Feature based data management

• US 7,921,089 B2
• Filed: 07/24/2008
• Issued: 04/05/2011
• Est. Priority Date: 07/24/2008
• Status: Active Grant

• Current Assignee: Zscaler Incorporated
• Original Assignee: Zscaler Incorporated
• Inventors: Regoti, Lakshmaiah, Ganapathy, Hariharan, Kailash, Kailash
• Primary Examiner(s): Corrielus; Jean M
• Application Number:
  US12/178,783
• Publication Number:
  US 20100023519A1
• Time in Patent Office: 985 Days
• Field of Search: 707/770, 707/662, 707/663, 707/694, 707/704, 707/783, 707/784, 707/786, 709/229, 726/1, 726/3, 726/5
• US Class Current: 707/694
• CPC Class Codes: G06F 9/466 Transaction processing
• CPC Class Codes: G06F 9/52 Program synchronisation; Mutual exclusion, e.g. by means of semaphores
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

Methods, systems, and apparatus, including computer program products, for data structure locking. In one aspect, a proper subset of variables of a set of variables in a data structure are received. An access privilege to modify variables in the data structure to administrator accounts is assigned. A first administrator access request to modify a variable in the proper subset of variables is received, and the access privilege to modify the variable in the proper subset of variables for the first administrator account. A second administrator access request to modify the variable in the proper subset of variables is received, and an access timer that expires after a time period is initiated; the access privilege is disabled for the first administrator account in response to expiration of the access timer; and the access privilege for the second administrator account is enabled in response to expiration of the access timer.

Claims

1. A computer-implemented method, comprising:

identifying a proper subset of variables of a set of variables in a data structure, wherein the set of variables are associated according to a lock hierarchy comprising a plurality of nodes, and wherein the proper subset of variables are the variables associated with a corresponding node in the lock hierarchy and all child nodes of the node in the lock hierarchy, and do not include variables associated with parent nodes of the node;

assigning an access privilege to modify variables in the data structure to administrator accounts;

receiving a first administrator access request to modify a variable in the proper subset of variables;

in response to receiving the first administrator access request;

enabling the access privilege to modify the variable in the proper subset of variables for the first administrator account

enabling a read lock for the parent nodes of the node in the hierarchy so that the parent nodes in the hierarchy can be accessed by other administrator accounts; and

imposing a write lock on the node and all child nodes of the node in the lock hierarchy so that only the first administrator has the ability to view contents of the node and all the child nodes;

receiving a second administrator access request to modify the variable associated in the proper subset of variables;

in response to receiving the second administrator access request;

initiating an access timer that expires after a time period;

disabling the access privilege for the first administrator account in response to expiration of the access timer; and

enabling the access privilege for the second administrator account in response to expiration of the access timer.

2. The method of claim 1, wherein imposing the write lock comprises enabling modification of the variables associated with the node and the child nodes of the node in the lock hierarchy only by the administrator account having access privilege enabled.

3. The method of claim 1, further comprising associating the node in the lock hierarchy and all child nodes of the node in the lock hierarchy with an administrative policy.

4. The method of claim 1, wherein the data structure includes a plurality of proper subsets of variables, each proper subset of variables being variables associated with a corresponding node in a lock hierarchy and all child nodes of the corresponding node, and further comprising associating each proper subset with its own access privileges.

5. The method of claim 4, wherein each proper subset has a lock policy separate from all other proper subsets, such that the first administrator account has access request enabled for a first proper subset and a second administrator account has access request enabled for a second proper subset.

6. The method of claim 1, wherein the data structure is representative of a database.

7. The method of claim 1, wherein the data structure is a database.

8. The method of claim 1, further comprising disabling the access privilege for an administrator account after a modification of the variable has entered through the administrator account.

9. The method of claim 1, further comprising:

assigning a version number for a version of the proper subset to which an administrator account has an access privilege enabled; and

comparing the version number to a most recent version number assigned to the proper subset; and

allowing the modification to the variable in the proper subset if the version number of the proper subset to which the variable belongs matches the most recent version number.

10. The method of claim 9, further comprising:

precluding the modification to the variable in the proper subset if the version number of the proper subset to which the variable belongs does not match the most recent version number.

11. A system, comprising:

a logging node configured to receive a configuration state associated with a data store and to manage configuration requests from administrator accounts, each of the administrator accounts being associated with an access privilege determinative of which of the administrator accounts is used to modify a proper subset of variables in a data store, wherein the proper subset of variables are associated according to a lock hierarchy comprising a plurality of nodes, and wherein the proper subset of variables are the variables associated with a corresponding node in the lock hierarchy and all child nodes of the node in the lock hierarchy, and do not include variables associated with parent nodes of the node;

a configuration map mapping relationships between the nodes in the lock hierarchy and all child nodes of the nodes in the lock hierarchy of the data store;

an authority node configured to serialize requests from the administrator accounts by enabling the access privilege of a first administrator account to the proper subset of variables in the data store, enable a read lock for the parent nodes of the node in the hierarchy so that the parent nodes in the hierarchy can be accessed by other administrator accounts, and impose a write lock on the node and all child nodes of the node in the lock hierarchy so that only the first administrator account has the ability to view contents of the node and all the child nodes upon a first administrator account request and maintain enablement of the access privilege until a second administrator account request for the access privilege to the proper subset of variables is received; and

a timing module configures to initiate a timer in response to the second administrator account request, the timing module providing a signal to the authority node in response to an expiration of the timer that causes the authority node to disable the access privilege for the first administrator account and to enable the access privilege for the second administrator account.

12. The system of claim 11, wherein the logging node is associated with the authority node.

13. The system of claim 12, wherein the logging node is a functional module of the authority node.

14. The system of claim 11, further comprising enterprise locations containing one or more administrator accounts, each enterprise location with its own access privilege.

15. The system of claim 14, further comprising user interfaces, such that at least one enterprise location uses more than one of the user interfaces.

16. Software stored in a computer readable medium and comprising instructions executable by a processing node system, and in response to such execution causes the processing node system to perform operations comprising:

identifying a proper subset of variables of a set of variables in a data structure, wherein the set of variables are associated according to a lock hierarchy comprising a plurality of nodes, and wherein the proper subset of variables are the variables associated with a corresponding node in the lock hierarchy and all child nodes of the node in the lock hierarchy, and do not include variables associated with parent nodes of the node;

assigning an access privilege to modify variables in the data structure to administrator accounts;

receiving a first administrator access request to modify a variable in the proper subset of variables;

in response to receiving the first administrator access request;

enabling the access privilege to modify the variable in the proper subset of variables for the first administrator account,

enabling a read lock for the parent nodes of the node in the hierarchy, so that the parent nodes in the hierarchy can be accessed by other administrator accounts, and

imposing a write lock on the node and all child nodes of the node in the lock hierarchy so that only the first administrator has the ability to view contents of the node and all the child nodes;

receiving a second administrator access request to modify the variable associated in the proper subset of variables;

in response to receiving the second administrator access request;

initiating an access timer that expires after a time period;

disabling the access privilege for the first administrator account in response to expiration of the access timer; and

enabling the access privilege for the second administrator account in response to expiration of the access timer.