HOSTED APPLICATION GATEWAY ARCHITECTURE WITH MULTI-LEVEL SECURITY POLICY AND RULE PROMULGATIONS

• US 20150088934A1
• Filed: 11/06/2014
• Published: 03/26/2015
• Est. Priority Date: 09/20/2013
• Status: Active Grant

• Current Assignee: Ip Ot Sub Ulc
• Original Assignee: Open TEXT SA (Open Text Corporation)
• Inventors: Beckman, Gregory, Laird, Robert, Obbard, Geoffrey Michael
• Granted Patent: US 9,747,466 B2
• Time in Patent Office: Days
• US Class Current: 707/781
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/16 Program or content traceability, e.g. by watermarking
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: G06F 3/04817 using icons graphical or visual programming using iconic symbols G06F8/34
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/565 Conversion or adaptation of application format or content adding application control or application functional data H04L67/561
• CPC Class Codes: H04L 67/5683 Storage of data provided by user terminals, i.e. reverse caching
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A hosted application gateway server node may be communicatively coupled to backend systems, client devices, and database shards associated with database servers. Through the gateway server node, various services may be provided to managed containers running on client devices such that enterprise applications can be centrally managed. A sharding manager may manage relationships of database items across database shards. Each shard stores a copy of a table representing a split of a relationship. A shard ID mask is included in each item'"'"'s ID. At query time, the shard ID can be extracted and used to query the correct database. This query routing mechanism allows navigation from one shard to another when multiple items are in a relationship (e.g., share the same resource such as a document). As such, embodiments can eliminate the need for APIs to join in data that span multiple shards.

Claims

1. A database system, comprising:

a plurality of database shards operating on a plurality of database servers;

a sharding manager embodied on non-transitory computer memory including instructions executable by a processor to generate a relationship for database items across at least two of the database shards, wherein generating the relationship includes the sharding manager;

storing a first data structure representing a first split of the relationship in a first shard, the first data structure referencing a first database item; and

storing a second data structure representing a second split of the relationship in a second shard, the second data structure referencing the second database item.

2. The database system of claim 1, wherein the relationship represents a resource lock and wherein the resource lock is defined by the first data structure stored in the first shard and the second data structure stored in the second shard.

3. The database system of claim 1, wherein the first database item is associated with a user and wherein the second database item is associated with a document.

4. The database system of claim 1, wherein the first shard is associated with a user and wherein the second shard is associated with a document.

5. The database system of claim 1, wherein the first database item is associated with a first identifier encoded with a shard identification mask associated with the first shard.

6. The database system of claim 1, wherein the first data structure includes a first identifier and a second identifier and the second data structure includes a first identifier and a second identifier, wherein the second identifier of the first data structure is associated with a first foreign key referencing the second identifier of the second data structure, and wherein the first identifier of the second data structure is associated with a second foreign key referencing the first identifier of the first data structure.

7. The database system of claim 6, wherein the first identifier of the first data structure and the first identifier of the second data structure are associated with a resource and wherein the second identifier of the first data structure and the second identifier of the second data structure identify an entity having a lock on the resource.

8. The database system of claim 1, wherein the relationship is shared among three or more database items in three or more shards and wherein the sharding manager is operable to store a data structure representing a portion of the relationship in each shard, the data structure containing a foreign key referencing an item in a different shard that shares the relationship.

9. The database system of claim 8, wherein the relationship defines a document share.

10. A system, comprising:

an application gateway server node communicatively coupled to backend systems, client devices, and database shards operating on a plurality of database servers; and

a sharding manager embodied on non-transitory computer memory including instructions executable by a processor to generate a relationship for database items across at least two of the database shards, wherein generating the relationship includes the sharding manager;

storing a first data structure representing a first split of the relationship in a first shard, the first data structure referencing a first database item; and

storing a second data structure representing a second split of the relationship in a second shard, the second data structure referencing the second database item.

11. The system of claim 10, wherein the application gateway server node comprises a database manager and wherein the database manager comprises the sharding manager.

12. The system of claim 10, wherein the relationship represents a resource lock and wherein the resource lock is defined by the first data structure stored in the first shard and the second data structure stored in the second shard.

13. The system of claim 10, wherein the first database item is associated with a user and wherein the second database item is associated with a document.

14. The system of claim 10, wherein the first shard is associated with a user and wherein the second shard is associated with a document.

15. The system of claim 10, wherein the first database item is associated with a first identifier encoded with a shard identification mask associated with the first shard.

16. The system of claim 10, wherein the first data structure includes a first identifier and a second identifier and the second data structure includes a first identifier and a second identifier, wherein the second identifier of the first data structure is associated with a first foreign key referencing the second identifier of the second data structure, and wherein the first identifier of the second data structure is associated with a second foreign key referencing the first identifier of the first data structure.

17. The system of claim 16, wherein the first identifier of the first data structure and the first identifier of the second data structure are associated with a resource and wherein the second identifier of the first data structure and the second identifier of the second data structure identify an entity having a lock on the resource.

18. The system of claim 10, wherein the relationship is shared among three or more database items in three or more shards and wherein the sharding manager is operable to store a data structure representing a portion of the relationship in each shard, the data structure containing a foreign key referencing an item in a different shard that shares the relationship.

19. The system of claim 18, wherein the relationship defines a document share.