Hosted application gateway architecture with multi-level security policy and rule promulgations

Patent metadata

Field	Value
Publication number	US-9747466-B2
Application number	US-201414534623-A
Country	US
Kind code	B2
Filing date	Nov 6, 2014
Priority date	Sep 20, 2013
Publication date	Aug 29, 2017
Grant date	Aug 29, 2017

Abstract

A hosted application gateway server node may be communicatively coupled to backend systems, client devices, and database shards associated with database servers. Through the gateway server node, various services may be provided to managed containers running on client devices such that enterprise applications can be centrally managed. A sharding manager may manage relationships of database items across database shards. Each shard stores a copy of a table representing a split of a relationship. A shard ID mask is included in each item's ID. At query time, the shard ID can be extracted and used to query the correct database. This query routing mechanism allows navigation from one shard to another when multiple items are in a relationship (e.g., share the same resource such as a document). As such, embodiments can eliminate the need for APIs to join in data that span multiple shards.

First claim

What is claimed is:

1. A database system, comprising:
a plurality of database servers configured to provide a plurality of database shards, the plurality of database servers communicatively connected to a cloud-based application gateway server node over a network, the cloud-based application gateway server node configured for providing cloud-based gateway services to a plurality of client devices, the plurality of client devices associated with multiple tenants, the multiple tenants sharing the plurality of database shards, the plurality of database shards storing at least content data of the multiple tenants;
a server comprising a non-transitory memory, including instructions executable by a processor to provide a sharding manager to generate a relationship between or among database items across at least two database shards of the plurality of database shards, the database items associated with a tenant of the multiple tenants, wherein generating the relationship between or among the database items includes the sharding manager performing:
determining at least a first split relationship and a second split relationship of the relationship between or among the database items across the at least two database shards;
maintaining, in a first shard of the at least two database shards, a first split function data structure, the first split function data structure representing the first split relationship and identifying the first split relationship with a unique identifier, wherein the first split function data structure comprises a first split function database table keyed to a first database item in the first shard, and relating the first database item and a second database item across the at least two database shards; and
maintaining, in a second shard of the at least two database shards, a second split function data structure, the second split function data structure representing the second split relationship and identifying the first split relationship with the unique identifier, wherein the second split function data structure comprises a second split function database table keyed to a second database item in the second shard, and relating the second database item and the first database item across the at least two database shards.

2. The database system of claim 1 , wherein the relationship represents a resource lock and wherein the resource lock is defined by the first split function data structure stored in the first shard and the second split function data structure stored in the second shard.

3. The database system of claim 1 , wherein the first database item is associated with a user and wherein the second database item is associated with a document.

4. The database system of claim 1 , wherein the first shard is associated with a user and wherein the second shard is associated with a document.

5. The database system of claim 1 , wherein the first database item is associated with a first identifier encoded with a shard identification mask associated with the first shard.

6. The database system of claim 1 , wherein the relationship is shared among three or more database items in three or more shards and wherein the sharding manager is operable to store a data structure representing a portion of the relationship in each shard, the data structure containing a foreign key referencing an item in a different shard that shares the relationship.

7. The database system of claim 6 , wherein the relationship defines a document share.

8. The database system of claim 1 , wherein the unique identifier is a primary key comprising an identifier to the first database item and an identifier for the second database item.

9. The database system of claim 1 , wherein generating the relationship between or among the database items further includes the sharding manager performing:
generating the unique identifier for the relationship between the database items across the at least two database shards and storing the unique identifier in the first split function database table and the second split function database table.

10. The database system of claim 9 , wherein generating the relationship between or among the database items further includes the sharding manager performing:
storing the unique identifier as a primary key for the first split function database table and a primary key of the second split function database table.

11. The database system of claim 1 , wherein the first split function data structure includes a first identifier and a second identifier, wherein the second split function data structure includes a first identifier and a second identifier, wherein the second identifier of the split function first data structure is associated with a first foreign key referencing the second identifier of the second split function data structure, and wherein the first identifier of the second split function data structure is associated with a second foreign key referencing the first identifier of the first split function data structure.

12. The database system of claim 11 , wherein the first identifier of the first split function data structure and the first identifier of the second split function data structure are associated with a resource and wherein the second identifier of the first split function data structure and the second identifier of the second split function data structure identify an entity having a lock on the resource.

13. A system, comprising:
an application gateway server node communicatively coupled to backend systems, client devices, and database shards operating on a plurality of database servers, the plurality of database servers communicatively connected to a cloud-based application gateway server node over a network, the cloud-based application gateway server node configured for providing cloud-based gateway services to a plurality of client devices, the plurality of client devices associated with multiple tenants, the multiple tenants sharing a plurality of database shards, the plurality of database shards storing at least content data of the multiple tenants; and
a sharding manager embodied on non-transitory computer memory including instructions executable by a processor to generate a relationship between or among database items across at least two database shards of the plurality of database shards, the database items associated with a tenant of the multiple tenants, wherein generating the relationship between or among the database items includes the sharding manager performing:
determining at least a first split relationship and a second split relationship of the relationship between or among the database items across the at least two database shards;
maintaining, in a first shard of the at least two database shards, a first split function data structure, the first split function data structure representing the first split relationship and identifying the first split relationship with a unique identifier, wherein the first split function data structure comprises a first split function database table keyed to a first database item in the first shard, and relating the first database item and a second database item across the at least two database shards; and
maintaining, in a second shard of the at least two database shards, a second split function data structure, the second split function data structure representing the second split relationship and identifying the first split relationship with the unique identifier, wherein the second split function data structure comprises a second split function database table keyed to the second database item in the second shard, and relating the first database item and the second database item across the at leas

Assignees

• Open Text Sa Ulc

Inventors

• Beckman Gregory
• Laird Robert
• Obbard Geoffrey Michael

Classifications

• G06F21/6227 Primary

  where protection concerns the structure of data, e.g. records, types, queries · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L67/5683

  Storage of data provided by user terminals, i.e. reverse caching · CPC title

• H04L67/565

  Conversion or adaptation of application format or content (adding application control or application functional data H04L67/561) · CPC title

• H04L9/40

  Network security protocols · CPC title