Entitled data cache management

• US 8,397,066 B2
• Filed: 10/20/2009
• Issued: 03/12/2013
• Est. Priority Date: 10/20/2009
• Status: Active Grant

• Current Assignee: Refinitiv US Organization, LLC (Refinitiv US Holdings, Inc.)
• Original Assignee: Thomson Reuters LLC (The Woodbridge Co. Ltd.)
• Inventors: Krishnamoorthy, Venkatanarayanan, Varadrajan, Srinivasan, Zucknovich, Stephen, Leisy, Jacques, Jornitski, Vladimir
• Primary Examiner(s): PERUNGAVOOR, VENKATANARAY
• Application Number:
  US12/582,180
• Publication Number:
  US 20110093925A1
• Time in Patent Office: 1,239 Days
• Field of Search: None
• US Class Current: 713/165
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

Systems and methods are disclosed for managing an entitled data cache. A data server may generate and send entitled data to a data cache server. The data cache server, a server that may be located nearer to the user within a data provider'"'"'s computer network, may receive and cache the entitled data. A permission server may store user'"'"'s permissions and transmit the user'"'"'s permissions to the data server and the data cache server. Upon receiving a request for data, the data cache server may retrieve the requested data from the cache and send a subset of the cached data which matches the user'"'"'s permissions to the user, without the need to request the data from the data server.

Claims

1. An apparatus, comprising:

one or more processors; and

memory storing executable instructions that, when executed by the one or more processors, cause the apparatus to;

receive entitled data from a data server, the entitled data having associated data permissions defining one or more permissions needed by a requesting user to access the entitled data;

store the entitled data and a cache signature corresponding to the entitled data;

receive a first data request for the entitled data from a first user;

hash the first data request, resulting in the cache signature;

retrieve user permissions corresponding to the first user;

determine that the user permissions corresponding to the first user intersect with the data permissions; and

transmit a first set of the entitled data as a response to the first data request for the entitled data.

2. The apparatus of claim 1, wherein the memory further stores executable instructions that, when executed by the one or more processors, cause the apparatus to:

determine whether the entitled data is expired prior to responding to the first data request for the entitled data.

3. The apparatus of claim 1, wherein the memory further stores executable instructions that, when executed by the one or more processors, cause the apparatus to:

receive a second data request for the entitled data from a second user;

retrieve user permissions corresponding to the second user; and

transmit a second set of the entitled data as a response to the second data request for the entitled data, wherein the second set of the entitled data is different from the first set of the entitled data.

4. The apparatus of claim 1, wherein the memory further stores executable instructions that, when executed by the one or more processors, cause the apparatus to:

subscribe to a publish server to receive updates to the entitled data when the entitled data changes.

5. The apparatus of claim 4, wherein the memory further stores executable instructions that, when executed by the one or more processors, cause the apparatus to:

receive an update to the entitled data from the publish server prior to an expiration of the entitled data.

6. The apparatus of claim 1, wherein the memory further stores executable instructions that, when executed by the one or more processors, cause the apparatus to:

receive a second data request for the entitled data from the first user; and

determine that the user permissions have changed subsequent to receiving the first data request; and

transmit a second set of the entitled data as a response to the second data request for the entitled data, wherein the second set of the entitled data is different from the first set of the entitled data.

7. A method comprising:

receiving, by a computing device, entitled data from a data server, the entitled data having associated data permissions defining one or more permissions needed by a requesting user to access the entitled data;

store the entitled data and a cache signature corresponding to the entitled data;

receiving a first data request for the entitled data from a first user;

hashing the first data request, resulting in the cache signature;

retrieving user permissions corresponding to the first user;

determining that the user permissions corresponding to the first user intersect with the data permissions; and

transmitting a first set of the entitled data as a response to the first data request for the entitled data.

8. The method of claim 7, further comprising:

determining whether the entitled data is expired prior to responding to the first data request for the entitled data.

9. The method of claim 7, further comprising:

subscribing to a publish server to receive updated data;

receiving asynchronous data updates for the entitled data from the publish server; and

replacing the cached entitled data with the updated entitled data.

10. The method of claim 7, further comprising:

requesting and receiving the user permissions from a permission server.

14. The method of claim 7, further comprising:

receiving a second data request for the entitled data from the first user;

determining that the user permissions corresponding to the first user have changed subsequent to receiving the first data request;

transmitting a second set of the entitled data as a response to the second data request for the entitled data, wherein the second set of the entitled data is different from the first set of the entitled data.

15. The method of claim 7, further comprising:

storing, with the entitled data, an entitlement token corresponding to the data permissions.

16. The method of claim 15, wherein the entitlement token corresponds to the data permissions and is assigned to a grouping of users, wherein each user in the grouping of users is allowed access to data subject to the data permissions.

17. The method of claim 9, further comprising:

receiving a notification that notifies the computing device of an update to multiple data domains arranged in a hierarchy, wherein the entitled data is assigned to at least one of the multiple data domains.

18. The method of claim 7, wherein the memory further stores executable instructions that, when executed by the one or more processors, cause the apparatus to:

receive an update notification that includes an identification of one or more data domains that need to be updated, wherein the entitled data is assigned to at least one of the one or more data domains; and

request an update to the entitled data responsive to the update notification.

19. The method of claim 7, further comprising:

receiving a second data request for the entitled data from a second user;

hashing the second data request for the entitled data, resulting in the cache signature;

retrieving user permissions corresponding to the second user; and

transmitting a second set of the entitled data as a response to the second data request for the entitled data, wherein the second set of the entitled data is different from the first set of the entitled data.

11. A method comprising:

receiving, by a computing device, a first data request, the first data request corresponding to a first user having first user permissions;

hashing the first data request, resulting in a cache signature;

determining that first response data corresponding to the first data request and corresponding to the first user permissions is stored in a local data cache using the cache signature;

sending the first user the first response data;

receiving, by the computing device, a second data request corresponding to a second user having second user permissions, wherein the second data request requests the same data as the first data request, and wherein the second user permissions are different from the first user permissions;

hashing the first data request, resulting in a cache signature;

determining that second response data corresponding to the second user request and corresponding second user permissions is stored in the local data cache using the cache signature; and

sending the second user the second response data, wherein the second response data is different from the first response data.

12. The method of claim 11, further comprising:

upon determining that requested data is not stored in the local data cache, requesting the requested data from a data server and caching the data received from the local data cache.

13. The method of claim 11, further comprising:

verifying an expiration of the first response data prior to sending the first response data.

20. One or more non-transitory computer-readable media storing executable instructions configured to, when executed, cause an apparatus to:

receive entitled data from a data server, the entitled data having associated data permissions defining one or more permissions needed by a requesting user to access the entitled data;

store the entitled data and a cache signature corresponding to the entitled data;

receive a first data request for the entitled data from a first user;

hash the first data request, resulting in the cache signature;

retrieve user permissions corresponding to the first user;

determine that the user permissions corresponding to the first user intersect with the data permissions; and

transmit a first set of the entitled data as a response to the first data request for the entitled data.

21. The one or more non-transitory computer-readable media of claim 20 further storing executable instructions that, when executed, cause the apparatus to:

receive a second data request for the entitled data from a second user;

retrieve user permissions corresponding to the second user; and

transmit a second set of the entitled data as a response to the second data request for the entitled data, wherein the second set of the entitled data is different from the first set of the entitled data.

22. The one or more non-transitory computer-readable media of claim 21, further storing executable instructions that, when executed, cause the apparatus to:

hash the second data request for the entitled data, resulting in the cache signature.

23. The one or more non-transitory computer-readable media of claim 20, further storing executable instructions that, when executed, cause the apparatus to:

receive an update notification that includes an identification of one or more data domains that need to be updated, wherein the entitled data is assigned to at least one of the one or more data domains; and

request an update to the entitled data responsive to the update notification.