Hosted application gateway architecture with multi-level security policy and rule promulgations

• US 10,268,835 B2
• Filed: 07/18/2017
• Issued: 04/23/2019
• Est. Priority Date: 09/20/2013
• Status: Active Grant

• Current Assignee: Ip Ot Sub Ulc
• Original Assignee: Open Text Sa Ulc (Open Text Corporation)
• Inventors: Beckman, Gregory, Laird, Robert, Obbard, Geoffrey Michael
• Primary Examiner(s): Shaifer Harriman, Dant B
• Application Number:
  US15/653,017
• Publication Number:
  US 20170316224A1
• Time in Patent Office: 644 Days
• Field of Search: 707781
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/16 Program or content traceability, e.g. by watermarking
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: G06F 3/04817 using icons graphical or visual programming using iconic symbols G06F8/34
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/565 Conversion or adaptation of application format or content adding application control or application functional data H04L67/561
• CPC Class Codes: H04L 67/5683 Storage of data provided by user terminals, i.e. reverse caching
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A hosted application gateway server node may be communicatively coupled to backend systems, client devices, and database shards associated with database servers. Through the gateway server node, various services may be provided to managed containers running on client devices such that enterprise applications can be centrally managed. A sharding manager may manage relationships of database items across database shards. Each shard stores a copy of a table representing a split of a relationship. A shard ID mask is included in each item'"'"'s ID. At query time, the shard ID can be extracted and used to query the correct database. This query routing mechanism allows navigation from one shard to another when multiple items are in a relationship (e.g., share the same resource such as a document). As such, embodiments can eliminate the need for APIs to join in data that span multiple shards.

Claims

1. A database system, comprising:

a plurality of database shards operating on a plurality of database servers, each database shard of the plurality of database shards is tagged with a shard identifier on initialization, wherein the shard identifier is unique across the plurality of database shards;

a sharding manager embodied on a non-transitory computer memory including instructions executable by a processor to generate a relationship for database items across at least two of the database shards, wherein generating the relationship includes the sharding manager;

storing a first data structure representing a first split of the relationship in a first shard, the first data structure referencing a second database item in a second shard and keyed to a first database item in the first shard, the first database item having a first object identifier encoded with the shard identifier of the first shard; and

storing a second data structure representing a second split of the relationship in a second shard, the second data structure referencing the first database item in the first shard and keyed to the second database item in the second shard, the second database item having a second object identifier encoded with the shard identifier of the second shard, the second object identifier generated by the second shard independently of the first object identifier generated by the first shard;

wherein the sharding manager is included in a gateway server node or is in communication with the gateway server node;

wherein the sharding manager is communicatively connected to the plurality of database shards through an application programming interface; and

wherein the second database item in the second shard is accessible through the application programming interface using the first data structure keyed to the first database item in the first shard.

2. The system of claim 1, wherein the first database item in the first shard is accessible through the application programming interface using the second data structure keyed to the second database item in the second shard.

3. The system of claim 1, wherein the first database item in the first shard comprises a user item associated with a first user and wherein the second database item in the second shard comprises a document item associated with a second user.

4. The system of claim 1, wherein the sharding manager is further operable to perform a share operation in which a share relationship among three database items is split into three parts, each part associated with a shard storing one of the three database items in the share relationship.

5. The system of claim 4, wherein the three parts of the share relationship includes a first part in which a shared-by identifier is a foreign key in a first table, a second part in which a shared-to identifier is a foreign key in a second table, and a third part in which a share-resource identifier is a foreign key in a third table, wherein the first table, the second table, and the third tables are stored in different shards.

6. The system of claim 1, wherein the gateway server node implements a web application framework for Representational State Transfer (REST) web services configured for communicating with managed containers operating on client devices.

7. The system of claim 6, wherein the plurality of database shards operating on the plurality of database servers is accessible by the client devices as a single database through the gateway server node.

8. A method, comprising:

operating a plurality of database shards on a plurality of database servers, each database shard of the plurality of database shards is tagged with a shard identifier on initialization, wherein the shard identifier is unique across the plurality of database shards; and

generating a relationship for database items across at least two of the database shards, the generating performed by a sharding manager embodied on a non-transitory computer memory, the generating including;

storing a first data structure representing a first split of the relationship in a first shard, the first data structure referencing a second database item in a second shard and keyed to a first database item in the first shard, the first database item having a first object identifier encoded with the shard identifier of the first shard; and

storing a second data structure representing a second split of the relationship in a second shard, the second data structure referencing the first database item in the first shard and keyed to the second database item in the second shard, the second database item having a second object identifier encoded with the shard identifier of the second shard, the second object identifier generated by the second shard independently of the first object identifier generated by the first shard;

wherein the sharding manager is included in a gateway server node or is in communication with the gateway server node;

wherein the sharding manager is communicatively connected to the plurality of database shards through an application programming interface; and

wherein the second database item in the second shard is accessible through the application programming interface using the first data structure keyed to the first database item in the first shard.

9. The method according to claim 8, wherein the first database item in the first shard is accessible through the application programming interface using the second data structure keyed to the second database item in the second shard.

10. The method according to claim 8, wherein the first database item in the first shard comprises a user item associated with a first user and wherein the second database item in the second shard comprises a document item associated with a second user.

11. The method according to claim 8, wherein the sharding manager is further operable to perform a share operation in which a share relationship among three database items is split into three parts, each part associated with a shard storing one of the three database items in the share relationship.

12. The method according to claim 11, wherein the three parts of the share relationship includes a first part in which a shared-by identifier is a foreign key in a first table, a second part in which a shared-to identifier is a foreign key in a second table, and a third part in which a share-resource identifier is a foreign key in a third table, wherein the first table, the second table, and the third tables are stored in different shards.

13. The method according to claim 8, wherein the gateway server node implements a web application framework for Representational State Transfer (REST) web services configured for communicating with managed containers operating on client devices.

14. The method according to claim 8, wherein the plurality of database shards operating on the plurality of database servers is accessible by the client devices as a single database through the gateway server node.

15. A computer program product comprising a non-transitory computer-readable medium storing instructions translatable by a processor for implementing a sharding manager communicatively connected to a plurality of database shards through an application programming interface, the plurality of database shards operating on a plurality of database servers, each database shard of the plurality of database shards is tagged with a shard identifier on initialization, wherein the shard identifier is unique across the plurality of database shards, the instructions when translated by the processor performing:

generating a relationship for database items across at least two of the database shards, the generating including;

storing a first data structure representing a first split of the relationship in a first shard, the first data structure referencing a second database item in a second shard and keyed to a first database item in the first shard, the first database item having a first object identifier encoded with the shard identifier of the first shard; and

storing a second data structure representing a second split of the relationship in a second shard, the second data structure referencing the first database item in the first shard and keyed to the second database item in the second shard, the second database item having a second object identifier encoded with the shard identifier of the second shard, the second object identifier generated by the second shard independently of the first object identifier generated by the first shard;

wherein the second database item in the second shard is accessible through the application programming interface using the first data structure keyed to the first database item in the first shard.

16. The computer program product of claim 15, wherein the first database item in the first shard is accessible through the application programming interface using the second data structure keyed to the second database item in the second shard.

17. The computer program product of claim 15, wherein the first database item in the first shard comprises a user item associated with a first user and wherein the second database item in the second shard comprises a document item associated with a second user.

18. The computer program product of claim 15, wherein the sharding manager is further operable to perform a share operation in which a share relationship among three database items is split into three parts, each part associated with a shard storing one of the three database items in the share relationship.

19. The computer program product of claim 18, wherein the three parts of the share relationship includes a first part in which a shared-by identifier is a foreign key in a first table, a second part in which a shared-to identifier is a foreign key in a second table, and a third part in which a share-resource identifier is a foreign key in a third table, wherein the first table, the second table, and the third tables are stored in different shards.

20. The computer program product of claim 15, wherein the plurality of database shards operating on the plurality of database servers is accessible as a single database through the application programming interface.