Systems, methods, and apparatuses for implementing cross organizational data sharing

Patent metadata

Field	Value
Publication number	US-9646169-B2
Application number	US-201514937698-A
Country	US
Kind code	B2
Filing date	Nov 10, 2015
Priority date	Dec 18, 2012
Publication date	May 9, 2017
Grant date	May 9, 2017

Abstract

In accordance with disclosed embodiments, there are provided methods, systems, and apparatuses for implementing cross organizational data sharing including, for example, means for storing customer organization data in a database of the host organization; allocating at least a sub-set of the customer organization data to be shared as shared data; configuring a hub to expose the shared data to a proxy user and configuring the proxy user at the hub with access rights to the shared data; configuring one or more spokes with access rights to the shared data of the hub via the proxy user; receiving a request from one of the hubs for access to the shared data of the customer organization via the proxy user at the hub; and returning a response to the hub having made the request. Other related embodiments are disclosed.

First claim

What is claimed is:

1. A method performed by a system having at least a hardware processor and a memory therein, wherein the method comprises:
storing data in a database system communicatively interfaced with the system;
allocating at least a sub-set of the data to be shared as shared data, wherein the sub-set of the data includes one or more queryable objects stored at the database system;
configuring a hub to expose the shared data to a proxy user and configuring the proxy user at the hub with access rights to the shared data, wherein the proxy user at the hub is configured to query the one or more queryable objects stored at the database system without replicating the one or more queryable objects;
configuring one or more spokes with access rights to the shared data of the hub via the proxy user by configuring each of the one or more spokes with a queryable proxy object void of the shared data;
receiving a request from one of the hubs for access to the shared data via the proxy user at the hub; and
returning a response to the hub having made the request.

2. The method of claim 1 , wherein configuring the hub to expose the shared data to a proxy user and configuring the proxy user at the hub with access rights to the shared data comprises configuring the proxy with access rights to the data stored in the database system without replicating the exposed shared data.

3. The method of claim 1 , wherein configuring the hub to expose the shared data to a proxy user comprises allocating the shared data to an object at the hub and configuring the proxy user with access rights to the object.

4. The method of claim 1 :
wherein the data stored within the database system comprises customer organization data; and
wherein a host organization operates the system and communicably interfaced database system as a cloud based service on behalf of a plurality of customer organizations, each customer organization having ownership of at least a portion of the customer organization data stored within the database system.

5. The method of claim 1 :
wherein the queryable proxy object is configured to proxy any received query to a corresponding proxy user at the hub; and
wherein the corresponding proxy user at the hub is configured to query the one or more queryable objects stored at the database responsive to the proxied query from the spoke.

6. The method of claim 1 , wherein configuring a hub to expose the shared data to a proxy user and configuring the proxy user at the hub with access rights to the shared data comprises configuring the proxy user with one or more of the following access rights to the shared data:
read-only access to the shared data;
write, update, and modify access to the shared data;
delete capability of database records within the shared data;
create and record insertion capability to introduce new database records into the shared data.

7. The method of claim 1 , wherein configuring the hub to expose the shared data to a proxy user and configuring the proxy user at the hub with access rights to the shared data comprises configuring the hub as a broadcast hub, wherein the shared data is exposed to the one or more spokes with read-only access for the shared data and no capability to update, modify, insert, or delete database records within the shared data.

8. The method of claim 1 , wherein configuring the hub to expose the shared data to a proxy user and configuring the proxy user at the hub with access rights to the shared data comprises configuring the hub with selective write-back capability, wherein the shared data is exposed to the one or more spokes with read-only access for the shared data via the one or more queryable objects and with no capability to update, modify, insert, or delete database records within the first queryable object and further wherein a second queryable object is exposed to the one or more spokes with create and record insertion capability to introduce new database records into the shared data via the second queryable object.

9. The method of claim 1 , wherein returning the response to the hub having made the request comprises:
querying the shared data stored in the database system via the proxy user at the hub; and
returning query results to the spoke having initiated the request responsive to the request.

10. The method of claim 1 , further comprising:
storing the configuration of the hub, the configuration of the one or more spokes, and the configuration of the proxy user and its access rights to the shared data via a proxy schema.

11. The method of claim 10 , further comprising:
packaging and deploying the proxy schema into a live production environment; and
installing the hub and the one or more spokes within the live production environment according to the stored configuration of the hub, the stored configuration of the one or more spokes, and the stored configuration of the proxy user and its access rights to the shared data as represented by the packaged and deployed proxy schema.

12. The method of claim 11 :
wherein the data stored within the database system comprises customer organization data; and
wherein packaging and deploying the proxy schema into the live production environment comprises releasing updates to custom object definitions to implement cross-organizational data sharing between multiple customer organizations having distinct ownership of separate portions of the customer organization data stored by the database system.

13. The method of claim 11 :
wherein the data stored within the database system comprises customer organization data stored on behalf of a plurality of distinct customer organizations serviced by the system; and
wherein packaging and deploying the proxy schema into the live production environment comprises releasing updates to one or more of:
cross-organizational data sharing object definitions for sharing the data amongst any of the distinct customer organizations;
profiles associated with the shared data or the customer organizations;
permissions associated with the shared data or the customer organizations; and
updates to roles to manage data sharing amongst any of the customer organizations participating with cross-organizational data sharing services provided by the system.

14. The method of claim 11 :
wherein the data stored within the database system comprises customer organization data stored on behalf of a plurality of distinct customer organizations serviced by the system;
wherein records of the shared data which are shared via a hub by any one of the distinct customer organizations are subjected to access controls as defined by the access rights, the access controls being one of (i) access controls on a per-spoke basis or alternatively (ii) common access controls applied to multiple spokes; and
wherein the access controls are defined by and at the direction of a customer organization having ownership of the data being shared and participating in cross-organizational data sharing between multiple customer organizations, each of the multiple customer organizations having distinct ownership of separate portions of the customer organization data stored by the database system.

15. The method of claim 14 , wherein the access controls define any one or more of:
limitations on “CRUD” controlled access rights including (i) CREATE calls for inserting records into the database system, (ii) READ-ONLY access controls, (iii) limitations on UPDATE calls, and (iv) limitations on DELETE statements;
wherein the access controls are configurable by an administrator enabling cross-organizational data sharing for a part

Assignees

• Salesforce Com Inc

Inventors

• Wong Simon Y
• Tsyganskiy Igor
• Calahan Patrick John
• Hersans Alexandre

Classifications

• G06F17/30864

  Physics · mapped topic

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L63/0281 Primary

  Proxies · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F16/951

  Indexing; Web crawling techniques · CPC title