Systems, methods, and apparatuses for implementing cross organizational data sharing

• US 9,646,169 B2
• Filed: 11/10/2015
• Issued: 05/09/2017
• Est. Priority Date: 12/18/2012
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Wong, Simon Y., Tsyganskiy, Igor, Calahan, Patrick John, Hersans, Alexandre
• Primary Examiner(s): LEE, JASON T
• Application Number:
  US14/937,698
• Publication Number:
  US 20160063273A1
• Time in Patent Office: 546 Days
• Field of Search: 726 4
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

In accordance with disclosed embodiments, there are provided methods, systems, and apparatuses for implementing cross organizational data sharing including, for example, means for storing customer organization data in a database of the host organization; allocating at least a sub-set of the customer organization data to be shared as shared data; configuring a hub to expose the shared data to a proxy user and configuring the proxy user at the hub with access rights to the shared data; configuring one or more spokes with access rights to the shared data of the hub via the proxy user; receiving a request from one of the hubs for access to the shared data of the customer organization via the proxy user at the hub; and returning a response to the hub having made the request. Other related embodiments are disclosed.

Claims

1. A method performed by a system having at least a hardware processor and a memory therein, wherein the method comprises:

storing data in a database system communicatively interfaced with the system;

allocating at least a sub-set of the data to be shared as shared data, wherein the sub-set of the data includes one or more queryable objects stored at the database system;

configuring a hub to expose the shared data to a proxy user and configuring the proxy user at the hub with access rights to the shared data, wherein the proxy user at the hub is configured to query the one or more queryable objects stored at the database system without replicating the one or more queryable objects;

configuring one or more spokes with access rights to the shared data of the hub via the proxy user by configuring each of the one or more spokes with a queryable proxy object void of the shared data;

receiving a request from one of the hubs for access to the shared data via the proxy user at the hub; and

returning a response to the hub having made the request.

2. The method of claim 1, wherein configuring the hub to expose the shared data to a proxy user and configuring the proxy user at the hub with access rights to the shared data comprises configuring the proxy with access rights to the data stored in the database system without replicating the exposed shared data.

3. The method of claim 1, wherein configuring the hub to expose the shared data to a proxy user comprises allocating the shared data to an object at the hub and configuring the proxy user with access rights to the object.

4. The method of claim 1:

wherein the data stored within the database system comprises customer organization data; and

wherein a host organization operates the system and communicably interfaced database system as a cloud based service on behalf of a plurality of customer organizations, each customer organization having ownership of at least a portion of the customer organization data stored within the database system.

5. The method of claim 1:

wherein the queryable proxy object is configured to proxy any received query to a corresponding proxy user at the hub; and

wherein the corresponding proxy user at the hub is configured to query the one or more queryable objects stored at the database responsive to the proxied query from the spoke.

6. The method of claim 1, wherein configuring a hub to expose the shared data to a proxy user and configuring the proxy user at the hub with access rights to the shared data comprises configuring the proxy user with one or more of the following access rights to the shared data:

read-only access to the shared data;

write, update, and modify access to the shared data;

delete capability of database records within the shared data;

create and record insertion capability to introduce new database records into the shared data.

7. The method of claim 1, wherein configuring the hub to expose the shared data to a proxy user and configuring the proxy user at the hub with access rights to the shared data comprises configuring the hub as a broadcast hub, wherein the shared data is exposed to the one or more spokes with read-only access for the shared data and no capability to update, modify, insert, or delete database records within the shared data.

8. The method of claim 1, wherein configuring the hub to expose the shared data to a proxy user and configuring the proxy user at the hub with access rights to the shared data comprises configuring the hub with selective write-back capability, wherein the shared data is exposed to the one or more spokes with read-only access for the shared data via the one or more queryable objects and with no capability to update, modify, insert, or delete database records within the first queryable object and further wherein a second queryable object is exposed to the one or more spokes with create and record insertion capability to introduce new database records into the shared data via the second queryable object.

9. The method of claim 1, wherein returning the response to the hub having made the request comprises:

querying the shared data stored in the database system via the proxy user at the hub; and

returning query results to the spoke having initiated the request responsive to the request.

10. The method of claim 1, further comprising:

storing the configuration of the hub, the configuration of the one or more spokes, and the configuration of the proxy user and its access rights to the shared data via a proxy schema.

11. The method of claim 10, further comprising:

packaging and deploying the proxy schema into a live production environment; and

installing the hub and the one or more spokes within the live production environment according to the stored configuration of the hub, the stored configuration of the one or more spokes, and the stored configuration of the proxy user and its access rights to the shared data as represented by the packaged and deployed proxy schema.

12. The method of claim 11:

wherein the data stored within the database system comprises customer organization data; and

wherein packaging and deploying the proxy schema into the live production environment comprises releasing updates to custom object definitions to implement cross-organizational data sharing between multiple customer organizations having distinct ownership of separate portions of the customer organization data stored by the database system.

13. The method of claim 11:

wherein the data stored within the database system comprises customer organization data stored on behalf of a plurality of distinct customer organizations serviced by the system; and

wherein packaging and deploying the proxy schema into the live production environment comprises releasing updates to one or more of;

cross-organizational data sharing object definitions for sharing the data amongst any of the distinct customer organizations;

profiles associated with the shared data or the customer organizations;

permissions associated with the shared data or the customer organizations; and

updates to roles to manage data sharing amongst any of the customer organizations participating with cross-organizational data sharing services provided by the system.

14. The method of claim 11:

wherein the data stored within the database system comprises customer organization data stored on behalf of a plurality of distinct customer organizations serviced by the system;

wherein records of the shared data which are shared via a hub by any one of the distinct customer organizations are subjected to access controls as defined by the access rights, the access controls being one of (i) access controls on a per-spoke basis or alternatively (ii) common access controls applied to multiple spokes; and

wherein the access controls are defined by and at the direction of a customer organization having ownership of the data being shared and participating in cross-organizational data sharing between multiple customer organizations, each of the multiple customer organizations having distinct ownership of separate portions of the customer organization data stored by the database system.

15. The method of claim 14, wherein the access controls define any one or more of:

limitations on “

CRUD”

controlled access rights including (i) CREATE calls for inserting records into the database system, (ii) READ-ONLY access controls, (iii) limitations on UPDATE calls, and (iv) limitations on DELETE statements;

wherein the access controls are configurable by an administrator enabling cross-organizational data sharing for a particular one of the distinct customer organizations'"'"' data.

16. The method of claim 1:

wherein a user interface operates at a user client device remote from the system and communicatively interfaces with the system via a public Internet;

wherein the system operates within a host organization as a cloud based service provider to the user client device; and

wherein the request is received at the host organization from the user client device.

17. The method of claim 16:

wherein the database system operates within the host organization as a multi-tenant database system having elements of hardware and software that are shared by a plurality of separate and distinct customer organizations, each of the separate and distinct customer organizations being remotely located from the host organization; and

wherein each customer organization is an entity selected from the group consisting of;

a separate and distinct remote organization, an organizational group within the host organization, a business partner of the host organization, or a customer organization that subscribes to cloud computing services provided by the host organization.

18. The method of claim 1,

wherein allocating at least the sub-set of the data to be shared as shared data comprises at least one of:

sharing one or more database tables as the shared data;

sharing a plurality of database records as the shared data;

sharing access to one or more database fields as the shared data;

sharing access to one or more queryable database objects as the shared data; and

sharing access to executable code, reports, or user interfaces as the shared data.

19. Non-transitory computer readable storage media having instructions stored thereon that, when executed by a hardware processor of a system, the instructions cause the system to perform operations comprising:

storing data in a database system communicatively interfaced with the system;

allocating at least a sub-set of the data to be shared as shared data, wherein the sub-set of the data includes one or more queryable objects stored at the database system;

configuring a hub to expose the shared data to a proxy user and configuring the proxy user at the hub with access rights to the shared data, wherein the proxy user at the hub is configured to query the one or more queryable objects stored at the database system without replicating the one or more queryable objects;

configuring one or more spokes with access rights to the shared data of the hub via the proxy user by configuring each of the one or more spokes with a queryable proxy object void of the shared data;

receiving a request from one of the hubs for access to the shared data via the proxy user at the hub; and

returning a response to the hub having made the request.

20. A system comprising:

a hardware processor and a memory to execute instructions at the system;

a database system to store data;

a sharing configurator to allocate at least a sub-set of the data to be shared as shared data, wherein the sub-set of the data includes one or more queryable objects stored at the database system;

the sharing configurator to configure a hub to expose the shared data to a proxy user and configuring the proxy user at the hub with access rights to the shared data, wherein the proxy user at the hub is configured to query the one or more queryable objects stored at the database system without replicating the one or more queryable objects;

the sharing configurator to configure one or more spokes with access rights to the shared data of the hub via the proxy user by configuring each of the one or more spokes with a queryable proxy object void of the shared data;

a request interface to receive a request from one of the hubs for access to the shared data via the proxy user at the hub; and

the request interface to return a response to the hub having made the request.