Abstract: The present disclosure relates to systems, methods, and computer-readable media for utilizing a content access authorization system to determine user access control efficiently and flexibly for digital documents that are stored in different geographic regions. For instance, the content access authorization system can convert sensitive user information for digital documents stored in a first geographic region into a probabilistic data structure that does not include user information and share the probabilistic data structure with a second geographic region. The content access authorization system can then utilize the probabilistic data structure to efficiently pre-filter user document access control for digital documents requested by a user in the second geographic region that are stored in the first geographic region, which significantly saves on latency and computing resource usage by reducing the number of document control access queries needed to be made to the first geographic region.

Abstract: Techniques of federation of data during query time are disclosed herein. One example technique includes upon receiving an indication of interaction of a file by a user of a tenant, determining whether automatic replication of the file to a user shard corresponding to the user is permitted according to a company policy or a legal requirement, the user shard being in a second geographic region. The example technique can then include when automatic replication of the file is not permitted, storing the file in a tenant shard corresponding to the tenant in a network storage in the first geographic region and instead of replicating the file to the user shard in the second geographic region, creating, in the user shard in the second geographic region, a file reference that is a pointer to the file stored in the tenant shard in the network storage in the first geographic region.

Abstract: A method comprising: storing, in a database, a list of geographical regions in which the party consents to their data being stored; receiving a request to store data of the party, wherein at least one of the data has a region-restriction that restricts the regions in which that data can be stored; determining, based on a respective region-restriction of a respective one of the data, in which of the list of regions the respective data can be stored; storing the data, wherein each respective data is stored in at least one respective storage centre associated with one of the regions according to the determination; storing, in the database, a list comprising a pointer to each respective stored data, wherein the pointer identifies the respective storage centre; receiving a request to retrieve a respective stored data; and using the pointer to route the request to the respective storage centre.

Abstract: In one aspect, a data item is written to a data chunk of a stream segment. The stream segment includes a stream segment header and a plurality of data chunks. A first identifier of the data item is written to the stream segment header of the stream segment. A second identifier of the data item is written to a header of the data chunk of the stream segment. In another aspect, a stream segment header of a stream segment is queried with a query identifier. The querying identifies if any of the data items in the data chunks of the stream segment have the query identifier. If any of the data items in the data chunks of the stream segment have the query identifier, the data chunks of the stream segment are queried with the query identifier to identify which data chunks of the stream segment have the query identifier.

Abstract: Particular aspects of this disclosure relate to computerized systems for generating and using improved data structures and functionality to efficiently render different multiple access-controlled resources (or properties of access-controlled resources) that are part of a concept. Often times, two or more resources of a concept or properties of a resource are subject to different access controls. This adds computing complexity as to whether or not a user is granted access to the entire concept or resource, a portion of the concept or resource, or none of the concept or resources and what exactly is surfaced back to the user when there are resources or properties the user does and does not have access to. Some embodiments accordingly render an efficient composite view of concepts or resources where some resources or properties are accessible by the requesting user, while other resources or properties are not accessible by the requesting user.

Abstract: Examples described herein generally relate to a computer system for generating a knowledge graph storing a plurality of entities and to displaying a topic page for an entity in the knowledge graph. The computer system performs a mining of source documents within an enterprise intranet to determine a plurality of entity names. The computer system generates an entity record within the knowledge graph for a mined entity name based on an entity schema and the source documents. The entity record includes attributes aggregated from the source documents. The computer system receives a curation action on the entity record from a first user. The computer system updates the entity record based on the curation action. The computer system displays an entity page including at least a portion of the attributes to a second user based on permissions of the second user to view the source documents.

Abstract: A method comprising: storing, in a database, a list of geographical regions in which the party consents to their data being stored; receiving a request to store data of the party, wherein at least one of the data has a region-restriction that restricts the regions in which that data can be stored; determining, based on a respective region-restriction of a respective one of the data, in which of the list of regions the respective data can be stored; storing the data, wherein each respective data is stored in at least one respective storage centre associated with one of the regions according to the determination; storing, in the database, a list comprising a pointer to each respective stored data, wherein the pointer identifies the respective storage centre; receiving a request to retrieve a respective stored data; and using the pointer to route the request to the respective storage centre.

Abstract: Techniques of property grouping for change detection in distributed storage systems are disclosed herein. In one embodiment, a method includes grouping multiple properties of a document into multiple groups individually including a subset of the multiple properties. For each of the multiple groups, a hash value of the group is generated based on values of the subset of properties in the group. The method further includes determining whether the generated hash value of the group is different than that of a corresponding group in a previous version of the document in the distributed storage system. In response to determining that generated hash value of the group is not different than that of the corresponding group in the previous version, metadata is inserted into the new version of the document indicating that none of the subset of properties in the group has changed.

Abstract: Techniques of dynamic hash function composition for change detection in distributed storage systems are disclosed herein. In one embodiment, a method includes dynamically selecting a hash function for a property of a new version of the document and generating a hash value of the value of the property using the selected hash function. The method can then include determining whether the generated hash value of the property of the received new version is different than that of a previous version of the document in the distributed storage system. In response to determining that the generated hash value is different than that of the previous version of the document, a notification can be transmitted to one or more computing services previously registered to receive a notification regarding a change in the property without transmitting the notification to other computing services not registered to receive the notification.

Abstract: Techniques of granular change detection in distributed storage system are disclosed herein. In one embodiment, a method includes receiving a subset of data representing a new version of a document with multiple properties. The subset of data includes hash values corresponding to the properties of the document. The method further includes for each of the properties, performing a comparison of the hash values in the new version to that of the properties in a previous version of the document. Based on the performed comparison, whether the property has changed in the new version of the document is determined. The method can then include, transmitting a notification to one or more computing services previously registered to receive a notification regarding a change in the identified one of the properties without transmitting the notification to other computing services not registered to receive the notification.

Abstract: A method comprising: storing, in a database, a list of geographical regions in which the party consents to their data being stored; receiving a request to store data of the party, wherein at least one of the data has a region-restriction that restricts the regions in which that data can be stored; determining, based on a respective region-restriction of a respective one of the data, in which of the list of regions the respective data can be stored; storing the data, wherein each respective data is stored in at least one respective storage centre associated with one of the regions according to the determination; storing, in the database, a list comprising a pointer to each respective stored data, wherein the pointer identifies the respective storage centre; receiving a request to retrieve a respective stored data; and using the pointer to route the request to the respective storage centre.

Abstract: In one aspect, a data item is written to a data chunk of a stream segment. The stream segment includes a stream segment header and a plurality of data chunks. A first identifier of the data item is written to the stream segment header of the stream segment. A second identifier of the data item is written to a header of the data chunk of the stream segment. In another aspect, a stream segment header of a stream segment is queried with a query identifier. The querying identifies if any of the data items in the data chunks of the stream segment have the query identifier. If any of the data items in the data chunks of the stream segment have the query identifier, the data chunks of the stream segment are queried with the query identifier to identify which data chunks of the stream segment have the query identifier.