Through and around the data catalog to the managed database connectivity (GDBC) to registered data sources

Abstract

The embodiment includes: receiving a request for access to data from a data source at the Database Connectivity (DBC) layer, wherein the data source is registered to a data directory including a data governance artifact, and wherein the request is made via a connection bypassing the data directory. The embodiment also includes: a governance manager at the DBC layer comparing the access permission level of the credentials associated with the request with the access requirements of the requested data included in data protection rules of the governance artifact. The embodiment further includes: the governance manager masking a portion of the data provided in response to the request, wherein this portion of the data has an access requirement where the access permission level of the credentials associated with the request is not met.

Description

Technical Field

[0001] This invention generally relates to methods, systems, and computer program products for data processing. More specifically, this invention relates to methods, systems, and computer program products for implementing data governance for connections to registered data sources via and around data catalogs. Background Technology

[0002] Data governance is a defined process that organizations follow to ensure high-quality data exists throughout its lifecycle. Key focus areas of data governance include availability, usability, integrity, and security. This includes establishing processes to ensure that critical data assets are formally managed across the enterprise and that data can be trusted for decision-making.

[0003] A key part of data governance involves establishing and maintaining governance rules that define how data governance strategies are implemented. For example, some governance rules define governance strategies based on data classes. Data classes describe the type of data contained in data assets, such as data fields or table columns. Some examples of data classes include Social Security Numbers (SSNs), credit card numbers, dates of birth, etc.

[0004] For example, a data governance policy might state: "If a data asset contains a column whose data classification is a Social Security Number (SSN) with at least 75% confidence, then all access to that column should be logged." The confidence level of a data classification refers to the percentage of data in that column that belongs to that data class. In other words, the rule above stipulates that if at least 75% of the data in a column is of the SSN type, then all access to that data asset should be logged.

[0005] Data assets are used to represent data. Examples of data assets include tables in relational databases, files in object storage, or databases storing JavaScript Object Notation (JSON) data. Data sources can be relational databases or object storage and can contain multiple data assets. A catalog is a metadata repository that stores information about data assets. Typically, whenever a data asset is added to the catalog, it is profiled. As part of the profiling process, the data class is identified for each column. Data assets added to the catalog can be, for example, databases or files on external systems. Therefore, these data sources are evaluated to determine how governance rules should be applied to the data within them. Summary of the Invention

[0006] The illustrative embodiments provide data governance for connections to registered data sources via and around a data directory. The embodiments include: receiving a request for access to data from a data source at a Database Connectivity (DBC) layer, wherein the data source is registered to a data directory including a data governance gateway, and wherein the request is made via a connection bypassing the data directory. The embodiments also include: a governance manager at the DBC layer comparing the access permission level of credentials associated with the request with the access requirements of the requested data included in data protection rules of a governance artifact. The embodiments further include: the governance manager masking a portion of data provided in response to the request, wherein that portion of the data has an access requirement where the access permission level of credentials associated with the request is not met. Other embodiments of this aspect include corresponding computer systems, apparatuses, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the embodiments.

[0007] The embodiments include a computer-usable program product. The computer-usable program product includes a computer-readable storage medium and program instructions stored on the storage medium.

[0008] The embodiments include a computer system. The computer system includes a processor, a computer-readable storage device, a computer-readable storage medium, and program instructions stored on the storage medium for execution by the processor via the memory. Attached Figure Description

[0009] The novel features considered to be characteristic of the invention are set forth in the appended claims. However, the invention itself, as well as its preferred modes of use, further objects and advantages, will be best understood by reading in conjunction with the accompanying drawings and by referring to the following detailed description of illustrative embodiments, wherein:

[0010] Figure 1 A cloud computing environment according to an embodiment of the present invention is described;

[0011] Figure 2 An abstract model layer according to an embodiment of the present invention is described;

[0012] Figure 3 A block diagram of an example service infrastructure including a data catalog system according to an illustrative embodiment is depicted;

[0013] Figure 4 A block diagram depicts an example data governance environment according to an illustrative embodiment;

[0014] Figure 5 A block diagram of an example data catalog system according to an illustrative embodiment is depicted;

[0015] Figure 6A block diagram of an example GBBC according to an illustrative embodiment is depicted; and

[0016] Figure 7 A flowchart is depicted according to an illustrative embodiment of an example process for implementing data governance for connections to registered data sources via and around a data catalog. Detailed Implementation

[0017] Data governance is a defined process that organizations follow to ensure high-quality data exists throughout its entire lifecycle. Key focus areas of data governance include availability, usability, integrity, and security. This includes establishing processes to ensure that critical data assets are formally managed across the enterprise and that data can be trusted for decision-making.

[0018] The illustrative embodiments provide data governance for connections to registered data sources via and around a data catalog. Embodiments of a data management platform or database system include a data catalog and a Database Connectivity (DBC) layer. In some such embodiments, the database connectivity layer includes data governance functionality and may be referred to as a managed database connectivity (GDBC) layer. Some such embodiments include receiving a request for access to data from a data source at the DBC layer, wherein the data source is registered to a data catalog that includes data governance artifacts, and wherein the request is made via a connection bypassing the data catalog. In some embodiments, the governance artifacts are stored in a JavaScript Object Notation (JSON) document within the data catalog.

[0019] In some embodiments, the request originates from an application, and the method further includes establishing an application programming interface (API) connection between the application and a DBC layer. In some such embodiments, the method further includes establishing a socket connection between the application and the DBC layer within the API connection. In some such embodiments, the API includes a DBC driver for establishing the API connection. The DBC driver may be an Open Database Connectivity (ODBC) driver. In some such embodiments, the method further includes retrieving the requested data from a data source by the DBC driver.

[0020] The embodiments also include a comparison, by a governance manager at the DBC layer (e.g., a governance manager of GBBC), of the access permission level of the credentials associated with the request and the access requirement of the requested data included in the data protection rules of the governance artifact. In some embodiments, if the access permission level allows access to all requested data, GBBC returns the requested data in response to the request, according to access controls defined in the data catalog. On the other hand, if the access permission level does not allow access to all requested data, GBBC masks or denies access to unauthorized data, as defined by the governance artifact from the data catalog system. For example, in some embodiments, if the access permission level lacks authorization for access to one or more specific data elements but includes authorization for other data elements, GBBC masks the unauthorized data elements and delivers the remaining authorized data elements in response to the request. If the access permission level does not allow authorized access to any one of the data elements(s) of the requested data, GBBC denies access to the data asset.

[0021] In some embodiments, the process further includes generating log entries in the data catalog that report and serve as a record of data requests, such as for compliance and auditing purposes, and include reports of requests to access data, including unauthorized access requests (if applicable). The exact content and format of the logs and log entries can vary depending on the implementation. For example, log entries may include information such as the requester's username, the date and time of the request, the target (i.e., the requested data), the action performed (the requested data was returned, the requested data was partially returned and partially blocked, the request was rejected, etc.), and indications of any unauthorized requests.

[0022] In some embodiments, GDBC also provides automatic synchronization of data assets from the data source to the data catalog. For example, in some embodiments, GDBC detects the presence of new data assets or changes to data assets in the data source, and if detected, automatically synchronizes the new or modified data assets with the data catalog. Therefore, in some embodiments, the process further includes the governance manager detecting that a request to access data includes new data not registered with the data catalog. In some such embodiments, the process includes the governance manager automatically synchronizing the new data with the data catalog, wherein the synchronization includes generating metadata for the new data and storing the metadata in the data catalog.

[0023] For clarity of description and without implying any limitation thereof, some example configurations are used to describe illustrative embodiments. Based on this disclosure, those skilled in the art will be able to conceive of many changes, adaptations, and modifications to the described configurations for achieving the described objectives, and the same changes, adaptations, and modifications are contemplated within the scope of the illustrative embodiments.

[0024] Furthermore, simplified diagrams of the data processing environment are used in the accompanying drawings and illustrative embodiments. In a real computing environment, additional structures or components, not shown or described herein, or structures or components different from those shown but used for similar functions as described herein, may exist without departing from the scope of the illustrative embodiments.

[0025] Furthermore, illustrative embodiments are described merely as examples, for specific actual or hypothetical components. For instance, the steps described in the various illustrative embodiments can be adapted to provide explanations of decisions made by machine learning classifier models.

[0026] Any particular manifestation of these and other similar products is not intended to limit the invention. Within the scope of the illustrative embodiments, any suitable manifestation of these and other similar products may be chosen.

[0027] The examples in this disclosure are for clarity of description only and are not intended to limit the illustrative embodiments. Any advantages listed herein are merely examples and are not intended to limit the illustrative embodiments. Additional or different advantages may be achieved through specific illustrative embodiments. Furthermore, a particular illustrative embodiment may have some, all, or none of the advantages listed above.

[0028] Furthermore, illustrative embodiments can be implemented with respect to any type of data, data source, or access to a data source via a data network. Within the scope of this invention, any type of data storage device can provide data to embodiments of the invention locally within a data processing system or via a data network. Within the scope of the illustrative embodiments, where embodiments are described using mobile devices, any type of data storage device suitable for use with mobile devices can provide data to such embodiments locally within the mobile device or via a data network.

[0029] The use of specific code, comparative explanations, computer-readable storage media, advanced features, training data, designs, architectures, protocols, layouts, diagrams, and tools to describe exemplary embodiments is merely illustrative and does not limit the scope of exemplary embodiments. Furthermore, for clarity, specific software, tools, and data processing environments are used in some instances to describe illustrative embodiments, which are merely examples. Illustrative embodiments can be used in conjunction with other comparable or similar structures, systems, applications, or architectures. For example, other comparable mobile devices, structures, systems, applications, or architectures can therefore be used in conjunction with such embodiments of the invention within the scope of this invention. Illustrative embodiments can be implemented in hardware, software, or a combination thereof.

[0030] The examples in this disclosure are for clarity of description only and are not intended to limit the illustrative embodiments. Additional data, operations, actions, tasks, activities, and manipulations will be contemplated from this disclosure, and the same data, operations, actions, tasks, activities, and manipulations will be contemplated within the scope of the illustrative embodiments.

[0031] Any advantages listed herein are merely examples and are not intended to limit the illustrative embodiments. Additional or different advantages may be achieved through specific illustrative embodiments. Furthermore, certain illustrative embodiments may have some, all, or none of the advantages listed above.

[0032] It should be understood that although this disclosure includes a detailed description of cloud computing, the implementation of the teachings recorded herein is not limited to a cloud computing environment. Rather, embodiments of the invention can be implemented in conjunction with any other type of computing environment now known or developed hereafter.

[0033] Cloud computing is a service delivery model that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, storage, applications, VMs, and services) that can be rapidly provisioned and released with minimal management costs or interaction with service providers. This cloud model may include at least five features, at least three service models, and at least four deployment models.

[0034] The features are as follows:

[0035] On-demand self-service: Cloud consumers can unilaterally and automatically provide computing power (such as server time and network storage) on demand without human interaction with the service provider.

[0036] Wide network access: Capabilities are available on the network and accessed through standard mechanisms that facilitate the use of heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs).

[0037] Resource pooling: A provider's computing resources are grouped into resource pools to serve multiple consumers using a multi-tenant model, where different physical and virtual resources are dynamically allocated and reallocated based on demand. Typically, consumers cannot control or know the exact location of the resources provided, but can specify the location at a higher level of abstraction (e.g., country, state, or data center), thus exhibiting location independence.

[0038] Rapid flexibility: Capabilities can be rapidly and flexibly (in some cases automatically) provided to expand outward quickly and be rapidly released to shrink back down. For consumers, the available capacity often appears unlimited and can be purchased at any time and in any quantity.

[0039] Measurable services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at a level of abstraction appropriate to the service type (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both service providers and consumers.

[0040] The service model is as follows:

[0041] Software as a Service (SaaS): The capability offered to consumers is the ability to use applications running on a provider's cloud infrastructure. These applications can be accessed from various client devices via thin client interfaces such as web browsers (e.g., web-based email). Aside from limited user-specific application configuration settings, consumers neither manage nor control the underlying cloud infrastructure, including the network, servers, operating system, storage, or even individual application capabilities.

[0042] Platform as a Service (PaaS): This provides consumers with the ability to deploy consumer-created or acquired applications on cloud infrastructure using programming languages ​​and tools supported by the provider. Consumers neither manage nor control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but they have control over the applications they deploy and may also have control over the configuration of the application hosting environment.

[0043] Infrastructure as a Service (IaaS): This provides consumers with the capability to deploy and run any software, including operating systems and applications, on the cloud, providing them with processing, storage, networking, and other basic computing resources. Consumers neither manage nor control the underlying cloud infrastructure, but they have control over the operating system, storage, and deployed applications, and may have limited control over chosen network components (e.g., host firewalls).

[0044] The deployment model is as follows:

[0045] Private cloud: A cloud infrastructure that runs exclusively for a single organization. It can be managed by that organization or a third party, and can exist inside or outside the organization.

[0046] Community cloud: A cloud infrastructure shared by several organizations and supporting a specific community with common interests (e.g., mission, security requirements, policies, and compliance considerations). It can be managed by the organization or a third party and can exist inside or outside the organization.

[0047] Public cloud: Cloud infrastructure available to the general public or large industrial groups and owned by organizations that sell cloud services.

[0048] Hybrid cloud: A cloud infrastructure consisting of two or more clouds (private, community, or public) that remain distinct entities but are bound together by standardized or proprietary technologies that enable data and applications to be ported together (e.g., cloud bursts for load balancing between clouds).

[0049] Cloud computing environments are service-oriented, characterized by statelessness, loose coupling, modularity, and semantic interoperability. The core of computing is the infrastructure comprising a network of interconnected nodes.

[0050] See Figure 1 The diagram illustrates a cloud computing environment 50. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 that can communicate with local computing devices used by cloud consumers, such as personal digital assistants (PDAs) or cellular phones 54A, desktop computers 54B, laptop computers 54C, and / or automotive computer systems 54N. The nodes 10 can communicate with each other. They can be physically or virtually grouped (not shown) in one or more networks, such as private clouds, community clouds, public clouds, or hybrid clouds, or combinations thereof, as described above. This allows the cloud computing environment 50 to provide Infrastructure as a Service, Platform as a Service, and / or Software as a Service, without requiring cloud consumers to maintain resources for them on their local computing devices. It should be understood that... Figure 1 The types of computing devices 54A-N shown are intended to be illustrative only. Computing node 10 and cloud computing environment 50 can communicate with any type of computerized device on any type of network and / or network-addressable connection (e.g., using a web browser).

[0051] refer to Figure 2 The diagram depicts a 50-fold cloud computing environment. Figure 1 This provides a set of functional abstractions. It should be understood beforehand. Figure 2 The components, layers, and functions shown are intended to be illustrative only, and embodiments of the invention are not limited thereto. As described, the following layers and corresponding functions are provided:

[0052] The hardware and software layer 60 includes hardware and software components. Examples of hardware components include: a mainframe 61; a RISC (Reduced Instruction Set Computer) based server 62; a server 63; a blade server 64; a storage device 65; and network and networking components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0053] The virtualization layer 70 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual server 71; virtual storage 72; virtual network 73, including virtual private network; virtual application and operating system 74; and virtual client 75.

[0054] In one example, management layer 80 may provide the following functionalities: Resource provisioning function 81 provides dynamic acquisition of computing resources and other resources used to perform tasks in the cloud computing environment. Metering and pricing function 82 provides cost tracking for the use of resources in the cloud computing environment and provides bills or invoices for the consumption of these resources. In one example, these resources may include application software licenses. Security function provides authentication for cloud consumers and tasks and protection for data and other resources. User portal function 83 provides access to the cloud computing environment for consumers and system administrators. Service level management function 84 provides cloud resource allocation and management to meet required service levels. Service level agreement (SLA) planning and enforcement function 85 provides pre-scheduling and procurement of cloud resources according to the SLA for its projected future needs.

[0055] Workload layer 90 provides examples of functionalities that can leverage a cloud computing environment. Examples of workloads and functionalities available in this layer include: map creation and navigation 91; software development and lifecycle management 92; virtual classroom instruction delivery 93; data analytics processing 94; transaction processing 95; and, in the context of the illustrative embodiments of this disclosure, various workloads and functionalities 96 for machine learning processing using training and validation. Furthermore, workloads and functionalities 96 for data governance processing may include operations such as data cataloging and database management as described herein. In some embodiments, workloads and functionalities 96 for data governance processing also work in conjunction with other parts of different abstraction layers, such as those in hardware and software 60, virtualization 70, management 80, and other workloads 90 (such as data analytics processing 94), to achieve different purposes of the disclosed embodiments.

[0056] refer to Figure 3 The figure depicts a block diagram of an example service infrastructure 300 including a data catalog system 306 according to an illustrative embodiment. In some embodiments, the data catalog system 306 is deployed in... Figure 2In workload layer 90. As an example, in some embodiments, data catalog system 306 is implemented as Figure 2 Machine learning processing in 96.

[0057] In the illustrated embodiment, service infrastructure 300 provides services and service instances to user equipment 308. User equipment 308 communicates with service infrastructure 300 via API gateway 302. In various embodiments, service infrastructure 300 and its associated data catalog system 306 serve multiple users and multiple tenants. A tenant is a group of users (e.g., a company) that share public access with specific permissions to a software instance. Service infrastructure 300 ensures that tenant-specific data is isolated from other tenants.

[0058] In some embodiments, user equipment 308 connects to API gateway 302 via any suitable network or combination of networks (e.g., the Internet, etc.) and uses any suitable communication protocol (e.g., Wi-Fi, Bluetooth, etc.). Service infrastructure 300 may be built on cloud computing. API gateway 302 provides access to client applications such as data catalog system 306. API gateway 302 receives service requests from client applications and creates service lookup requests based on these requests. As a non-limiting example, in an embodiment, user equipment 308 is a card reader device that executes access routines to determine whether access to the workspace is permitted in response to a sensed access card.

[0059] In the illustrated embodiment, service infrastructure 300 includes a service registry 304. In some embodiments, service registry 304 looks up service instances of data catalog system 306 in response to service lookup requests, such as a service lookup request from API gateway 302 in response to a service request from user device 308. For example, in some embodiments, service registry 304 looks up service instances of data catalog system 306 in response to a request from user device 308 related to accessing data indexed by data catalog system 306.

[0060] In some embodiments, the request originates from an application on user equipment 308, where user equipment 308 is configured with the application and data catalog system 306 or its DBC layer (e.g., ...). Figure 4 An API connection is established between the user equipment 308 and the data directory system 306 or its DBC layer in the API connection. In some such embodiments, the method further includes establishing a socket connection between the user equipment 308 and the data directory system 306 or its DBC layer in the API connection. In some such embodiments, the API includes a DBC driver for establishing the API connection. The DBC driver may be an Open Database Connectivity (ODBC) driver. In some such embodiments, the user equipment 308 is connected to the data source via the DBC driver.

[0061] In some embodiments, service infrastructure 300 includes one or more instances of data directory system 306. In some such embodiments, each of the multiple instances of data directory system 306 operates independently on multiple computing systems. In some such embodiments, data directory system 306, along with other service instances of data directory system 306, is registered in service registry 304.

[0062] In some embodiments, the service registry 304 maintains information about the status or health of each service instance, including performance information associated with each service instance. For example, such performance information may include several types of performance characteristics for a given service instance (e.g., cache metrics, etc.). In some embodiments, the extended service registry 304 sorts service instances based on their respective performance characteristics and selects the highest-ranked service instance for a classification request. In some such embodiments, if a service instance becomes unresponsive or unhealthy, the service registry will no longer provide its address or information about that service instance to other services.

[0063] refer to Figure 4 The figure depicts a block diagram of an example data governance environment 400 according to an illustrative embodiment. In a particular embodiment, the data governance environment 400 is for... Figure 1 The data governance processing workload and 96 instances.

[0064] In some embodiments, the data governance environment 400 includes a data catalog system 402, which includes governance artifacts 404 and technical assets (metadata) 406. In some embodiments, the data catalog 402 is a detailed list of some or all of the data assets in an organization and can be provided to help data professionals quickly find the most suitable data for any analytical or business purpose.

[0065] In some embodiments, technical assets 406 include metadata (data describing or summarizing the data) for creating an information-searchable inventory of the organization's data assets. In the illustrated embodiment, data catalog 402 also includes governance artifacts 404, which may be in the form of business metadata.

[0066] In the illustrated embodiment, governance artifact 404 includes governance policies, governance rules, data protection rules, a glossary of business terms, data rules, data classifications, etc. These are typically created by the organization to enable data assets to be better managed, maintained, protected, visualized, and reported (e.g., for audit and / or compliance purposes).

[0067] In the illustrated embodiment, the data catalog system 402 communicates with the governance database connectivity module 416 (also more simply referred to as GDBC 416) and one or more data sources 418. GDBC 416 provides database drivers and data governance functionality. Ideally, user devices and applications (such as user device 408 and application 410) access the organization's data via the data catalog 402. This allows governance artifacts 404 to enforce governance policies and rules in an attempt to access the data.

[0068] In some cases, user devices and applications (such as user device 412 and application 414) may attempt to access external data sources directly (i.e., without going through the data catalog system 402). However, such access will still be subject to data governance due to the integration of data governance functions with the database driver in GBBC416.

[0069] See Figure 5 The figure depicts a block diagram of an example data catalog system 500 according to an illustrative embodiment. In a particular embodiment, the data catalog system 500 is... Figure 4 An example of data catalog system 402. Data catalog system 500 also includes, as... Figure 4 The example of the treatment workpiece 404 is the treatment workpiece 502, and includes as a treatment workpiece 502. Figure 4 Example of technical asset (metadata) 406.

[0070] In the illustrated embodiment, governance artifact 502 includes several categories of policies, rules, and other management elements, such as governance policies, governance rules, reference data, metadata synchronization policies, business terms, classifications, data protection rules, data classes, and processes for things like assigning business terms to assets, classifying sensitive data, and protecting sensitive data. For example, a classification is a governance artifact that can be used to categorize data assets based on an organization's sensitivity or confidentiality level. Classifications can be used like tags to control the grouping of assets within an organization. Unlike data classes, which include logic for matching data values, classifications are more like tags. Examples of classifications can include personally identifiable information, sensitive information, and confidential information. In practice, an organization can maintain, change, or add classifications associated with that organization.

[0071] For example, organizations can create classifications of restricted, private, and public data based on their own corporate data security guidelines. To protect highly sensitive data, organizations can create data protection rules in governance artifact 502 to prevent certain users from accessing specific data assets based on the data asset classification and the user's authorization level.

[0072] In some embodiments, within the data catalog system 500, categories can describe the sensitivity of an entire data asset to help catalog members understand the asset. Organizations can use categories to describe business terms, data classes, reference datasets, and governance rules. In some embodiments, when the data catalog system 500 indexes or synchronizes with a new data asset, the data catalog system 500 automatically profiles data classes and assigns them to the new data asset.

[0073] In some embodiments, asset classifications and data classes are included in the data protection rules of governance artifact 502 to identify the types of data to be controlled. Governance artifact 502 may also allow asset classifications and data classes to be renamed by associating them with a glossary of business terms.

[0074] In some embodiments, technical assets 504 include metadata about data sources (such as one or more data sources 510), in the form of imported metadata, quality scorecards, and / or knowledge repositories. These assets can be accessed via data catalog system 500 using self-service 506, for example, to search for and find relevant data, for workflow and collaboration, and for self-service data preparation. These assets can also be accessed via data catalog system 500 using data consumers 508, for purposes such as data virtualization, user reporting, or SQL access and data streaming. Access is managed by GDBC 512 using governance artifact 502. Furthermore, when user device 514 attempts to access external data source 510 without going through data catalog system 500, GDBC 512 governs access to external data source 510.

[0075] The illustrative embodiments provide data governance for connections to a registered data source 510 via and around a data directory 500. The embodiments include receiving requests for access to data from the data source 510 at a Database Connectivity (DBC) layer (e.g., GBBC 512), wherein the data source is registered to a data directory 500 including a data governance artifact 502, and wherein the requests are made via a connection bypassing the data directory 500 (e.g., a connection from user device 514 to data source 510 bypassing the data directory 500). In some embodiments, the governance artifact 502 is stored in a JavaScript Object Notation (JSON) document within the data directory 500.

[0076] refer to Figure 6 This figure depicts a block diagram of an example GBBC 600 according to an illustrative embodiment. In a particular embodiment, GBBC 600 is... Figure 5 GBBC 512 or Figure 4 An example of GBBC 416. GBBC 600 communicates with data catalog system 610, which is... Figure 5Data directory system 500 or Figure 4 Example of a data catalog system 402.

[0077] In the illustrated embodiment, GDBC 600 includes a governance manager 602, a driver 604 for data source(s) 608, and a database driver 606. In this embodiment, the governance manager 602 uses a governance artifact 612 to provide data privacy implementation, data protection implementation, and general governance policy standards, such as authorizing or denying requests for data from data source 608. The driver manager 604 and database driver 606 allow a data catalog 610 to connect to data source 608, for example, to update / synchronize technical assets 614. The driver manager 604 provides a connection at the DBC layer between the governance manager 602, the access permission level for credentials associated with the request, and the access requirements for the requested data included in the data protection rules of the governance artifact. The embodiment also includes a portion of data provided in response to a request by the governance manager 602, wherein this portion of data has an access requirement where the access permission level for credentials associated with the request is not met. In some embodiments, the process further includes generating log entries in the data catalog that act as a record of data requests, for example for compliance and auditing purposes, and include reports of unauthorized access requests, if applicable. The exact content and format of logs and log entries can vary depending on the implementation. For example, log entries may include information such as the requester's username, the date and time of the request, the target (i.e., the data requested), the action performed (the requested data was returned, the requested data was partially returned or partially blocked, the request was rejected, etc.), and indications of any unauthorized requests.

[0078] In some embodiments, the process further includes the governance manager 602 detecting that the request to access data includes new data not registered with the data directory. In some such embodiments, the process includes the governance manager automatically synchronizing the new data with the data directory, wherein the synchronization includes generating metadata for the new data and storing the metadata in the data directory.

[0079] refer to Figure 7 This figure depicts a flowchart of an example process 700 for implementing data governance for connections to registered data sources via and around a data catalog, according to an illustrative embodiment. In a particular embodiment, GBBC 416, 512, or 600 performs process 700.

[0080] In this embodiment, at block 702, the process receives a request at the Database Connectivity (DBC) layer to access data from a data source via a connection bypassing the data directory. Next, at block 704, the process compares the access permission level of the credentials associated with the request with the access requirements of the requested data through a governance manager at the DBC layer. Next, at block 706, the process determines, for example, whether the data request includes an unauthorized request based on the access permission level of the credentials from block 704.

[0081] If no authorization defect is detected (No from box 706), the process continues to box 707, where GBBC delivers the requested data in response to the request, based on access controls defined in the data catalog. Conversely, if an unauthorized data request is detected (Yes from box 706), the process continues to box 708, where GBBC masks or denies access to the unauthorized data, as defined by governance artifacts from the data catalog system. For example, in some embodiments, if an access permission level lacks authorization for access to one or more specific data elements but includes authorization for other data elements, GBBC masks the unauthorized data elements and delivers the remaining authorized data elements in response to the request. If the access permission level does not allow authorized access to any of the requested data elements, GBBC denies access to the data asset.

[0082] Next, in box 710, the process generates a log entry in the data catalog that acts as a record of data requests, such as for compliance and auditing purposes, and includes reports of unauthorized access requests (if applicable). Next, in box 712, the process determines whether the data request references data not registered in the data catalog. If so, in box 714, the process automatically synchronizes the new data with the data catalog.

[0083] The following definitions and abbreviations will be used to interpret the claims and description. As used herein, the terms “comprising,” “including,” “having,” or “containing,” or any other variations thereof, are intended to cover a non-exclusive inclusion. For example, a composition, mixture, process, method, article, or apparatus that comprises a list of elements is not necessarily limited to those elements, but may include other elements not expressly listed or inherent to such composition, mixture, process, method, article, or apparatus.

[0084] Furthermore, the term "illustrative" is used herein to mean "serving as an example, instance, or illustration." Any embodiment or design described herein as "illustrative" is not necessarily to be construed as preferred or advantageous over other embodiments or designs. The terms "at least one" and "one or more" should be understood to include any integer greater than or equal to one, i.e., one, two, three, four, etc. The term "multiple" should be understood to include any integer greater than or equal to two, i.e., two, three, four, five, etc. The term "connection" can include both indirect "connection" and direct "connection."

[0085] The use of terms such as "an embodiment," "embodiment," and "exemplary embodiment" in the specification indicates that the described embodiment may include a particular feature, structure, or characteristic; however, each embodiment may or may not include that particular feature, structure, or characteristic. Furthermore, such phrases do not necessarily refer to the same embodiment. Moreover, when a particular feature, structure, or characteristic is described in connection with an embodiment, it is believed that the influence of combining it with other embodiments (whether explicitly described or not) on such feature, structure, or characteristic is within the knowledge of those skilled in the art.

[0086] The terms “about,” “substantially,” “roughly,” and variations thereof are intended to include the degree of error associated with a measurement of a specific quantity based on the equipment available at the time of filing this application. For example, “about” may include a range of ±8%, 5%, or 2% of a given value.

[0087] Various embodiments of the invention have been described for illustrative purposes, but this description is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein has been chosen to best explain the principles of the embodiments, their practical application, or technical improvements superior to those found in the market, or to enable those skilled in the art to understand the embodiments described herein.

[0088] Various embodiments of the invention have been described for illustrative purposes, but this description is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein has been chosen to best explain the principles of the embodiments, their practical application, or technical improvements superior to those found in the market, or to enable those skilled in the art to understand the embodiments described herein.

[0089] Therefore, computer-implemented methods, systems, or apparatuses, as well as computer program products, are provided in the illustrative embodiments for managing participation and other related features, functions, or operations in online communities. When describing embodiments or portions thereof with respect to the type of device, the computer-implemented methods, systems, or apparatuses, computer program products, or portions thereof are adapted or configured for use with suitable and comparable performance to devices of that type.

[0090] Where embodiments are described as being implemented within an application, the delivery of the application in a Software as a Service (SaaS) model is envisioned within the scope of the illustrative embodiments. In the SaaS model, the ability to implement an application in an embodiment is provided to a user by executing the application within a cloud infrastructure. Users can access the application using various client devices through thin-client interfaces such as web browsers (e.g., web-based email) or other lightweight client applications. Users do not manage or control the underlying cloud infrastructure, including the network, servers, operating system, or storage of the cloud infrastructure. In some cases, users may not even have the ability to manage or control the SaaS application. In some other cases, the SaaS implementation of the application may allow for limited user-specific application configuration settings that may be anomalous.

[0091] This invention can be a system, method, and / or computer program product at any possible level of technical detail integration. The computer program product may include one or more computer-readable storage media having computer-readable program instructions thereon for causing a processor to perform aspects of the invention.

[0092] Computer-readable storage media can be tangible devices capable of holding and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example, but not limited to, electronic storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable optical disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices such as punch cards or recessed structures on which instructions are recorded, and any suitable combination of the foregoing. As used herein, computer-readable storage media should not be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0093] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a suitable computing / processing device, or downloaded via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network) to an external computer or external storage device. The network may include copper cables, optical fibers, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to a computer-readable storage medium within the respective computing / processing device.

[0094] Computer-readable program instructions used to perform the operations of this invention may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, integrated circuit configuration data, or source code or object code written in any combination of one or more programming languages ​​(including object-oriented programming languages ​​such as Smalltalk, C++, etc.) and procedural programming languages ​​(such as the "C" programming language or similar programming languages). The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer via any type of network (including a local area network (LAN) or a wide area network (WAN)) or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuits including, for example, programmable logic circuits, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs) may execute computer-readable program instructions by utilizing state information from the computer-readable program instructions to personalize the electronic circuits in order to perform aspects of this invention.

[0095] Various aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0096] These computer-readable program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / actions specified in one or more blocks of a flowchart and / or block diagram. These computer-readable program instructions may also be stored in a computer-readable storage medium that can direct a computer, programmable data processing apparatus, and / or other device to operate in a particular manner, such that the computer-readable storage medium in which the instructions are stored includes an article of writing comprising instructions for implementing aspects of the functions / actions specified in one or more blocks of a flowchart and / or block diagram.

[0097] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer-implemented process, such that the instructions executed on the computer, other programmable apparatus or other device perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0098] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of instructions comprising one or more executable instructions for implementing a specified logical function. In some alternative embodiments, the functions indicated in the blocks may occur in a non-consecutive order as shown in the figures. For example, two blocks shown consecutively may actually be executed substantially simultaneously, or these blocks may sometimes be executed in reverse order, depending on the functions involved. It will also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented by a dedicated hardware-based system that performs the specified function or action or executes a combination of dedicated hardware and computer instructions.

[0099] Embodiments of the present invention can also be delivered as part of service engagement with client companies, non-profit organizations, government entities, internal organizational structures, etc. Aspects of these embodiments may include configuring computer systems to perform and deploy software, hardware, and network services that implement some or all of the methods described herein. Aspects of these embodiments may also include analyzing client operations, creating recommendations in response to the analysis, building systems to implement portions of the recommendations, integrating the systems into existing processes and infrastructure, metering system usage, allocating costs to users of the system, and accounting for system usage. While the above embodiments of the invention have been described by setting forth their respective advantages, the invention is not limited to their specific combinations. Rather, such embodiments can be combined in any manner and number according to the intended deployment of the invention without loss of their beneficial effects.

Claims

1. A computer-implemented method, comprising: The database connectivity (DBC) layer associated with the data catalog system bypasses the connection to the data catalog system to receive requests for access to data from the data source, wherein the data source is registered to the data catalog system, which includes data governance artifacts. The governance manager at the DBC layer compares the access permission level of the credentials associated with the request with the access requirements for the requested data included in the data protection rules of the governance artifact; and In response to an access request where a portion of the data has an access level for the credentials associated with the request that is not met, the governance manager masks the portion of the data provided in response to the request.

2. The method of claim 1, further comprising: Generate log entries, which include reports of requests to access data, including unauthorized access requests.

3. The method of claim 1, further comprising: The governance manager detects that the request to access data includes new data that has not been registered with the data catalog system.

4. The method of claim 3, further comprising: The governance manager automatically synchronizes the new data with the data directory system, wherein the synchronization includes: generating metadata of the new data, and storing the metadata in the data directory system.

5. The method of claim 1, wherein, The request originates from an application, and the method further includes: establishing an application programming interface (API) connection between the application and the DBC layer.

6. The method of claim 5, further comprising: Establish a socket connection between the application and the DBC layer in the API connection.

7. The method of claim 6, wherein, The API includes a DBC driver for establishing API connections.

8. The method according to claim 7, wherein, The DBC driver is an Open Database Connectivity (ODBC) driver.

9. The method of claim 7, further comprising: The requested data is retrieved from the data source by the DBC driver.

10. The method according to claim 1, wherein, The governance artifact is stored in a JavaScript object representation JSON document in the data catalog system.

11. A computer program product comprising one or more computer-readable storage media and program instructions commonly stored on the one or more computer-readable storage media, the program instructions being executable by one or more processors to cause the one or more processors to perform operations according to any one of claims 1 to 10.

12. A computer system, comprising: One or more processors and one or more computer-readable storage media, and program instructions commonly stored on the one or more computer-readable storage media, the program instructions being executable by the one or more processors to cause the one or more processors to perform the operation of the method according to any one of claims 1 to 10.

13. A data management platform, comprising: One or more processors; One or more computer-readable storage media; as well as Program instructions co-stored on the one or more computer-readable storage media, the program instructions being executable by one or more processors to cause the one or more processors to perform operations, the operations including: The database connectivity (DBC) layer associated with the data catalog system bypasses the connection to the data catalog system to receive requests for access to data from the data source, wherein the data source is registered to the data catalog system, which includes data governance artifacts. The governance manager at the DBC layer determines whether the access level of the credentials associated with the request satisfies the access requirements for the requested data, which are included in the data protection rules of the governance artifact; and In response to determining that the access permission level fails to meet the access requirements, the governance manager rejects the request to access the data.

14. The data management platform according to claim 13, wherein, The operation further includes: generating log entries, the log entries including reports of requests to access data, including unauthorized access requests.

15. A data management platform, comprising: One or more processors; One or more computer-readable storage media; as well as Program instructions co-stored on the one or more computer-readable storage media, the program instructions being executable by one or more processors to cause the one or more processors to perform operations, the operations including: The managed database connectivity GDBC layer associated with the data catalog system bypasses the connection to the data catalog system to receive requests for access to data from a data source, wherein the data source is registered to the data catalog system, which includes data governance artifacts. The GBBC layer determines whether the access permission level of the credentials associated with the request satisfies the access requirement for at least a portion of the requested data, the access requirement being included in the data protection rules of the governance artifact; and If the GBBC layer determines that the access permission level satisfies the access requirements of the first part of the requested data but not the access requirements of the second part of the requested data, the GBBC layer masks the second part of the data that is only provided in response to the request.

16. The data management platform according to claim 15, wherein, The operation further includes: if the GBBC layer determines that the access permission level does not meet the access requirements of all requested data, the GBBC layer rejects the request to access the data.

17. The data management platform according to claim 15, wherein, The operation further includes: generating log entries, the log entries including reports of requests to access data, including unauthorized access requests.

Images