Waking and putting data room connectors to sleep

Abstract

A data exchange system (20) comprises a virtualization environment (22); a plurality of active data space connectors (10c), one of which is operated in a virtual machine (24); a plurality of inactive data space connectors (10d) stored in a non-executable form; and a communication distributor (26) configured to receive data communication (12) for the active data space connectors (10c) and the inactive data space connectors (10d) and to determine whether a data space connector (10c, 10d) to which the data communication (12) is intended is active or inactive. The communication distributor (26) forwards the data communication (12) to the data space connector (10c) if the data space connector (10c) is active.If the data room connector (10d) for which the data communication (12) is intended is inactive, the communication distributor (26) converts the inactive data room connector (10d) into an active data room connector (10c) by copying the inactive data room connector (10d) into a virtual machine (24). The data communication (12) is then forwarded to this active data room connector (10c).

Description

[0001] The invention relates to a data exchange system, a method for data exchange, a computer program and a computer-readable medium.

[0002] A data space is a collection of data that a provider, for example a company, makes available to consumers, for example other companies. The data from a data space is usually subject to certain rules or policies that regulate how consumers handle the corresponding data. To enable automated data exchange, standards have been defined, such as the International Data Spaces Standard (IDS), which describes data space connectors – i.e., special software components with corresponding functions through which providers and consumers can exchange data. For example, the Eclipse Data Space Connector (EDC) is the implementation of such a data space connector that implements the International Data Spaces Standard (IDS).

[0003] For security reasons, a standard may require that only a single data room connector be run in a secure environment, such as a virtual machine. Since larger companies may deploy multiple data room connectors, such as one per business unit, running such data room connectors can be resource-intensive and expensive.

[0004] The object of the invention is to implement the operation of data room connectors in a resource-saving and cost-effective manner.

[0005] This object is achieved by the subject matter of the independent claims. Further embodiments of the invention emerge from the dependent claims and the following description.

[0006] One aspect of the invention relates to a data exchange system. The data exchange system can be implemented on a hardware system that, for example, comprises a plurality of individual computers, such as blade servers. The data exchange system enables data exchange between data providers and data consumers in a data room. To this end, the data exchange system operates a plurality of data room connectors that offer various services for secure and rule-based data exchange with other data room connectors that may be located outside the data exchange system.

[0007] According to one embodiment, the data exchange system comprises a virtualization environment designed to operate a plurality of virtual machines, in particular within the hardware system. A virtual machine provides the resources for running software on it, such as one or more processors, volatile and / or persistent memory, communication interfaces, etc. The associated hardware resources are assigned to the virtual machines by the virtualization environment. From the perspective of a software component, such as the data room connectors described below, a virtual machine is equivalent to a single hardware computer.

[0008] According to one embodiment, the data exchange system comprises a plurality of data space connectors, in particular a plurality of active data space connectors, wherein an active data space connector is operated or executed in one of the virtual machines and a plurality of inactive data space connectors that are stored in a non-executable form, for example in the virtualization environment. An active data space connector, which can be understood as a server process, runs in a virtual machine and is able to process requests and send data. An inactive data space connector can merely be the image of an active data space connector, which is stored in some form in the virtualization environment, but in a non-executable or non-runnable state. This means that no process exists in one of the virtual machines orthe data exchange system that can execute the program code of the data room connector.

[0009] According to one embodiment, an active data room connector is designed to conduct a rule-based data exchange with another data room connector (which may be located outside the data exchange system) based on data communication. This data communication can take place via the Internet or based on TCP / IP. For this purpose, the other data room connector and / or the active data room connector can be authenticated, for example, by exchanging certificates. The active data room connector can provide the other data room connector with data, or information about this data, and rules associated with this data. These rules ("policies") describe how the data must be handled. For example, the rules can define that the data may not be modified, may not be passed on, may not be published, etc.The active data room connector can then send this data to the other data room connector upon request, provided the other data room connector is authorized to retrieve the data.

[0010] The data and the associated information and / or rules can be stored in the virtualization environment, the data exchange system, and / or another external system to which the data room connector has access. The data and the associated information and / or rules can be stored in a data source, such as a database or file system.

[0011] According to one embodiment, the data exchange system comprises a communication distributor configured to receive data communication for the active data space connectors and the inactive data space connectors. The communication distributor is a software component of the data exchange system, which can also run in a virtual machine, for example. Data communication can be carried out via JSON. All requests to the data space connectors, which can be in JSON format, for example, are first received by the communication distributor, which identifies the data space connector for which the data communication or request is intended.

[0012] The communication distributor is designed to determine whether a data room connector for which the data communication is intended is active or inactive, i.e., whether it is an active data room connector or an inactive data room connector. If the data room connector is active, the communication distributor forwards the data communication to this active data room connector. The active data room connector, which is in the running state, can then further process the data communication or the request. In particular, the active data room connector can perform a rule-based data exchange with another data room connector based on the data communication.

[0013] If the Dataroom Connector for which the data communication is intended is inactive, the communication distributor is designed to convert the inactive Dataroom Connector into an active Dataroom Connector. In this case, the Dataroom Connector is in a non-runnable state. The communication distributor can start a virtual machine or select a virtual machine on which no Dataroom Connector is yet running. The inactive Dataroom Connector is then copied to the virtual machine and started. The communication distributor then forwards the data communication to this now activated and active Dataroom Connector. In other words, the communication distributor wakes up the Dataroom Connector by transitioning it from the inactive to the active state.

[0014] Conversely, the communications distributor can also hibernate active data room connectors, or put them into an inactive state when they are inactive. Since the inactive data room connectors do not consume virtual machines and thus processor resources, the data exchange system can be operated more efficiently than if all data room connectors were always active. The associated hardware system can be designed smaller, and costs for hardware and licenses can be saved. This can have significant cost advantages, especially for companies that operate a large number of data room connectors, such as one for each business unit.

[0015] According to one embodiment, an inactive data room connector is stored as a dump in non-executable form. While the dump may contain executable code, this cannot be executed unless copied to a virtual machine. The dump must first be converted into a form so that its contents are executable by a processor. For example, the dump can be packed. The dump can also be stored in a non-executable memory area, for example, a memory area of ​​the virtualization environment and / or the data exchange system, such as a hard disk. The dump includes at least a copy of the executable memory area of ​​the data room connector. When the data room connector is woken up, the dump is copied to a virtual machine. Optionally, the dump can then be deleted. When the data room connector is hibernated, a dump of the virtual machine or the data room connector is created.The virtual machine is then stopped.

[0016] According to one embodiment, the communications distributor is designed to determine whether no data communication has taken place with an active data room connector for a certain period of time and, in this case, to convert the active data room connector into an inactive data room connector, i.e., to hibernate it. The data communication generated by the active data room connectors in the virtualization environment is also monitored by the communications distributor. In particular, the communications distributor monitors whether an active data room connector is processing any data at all or whether it is merely idle. In the second case, the communications distributor hibernates the idle active data room connector. The active data room connector is stored in a non-executable form in the virtualization environment. The associated virtual machine can be stopped and / or deleted.

[0017] According to one embodiment, during euthanasia, a dump of the active data space connector is created, which includes at least one copy of the executable memory area of ​​the active data space connector. The dump is stored in a non-executable form, for example, in a non-executable memory area of ​​the virtualization environment and / or the data exchange system.

[0018] According to one embodiment, an active data room connector is configured to provide a plurality of data contracts to the additional data room connector, wherein a data contract comprises specific provided data and associated rules to which the provided data is subject. Data exchange in the data room can be regulated via specific data structures, so-called contracts, which encode which data is available to which participants and what these participants are permitted to do with this data. The contracts of a data room connector can be created by the owner of the data room connector and stored in the data room connector.

[0019] According to one embodiment, the communications distributor is operated in the virtualization environment. A separate virtual machine can be operated for the communications distributor, which can also be scaled up and down depending on the activity level of the communications distributor (see below).

[0020] According to one embodiment, the virtualization environment is designed to determine the activity level of an active data room connector and to adjust the resources of the associated virtual machine according to the activity level. The activity level can depend on the processor utilization and / or memory utilization of the virtual machine of the data room connector. If the activity level is greater than a threshold, the resources of the virtual machine, such as the number of processors, volatile and persistent memory, can be increased, i.e., the virtual machine is scaled up. If the activity level is less than a threshold, the resources of the virtual machine can be reduced, i.e., the virtual machine is scaled down. However, in contrast to hibernating and waking a virtual machine, the virtual machine is not transferred to an inactive state, which consumes even fewer resources.

[0021] A further aspect of the invention relates to a method for data exchange, which can be performed, for example, by the data exchange system as described herein. It should be understood that features of the method as described herein can also be features of the data exchange system, and vice versa.

[0022] According to one embodiment, the method comprises the steps of: operating a plurality of active data space connectors in virtual machines of a virtualization environment, wherein a plurality of inactive data space connectors are stored in a non-executable form; receiving a data communication for the active data space connectors and the inactive data space connectors; determining whether a data space connector for which the data communication is intended is active or inactive; if the data space connector for which the data communication is intended is active, forwarding the data communication to the active data space connector;Performing a rule-based data exchange with another data room connector based on the data communication through the active data room connector, wherein the other data room connector is authenticated, providing the other data room connector with data and rules associated with this data through the active data room connector, and sending this data to the other data room connector; if the data room connector for which the data communication is intended is inactive, converting the inactive data room connector into an active data room connector by copying the inactive data room connector into a virtual machine, and then forwarding the data communication to this active data room connector.

[0023] According to one embodiment, the method further comprises the steps of: determining whether no data communication has taken place with an active data room connector for a certain period of time and, in this case, converting the active data room connector into an inactive data room connector by storing the active data room connector in a non-executable form in the virtualization environment and stopping the associated virtual machine.

[0024] A further aspect of the invention relates to a computer program that, when executed on at least one processor, performs the method as described herein. In particular, the computer program comprises the software of the virtualization environment, the data room connectors, and the communications distributor. The at least one processor can be provided by the hardware system on which the virtualization environment runs.

[0025] A further aspect of the invention relates to a computer-readable medium on which the computer program is stored. A computer-readable medium can be a hard disk, a USB storage device, a RAM, a ROM, an EPROM, or a FLASH memory. A computer-readable medium can also be a data communications network, such as the Internet, which allows the download of program code.

[0026] In the following, embodiments of the invention are described in detail with reference to the accompanying figures. Fig. Figure 1 schematically shows two data room connectors exchanging data. Fig. 2 schematically shows a data exchange system according to an embodiment of the invention, which also illustrates a method according to an embodiment of the invention.

[0027] The reference symbols used in the figures and their meaning are summarized in the list of reference symbols. Identical or similar parts are generally provided with the same reference symbols.

[0028] Fig. Figure 1 shows two data room connectors 10, 10a, 10b, which are connected via data communication 12. Each data room connector 10 is a server component that, as described herein, can be executed on a virtual machine and offers various services for secure and rule-based data exchange with another data room connector 10.

[0029] For example, each of the data space connectors 10 may be an Eclipse Data Space Connector (EDC) that implements the International Data Spaces Standard (IDS).

[0030] Each of the data room connectors 10 is connected to a data source 14, 14a, 14b, such as a database, a file system, etc., in which the data that the data room connector 10 can provide is stored. The data source 14 can be operated in a system remote from the system in which the associated data room connector 10 is operated. Communication between the data room connector 10 and the associated data source 14 can take place via the Internet.

[0031] Communication between the data room connectors 10 can also take place over the Internet, for example, using TCP / IP and / or HTTP. The data room connectors 10 can use web servers for data communication. Data communication 12 can also take place using JSON (JavaScript Object Notation) or XML.

[0032] A possible data exchange can occur as follows. In step 12a, the data room connector 10b queries the data room connector 10a whether a data exchange can take place. To do so, the two data room connectors 10a, 10b identify and authenticate each other in step 12a or during data communication 12a, for example, by exchanging certificates.

[0033] In step 12b, or data communication 12b, the data room connector 10a provides a list of contracts 16 that can be queried by the data room connector 10b. In this example, the data room connector 10a is the data provider, and the data room connector 10b is the data consumer. A contract 16 contains information about specific data provided by the data room connector 10a, which is subject to certain rules (policies).

[0034] In step 12c or data communication 12c, the data room connector 10b selects a contract 16, and the data room connector 10b provides the associated data 18. The data is loaded by the data room connector 10a from the data source 14a, sent to the data room connector 10b, and then stored, for example, by the data room connector 10b in the data source 14b.

[0035] Fig. Figure 2 shows a data exchange system 20 comprising a virtualization environment 22 operating a plurality of virtual machines 24. A virtual machine 24 is suitable for executing applications, and in particular a data room connector 10b, and provides one or more processors, memory, and / or system resources. The virtualization environment 22, in turn, is executed on real hardware, such as a plurality of blade servers in a data center. An example of such a virtualization environment 22 is Kubernetes.

[0036] A plurality of active or awakened data space connectors 10c are operated in the virtual machines 24. One active data space connector 10c is operated per virtual machine 24. The active data space connectors 10c are executed as at least one process in the respective virtual machine 24.

[0037] Furthermore, the data exchange system 20 comprises a plurality of inactive or dormant data room connectors 10d, which are stored in a non-executable form, for example, directly in the virtualization environment 22.

[0038] An inactive data room connector 10d is stored in a non-executable form only as a dump, for example, in a non-executable memory area. The dump can be the memory contents, i.e., the volatile and persistent memory of the associated virtual machine 24 that operated the data room connector 10d at a time when it was still active. An inactive data room connector 10d is not assigned a virtual machine 24, and there are no processes in the virtual machines that are currently executing the code of the data room connector 10d.

[0039] The data exchange system 20 further comprises a communications distributor 26, which operates as a software component in the data exchange system 20 and in particular in the virtualization environment 22. The communications distributor 26 can run in its own virtual machine.

[0040] The data exchange system 20 can perform a process with the communication distributor 26 that conserves the system resources of the hardware on which the virtualization environment 22 is operated. This is done by hibernating data room connectors 10d that are not currently needed and waking them up when they are required to process requests again.

[0041] For this purpose, the communications distributor 26 receives the data communication 12 from the data space connectors 10c, 10d and determines whether the data space connector 10c, 10d for which the data communication 12 is intended is active or inactive. The data communication 12 or the associated request can contain an identification number of the data space connector 10c, 10d, which can also be stored in a list of the communications distributor 26 containing these identification numbers and the status of the data space connectors 10c, 10d, i.e., active or inactive.

[0042] If the communication distributor 26 determines that the data room connector 10c for which the data communication 12 is intended is active or awake, it forwards the data communication 12 to the corresponding data room connector 10c. This connector then processes the data communication 12 or the associated request.

[0043] If the communications distributor 26 determines that the data room connector 10d, for which the data communication 12 is intended, is inactive or hibernated, it awakens it. The inactive data room connector 10d is then converted into an active data room connector 10c by copying the inactive data room connector 10d into a virtual machine 24. A virtual machine 24 can be created specifically for this purpose. The dump of the inactive data room connector 10d is copied into the virtual machine 24, and the virtual machine is then started. The now active, awakened data room connector 10c is then executed.

[0044] The communication distributor 26 then forwards the data communication 12 to this now active data room connector 10c.

[0045] Conversely, the communications distributor 26 can also determine whether no data communication 12 has taken place with an active data room connector 10c for a certain period of time. In this case, the communications distributor 26 converts the active data room connector 10c into an inactive data room connector 10d, i.e., puts it to sleep. The data room connector 10d is saved in a non-executable form, and the associated virtual machine 24 is stopped. A dump of the active data room connector 10c is created, which includes at least a copy of the executable memory area of ​​the active data room connector 10c. The associated virtual machine 24 is deactivated and / or deleted.

[0046] Furthermore, the virtualization environment 22 can determine the activity level of an active data room connector 10c or its associated virtual machine and adjust the resources of the associated virtual machine 24a, 24b according to the activity level. For example, with an increasing number of requests, greater processor utilization, and / or greater memory utilization, the resources of the virtual machine 24a can be increased, i.e., the virtual machine 24a is scaled up. With a decreasing number of requests, lower processor utilization, and / or lower memory utilization, the resources of the virtual machine 24b can be reduced, i.e., the virtual machine 24b is scaled down.

[0047] Additionally, it should be noted that "comprising" does not exclude other elements or steps, and "a" or "an" does not exclude a plurality. Furthermore, it should be noted that features or steps described with reference to one of the above embodiments may also be used in combination with other features or steps of other embodiments described above. Reference signs in the claims are not to be considered as limitations. Reference symbol 10 Data Room Connector 10a Data room connector as data provider 10b Data room connector as data consumer 10c active (awakened) data room connector 10d inactive (deactivated) data room connector 12 Data communication 12a Data communication for authentication 12b Data communication for the exchange of contracts 12c Data communication for data exchange 14, 14a, 14b Data source 16 Contract 18 data 20 Data exchange system 22 Virtualization environment 24 virtual machines 26 communication distributors

Claims

[1] Data exchange system (20), comprising: a virtualization environment (22) configured to operate a plurality of virtual machines (24); a plurality of active data space connectors (10c), wherein an active data space connector (10c) is operated in one of the virtual machines (24); a plurality of inactive data space connectors (10d) stored in a non-executable form; a communication distributor (26) configured to receive a data communication (12) for the active data space connectors (10c) and the inactive data space connectors (10d) and to determine whether a data space connector (10c, 10d) for which the data communication (12) is intended is active or inactive; wherein the communication distributor (26), when the data room connector (10c) is active, forwards the data communication (12) to the data room connector (10c); wherein the active data space connector (10c) is designed to carry out a rule-based data exchange with a further data space connector (10) based on the data communication (12), wherein the further data space connector (10) is authenticated, to provide the further data space connector (10) with data (18) and rules associated with this data by the active data space connector (10c) and to send this data (18) to the further data space connector (10); wherein, if the data space connector (10d) for which the data communication (12) is intended is inactive, the communication distributor (26) is designed to convert the inactive data space connector (10d) into an active data space connector (10c) by copying the inactive data space connector (10d) into a virtual machine (24) and then forwarding the data communication (12) to this active data space connector (10c). [2] Data exchange system (20) according to claim 1, wherein an inactive data space connector (10d) is stored as a dump in non-executable form, the dump comprising at least a copy of the executable memory area of ​​the data space connector (10d). [3] Data exchange system (20) according to claim 1 or 2, wherein the communication distributor (26) is designed to determine whether no data communication (12) has taken place with an active data space connector (10c) for a certain period of time and, in this case, to convert the active data space connector (10c) into an inactive data space connector (10d) by storing the active data space connector (10c) in a non-executable form and stopping the associated virtual machine (24). [4] Data exchange system (20) according to claim 3, wherein a dump of the active data space connector (10c) is created, which dump comprises at least one copy of the executable memory area of ​​the active data space connector (10c), and the dump is stored in a non-executable form. [5] Data exchange system (20) according to one of the preceding claims, wherein an active data room connector (10c) is designed to provide the further data room connector (10) with a plurality of data contracts (16), wherein a data contract (16) comprises certain provided data (18) and associated rules to which the provided data (18) are subject. [6] Data exchange system (20) according to one of the preceding claims, wherein the communication distributor (26) is operated in the virtualization environment (22). [7] Data exchange system according to one of the preceding claims, wherein the virtualization environment (22) is designed to determine an activity level of an active data space connector (10c) and to adapt resources of the associated virtual machine (24a, 24b) according to the activity level. [8] A method for exchanging data, comprising the steps of: Operating a plurality of active data space connectors (10c) in virtual machines (24) of a virtualization environment (22), wherein a plurality of inactive data space connectors (10d) are stored in a non-executable form in the virtualization environment (22); Receiving a data communication (12) for the active data room connectors (10c) and the inactive data room connectors (10d); Determining whether a data room connector (10c, 10d) for which the data communication (12) is intended is active or inactive; if the data room connector (10c) for which the data communication (12) is intended is active, forwarding the data communication (12) to the active data room connector (10c); Carrying out a rule-based data exchange (12c) with a further data room connector (10) based on the data communication (12) by the active data room connector (10c), wherein the further data room connector (10) is authenticated, providing the further data room connector (10) with data (18) and rules associated with this data by the active data room connector (10c) and sending this data (18) to the further data room connector (10); if the data room connector (10d) for which the data communication (12) is intended is inactive, converting the inactive data room connector (10d) into an active data room connector (10c) by copying the inactive data room connector (10d) into a virtual machine (24), and then forwarding the data communication (12) to this active data room connector (10c). [9] A computer program which, when executed on at least one processor, carries out the method according to claim 8. [10] A computer-readable medium having stored thereon a computer program according to claim 9.

Images