Abstract: Example solutions for performing federated graph queries use schemas and include: generating a logical graph using a query input and generating a physical plan using a query planning schema for double-nested loops, the outer loop for each permutation of data stores in a set of data stores, and the inner loop for each data store—ceasing when the logical graph has been fully consumed. A query cost is determined for each of the permutations, and a physical plan is selected based on the query cost, for example minimizing the query cost, and the query is executed based on the selected physical plan. The cost may be determined based on a weighted combination of factors such as freshness of the data, latency, power consumption, environmental impact (e.g., carbon footprint), energy efficiency, and network burden.

Abstract: The technology described herein protects the privacy and security of data stored in a knowledge graph (“graph”) by enforcing visibility policies when returning property information in response to a query or other attempt to extract property information from the graph and/or about the graph. The visibility policies may be stored with the object and used to prevent restricted properties from being extracted from the object, let alone the graph. The object-specific visibility policy may be stored in the storage layer of the knowledge-graph object with the object properties and content. Some implementations may include multiple visibility records for a single object. Together the visibility records form the object visibility policy. An object visibility policy may have a single visibility record or multiple visibility records.

Abstract: Particular aspects of this disclosure relate to computerized systems for generating and using improved data structures and functionality to efficiently render different multiple access-controlled resources (or properties of access-controlled resources) that are part of a concept. Often times, two or more resources of a concept or properties of a resource are subject to different access controls. This adds computing complexity as to whether or not a user is granted access to the entire concept or resource, a portion of the concept or resource, or none of the concept or resources and what exactly is surfaced back to the user when there are resources or properties the user does and does not have access to. Some embodiments accordingly render an efficient composite view of concepts or resources where some resources or properties are accessible by the requesting user, while other resources or properties are not accessible by the requesting user.

Abstract: The disclosure herein describes processing data operation requests and performing associated operations on pages of a record data structure. A data operation is generated based on a received data operation request. The data operation request includes a bookkeeping page identifier. A bookkeeping page of the record index structure is identified based on the bookkeeping page identifier and an index page of the record index structure with a parameter of the data operation. If a timestamp in metadata of the identified index page matches a corresponding timestamp associated with the identified index page in metadata of the bookkeeping page, the data operation is performed on the identified index page. The disclosure enables the use and maintenance of large data indexes in data storage systems where data entries expire over time due to automatic temporal compaction processes.

Abstract: Example solutions are disclosed for performing a distributed data query for a connected data set, such as a property graph or a relational database, distributed across a plurality of regions (e.g., different geographic regions) under data flow limitations. For a restrictive limitation, a first region stores a data entity that is subject to a data flow limitation, and a second region stores only a reference to the data entity (e.g., a pseudonymous reference). The query is executed in the first region, and at least a partial representation of the state is injected into the query for execution in the second region. The query locates the reference to the data entity in the second region, and the state of the query from the second region is returned. Query results from the plurality of regions are synthesized into a final result. Further solutions address prohibitive limitations when references are not permitted.

Abstract: Techniques of reproduction of graph data during query time are disclosed herein. One example technique includes receiving, at a query processor, a query having a set of predicates to be evaluated on data in a graph. Upon receiving the query, the example technique includes evaluating the set of predicates based on data in the first or second partition of the graph and recording a sequence of query states of the first or second partition whose data is used to evaluate each of the set of predicates. Subsequently, the example technique includes constructing a set of snapshots of the data in the first or second partition based on the recorded query states and reevaluating the set of predicates on the constructed set of snapshots of the data in the first or second partition to troubleshoot the detected query error when the set of predicates were previously evaluated.

Abstract: Methods and systems are disclosed for optimizing record placement in defragmenting a graph database. Issues with fragmented data within a graph database are addressed on the record level by placing data that is frequently accessed together contiguously within memory. For example, a dynamic rule set may be developed based on dynamically analyzing access patterns of the graph database, policies, system characteristics and/or other heuristics. Based on statistics regarding normal query patterns, the systems and methods may identify an optimal position for certain types of edges that are often traversed with respect to particular types of nodes.

Abstract: Examples of the present disclosure describe systems and methods for query execution across multiple graphs. In an example, a graph or isolated collection may be split into multiple subparts, such that each subpart may store information of the isolated collection. Cross-collection reference resources may be used to reference resources that are stored by other isolated collection subparts. A breadth-first search of an isolated collection subpart may be performed in order to identify matches or potential matches in an isolated collection subpart. In an example, a potential match may comprise a cross-collection reference resource, which may reference a resource in another isolated collection subpart. Once query execution has completed in the isolated collection subpart, query execution may be paused and transferred to another isolated collection subpart that comprises a resource referenced by a cross-collection resource reference.

Abstract: The present disclosure relates to systems, methods, and computer-readable media for utilizing a content access authorization system to determine user access control efficiently and flexibly for digital documents that are stored in different geographic regions. For instance, the content access authorization system can convert sensitive user information for digital documents stored in a first geographic region into a probabilistic data structure that does not include user information and share the probabilistic data structure with a second geographic region. The content access authorization system can then utilize the probabilistic data structure to efficiently pre-filter user document access control for digital documents requested by a user in the second geographic region that are stored in the first geographic region, which significantly saves on latency and computing resource usage by reducing the number of document control access queries needed to be made to the first geographic region.

Abstract: Example solutions balance traversals and precomputations for connected data sets subject to access control. When a request for a commutative operation on a connected data set is received, a downwardly recursive process starts with the current hierarchy tier set to a highest hierarchy tier of the request. The process traverses the current hierarchy tier laterally. At each discovered node in the current hierarchy tier, a determination is made whether the requested operation is permitted to include a discovered node. If not, that node and any nodes hierarchically below it are omitted from the operation. That node and its subtree are skipped and the recursion halts for that branch. If, however, the requested operation is permitted to include the node, it is incorporated into the cumulative result and the recursion continues while there remains a lower hierarchy tier. Some examples leverage precomputed aggregates to avoid traversing branches having aggregates.

Abstract: Example solutions are disclosed for performing a distributed data query for a connected data set, such as a property graph or a relational database, distributed across a plurality of regions (e.g., different geographic regions) under data flow limitations. For a restrictive limitation, a first region stores a data entity that is subject to a data flow limitation, and a second region stores only a reference to the data entity (e.g., a pseudonymous reference). The query is executed in the first region, and at least a partial representation of the state is injected into the query for execution in the second region. The query locates the reference to the data entity in the second region, and the state of the query from the second region is returned. Query results from the plurality of regions are synthesized into a final result. Further solutions address prohibitive limitations when references are not permitted.

Abstract: Example solutions for executing a query in a declarative graph query language include receiving the query for data in a database and determining if one or both of i) a pattern in the query, and ii) the data in the database render the query suitable for being executed, at least in part, in parallel. If either condition indicates that the query is suitable for being executed, at least in part, in parallel, one or more fork operations and join operations are injected into a query plan, and the query is executed according to the query plan. Some examples further determine whether executing the query in parallel is computing resource-efficient, and only executes computing resource-efficient queries in parallel.

Abstract: Techniques of federation of data during query time are disclosed herein. One example technique includes upon receiving an indication of interaction of a file by a user of a tenant, determining whether automatic replication of the file to a user shard corresponding to the user is permitted according to a company policy or a legal requirement, the user shard being in a second geographic region. The example technique can then include when automatic replication of the file is not permitted, storing the file in a tenant shard corresponding to the tenant in a network storage in the first geographic region and instead of replicating the file to the user shard in the second geographic region, creating, in the user shard in the second geographic region, a file reference that is a pointer to the file stored in the tenant shard in the network storage in the first geographic region.

Abstract: The disclosure herein describes processing data operation requests and performing associated operations on pages of a record data structure. A data operation is generated based on a received data operation request. The data operation request includes a bookkeeping page identifier. A bookkeeping page of the record index structure is identified based on the bookkeeping page identifier and an index page of the record index structure with a parameter of the data operation. If a timestamp in metadata of the identified index page matches a corresponding timestamp associated with the identified index page in metadata of the bookkeeping page, the data operation is performed on the identified index page. The disclosure enables the use and maintenance of large data indexes in data storage systems where data entries expire over time due to automatic temporal compaction processes.

Abstract: Controlling access to nodes in a relational graph at query time by using an approximate membership query (AMQ) filter and ordered queries based on historic grants or denials of access according to security context enables a more efficient querying of the relational graph while preserving access controls. Security contexts that grant or deny access to a node are stored in an associated AMQ filter and are queried according to the subject's security context in an order based on the frequency at which the security contexts have previously granted or denied access to nodes in the relational graph.

Abstract: Techniques of reproduction of graph data during query time are disclosed herein. One example technique includes receiving, at a query processor, a query having a set of predicates to be evaluated on data in a graph. Upon receiving the query, the example technique includes evaluating the set of predicates based on data in the first or second partition of the graph and recording a sequence of query states of the first or second partition whose data is used to evaluate each of the set of predicates. Subsequently, the example technique includes constructing a set of snapshots of the data in the first or second partition based on the recorded query states and reevaluating the set of predicates on the constructed set of snapshots of the data in the first or second partition to troubleshoot the detected query error when the set of predicates were previously evaluated.

Abstract: Techniques of federation of data during query time are disclosed herein. One example technique includes upon receiving an indication of interaction of a file by a user of a tenant, determining whether automatic replication of the file to a user shard corresponding to the user is permitted according to a company policy or a legal requirement, the user shard being in a second geographic region. The example technique can then include when automatic replication of the file is not permitted, storing the file in a tenant shard corresponding to the tenant in a network storage in the first geographic region and instead of replicating the file to the user shard in the second geographic region, creating, in the user shard in the second geographic region, a file reference that is a pointer to the file stored in the tenant shard in the network storage in the first geographic region.

Abstract: Examples of the present disclosure describe systems and methods for determining authoritative documents based on implicit interlinking and communication signals. In aspects, a search operation may be initiated from one or more applications or services. The search operation may be processed to identify search information, such as one or more content items, content topics, or entities. The identified search information may be used to search one or more data sources for implicit relationships between the search information and content items and/or entities stored by the data sources. The results of the search may be collected and ranked according to one or more criteria. The ranked results may be provided in response to the search operation.

Abstract: A method comprising: storing, in a database, a list of geographical regions in which the party consents to their data being stored; receiving a request to store data of the party, wherein at least one of the data has a region-restriction that restricts the regions in which that data can be stored; determining, based on a respective region-restriction of a respective one of the data, in which of the list of regions the respective data can be stored; storing the data, wherein each respective data is stored in at least one respective storage centre associated with one of the regions according to the determination; storing, in the database, a list comprising a pointer to each respective stored data, wherein the pointer identifies the respective storage centre; receiving a request to retrieve a respective stored data; and using the pointer to route the request to the respective storage centre.

Abstract: In one aspect, a data item is written to a data chunk of a stream segment. The stream segment includes a stream segment header and a plurality of data chunks. A first identifier of the data item is written to the stream segment header of the stream segment. A second identifier of the data item is written to a header of the data chunk of the stream segment. In another aspect, a stream segment header of a stream segment is queried with a query identifier. The querying identifies if any of the data items in the data chunks of the stream segment have the query identifier. If any of the data items in the data chunks of the stream segment have the query identifier, the data chunks of the stream segment are queried with the query identifier to identify which data chunks of the stream segment have the query identifier.