Abstract: Database query analysis technology, in which an input query is received that relates to multiple attribute classes of data records. An index that is descriptive of the data records in data storage is accessed and relative positions in the accessed index for the multiple attribute classes are identified. The accessed index is processed based on more than one of the multiple attribute classes and the identified relative positions, and the processed index is used to identify groups of data records that are included in the data records in the data storage and that share common values for the multiple attribute classes in the input query. Metrics corresponding to the data records included in each of the identified groups of data records are accessed, computations are performed on the accessed metrics, and a report is generated that reflects results of the computations.

Abstract: The subject matter described in this specification includes a computer-readable medium storing instructions that cause one or more processors to perform various operations including receiving, from a first client device associated with a user account of a first user, a request for sharing a key. The key is associated with the user account of the first user, and permits access to a resource. The operations include generating, at a server, one or more representations of the key, transmitting the representations of the key to the first client device, and receiving, from a second client device associated with a user account of a second user, a request to access the key. The request to access the key is derived from one of the one or more representations of the key. The operations further include communicating, to the second client device, a message indicating whether access to the key has been granted.

Abstract: Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for electronic credential and analytics integrations are described. In one aspect, a method includes the actions of receiving, by a restricted access system and from a client device, a request for access to the restricted access system for a user. The actions further include transmitting a request to authenticate the user. The actions further include receiving, by the restricted access system and from the credential management system, challenge data. The actions further include transmitting the challenge data. The actions further include receiving a token indicating that the credential management system authenticated the user based on the user interacting with a representation of the challenge data that was provided to the client device. The actions further include in response to receiving the token, opening a session between the client device and the restricted access system.

Abstract: Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for optimization of memory analytics are disclosed. In one aspect, a method includes receiving, by a data storage system, a request to generate a visualization of a portion of data stored in the data storage system. The method includes providing, for display, the visualization of the portion of the data. The method includes accessing historical data that includes data indicating actions performed on previously displayed visualizations and corresponding portions of the data. The method includes generating an action to perform on the visualization and the portion of the data. The method further includes performing, in background, the generated action on the visualization and the portion of the data and suppressing results of the generated action. The method includes receiving a user specified action to perform on the visualization and the portion of the data.

Abstract: In some implementations, data specifying (i) identification information, (ii) a beacon identifier associated with a wireless proximity beacon, and (iii) a proximity of a client device to the wireless proximity beacon is received. A path of movement is determined based on the received data. Data specifying a pattern of movement that is associated with an action is accessed. The path of movement of the client device is determined to satisfy a particular pattern of movement associated with a particular action. An application instance operating on the client device is authorized to perform the particular action based at least on determining that the path of movement of the client device satisfies the particular pattern of movement associated with the particular action. Data enabling the application instance operating on the client device to perform the particular action is transmitted.

Abstract: A credential management system is described. The credential management system allows a user to identify peers and obtain additional information regarding the peers through the credential management system. The credential management system may perform user analytics and provide the requested additional information to the user. The credential management system may associate the discovered peers with a group or credential, and share information and data with one or more of the discovered peers associated with a particular group or credential in a convenient manner. The credential management system may also implement a hierarchical menu and/or conditions to determine which users of the credential management system may be able to view other users' information and to determine a type of information or data that is transmitted between users.

Abstract: Search integration is described. The actions include receiving, by one or more processors, a query. The actions include identifying search results that are responsive to the query. The actions include identifying, based on the query and the search results, structured data to supplement the search results, wherein the structured data is generated from binary table data that is received and deserialized by one or more processing modules. The actions include processing the structured data and the search results. The actions include providing, for output, the processed search results and the processed structured data results.

Abstract: Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for receiving an enrollment biometric identifier of a user. Determining a matching threshold based on a characteristic of the enrollment biometric identifier of the user. Storing the matching threshold in an enrollment profile for the use in association with the enrollment biometric identifier.

Abstract: Systems, methods, and apparatus, including computer-readable storage media storing executable instructions, for providing dynamic identity profiles are described. A dynamic user identity may be generated and updated in real time according to a user's interactions, interests, and various other suitable parameters. Contextual information, geo-fencing, beacon transmissions, and various other features may be used to acquire information that is included in the dynamic user identity and to provide more effective and intelligent interactions of the user with other devices based on the dynamic user identity.

Abstract: In one implementation, a computer system maintains one or more permissions associated with a credential held by a first user, where at least one of the one or more of permissions is delegatable by the first user to one or more other users. The computer system receives an indication that the first user has chosen to delegate a particular permission from amongst the one or more permissions to a second user, wherein the particular permission is needed to perform a particular type of action. Based on the first user indicating a choice to delegate the particular permission to the second user, the computer system associates the delegation of the particular permission with the second user. Based on delegating the particular permission with the second user, the computer system enables the second user to perform the particular type of action.

Abstract: Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for proximity-based device access. In some implementations, a first electronic device receives, over a wireless communication link, a message from a second electronic device in proximity to the first electronic device. The first electronic device determines that the second electronic device has been previously associated with the first electronic device as an authentication factor for accessing the first electronic device. The first electronic device receives an encrypted form of a password from the second electronic device over the wireless communication link. The first electronic device determines the password from the encrypted form of the password and provides the password to software executing on the first electronic device to enable access to the first electronic device.

Abstract: A system extracts data from one or more sources of data and displays information regarding the data using interactive visualizations that allow a user to interact directly with the visualizations of the data, without necessarily requiring the user to utilize a menu-driven interface.

Abstract: A method including actions of pairing with a mobile device and receiving a user name, a password encrypted with a connector password key, and a public key of the mobile device. Additional actions include providing the password encrypted with the connector password key, receiving the password in a decrypted form, obtaining a pairing key, encrypting the pairing key using the public key, encrypting the password with a local password key, providing the pairing key encrypted using the public key and the password encrypted with the local password key, disconnecting from the mobile device, after disconnecting form the mobile device, reconnecting with mobile device, providing a workstation identification, receiving the user name and the password encrypted with the local password key, decrypting the password encrypted with the local password key, and logging in the user using the user name and the password decrypted with the local password key.

Abstract: In one implementation, a server receives a request from a client device to access a user account, wherein the user account provides access to one or more credentials associated with the user. The server determines that the client device is not associated with the user account and prompts the user to provide a biometric identification of the user. The server then receives data representing the biometric identification of the user from the client device. The server determines that the data representing the biometric identification of the user matches a biometric profile of the user associated with the user account. In response to the determination, the server associates the client device with the user account, such that the user is enabled to access the user account, and the associated one or more credentials, from the client device.

Abstract: Method, systems, and computer-readable media for receiving, from an application instance operating on a client device, healthcare information that indicates a client device identifier, a wireless proximity beacon identifier, and a proximity of the identified client device to the identified wireless proximity beacon. From the received healthcare information, a determination is made whether the proximity of the identified client device to the identified wireless proximity beacon satisfies a threshold proximity. Based at least on the determination, an action is determined that the application instance operating on the identified client device is permitted to perform while the proximity of the identified client device to the identified wireless proximity beacon satisfies the threshold proximity. Healthcare information is transmitted to the identified client device that enables the application instance operating on the identified client device to perform the action.

Abstract: In one implementation, requirement client device receives an indication of a transaction. The client device determines risk profile information and a credential for the transaction. The risk profile information describes a location of the client device, a time associated with the transaction, and a transaction provider to complete the transaction Finally, the client device prompts for biometric input based on the location of the client device, the time associated with the transaction, the transaction provider to complete the transaction, and the credential.

Abstract: In one implementation, a processing system receives a request from a user to output a representation for a credential at a client device, the credential being associated with the user. In response to receiving the request from the user to output the representation for the credential, the processing system accesses data identifying one or more conditions associated with the credential. The processing system then determines that at least one of the one or more conditions associated with the credential is not satisfied. And then, in response to determining that the at least one of the one or more conditions associated with the credential is not satisfied, the processing system denies the request from the user to output the representation for the credential at the client device.

Abstract: Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for memory analytics are disclosed. In one aspect, a method includes receiving input that requests a particular number of data items that are highest ranking in the data storage system based on a characteristic. The method includes accessing sets of data items to use in satisfying the request by selecting, from each of the independent data partitions, a set of data items that includes less than the particular number of data items that are highest ranking in the respective independent data partition based on the characteristic. The method includes comparing the sets of data items accessed from the plurality of independent data partitions. The method includes selecting the particular number of data items that are ranked highest based on the characteristic. The method includes providing, for output, the selected particular number of data items.

Abstract: A biometric identifier is received, from a first credential granting authority, is associated with a user and was collected by the first credential granting authority. The biometric identifier is stored in association with the user and the first credential granting authority. Trust data is accessed and enables determination of whether a second credential granting authority trusts biometric identifiers collected by the first credential granting authority. It is determined that the second credential granting authority trusts biometric identifiers collected by the first credential granting authority based on the accessed trust data. Based on the determination that the second credential granting authority trusts biometric identifiers collected by the first credential granting authority, biometric identification of the user using the biometric identifier collected by the first credential granting authority is performed for the second credential granting authority.

Abstract: Data engine integration and data refinement are described. The actions include receiving, by an in-memory engine, a request for data. The actions include transmitting, by the in-memory engine and to a metadata storage unit, data that is associated with the request. The actions include receiving metadata. The actions include determining a first amount of processing to be performed by the in-memory engine and a second amount of processing to be performed by a data engine. The actions include transmitting a request (i) for a first portion of unprocessed data and (ii) to perform a second amount of processing on a second portion of unprocessed data. The actions include receiving the first portion of unprocessed data and the second portion of processed data. The actions include processing the first portion of unprocessed data. The actions include, providing the first portion of processed data and the second portion of processed data.