System, method and computer program product for conditionally sharing an object with one or more entities

• US 9,268,955 B2
• Filed: 03/14/2011
• Issued: 02/23/2016
• Est. Priority Date: 03/12/2010
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Wu, Yongsheng, Smith, Andrew, Torman, Adam, Jain, Punit
• Primary Examiner(s): Uddin, Md. I
• Application Number:
  US13/047,709
• Publication Number:
  US 20110225118A1
• Time in Patent Office: 1,807 Days
• Field of Search: 707/608, 707/609, 707/704, 707/705, 707/781, 707/999.102, 707/999.006
• US Class Current: 1/1
• CPC Class Codes: G06F 16/335 Filtering based on additional data, e.g. user or group profiles filtering in web context G06F16/9535, G06F16/9536
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

In accordance with embodiments, there are provided mechanisms and methods for conditionally sharing an object with one or more entities. These mechanisms and methods for conditionally sharing an object with one or more entities can enable enhanced data sharing, simplified data security, etc.

Claims

1. A computer program product, comprising a non-transitory computer usable medium having computer readable program code embodied therein, the computer readable program code adapted to be executed to implement a method for conditionally sharing an object with one or more entities, the method comprising:

specifying, by a system, a plurality of object types, each of the object types defining fields for objects of the object type;

storing a plurality of objects within the system, each of the objects being of one of the object types, each of the objects including the fields defined for the one of the object types, and each of the objects storing a value in each of the included fields;

receiving, by the system, a definition of a rule specific to one of the object types that is to be used to determine whether to share the objects of the object type that are stored within the system, the definition of the rule received by;

receiving a specification of one or more of the fields defined for the object type,

receiving a requisite value for each of the specified one or more fields,

receiving a specification of an operation to be used to compare each of the requisite values with values of the specified one or more fields that are in the objects of the object type that are stored within the system,

receiving a specification of a type of organizational unit defined within the system, and

receiving a specification of an organizational unit defined within the system that is of the specified type of organizational unit, the organizational unit being that with which the objects of the object type stored within the system will be shared, based on the determination of whether to share the objects of the object type stored within the system,

receiving a specification of a type of access permitted when it is determined to share the objects of the object type stored within the system;

in response to receiving the rule, the system;

(a) applying, by the system, the rule to each of the objects within the system that are of the object type specific to the rule, including;

identifying from the rule the requisite values for each of the one or more fields defined for the object type that are specified by the rule,

comparing, in accordance with corresponding operation specified by the rule, the requisite values identified from the rule to values of the one or more fields specified by the rule that are in the object,

determining from the comparison whether each of the values of the one or more fields specified by the rule that are in the object meets the corresponding requisite value;

(b) based on the application of the rule to each of the objects within the system that are of the object type specific to the rule, conditionally sharing, by the system, the object with one or more entities of the system included in the organizational unit specified by the rule in accordance with the determining of whether each of the values of the one or more fields specified by the rule that are in the object meets the corresponding requisite value including;

when it is determined from the comparison that the values of all of the one or more fields specified by the rule that are in the object meet the requisite values specified by the rule, storing in a share table an association between the object and the one or more entities of the system included in the organizational unit specified by the rule and permitting the type of access to the object specified by the rule to the one or more entities of the system included in the organizational unit specified by the rule via the share table;

after performing (a)-(b) responsive to the receipt of the rule, identifying by the system when the rule is edited and saved, and in response repeating (a)-(b) for each of the objects within the system that are of the object type specific to the rule; and

after performing (a)-(b) responsive to the receipt of the rule, identifying by the system when one of the values of the one or more fields specified by the rule that are in one of the objects of the object type specified by the rule is modified, and in response repeating (a)-(b) only for the object having the one of the values modified.

2. The computer program product of claim 1, wherein the object includes a system record.

3. The computer program product of claim 1, wherein the object includes a custom object.

4. The computer program product of claim 1, wherein the object is located within an organization of the system.

5. The computer program product of claim 1, wherein the fields of the object include one or more of an owner of the object, a name of the object, keywords associated with the object, and a monetary value associated with the object.

6. The computer program product of claim 1, wherein the rule is created by an administrator.

7. The computer program product of claim 1, wherein the one or more entities of the system include a group of users of the system.

8. The computer program product of claim 1, wherein the object is located within one organization of the system, and the one or more entities of the system include one or more users from another organization of the system.

9. The computer program product of claim 1, wherein sharing the object includes making the object visible to the one or more entities.

10. The computer program product of claim 1, wherein applying the rule to each of the objects within the system is performed before the one or more entities request the object.

11. The computer program product of claim 1, wherein the specified one or more fields of the object are at least in part independent of an owner of the object.

12. The computer program product of claim 1, wherein the operation is one of:

equal to and greater than.

13. The computer program product of claim 1, wherein the type of the organizational unit is one of:

a role, a group, and a territory.

14. The computer program product of claim 1, wherein a predetermined number of rules are allowed for each of the entities of the system.

15. The computer program product of claim 1, wherein multiple rules are received and stored by the system for a particular one of the object types.

16. The computer program product of claim 1, wherein predetermined ones of the fields of the object are specified in a registry for being monitored for changes in order to identify when one of the values of the one or more fields specified by the rule that are in one of the objects of the object type specified by the rule is modified.

17. A method, comprising:

specifying, by a system, a plurality of object types, each of the object types defining fields for objects of the object type;

storing a plurality of objects within the system, each of the objects being of one of the object types, each of the objects including the fields defined for the one of the object types, and each of the objects storing a value in each of the included fields;

receiving, by the system, a definition of a rule specific to one of the object types that is to be used to determine whether to share the objects of the object type that are stored within the system, the definition of the rule received by;

receiving a specification of one or more of the fields defined for the object type,

receiving a requisite value for each of the specified one or more fields,

receiving a specification of an operation to be used to compare each of the requisite values with values of the specified one or more fields that are in the objects of the object type that are stored within the system,

receiving a specification of a type of organizational unit defined within the system, and

receiving a specification of an organizational unit defined within the system that is of the specified type of organizational unit, the organizational unit being that with which the objects of the object type stored within the system will be shared, based on the determination of whether to share the objects of the object type stored within the system,

receiving a specification of a type of access permitted when it is determined to share the objects of the object type stored within the system;

in response to receiving the rule, the system;

(a) applying, by the system, the rule to each of the objects within the system that are of the object type specific to the rule, including;

identifying from the rule the requisite values for each of the one or more fields defined for the object type that are specified by the rule,

comparing, in accordance with corresponding operation specified by the rule, the requisite values identified from the rule to values of the one or more fields specified by the rule that are in the object,

determining from the comparison whether each of the values of the one or more fields specified by the rule that are in the object meets the corresponding requisite value;

(b) based on the application of the rule to each of the objects within the system that are of the object type specific to the rule, conditionally sharing, by the system, the object with one or more entities of the system included in the organizational unit specified by the rule in accordance with the determining of whether each of the values of the one or more fields specified by the rule that are in the object meets the corresponding requisite value including;

when it is determined from the comparison that the values of all of the one or more fields specified by the rule that are in the object meet the requisite values specified by the rule, storing in a share table an association between the object and the one or more entities of the system included in the organizational unit specified by the rule and permitting the type of access to the object specified by the rule to the one or more entities of the system included in the organizational unit specified by the rule via the share table;

after performing (a)-(b) responsive to the receipt of the rule, identifying by the system when the rule is edited and saved, and in response repeating (a)-(b) for each of the objects within the system that are of the object type specific to the rule; and

after performing (a)-(b) responsive to the receipt of the rule, identifying by the system when one of the values of the one or more fields specified by the rule that are in one of the objects of the object type specified by the rule is modified, and in response repeating (a)-(b) only for the object having the one of the values modified.

18. An apparatus, comprising:

a processor for;

specifying, by a system, a plurality of object types, each of the object types defining fields for objects of the object type;

storing a plurality of objects within the system, each of the objects being of one of the object types, each of the objects including the fields defined for the one of the object types, and each of the objects storing a value in each of the included fields;

receiving, by the system, a definition of a rule specific to one of the object types that is to be used to determine whether to share the objects of the object type that are stored within the system, the definition of the rule received by;

receiving a specification of one or more of the fields defined for the object type,

receiving a requisite value for each of the specified one or more fields,

receiving a specification of an operation to be used to compare each of the requisite values with values of the specified one or more fields that are in the objects of the object type that are stored within the system,

receiving a specification of a type of organizational unit defined within the system, and

receiving a specification of an organizational unit defined within the system that is of the specified type of organizational unit, the organizational unit being that with which the objects of the object type stored within the system will be shared, based on the determination of whether to share the objects of the object type stored within the system,

receiving a specification of a type of access permitted when it is determined to share the objects of the object type stored within the system;

in response to receiving the rule, the system;

(a) applying, by the system, the rule to each of the objects within the system that are of the object type specific to the rule, including;

identifying from the rule the requisite values for each of the one or more fields defined for the object type that are specified by the rule,

comparing, in accordance with corresponding operation specified by the rule, the requisite values identified from the rule to values of the one or more fields specified by the rule that are in the object,

determining from the comparison whether each of the values of the one or more fields specified by the rule that are in the object meets the corresponding requisite value;

(b) based on the application of the rule to each of the objects within the system that are of the object type specific to the rule, conditionally sharing, by the system, the object with one or more entities of the system included in the organizational unit specified by the rule in accordance with the determining of whether each of the values of the one or more fields specified by the rule that are in the object meets the corresponding requisite value including;

when it is determined from the comparison that the values of all of the one or more fields specified by the rule that are in the object meet the requisite values specified by the rule, storing in a share table an association between the object and the one or more entities of the system included in the organizational unit specified by the rule and permitting the type of access to the object specified by the rule to the one or more entities of the system included in the organizational unit specified by the rule via the share table;

after performing (a)-(b) responsive to the receipt of the rule, identifying by the system when the rule is edited and saved, and in response repeating (a)-(b) for each of the objects within the system that are of the object type specific to the rule; and

after performing (a)-(b) responsive to the receipt of the rule, identifying by the system when one of the values of the one or more fields specified by the rule that are in one of the objects of the object type specified by the rule is modified, and in response repeating (a)-(b) only for the object having the one of the values modified.

19. A method for transmitting code for use in a multi-tenant database system on a transmission medium, the method comprising transmitting code for:

specifying, by a system, a plurality of object types, each of the object types defining fields for objects of the object type;

storing a plurality of objects within the system, each of the objects being of one of the object types, each of the objects including the fields defined for the one of the object types, and each of the objects storing a value in each of the included fields;

receiving, by the system, a definition of a rule specific to one of the object types that is to be used to determine whether to share the objects of the object type that are stored within the system, the definition of the rule received by;

receiving a specification of one or more of the fields defined for the object type,

receiving a requisite value for each of the specified one or more fields,

receiving a specification of an operation to be used to compare each of the requisite values with values of the specified one or more fields that are in the objects of the object type that are stored within the system,

receiving a specification of a type of organizational unit defined within the system, and

receiving a specification of an organizational unit defined within the system that is of the specified type of organizational unit, the organizational unit being that with which the objects of the object type stored within the system will be shared, based on the determination of whether to share the objects of the object type stored within the system,

receiving a specification of a type of access permitted when it is determined to share the objects of the object type stored within the system;

in response to receiving the rule, the system;

(a) applying, by the system, the rule to each of the objects within the system that are of the object type specific to the rule, including;

identifying from the rule the requisite values for each of the one or more fields defined for the object type that are specified by the rule,

comparing, in accordance with corresponding operation specified by the rule, the requisite values identified from the rule to values of the one or more fields specified by the rule that are in the object,

determining from the comparison whether each of the values of the one or more fields specified by the rule that are in the object meets the corresponding requisite value;

(b) based on the application of the rule to each of the objects within the system that are of the object type specific to the rule, conditionally sharing, by the system, the object with one or more entities of the system included in the organizational unit specified by the rule in accordance with the determining of whether each of the values of the one or more fields specified by the rule that are in the object meets the corresponding requisite value including;

when it is determined from the comparison that the values of all of the one or more fields specified by the rule that are in the object meet the requisite values specified by the rule, storing in a share table an association between the object and the one or more entities of the system included in the organizational unit specified by the rule and permitting the type of access to the object specified by the rule to the one or more entities of the system included in the organizational unit specified by the rule via the share table;

after performing (a)-(b) responsive to the receipt of the rule, identifying by the system when the rule is edited and saved, and in response repeating (a)-(b) for each of the objects within the system that are of the object type specific to the rule; and

after performing (a)-(b) responsive to the receipt of the rule, identifying by the system when one of the values of the one or more fields specified by the rule that are in one of the objects of the object type specified by the rule is modified, and in response repeating (a)-(b) only for the object having the one of the values modified.