Systems, methods, and apparatuses for implementing cross-organizational data sharing

Patent metadata

Field	Value
Publication number	US-10089488-B2
Application number	US-201715585881-A
Country	US
Kind code	B2
Filing date	May 3, 2017
Priority date	Dec 18, 2012
Publication date	Oct 2, 2018
Grant date	Oct 2, 2018

Abstract

In accordance with disclosed embodiments, there are provided methods, systems, and apparatuses for implementing cross organizational data sharing including, for example, means for storing customer organization data in a database of the host organization; allocating at least a sub-set of the customer organization data to be shared as shared data; configuring a hub to expose the shared data to a proxy user and configuring the proxy user at the hub with access rights to the shared data; configuring one or more spokes with access rights to the shared data of the hub via the proxy user; receiving a request from one of the hubs for access to the shared data of the customer organization via the proxy user at the hub; and returning a response to the hub having made the request. Other related embodiments are disclosed.

First claim

What is claimed is:

1. A method performed by a system having at least a hardware processor and a memory therein, wherein the method comprises:
storing data in a database system communicably interfaced with the system;
allocating at least a sub-set of the data to be exposed by the database system shared as shared data, wherein the sub-set of the data includes one or more queryable objects stored at the database system;
configuring a package for deployment into a production environment, wherein the package includes a pre-configured hub to expose the shared data to a proxy user and one or more pre-configured spokes bound to the pre-configured hub, wherein each of the one or more pre-configured spokes defines access rights to the shared data of the pre-configured hub, via the proxy user, through a queryable proxy object void of the shared data;
deploying the package into the production environment to activate a hub and one or more spokes within the production environment corresponding to the pre-configured hub and the one or more pre-configured spokes of the package;
wherein the queryable proxy object is configured to proxy any received query to a corresponding proxy user at the hub and further wherein the corresponding proxy user at the hub is configured to query the one or more queryable objects stored at the database system responsive to the proxied query from the spoke;
receiving a request from the hub for access to the shared data via the proxy user at the hub; and
returning a response to the hub having made the request.

2. The method of claim 1 , wherein the pre-configured hub to expose the shared data to the proxy user and the one or more pre-configured spokes bound to the pre-configured hub expose the shared data to the proxy user without replicating the exposed shared data in either the hub or the one or more spokes and without replicating any of the one or more queryable objects from the database system to the hub or the one or more spokes.

3. The method of claim 1 , wherein configuring the package to be deployed with the pre-configured hub to expose the shared data to the proxy user comprises early binding the one or more spokes to the hub having a pre-configured allocation defined via a shared proxy schema allocating the shared data to an object at the hub granting the proxy user with access rights to the object.

4. The method of claim 1 , wherein deploying the package into the production environment, comprises:
performing a silent deployment of the package into the production environment without requiring requesting any hub information from a spoke administrator during the deployment process to yield a fully automated installation of the package within the production environment.

5. The method of claim 1 , wherein configuring a hub to expose the shared data to a proxy user and configuring the proxy user at the hub with access rights to the shared data comprises configuring the proxy user with one or more of the following access rights to the shared data:
read-only access to the shared data;
write, update, and modify access to the shared data;
delete capability of database records within the shared data;
create and record insertion capability to introduce new database records into the shared data.

6. The method of claim 1 , wherein configuring the hub to expose the shared data to a proxy user and configuring the proxy user at the hub with access rights to the shared data comprises configuring the hub as a broadcast hub, wherein the shared data is exposed to the one or more spokes with read-only access for the shared data and no capability to update, modify, insert, or delete database records within the shared data.

7. The method of claim 1 , wherein configuring the hub to expose the shared data to a proxy user and configuring the proxy user at the hub with access rights to the shared data comprises configuring the hub with selective write-back capability, wherein the shared data is exposed to the one or more spokes with read-only access for the shared data via a first queryable object and no capability to update, modify, insert, or delete database records within the first queryable object and further wherein a second queryable object is exposed to the one or more spokes with create and record insertion capability to introduce new database records into the shared data via the second queryable object.

8. The method of claim 1 , further comprising:
automatically deploying a plurality of packages to the production environment via a silent spoke deployment operation, wherein each of the plurality of packages defines at least one spoke having been early bound to the hub via pre-configured access rights to the shared data of the hub, via the proxy user, through a queryable proxy object void of the shared data at the hub; and
wherein automatically deploying the plurality of packages to the production environment via the silent spoke deployment operation completes without requesting any spoke configuration data from a spoke administrator deploying the plurality of packages.

9. The method of claim 1 , wherein configuring the package for deployment into a production environment with the pre-configured hub to expose the shared data to a proxy user and the one or more pre-configured spokes bound to the pre-configured hub, comprises performing early binding of the one or more spokes activated within the production environment via the deployment of the package to establish a sharing scheme within the package to be deployed in advance of deploying the package to the production environment and without making the sharing scheme live within the production environment.

10. The method of claim 1 , further comprising:
configuring a second package for deployment into the production environment, wherein the package includes a second pre-configured hub to expose a second sub-set of data to a second proxy user;
wherein the second package includes late binding of a second hub and spoke combination, wherein the second package is deployable to any customer organization interacting with the database system having a required set of permissions; and
wherein the customer organizations to which the second package deployable are unknown at the time of packaging of the second package.

11. The method of claim 1 , further comprising:
activating the hub and the one or more spokes within the production environment pursuant to deployment of the package; and
displaying a data management User Interface (UI) to an administrator to manage the hub and the one or more spokes activated within the production environment, wherein the data management UI permits addition of shared data to be exposed, removal of shared data to be exposed, addition of new connections from the hub to permitted spokes, and alteration of access rights and restrictions for the shared data.

12. The method of claim 1 :
wherein a user interface operates at a user client device remote from the system and communicatively interfaces with the system via a public Internet;
wherein the system operates within a host organization as a cloud based service provider to the user client device; and
wherein the request from the hub for access to the shared data is received at the host organization from the user client device.

13. The method of claim 12 :
wherein the database system operates within the host organization as a multi-tenant database system having elements of hardware and software that are shared by a plurality of separate and distinct customer organizations, each of the separate and distinct customer organizations being remotely located from the host organization; and
wherein each customer organization i

Assignees

• Salesforce Com Inc

Inventors

• Wong Simon Y
• Tsyganskiy Igor
• Calahan Patrick John
• Hersans Alexandre

Classifications

• H04L63/0281 Primary

  Proxies · CPC title

• G06F17/30864

  Physics · mapped topic

• H04L63/10

  for controlling access to devices or network resources · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F16/951

  Indexing; Web crawling techniques · CPC title