view a link 156, the user must have at least read-level access to that link 156. In some embodiments, to view a presentation item 166, the user must have at least read-level access to that presentation item 166. Diagram-based investigations

[0060] In some embodiments, a user at user site 101 may use the diagram application 130 to perform a separate line of investigation or analysis regarding a subset 163 of data objects 154, properties 155, links 156, and presentation elements 166 retrieved from the shared data repository 153. This separate line of investigation or analysis is referred to herein as investigation 162.During an investigation 162, changes made to the investigation subset 163 of the investigation 162 are not visible to other users at other user locations 101 and do not conflict with changes to the data objects 154, properties 155, links 156, and presentation elements 166 of the investigation subset 163 made by other users at other user locations 101, either during a further investigation 162 or to the base copies of the data objects 154, properties 155, links 156, and presentation elements 166 in the shared data repository 153 from which the investigation subset 163 was obtained. Changes made during an investigation 162 are made visible to other users at other locations 101 by “publishing” the changes to the shared data repository 153. Investigation authorizations

[0061] In some embodiments, the set of data objects 154, properties 155, links 156, and presentation elements 166 in the shared data repository 153 that can be included in a user's discovery subset 163 is restricted by discovery authorizations 165. A discovery authorization 165 is a set of access control groups and / or a set of access control classifications. A discovery authorization 165 is associated with a discovery 162 and represents the applicable permission for the associated discovery 162. The applicable permission determines the type of data that can be included in the discovery 162 from the shared data repository 153.For example, if the investigation authorization 165 has the "Everyone" and "Finance" groups, only data in the shared data repository 153 that is authorized for "Everyone", "Finance", or both can be brought into the investigation 162.

[0062] As a result of an associated discovery authorization 165, a discovery 162 may include data authorized by each group or classification in the discovery authorization 165. In some embodiments, in order to gain access to a discovery 162, the user must have at least the same set of access control groups and access control classifications as specified in the associated discovery authorization 165, according to their user access control level information 152. Diagrams before editing

[0063] In the context of a discovery 162, a user at user site 101 may use the diagram application 130 to make changes to the discovery subset 163 of the discovery 162 by creating and saving a diagram 164. Similar to the discovery subset 163, the diagram 164 is local to the discovery 162 until it is published to the shared diagram repository 160. In some embodiments, a diagram 164 created in the context of a discovery may be published to the shared diagram repository 160 as a redacted diagram 161 in which one or more nodes, edges, and / or other presentation elements 166 of the diagram 164 created in the context of the discovery are redacted. In this sense, the diagram 164 created in the discovery 162 may be conceptually considered a pre-redacted diagram.

[0064] To make changes to the determination subset 163, the diagram application 130 controls a user interface, allowing the user to navigate and work with the contents of a diagram 164. Among other possible features, the user interface may allow a user to add and remove data objects 154 from the diagram 164, create and remove links 156 between data objects 154 of the diagram 164, add and remove a presentation element 166, and organize and format the diagram 164 for presentation.

[0065] A pre-editing diagram 164 of an investigation 162 may be a collection of nodes, the edges between them, and presentation elements 166. Each node of a pre-editing diagram 164 corresponds to a data object 154 that is the subject of the investigation 162. Each edge of the pre-editing diagram 164 corresponds to a link 156 established between two data objects 154 that are the subject of the investigation 162. Each presentation element 166 of the pre-editing diagram corresponds to a presentation element 166 that is the subject of the investigation 162. Chart status data

[0066] A pre-edit diagram 164 of a determination 162 may be stored in the database 150 by the diagram application 130 as "diagram status data." Diagram status data includes information for displaying the nodes, edges, and other presentation elements of the diagram on an image display. Diagram status data may include information such as two-dimensional positioning information for positioning the nodes and other presentation elements of the diagram on the image display, and link information indicating the nodes to display with edges drawn between them. The diagram status data may include other information such as a name of the diagram and a description.

[0067] In some embodiments, diagram state data for a pre-redaction diagram 164 does not include the data objects 154, links 156, and presentation elements 166 represented by the pre-redaction diagram 164. Instead, the diagram state data includes pointers or references to the represented data objects 154, links 156, and presentation elements 166 of the discovery subset 163. Accordingly, deleting or modifying the diagram state data for a pre-redaction diagram 164 does not, as an operation, delete or modify the underlying data objects 154, links 156, and presentation elements 166 represented by the pre-redaction diagram 164. Publishing a diagram

[0068] Once a user has created a pre-redaction diagram 164 representing results of the ongoing investigation 162, the user may use the diagram application 130 to publish the pre-redaction diagram 164 to the diagram repository 160 as a redacted diagram 161, from where it may be read by other users and incorporated into their own investigations 162 to continue analysis.

[0069] In some embodiments, the diagram publishing process begins with the publishing user specifying a set of individual users expected to retrieve the redacted diagram 161 from the shared diagram repository 160. This set of users is hereinafter referred to as the set of "target users." In some embodiments, the publishing user specifies the set of target users by entering target user identifiers and / or workgroup identifiers through a user interface driven by diagram application 130. A workgroup is a named collection of individual users, similar to a distribution list.

[0070] Next, the diagram application 130 determines a common access control level of the set of target users. In some embodiments, the common access control level is the set of access control groups to which each target user belongs, as well as the set of access control classifications each target user has. In some embodiments, the common access control level is the intersection of the set of access control groups to which each target user belongs and the set of access control groups of the discovery authorization 165 associated with the discovery 162, as well as the intersection of the set of access control classifications each target user has and the set of access control classifications of the discovery authorization 165 associated with the discovery 162.

[0071] In some embodiments, determining a common access control level of the set of target users includes the chart application 130 consulting the user access control level information 152 to determine, for each target user, the set of access control groups to which the target user belongs and the set of access control classifications the target user has. In this case, two intersections are calculated. One intersection is the intersection of the sets of access control groups for the target users (the "target user common access control groups"). The other intersection is the intersection of the sets of access control classifications of the target users (the "target user common access control classifications").

[0072] In some embodiments, the common access control level is the set of common access control groups of the target users and the set of common access control classifications of the target users. In some embodiments, common access control groups of the target users that are subordinate to or subsumed by common access control groups of the target users higher in the access control level hierarchy are not included in the common access control level. Similarly, in some embodiments, common access control classifications of the target users that are subordinate to or subsumed by common access control classifications of the target users higher in the access control level hierarchy are not included in the common access control level.

[0073] In some embodiments, the common access control level is (a) the intersection of the set of common access control groups of the target users (possibly omitting any subordinate or subsumed groups) and the set of access control groups of the discovery authorization 165 associated with the discovery 162, and (b) the intersection of the set of common access control classifications of the target users (possibly omitting any subordinate or subsumed classifications) and the set of access control classifications of the discovery authorization 165 associated with the discovery 162.Due to these intersections with the discovery authorization 165 associated with the discovery 162, the preview of the edited diagram presented to the publishing users does not display any nodes, edges, and presentation elements that cannot be viewed by the set of target users due to the discovery authorization 165 associated with the discovery 162.

[0074] In some embodiments, rather than beginning the diagram publishing process by specifying a set of individual users and / or workgroups expected to retrieve the redacted diagram 161 from the shared diagram repository 160, the user instead begins the diagram publishing process by providing a template file that directly specifies the shared access control level.

[0075] Next, whether the shared access control level is determined indirectly from a set of designated users / workgroups or directly from a template file, the diagram application 130 iteratively walks through the diagram components (i.e., nodes, edges, and presentation elements) of the pre-redaction diagram 164 to determine, for each such diagram component, whether a hypothetical user with the shared access control level can view the component based on the access control information 157 associated with the data object 154, link 156, or presentation element 166 that the diagram component represents. If the hypothetical user with the shared access control level could not view the component, then the component is redacted in the redacted diagram 161 published to the shared diagram repository 160.In particular, the pre-redaction diagram 164 may be published as a redacted diagram 161 based on the diagram status data for the pre-redaction diagram 164, but without diagram status data for the components that were redacted.

[0076] Before publishing the pre-redaction diagram 164 as a redacted diagram 161 to the shared diagram repository 160, the diagram application 130 displays a visual representation of the redacted diagram 161 on the publishing user's image display so that the publishing user can view how the redacted diagram 161 appears to a user with a shared access control level. By doing so, the publishing user can confirm that publishing the redacted diagram 161 will not constitute an information leak before publishing the redacted diagram 161 to the shared data repository 160, while also providing information useful for investigations 162 by others. Diagram sharing methodology

[0077] Fig. 2 is a flowchart of a diagram propagation methodology 200 according to some embodiments. The methodology 200 may be performed by the server computing devices running the diagram application 130. Alternatively, the methodology 200 may be performed by a client computing device at the user location 101, in which case the diagram application 130 runs on the client computing device. As yet another alternative, the methodology 200 may be performed by a combination of a client computing device located at the user location 101 and one or more server computing devices running the diagram application 130, in which case a portion of the diagram application 130 runs on the client computing device.

[0078] For ease of understanding, the steps of the diagram propagation methodology 200 are illustrated and described as being performed in a certain order. However, those skilled in the art will understand that where a step does not depend on results from another step or steps, that step may be performed in a different order or may be performed concurrently with other steps.

[0079] At block 201, the diagram application 130 stores in database 150 first diagram state data representing a pre-edit diagram 164 having nodes, edges, and presentation elements 166. The pre-edit diagram 164 represents a result of a first user discovery that includes data objects 154, properties 155, links 156, and presentation elements 166 that are the subject of the first user discovery 162. The first diagram state data points to, or references, the data objects 154, links 156, and presentation elements 166 in the first user discovery subset 163.

[0080] In some embodiments, the first diagram state data includes information that edits the nodes, edges, and presentation elements of the pre-edit diagram 164, including information to represent the nodes, edges, and presentation elements in a pictorially represented diagram arrangement on an image display. For each node of the pre-edit diagram 164, there is information in the first diagram state data that points to or references the data object 154 in the first user's discovery subset 163 represented by the node. Additionally, for each edge in the pre-edit diagram 164, there is information in the first diagram state data that points to or references the link 156 in the first user's discovery subset 163 represented by the edge.Additionally, for each presentation element of the pre-edit diagram 164, there is information in the first diagram state data that points to or references the presentation element 166 in the first user's discovery subset 163.

[0081] In some embodiments, the pre-editing diagram 164 may include additional components than just nodes and edges. These additional non-edge and non-node components may include textual annotations, property boxes, audio content, video content, audio / video content, documents, or other displayable information. The first diagram status data may include positioning information indicating where on the visually displayed diagram the non-edge and non-node components are to be displayed in relation to the node and edge components of the pre-editing diagram 164. Further, the first diagram status data may include information for each non-edge and non-node component that references the database information (e.g.,The information in the first user's discovery subset 163 that is represented by the non-edge and non-node component (the textual annotation, the property box, the audio content, the video content, the audio / video content, the document, or other displayable information) in the first user's discovery subset 163 that is represented by the non-edge and non-node component of the pre-editing diagram 164 may be associated, in the first user's discovery subset 163, with access control information 157 for controlling access to the database information.

[0082] At block 202, the diagram application 130 obtains user identification information identifying a set of one or more target users with whom the first user expects to share the pre-redaction diagram 164. The user identification information may include a list of one or more individual user identifiers and / or a list of one or more workgroup identifiers. User identification information may be obtained by the diagram application 130 directly from the first user. Alternatively, user identification information may be obtained from the database 150 based on information obtained directly from the first user.

[0083] At block 203, based on the user identification information obtained at block 202, the chart application 130 determines user access control level information that identifies a set of one or more access control levels common to the one or more target users with whom the first user expects to share the pre-redaction chart 164. To accomplish this, the chart application 130 may use the user identification information to obtain, from the user access control level information 152 in the database 150, for each target user, the set of access control groups to which the target user belongs, as well as the set of access control classifications the target user has. From this access control level information obtained for each target user, the chart application 130 determines a common access control level for the set of target users.

[0084] At block 204, based on the user access control level information determined at block 203 and the first diagram state data stored at block 201, the diagram application 130 generates second diagram state data representing a redacted diagram in which one or more nodes, edges, or non-edge and non-node components of the pre-redaction diagram 164 have been redacted. Generally, this entails the diagram application 130 generating a copy of the first diagram state data with information representing the redacted nodes, edges, and non-edge and non-node components removed from the second diagram state data.To determine which nodes, edges, and non-edge and non-node components of the pre-editing diagram 164 are to be edited, the diagram application 130 iteratively processes the nodes, edges, and non-edge and non-node components of the pre-editing diagram 164, comparing the version of the access control information 157 associated with the database information represented by the nodes, edges, or non-edge and non-node components stored in the first user's discovery subset 163 with the common access control level determined for the set of target users.In some embodiments, if the common access control layer grants permission to view the database information represented by a node, edge, or non-edge and non-node component, then information representing the node, edge, or non-edge and non-node component in the first graph state data is retained in the second graph state data.

[0085] In some embodiments, to view a data object 154, a link 156, or other database information represented by a non-edge and non-node component, the shared access control level must include all classifications required by the access control list 158 ​​associated with the data object 154, the link 156, or other database information, and must have at least the discover permission, according to the access control group information of the associated access control list 158 ​​and the access control groups of the shared access control level. Other requirements for viewing are possible, and embodiments are not limited to any particular set of requirements. For example, a shared access control level user may be required to have the read permission instead of just the discover permission.

[0086] In some embodiments, a node of the pre-redaction graph 164 corresponding to a data object 154 in the first user's determination subset 163 is not redacted from the pre-redaction graph 164 if at least one data property 155 of the data object 154 can be considered according to the common access control level.

[0087] In some embodiments, a pre-redaction graph 164 may include a group node representing a set of two or more data objects 154 in the first user's discovery subset 163. In some embodiments, a group node of the pre-redaction graph 164 corresponding to data objects 154 in the first user's discovery subset 163 is not redacted from the pre-redaction graph 164 if at least one of the group's data objects 154 is viewable for the common access control layer. Viewability of a group's data object 154 may be determined based on the properties 155 of the data object 154, as discussed in the previous paragraph.

[0088] In some embodiments, an edge of the pre-redaction graph 164 corresponding to a link 156 in the first user's discovery subset 163 is redacted if it is not viewable by the common access control layer.

[0089] In some embodiments, an edge of the pre-redaction graph 164 is also redacted if the common access control layer cannot view both data objects 154 connected by the corresponding link 156, even if the common access control layer has permission to view the corresponding link 156. Viewability of a data object 154 connected by a link 156 may be determined based on the properties 155 of the data object 154, as discussed in the previous paragraph.

[0090] In some embodiments, an edge of the pre-redaction graph 164 corresponds to more than one link in the first user's discovery subset 163. In this case, the edge may not be redacted if at least one of the links 156 is viewable by the common access control layer. However, the edge may be redacted even if one of the links 156 is viewable by the common access control layer if both data objects 154 connecting the links 156 are not viewable by the common access control layer.

[0091] At block 205, the diagram application 130 presents the first user with a visual representation of the second diagram status data on the first user's image display. This visual representation may be a diagrammatic representation of the pre-redaction diagram 164, but the nodes and edges that were redacted at block 204 are not displayed.

[0092] At block 206, the chart application 130 publishes the second chart status data representing a redacted chart 161 to the shared chart repository 160 in response to an instruction provided by the first user via user interface controls presented on the first user's image display. Once published, other users of the chart application 130 can incorporate the redacted chart 161 into their own investigations 162 for continued analysis.

[0093] In some embodiments, publishing the second diagram status data to the shared diagram repository 160 coincides with publishing the discovery subset 163 back to the shared data repository 153. In some embodiments, if there are data change conflicts between the versions of the data objects 154 and links 156 in the discovery subset 163 and the versions of these data objects 154 and links 156 in the shared data repository 153 at the time of publishing, the data change conflicts in the discovery subset 163 must be resolved either manually or automatically before publishing the second diagram status data to the shared diagram repository 160.Such data change conflicts include any conflicts between access control information 157 associated with these data objects 154 and links 156 in the discovery subset 163 and access control information 157 associated with these data objects 154 and links 156 in the shared data repository 153. In the case of data change conflicts, after the data change conflicts have been resolved, the methodology 200 may return to block 204 to generate new second diagram status data based on the updated discovery subset 163 including the results of the conflict resolutions. Examples of diagram sharing user interfaces

[0094] Fig. 3A, Fig. 3B, Fig. 3C are exemplary diagram sharing user interfaces that can be controlled by the diagram application 130 for sharing a pre-redaction diagram 164 of a determination 162 with other users of a diagram application 130 according to one embodiment. The user interfaces of Fig. 3A-C may be presented on an image display at a user location 101 that is operatively connected to the chart application 130.

[0095] In Fig. 3A shows a graphical user interface dialog 301 in which a selected pre-edit diagram 164 to be shared is displayed in the diagram preview pane 306. The dialog 301 includes a "User Template" button 302 which, when selected, allows the user to specify a template file containing a list of users and / or workgroups representing the users with whom the pre-edit diagram 164 is to be shared. In addition to, or instead of, a list of users and / or workgroups, the template may specify a set of access control groups and / or classifications, as previously described. Alternatively, the user may specify the individual users and workgroups in the input field 304 when the "Share with Users and Workgroups" button 303 is selected.The dialog 301 also includes a message field 305 to enter optional information in the form of a collaboration message.

[0096] As in Fig. 3B, in one embodiment, when the user enters individual users and / or workgroups into the input field 304, the diagram application 130 automatically performs editing of nodes and edges of the pre-edit diagram 164 that are not visible to all users specified in the input field 304. In the example of Fig. 3B, as indicated in the diagram editing status field 309, the entry of a workgroup (“Fikri network group”) and the individual user (“John Doe”) in the input field 304 causes three nodes and seven edges from the Fig. 3A shown pre-editing diagram 164 are to be edited. In Fig. 3B, the redacted diagram displayed in the preview field 306 has the display of the redacted nodes and edges removed.

[0097] Alternatively, as in Fig. 3C, the redacted diagram is displayed with visible redacted nodes and edges, but with redacting indicator elements. In the current example, the redacting indicator elements are circles with diagonally aligned cross lines overlying the redacted nodes and edges. However, other redacting indicator elements are possible, and embodiments are not limited to those shown in Fig. 3C. In general, any visual indicator element that visually distinguishes a redacted node or edge from a non-redacted node or edge may be used. The user can click the "Show Changes" button 308 and the "Hide Changes" button 310 to toggle between the two preview displays.

[0098] Once the user has finished entering users and / or workgroups in the input field 304 or has provided a template, and the user is satisfied with the edited version of the diagram displayed in the diagram preview field 306, the user can select the "Next" button 307 to continue the editing process. Fig. 3D. Here, the user can select one of the radio buttons 311 to publish the redacted diagram displayed in the preview field 306 to the shared diagram repository 160 as a new redacted diagram, or to replace an existing redacted diagram in the shared diagram repository 160. If the "Overwrite Existing Diagram" radio button 311 is selected, the dialog 301 can display user interface controls for selecting and / or locating the redacted diagram to be overwritten in the shared diagram repository 160. If the "Create New Diagram" radio button 311 is selected, the user can enter a name for the new diagram in the text input field 312 and a description of the new diagram in the text input field 313.When the user is finished, the user may click the "Share Diagram" button 314 to publish diagram status data representing the redacted diagram displayed in the preview window 306 to the shared diagram repository 160.

[0099] Fig. 4 includes a user interface that can be displayed on an image display to a user at user location 101 for retrieving a previously published redacted diagram 161 in the shared diagram repository 160 and incorporating it into the user's discovery 162 as a pre-redacted diagram 164. The user interface can be accessed by the diagram application 130 and includes a user interface dialog 401. The dialog 401 allows the user to select a published redacted diagram 161 from a list 403 of published redacted diagrams 161 available to the user that are stored in the shared diagram repository 160. In the list 403 of published redacted diagrams, the user can select a list item 404 to display a preview of the corresponding redacted diagram 161 in the diagram preview field 405.Once the user has selected a list item 404 corresponding to the published redacted diagram 161 of interest to the user, the user may click the "Add to Diagram" button 406 to insert the published redacted diagram 161 into the user's current discovery 162 as a pre-redacted diagram 164. Alternatively, the user may click the "Open in New Discovery" button 407 to create a new discovery 162 and insert the published redacted diagram 161 into the new discovery 161 as a pre-redacted diagram 164. Example of a computer system

[0100] Fig.Figure 5 is a block diagram illustrating a computer system 500 on which embodiments of the invention may be implemented. Computer system 500 includes a bus 502 or other communication mechanism for communicating information, and one or more hardware processors 504 connected to bus 502 to process information. Hardware processor 504 may, for example, be a general-purpose microprocessor.

[0101] Computer system 500 also includes a main memory 506, such as a RAM (random access memory) or other dynamic storage device, connected to bus 502 for storing information and instructions to be executed by processor(s) 504. Main memory 506 may also be used to store temporary variables or other intermediate information during execution of instructions to be executed by processor(s) 504. Such instructions, when stored in non-transitory storage media accessible to processor(s) 504, make computer system 500 a special-purpose computing device customized to perform the operations specified in the instructions. For the purposes of this description, main memory 506 may include any non-volatile memory used to implement virtual memory.

[0102] Computer system 500 may further include a ROM (read-only memory) 508 or other static storage device connected to bus 502 for storing static information and instructions for processor(s) 504. One or more storage devices 510, such as magnetic disks, optical disks, or a solid-state drive, may be provided and connected to bus 502 for storing information and instructions.

[0103] Computer system 500 may be connected via bus 502 to a display 512, such as a liquid crystal display (LCD), for displaying information to a computer user. One or more input devices 514, including alphanumeric and other keys, a touch panel, physical buttons, a mouse, a trackball, a cursor control device, or other input device, may be connected to bus 502 to communicate information and instruct selections made to processor(s) 504. When input device 514 is a touch panel, the touch panel may be physically integrated with display 512, such as a resistive or capacitive sensing touch panel overlaid on an LCD screen to detect the presence and location of a touch within the area of ​​display 512.

[0104] In computer system 500, the methods described herein may be implemented using custom hard-wired logic circuitry, one or more ASICs or FPGAs, firmware, and / or program logic that, in combination with the computer system, cause or program the computer system 500 to be a special-purpose machine. The methods described herein may be performed by the computer system 500 in response to the processor(s) 504 executing one or more sequences of one or more instructions contained in main memory 506. Such instructions may be read into main memory 506 from another storage medium, such as the storage device(s) 510. Execution of the sequences of instructions contained in main memory 506 causes the processor(s) 504 to perform the process steps described herein.In alternative embodiments, hard-wired circuitry may be used instead of or in combination with software instructions.

[0105] The term "storage media," as used herein, refers to any non-transitory media that stores data and / or instructions that cause a machine to operate in a specific manner. Such storage media may include non-volatile media and / or volatile media. Non-volatile media includes, for example, optical disks, magnetic disks, or solid-state drives, such as storage device(s) 510. Volatile media includes dynamic memory, such as main memory 506.Common forms of storage media include, for example, a floppy disk, a flexible disk, a hard disk, a semiconductor drive, a magnetic tape or any other magnetic data storage medium, a CD-ROM, any other optical data storage medium, any physical medium with hole patterns, a RAM, a PROM and an EPROM, a FLASH EPROM, NVRAM, and any other memory chip or cartridge.

[0106] Storage media are distinct from transmission media, but can be used in conjunction with them. Transmission media participate in the transfer of information between storage media. For example, transmission media includes coaxial cable, copper wire, and fiber optic cables, including the wires contained in bus 502. Transmission media can also take the form of sound or light waves, such as those generated during radio wave and infrared data communications.

[0107] Various forms of media may be involved in executing one or more sequences of one or more instructions for execution by the processor(s) 504. For example, the instructions may initially be stored on a magnetic disk or solid-state drive of a remote computer. The remote computer may load the instructions into its dynamic memory and send the instructions over wired networks (e.g., a twisted pair cable, a coaxial cable, fiber optic cable, etc.) or wireless networks (e.g., microwave, satellite, cellular phone, radio transmission, etc.). A network communication device local to the computer system 500 may receive the data over the network and use an infrared transmitter to convert the data into an infrared signal.An infrared detector can receive the data carried in the infrared signal, and suitable circuitry can place the data on bus 502. Bus 502 carries the data to main memory 506, from which processor(s) 504 retrieve and execute the instructions. The instructions received from main memory 506 can optionally be stored on storage device(s) 510, either before or after execution by processor(s) 504.

[0108] Computer system 500 also includes one or more communication interfaces 518 connected to bus 502. The communication interface(s) 518 send and receive electrical, electromagnetic, or optical signals carrying digital data streams representing various types of information. The one or more communication interfaces 518 provide a two-way data communication connection to a network connection 520 connected to a wired or wireless local area network 522. For example, the one or more communication interfaces 518 may be a modem, an Integrated Services Digital Network (ISDN) card, an Ethernet card, a cable modem, a satellite modem, or an IEEE 802.11 or another WLAN (wide area network) interface, a 3G, a 4G or other cellular network interface, or another network interface for communicating on the wired or wireless local area network 522.

[0109] The network interconnect 520 typically provides data communication to other data devices over one or more networks. For example, the network interconnect 520 may provide a connection over a local area network 522 to a host computer 524 or to data facilities operated by an Internet service provider (ISP) 526. The ISP 526, in turn, provides data communication services over the worldwide packet data communications network, now commonly referred to as the "Internet" 528. Both the local area network 522 and the Internet 528 use electrical, electromagnetic, or optical signals capable of carrying digital data streams. The signals over the various networks and the signals in the network interconnect 520 and across the communications interface 518 that carry the digital data to and from the computer system 500 are exemplary forms of transmission media.

[0110] Computer system 500 may send messages and receive data, including program instructions, over the network(s), network link 520, and communications interface(s) 518. In the Internet example, a server 530 may send requested instructions for an application program over the Internet 528, ISP 526, local area network 522, and communications interface(s) 518.

[0111] The received instructions may be executed by the processor(s) 504, as received, and / or may be stored in the storage device(s) 510 or other non-volatile memory for later execution. Extensions and alternatives

[0112] In the foregoing description, embodiments of the invention have been described with reference to numerous specific details that may vary from implementation to implementation. Thus, the sole and exclusive indicator of the scope of the invention, and what is intended by the applicant as the scope of the invention, is the set of claims that emerge from this application, in the specific form in which such claims are drafted, including any subsequent amendment. Any definitions expressly set forth herein for terms included in these claims are intended to govern the meaning of such terms as used in the claims. Therefore, no limitation, element, property, feature, advantage, or attribute not expressly recited in a claim should limit the scope of such claim in any way.The description and drawings are therefore to be understood as explanatory and not restrictive.

Claims

[1] A computer-implemented method for accessing a database (150) by multiple locations (101A-C) via an application server (120) hosting a diagram application (130), wherein the diagram application (130) drives an interactive user interface for sharing diagrams presented on an image display at at least one user location (101) operatively connected to the application server (120) via one or more communication links (111A-C), the user interface enabling a user to perform a discovery involving data objects stored in the database (150) and to make changes to a subset of data in the discovery that are not visible to other users at other user locations (101), and to make changes made during the discovery visible to other users at other user locations (101),by publishing the changes in a shared data repository (160) of the database (150), the method comprising: Storing at a first user location of the plurality of user locations first diagram state data representing a pre-edit diagram (164) having nodes and edges, the pre-edit diagram representing results of a first user determination including a plurality of data objects (154) and links (156) therebetween, the plurality of data objects (154) and the links (156) therebetween including a subset of data in a shared data repository in the database and having associated access control lists (158) that govern access to the data objects (154) and the links (156); Determining a common access control level; wherein determining the common access control level comprises one of the following, namely (a), (b) or (c): (a) determining the common access control level from a template file provided by a user; (b) receiving a listing from a set of users to receive a result of determining the first user; determining, for each user in the listed set of users, a set of one or more access control groups to which the user belongs, and determining the common access control level by determining an intersection of the determined sets of one or more access control groups to which the majority of users belong; or (c) determining, for each user from a listed set of users, a set of one or more access control groups to which the user belongs; determining a first intersection from the determined sets of one or more access control groups to which the majority of users belong; and determining the common access control level by determining a second intersection between the first intersection and a set of one or more access control groups of a discovery authorization associated with the discovery of the first user; generating, based on the determined common access control level and the access control lists that govern access to the data objects and the links, second diagram status data representing a redacted diagram (161) in which one or more nodes or edges of the diagram (164) are redacted prior to redaction; wherein the one or more nodes or edges are created or edited during the determination of the first user; Receiving user input to switch a display between the first chart status data and the second chart status data and causing a corresponding display to be presented; Receiving an acknowledgment of the second chart status data or an instruction to further redact the second chart status data to prevent information leakage; Resolving conflicts in the access control information with the shared diagram repository due to the shared access level from the second diagram state data; publishing, after resolving the second diagram status data, to the shared diagram repository (160) of the database (150) while any redacted portion of the pre-redacted diagram remains visible only on the first user page; retrieving third diagram status data at the first user site representing a redacted diagram stored in the shared diagram repository and published by a second user site of the plurality of user sites; Consolidate the first chart state data with the third chart state data to advance the identification of the first user. [2] The method of claim 1, wherein a particular node of the diagram prior to redaction corresponds to a particular data object of the plurality of data objects, the particular data object having one or more data properties; and wherein generating the second diagram status data representing the redacted diagram includes determining that the particular node is not included in the redacted diagram in response to determining, based on the common access control level and the access control lists associated with the one or more data properties, that the common access control level does not grant permission to view any data property of the one or more data properties of the particular data object. [3] The method of claim 1, wherein a particular group node of the diagram prior to redaction corresponds to a particular set of data objects from the plurality of data objects; and wherein generating the second diagram status data representing the redacted diagram includes determining that the particular group node is not included in the redacted diagram in response to determining, based on the common access control level and the access control lists associated with the particular set of data objects, that the common access control level does not grant permission to view a data object from the particular set of data objects. [4] The method of claim 1, wherein a particular edge of the graph prior to redaction corresponds to a particular link connecting a first data object of the plurality of data objects to a second data object of the plurality of data objects; and wherein generating the second graph status data representing the redacted graph includes determining that the particular edge is not included in the redacted graph in response to determining, based on the common access control layer and the access control lists associated with the particular link, that the common access control layer does not grant permission to view the particular link. [5] The method of claim 1, wherein a particular edge of the graph prior to redaction corresponds to a particular link connecting a first data object of the plurality of data objects to a second data object of the plurality of data objects; and wherein generating the second graph status data representing the redacted graph includes determining that the particular edge is not included in the redacted graph in response to determining, based on the common access control layer and the access control lists associated with the first data object, that the common access control layer does not grant permission to view the first data object. [6] The method of claim 1, wherein each access control list of the access control lists associated with the data objects and the associations lists one or more access control groups and associated permissions. [7] The method of claim 1, further comprising, based on the second diagram status data, causing a pictorial representation of the redacted diagram to be displayed on an image display; and wherein the pictorial representation of the redacted diagram indicates the one or more nodes or edges of the pre-redacted diagram that were redacted. [8] The method of claim 1, further comprising, based on the second diagram status data, causing a pictorial representation of the redacted diagram to be displayed on an image display; and wherein the pictorial representation of the redacted diagram shows the diagram before redaction, with the nodes or edges that were redacted visually highlighted in the pictorial representation. [9] The method of claim 1, further comprising, based on the second diagram status data, causing a pictorial representation of the redacted diagram to be displayed on an image display; and wherein the pictorial representation of the redacted diagram shows the diagram before redaction without the nodes or edges that were redacted. [10] One or more computer-readable media storing computer-executable instructions that, when executed by one or more processors of one or more computing devices, cause the one or more computing devices to perform any of the methods of claims 1 to 9. [11] System comprising: a database; one or more processors configured to access the database (150) by multiple locations (101A-C) via an application server (120) hosting a diagram application (130), the diagram application (130) driving an interactive user interface for sharing diagrams presented on an image display at at least one user location (101) operatively connected to the application server (120) via one or more communication links (111A-C), the user interface enabling a user to perform a discovery involving data objects stored in the database (150) and to make changes to a subset of data in the discovery that are not visible to other users at other user locations (101), and to make changes made during the discovery visible to other users at other user locations (101),by publishing the changes in a shared data repository (160) of the database (150); and a memory storing logic elements for generating a redacted diagram and logic elements for publishing a redacted diagram executable by the one or more processors; wherein the database stores, at a first user location of the plurality of user locations, first diagram state data representing a pre-edited diagram (164) having nodes and edges, the pre-edited diagram representing results of a first user discovery including a plurality of data objects (154) and links (156) therebetween, the plurality of data objects (154) and the links (156) therebetween including a subset of data in a shared data repository in the database and associated with access control lists (158) that govern access to the data objects (154) and the links (156); where the logic to generate a redacted diagram is configured: to determine a common access control level by one of the following, namely (a), (b) or (c): (a) determining the common access control level from a template file provided by a user; (b) receiving a listing from a set of users to receive a result of determining the first user; determining, for each user in the listed set of users, a set of one or more access control groups to which the user belongs; and determining the common access control level by determining an intersection of the determined sets of one or more access control groups to which the majority of users belong; or (c) determining, for each user from a listed set of users, a set of one or more access control groups to which the user belongs; determining a first intersection from the determined sets of one or more access control groups to which the majority of users belong; and determining the common access control level by determining a second intersection between the first intersection and a set of one or more access control groups of a discovery authorization associated with the discovery of the first user; and for generating, based on the determined common access control level and the access control lists that govern access to the data objects and the links, second diagram status data representing a redacted diagram (161) in which one or more nodes or edges of the diagram (164) are redacted prior to redaction; wherein the one or more nodes or edges are created or edited during the determination of the first user; for receiving user input to switch a display between the first chart status data and the second chart status data, and causing a corresponding display to be presented; to receive an acknowledgment of the second chart status data or an instruction to further edit the second chart status data to prevent information leakage; to resolve conflicts in the access control information with the shared diagram repository due to the shared access level from the second diagram state data; to publish, after resolving, the second diagram status data to the shared diagram repository (160) of the database (150), while any redacted portion of the pre-redacted diagram remains visible only on the first user page; to retrieve third diagram status data at the first user site representing a redacted diagram stored in the shared diagram repository and published by a second user site of the plurality of user sites; to consolidate the first chart state data with the third chart state data to further identify the first user.

Images