Synchronization of access permissions in a database network

• US 20070220062A1
• Filed: 03/17/2006
• Published: 09/20/2007
• Est. Priority Date: 03/17/2006
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Carberry, Martin, Miranda-Portillo, Juan
• Granted Patent: US 7,769,715 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/273 Asynchronous replication or reconciliation
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/6236 between heterogeneous systems

Abstract

A system, method, and computer program product is disclosed for synchronizing access permissions across at least two disparate database systems. The invention includes a source database system coupled to a destination database system, wherein the databases have distinct access control mechanisms. At least one self-contained synchronization rule for synchronizing access permissions from the source database system to the destination database system is distributed to two or more processing engines. At least one processing rule is retrieved for at least one of the two or more processing engines based upon the self contained synchronization rule being distributed thereto. The invention also includes applying the at least one processing rule to at least one record in the at least one destination database system, thereby altering an access control mechanism associated with the at least one record.

Claims

1. A method for synchronizing access permissions across at least two disparate database systems, the method comprising:

coupling a source database system with at least one destination database system, wherein the source database system and the destination database system have distinct access control mechanisms associated therewith;

distributing at least one self-contained synchronization rule for synchronizing access permissions from the source database system to the destination database system to two or more processing engines;

retrieving at least one processing rule for at least one of the processing engines based upon the self-contained synchronization rule being distributed thereto; and

applying the at least one processing rule to at least one record in the destination database system, thereby altering an access control mechanism associated with the record.

2. The method according to claim 1, the method further comprising:

receiving at least one event from the source database system prior to the step of distributing the self-contained synchronization rule to the processing engines; and

determining how the self-contained synchronization rule is to be distributed to the processing engines based at least in part on the event received from the source database system.

3. The method according to claim 2, wherein the event is at least one of:

a user deactivation;

a user activation;

a user group deactivation;

a user group activation;

a modified security descriptor;

a modified security level; and

a modified custodian.

4. The method according to claim 2, wherein the at least one event is received asynchronously.

5. The method according to claim 1, the method further comprising:

distributing the self-contained synchronization rule to the processing engines in conformance with at least one of a predefined schedule and a predefined mapping rule.

6. The method according to claim 5, wherein the predefined schedule is based on errors received while previously applying at least one processing rule to at least one record in the at least one destination database system.

7. The method according to claim 1, wherein the self-contained synchronization rule is distributed based upon an amount of records to be synchronized.

8. The method according to claim 1, the method further comprising:

distributing at least one self-contained synchronization rule to each of at least two processing engines wherein the at least two processing engines are each on a different processing node in a network and the distributing is in response to one of the processing nodes in the network having insufficient resources.

9. The method according to claim 1, wherein

the source database system is a records management system;

and

the destination database system is a content management system.

10. A synchronization system for synchronizing access permissions across at least two disparate database systems, the synchronization system comprising:

a source database system having a first set of records with an access control mechanism for each record;

a destination database system communicatively coupled to the source database system, the destination database system having a second set of records with an access control mechanism for each record that differs from the control mechanism of the first set of records;

a work order dispatcher that distributes at least one self-contained synchronization rule for synchronizing access permissions from the source database system to the destination database system; and

at least two processing engines, wherein at least one of the processing engines receives the at least one self-contained synchronization rule and retrieves at least one self-contained processing rule based upon the self-contained synchronization rule, and applies the self-contained processing rule to at least one record in the destination database system, thereby altering the access control mechanism associated with the record.

11. The synchronization system according to claim 10, further comprising:

an event processor that receives at least one event from the source database system and communicates the event to the work order dispatcher asynchronously.

12. The synchronization system according to claim 10, further comprising:

a scheduler for controlling when the self-contained synchronization rule is distributed to the processing engines.

13. A computer program product for synchronizing access permissions across at least two disparate database systems, the computer program product comprising:

a storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising;

coupling a source database system with at least one destination database system, wherein the source database system and the destination database system have distinct access control mechanisms associated therewith;

distributing at least one self-contained synchronization rule for synchronizing access permissions from the source database system to the destination database system to two or more processing engines;

retrieving at least one processing rule for at least one of the processing engines based upon the self-contained synchronization rule being distributed thereto; and

applying the processing rule to at least one record in the destination database system, thereby altering an access control mechanism associated with the record.

14. The computer program product according to claim 13, the computer program product further comprising instructions for:

receiving at least one event from the source database system prior to the step of distributing the self-contained synchronization rule to the processing engines; and

determining how the self-contained synchronization rule is to be distributed to the processing engines based at least in part on the event received from the source database system.

15. The computer program product according to claim 14, wherein the event is at least one of:

a user deactivation;

a user activation;

a user group deactivation;

a user group activation;

a modified security descriptor;

a modified security level; and

a modified custodian.

16. The computer program product according to claim 14, wherein the event is received asynchronously.

17. The computer program product according to claim 13, the computer program product further comprising instructions for:

distributing the self-contained synchronization rule to the processing engines in conformance with at least one of a predefined schedule and a predefined mapping rule.

18. The computer program product according to claim 17, wherein the predefined schedule is based on errors received while previously applying at least one processing rule to at least one record in the destination database system.

19. The computer program product according to claim 13, wherein the self-contained synchronization rule is distributed based upon an amount of records to be synchronized.

20. The computer program product according to claim 13, the computer program product further comprising instructions for:

distributing at least one self-contained synchronization rule to each of at least two processing engines wherein the processing engines are each on a different processing node in a network and the distributing is in response to one of the processing nodes in the network having insufficient resources.