Secure data replication system and method - Patents.com

Abstract

One method embodiment includes receiving input creating a data distribution restriction to be implemented to restrict distribution of data by publisher nodes located in at least one geographic or political area to subscriber nodes outside the at least one geographic or political area. The method then queries a subscription repository that stores data defining subscriptions to publisher node data events on publisher nodes located in the at least one geographic or political area to identify existing subscriptions to data events for the particular data by subscriber nodes located outside the at least one geographic or political area. The method may then output query results that identify existing subscriber node subscriptions that violate the new or newly modified data distribution restriction. The received input may then be stored in a database such that subsequent modifications are conditionally restricted by the new or newly modified data distribution restriction.

Description

[Technical field]

[0001] FIELD OF THE DISCLOSURE This application relates generally to data storage and distribution, and more particularly to secure data replication systems and methods. [Background technology]

[0002] Data protection has become increasingly important in recent years. This importance is heightened by several factors, including easy, fast, and even automatic data duplication, concerns about the privacy of personal data, data security breaches and the associated negative consumer sentiment, export controls, and data privacy regulations. As a result, complying with regulations (e.g., General Data Protection Regulation, or "GDPR," California Consumer Protection Act, or "CCPA," and Health Insurance Portability and Accountability Act, or "HIPAA"), corporate policies, contractual requirements, and consumer expectations is a highly technical, time-consuming, and error-prone process. Such errors can lead to significant fines, adverse news coverage, and loss of customer confidence. Summary of the Invention [Problem to be solved by the invention]

[0003] Various embodiments herein address issues arising from data sharing, privacy, security regulations, laws, and other restrictions in some embodiments by introducing the role or function of a policy inspector. The policy inspector is responsible for storing, managing, evaluating, and acting on predefined policies upon new data replication events, such as when a subscriber data storage node sets up a new subscription to a data event published by a publisher data storage node. Thus, the data replication roles or functions in various embodiments herein are publisher, subscriber, distributor, and policy inspector. Such embodiments not only improve data security and compliance with policies and legal requirements, but also improve system performance by eliminating previously required validation of all data replication events. [Means for solving the problem]

[0004] One embodiment of the method form includes receiving input to create or modify a data distribution restriction that, when implemented, restricts distribution of certain data by publisher nodes located in at least one geographic or political area to subscriber nodes outside the at least one geographic or political area. The method continues by querying a subscription repository that stores data defining subscriptions to publisher node data events on publisher nodes located in the at least one geographic or political area to identify existing subscriptions to data events for the certain data by subscriber nodes located outside the at least one geographic or political area. The method may then output a query result that identifies subscriptions of existing subscriber nodes against the new or newly modified data distribution restriction. The received input may then be stored in a database, such that subsequent modifications to existing subscriptions and creation of new subscriptions are conditionally restricted by the new or newly modified data distribution restriction.

[0005] Another method embodiment includes storing data identifying a data source in a data storage device and designating the data source as a publisher node to which other nodes may subscribe, and a location associated with the source. The method may then store additional data in the data storage device identifying subscriber nodes and locations associated with the subscriber nodes.

[0006] Next, an input may be received by the subscriber node requesting a subscription from the publisher node. In response, some embodiments proceed by retrieving location data from the database identifying the locations of the publisher node and the subscriber node, and further retrieving location-related policies from the database associated with the locations of one or both of the publisher node and the subscriber node, each location-related policy restricting the distribution of data from, to, or between locations specified in the data defining the respective location-related policy. A validation process is then performed for the requested subscription taking into account all retrieved location-related policies. Upon successful validation, the method includes storing data enabling the requested subscription in the database and transmitting a success indication over the network in response to the received subscription request.

[0007] Further exemplary embodiments take the form of a data management system including a computer processor, a network interface device, a data storage device, and instructions stored on the data storage device defining modules of the data management system. The instructions of such embodiments are executable by the computer processor on data local to the data management system and accessible via the network interface device. These modules include various modules. In some such embodiments, the policy repository module stores data defining at least one policy that restricts replication of data by the distributor service module from a publisher node having a first association to a subscriber node having a second association. The distributor service module, in some embodiments, replicates data from the publisher node to each subscriber node upon occurrence of a data event configured to invoke data replication from the publisher node to the subscriber node, subject to compliance with the policy defined in the data stored in the policy repository module.

[0008] In addition, the policy engine module enforces policies defined in data stored in the policy repository module to restrict distribution of data by the distributor service modules. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is a block flow diagram of a method according to an example embodiment. [Diagram 2] FIG. 2 is a block flow diagram of a method according to an example embodiment. [Diagram 3] FIG. 3 is a block flow diagram of a method according to an example embodiment. [Figure 4] FIG. 4 is a logical block diagram of a system in accordance with an exemplary embodiment. [Diagram 5] FIG. 5 is a block flow diagram of a method according to an example embodiment. [Figure 6] FIG. 6 is a block diagram of a computing device in accordance with an exemplary embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Modern data systems often rely on a distributed data model where data is replicated over long distances from one database to another. This replication can occur for different reasons and to address different concerns. For example, current replication models and tools have two key concerns: data integrity, i.e., ensuring that all data is replicated correctly from the source to its intended destination, and performance improvement, i.e., filtering replicated data to reduce latency and overall network throughput. However, such tools do not take into account policies and additional issues that enterprises consider before replicating data. Furthermore, enforcing data sharing and replication policies and legal requirements on every data replication event, as is now the norm, is counterproductive to the performance improvement goals of some such initiatives.

[0011] Blind copying of data from one location to another may violate policies and regulations, such as the European Union's ("EU") Standard Contractual Clauses ("SCCs"), the General Data Protection and Privacy Regulation ("GDPR"), the California Consumer Protection Act ("CCPA"), and the Health Insurance Portability and Accountability Act ("HIPPA"). Other policies and regulations may be for export compliance, national or corporate security concerns or purposes, protection of trade secret data, compliance with contractual obligations, and other similar purposes. Such violations may occur by copying data to a data storage system located in a location prohibited by one of these policies or regulations or by other policies or regulations.

[0012] In most cases, such a breach does not have to be a malicious act. A breach can be done accidentally, for example, when a database administrator is not aware of the regulation or policy and copies data to a prohibited location, or sets up a data replication process that automatically exposes data events to a violating location. For a global enterprise, a breach can occur very easily. Either way, a breach can result in significant fines, adverse news coverage, and loss of customer confidence.

[0013] Various embodiments herein address such issues by introducing a policy inspector role or function that is responsible for storing, managing, evaluating, and acting on predefined policies upon new data replication events, such as when setting up new subscriptions of subscriber data storage nodes to data events published by publisher data storage nodes. Such embodiments validate data replication when subscriptions are set up before problematic data replication occurs. Thus, only established subscriptions can be created, eliminating the consumption of data processing resources for validation upon the occurrence of every data replication triggering event.

[0014] Thus, the roles or functions of data replication in various embodiments herein are publisher, subscriber, distributor, and policy inspector. A publisher is a data storage node configured to publish data from configured data events to a distributor. A subscriber is a data storage node configured to receive data from a particular data event configured by a publisher available from the distributor. A distributor is a mediator that registers subscribers to receive data events, such as new data or updates to existing data, from publishers.

[0015] The role or function of the policy inspector, in some embodiments, is a subordinate or separate element of the distributor and performs several tasks. These tasks may include, among other tasks, storing policy data that includes expressions regarding how various policies, laws, and regulations affect or restrict data sharing and copying, and evaluating subscriptions when subscriptions are created and new policies are defined to at least identify the impact on existing subscriptions and to notify and correct some or all violations. In some embodiments, such tasks utilize stored data that identifies various properties of the publisher and subscriber data storage nodes, such as, for example, geographic markers (geographic markers) that identify one or both of the geographic area (e.g., physical location) and political area (e.g., country, economic region or authority, participation in trade or other treaties, etc.) in which the respective nodes are located. In some such embodiments, the various publisher and subscriber nodes do not require knowledge of other geographic markers since the policy inspector has data in this regard. In some other embodiments, policies may be established for other purposes, such as restricting data sharing that exposes data to certain individuals, people with certain roles such as contractors or citizens, or other demographic information that is subject to export control data restrictions, in which case simply storing data in a location where unauthorized persons may be able to access sensitive data would constitute a violation, regardless of whether the data is actually accessed, etc.

[0016] These and other embodiments are described herein with reference to the drawings. Such embodiments allow for greater, faster, more accurate and predictable compliance, and may be implemented with minimal effort for both database administrators and policy officials.

[0017] In the following detailed description, reference is made to the accompanying drawings, which form a part hereof, and which show, by way of example, specific embodiments in which the present subject matter may be practiced. These embodiments have been described in sufficient detail to enable one skilled in the art to practice them, and it should be understood that other embodiments may be utilized and structural, logical, and electrical changes may be made without departing from the scope of the present subject matter. Such embodiments of the present subject matter may be referred to herein individually and / or collectively under the term "invention" for convenience, but there is no intention to spontaneously limit the scope of this application to any single invention or inventive concept when multiple inventions or inventive concepts are in fact disclosed.

[0018] The following description, therefore, is not to be taken in a limiting sense, and the scope of the inventive subject matter is defined by the appended claims.

[0019] The functions or algorithms described herein are implemented in one embodiment in hardware, software, or a combination of software and hardware. Software comprises computer-executable instructions stored in a computer-readable medium, such as a memory or other type of storage device. Furthermore, the functions described may correspond to modules, which may be software, hardware, firmware, or any combination thereof. Where appropriate, multiple functions are performed in one or more modules, and the described embodiment is merely an example. The software is executed in a digital signal processor, ASIC, microprocessor, or other type of processor operating in a system, such as a personal computer, server, router, or other device capable of data processing, including network interconnection devices.

[0020] In some embodiments, the functions are implemented in two or more specific interconnected hardware modules or devices, with associated control and data signals communicated between and through the modules, or as part of an application specific integrated circuit. Thus, the exemplary process flows are applicable to software, firmware, and hardware implementations.

[0021] 1 is a block flow diagram of a method 100 according to an example embodiment. Method 100 is an example of a method performed by a policy inspector module to validate newly added subscriptions, as defined by an administrator, before they are stored.

[0022] Method 100 may be performed based on input from a database administrator, policy officer, or other individual assigned such task. In some embodiments, method 100 is performed based on input received within a user interface presented by one or more of a web page, a mobile device application, a client deployed application, a command line interface, etc. In any case, the various validation functions of method 100 may be performed on the computing device, remote server, or cloud that receives the input, based on policy data that may be stored on the computing device, remote server, or cloud on which the validation is performed.

[0023] The method 100 includes receiving input that designates a data storage node as a publisher and designates a geographic marker of the location, such as France, where the data storage node is located (102). Because France is a member state of the EU, in some embodiments, the EU designation may be made automatically.

[0024] Next, method 100 includes receiving input (104) to configure a subscriber data storage node to receive replicated data from a publisher of the input received at 102. The subscriber may already be designated with a geographic marker or the input received at 104 may also include a geographic marker, such as Spain, which is also an EU member state. Method 100 also includes receiving input (106) to configure a subscriber data storage node to receive replicated data from a publisher of the input received at 102. The input received at 106 is for a subscriber located in the United States, which is a non-EU member state.

[0025] The next input received may be a command to store the inputs received at 102, 104, and 106, although in other embodiments a store command may be received for each of the inputs received at 102, 104, and 106, or may be executed automatically upon receiving the inputs. Regardless of when the store command input is received, whether manually or automatically, before storing each data replication configuration, the method 100 includes retrieving the relevant policy from a policy repository to determine whether any policies, regulations, etc. have been violated. The retrieval of the policy may depend on a geographic marker associated with each of the publisher and subscriber. In the illustrated embodiment, the publisher is located in France and the first subscriber is located in Spain. Since both are EU member states, there is no GDPR violation and the publisher input received at 102 and the subscription input received at 104 are stored. However, the second subscriber input received at 106 is for a subscriber located in the United States, which is not an EU member state. Thus, the second input received would, for example, violate GDPR regulations (108), and the input received at 106 would not be stored as a subscription. In some embodiments, at each point in the method 100 where an input is stored or not stored, an entry may be made in an audit table or file to track additions, identified violations, deletions, etc., to recreate the audit trail for accountability purposes, and to assist in troubleshooting any issues that may arise.

[0026] 2 is a block flow diagram of a method 200 according to an example embodiment. Method 200 is an example of a method that may be performed to receive input for defining a policy based on a data privacy policy or regulation that an enterprise may set or comply with based on law, regulation, contract, or otherwise.

[0027] Method 200 may be performed based on input from a database administrator, policy officer, or other individual tasked with creating a data representation of a policy stored in a policy repository. In some embodiments, method 200 is performed based on input received within a user interface presented by one or more of a web page, a mobile device application, a client deployed application, a command line interface, etc. In any case, various elements of method 200 may be performed on the computing device, remote server, or cloud that receives the input based on policy data that may be stored on the computing device, remote server, or cloud on which the validation is performed.

[0028] The method 200 includes beginning a policy configuration process (202), such as by retrieving an existing policy in a user interface or opening a blank interface for a new policy. The method 200 continues by receiving input (204) that identifies geographic markers, such as countries, treaty territories or members, political or geographic areas, to which the policy is applicable, and where data replication is to be blocked, tracked, provided with notifications, or other activities to be prevented or performed with respect to data replication between network data nodes, such as relational databases. The received input may also include additional data that associates the policy, either directly in the data or with a description, with a particular law, regulation, corporate policy, contractual obligation, best practice standard, user or customer preference, etc. The method 206 may then store 206 the policy in a policy repository (208).

[0029] In some embodiments of method 200, receiving input identifying a geographic marker (204) may instead include receiving input creating or modifying a data distribution restriction that, when implemented, restricts distribution of certain data by publisher nodes having at least one associated property to subscriber nodes that do not have at least one associated property. The property may not be a geographic marker, but rather data identifying an item of data relating to one or more individuals, such as nationality, an individual's identity, a role of one or a group of people, and other data that can be used to segment individuals or entities. In such embodiments, method 200 is then adapted to restrict data replication from the data store of individuals or entities that are inclusive or exclusive to the identified group based on the item of data.

[0030] 3 is a logical block diagram of a system 300 in accordance with an exemplary embodiment. System 300 is an example of a system in which some embodiments may be deployed. The system includes a cluster of data management systems 302, 304, 306, 308 deployed across different geographies, such as a country, state, economic region, etc. The cluster of data management systems 302, 304, 306, 308 may be or include one or more database management systems, such as a relational database management system, a file replication system, etc.

[0031] As illustrated, the data management system cluster 308 includes two databases 320, 322 configured as publishers to a distributor 310. The distributor operates to provide data subscriptions configured in a subscription repository 312 to replicate data from the databases 320, 322 to databases configured as subscribers in other clusters of the data management systems 302, 304, 306, or from one database 320, 322 to another database 320, 322. The subscriptions comply with policies, as described elsewhere herein, and are stored in a policy repository 318. The policies stored in the policy repository are applied by a policy inspector 316 to ensure that subscriptions in the subscription repository 312 do not violate the policies stored in the policy repository 318.

[0032] When a subscription is created and stored in the subscription repository, some embodiments run a policy inspector 316 to first ensure that the subscription complies with the policy before storing the subscription. However, some embodiments may instead evaluate the subscription before execution of a data replication event by the distributor 310. The data management system cluster 308 also includes an audit trail 314 in which various data regarding the creation, editing, and application of policies and subscriptions is recorded.

[0033] 4 is a block flow diagram of a method 400 according to an example embodiment. Method 400 is an example of a method that may be performed to create a new policy or modify an existing policy.

[0034] For example, method 400 includes receiving input to create or modify a data distribution restriction (402) that, when implemented, restricts distribution of particular data by publisher nodes of a data storage system, such as a relational database management system, located in at least one geographic or political area to subscriber nodes outside the at least one geographic or political area.

[0035] In some embodiments of method 400, as well as some other embodiments herein, the policy or data delivery restrictions may relate to all data from the target database. However, in some cases, the restrictions may relate only to certain types of data, such as financial account data, medical data, identity data, or other data that is less than the entire database. These restrictions may be specified by specific columns or tables of the database. In other embodiments, one or more databases may include metadata that provides characteristic details about the data stored by columns, tables, database views, stored procedures, etc. Thus, in some embodiments, restrictions may be defined with reference to such metadata of some databases, allowing additional logic to be defined within the policy to determine which data to restrict based on a particular policy.

[0036] The method 400 further includes querying (404) a subscription repository that stores data defining subscriptions to publisher node data events on publisher nodes located in the at least one geographic or political area. The querying (404) is performed to identify existing subscriptions to data events for the particular data by subscriber nodes located outside the at least one geographic or political area. The method then outputs (406) query results that identify existing subscriber node subscriptions that violate the new or newly modified data delivery restrictions and stores (408) the received input in a database. As a result, subsequent modifications to existing subscriptions and creation of new subscriptions are conditionally restricted by the new or newly modified data delivery restrictions.

[0037] Some embodiments of method 400 further include suspending existing identified subscriber node subscriptions identified by query 404 that violate new or newly modified data delivery restrictions. In some such embodiments, the list of identified subscriptions may be presented in a user interface and one or more messages may be sent notifying the subscribers of the suspended subscriptions, or other notifications may be generated and presented or transmitted. In other embodiments, the list of existing identified subscriber node subscriptions identified by query 404 may be output to a user or via another communication mechanism, such as email, to notify appropriate parties or entities of the problem.

[0038] 5 is a block flow diagram of a method 500 according to an example embodiment. Method 500 is an example of a method that may be performed to define a subscription and validate the subscription given one data replication restriction embodied in stored policy data.

[0039] The method 500 includes storing (502) data in a data storage device that identifies a data source and designates the data source as a publisher node to which other nodes can subscribe. The stored data also includes data identifying a location associated with the data source. The method 500 further includes storing (504) data in the data storage device that identifies a subscriber node and a location associated with the subscriber node.

[0040] Method 500, in some embodiments, includes receiving input by a subscriber node from a publisher node requesting a subscription (506) and retrieving (508) location data from a database identifying locations of the publisher node and the subscriber node. Method 500 also includes retrieving (510) location-related policies associated with the locations of one or both of the publisher node and the subscriber node from the database. In such embodiments, each retrieved (510) location-related policy restricts distribution of data from, to, or between locations specified in the data defining the respective location-related policy. The retrieved (510) location-related policies are then utilized to validate (512) the requested subscription, and upon successful validation (512) of the requested subscription, method 500 includes storing data enabling the requested subscription in a database and transmitting (514) a success indication over a network in response to the received subscription request.

[0041] In another embodiment of method 500, if validation (512) fails, an error indication is sent over the network in response to the received subscription request and the subscription request is ignored. A further embodiment of method 500 includes receiving and storing in the data storage device an input over the network identifying the data source as storing a type of data that complies with at least one of privacy and security requirements that limit access to and distribution of data stored by the data source.

[0042] 6 is a block diagram of a computing device according to an exemplary embodiment. In one embodiment, multiple such computer systems are employed in a distributed network to perform multiple components in a transaction-based environment. Object-oriented, service-oriented, cloud-based, other architectures, or various combinations thereof, may be used to perform such functions and communicate between multiple systems and components.

[0043] One exemplary computing device in the form of a computer 610 may include a processing unit 602, a memory 604, removable storage 612, and non-removable storage 614. Although the exemplary computing device is illustrated and described as a computer 610, the computing device may include or communicate with different forms of computing devices in different embodiments. For example, the computing device may instead be a computing device running multiple virtual machines, a smartphone, a tablet, a smartwatch, or other computing device that includes the same or similar elements as illustrated and described with respect to FIG. 6. Devices such as smartphones, tablets, and smartwatches are generally collectively referred to as mobile devices.

[0044] Additionally, although various data storage elements are illustrated as part of the computer 610, storage may also or instead include cloud-based storage accessible via a network such as the Internet.

[0045] Returning to the computer 610, the memory 604 may include volatile memory 606 and non-volatile memory 608. The computer 610 may include or have access to a computing environment that includes a variety of computer-readable media, such as volatile memory 606 and non-volatile memory 608, removable storage 612, and non-removable storage 614. Computer storage may include random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM) and electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD ROM), digital versatile disc (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium capable of storing computer-readable instructions.

[0046] The computer 610 may include or have access to a computing environment including an input 616, an output 618, and a communication connection 620. The input 616 may include one or more of a touch screen, a touch pad, a mouse, a keyboard, a camera, one or more device specific buttons, one or more sensors integrated within the computer 610 or coupled to the computer 610 via a wired or wireless data connection, and other input devices. The computer 610 may operate in a network environment using the communication connection 620 to connect to one or more remote computers such as database servers, web servers, and other computing devices. Exemplary remote computers may include personal computers (PCs), servers, routers, network PCs, peer devices, or other common network nodes, and the like. The communication connection 620 may be a network interface device such as an Ethernet card and / or wireless card or circuitry that may be connected to a network. The network may include one or more of a local area network (LAN), a wide area network (WAN), the Internet, and other networks. In some embodiments, the communication connection 620 may also or instead include a transceiver device, such as a BLUETOOTH device, that allows the computer 610 to wirelessly receive and transmit data to other BLUETOOTH devices. For example, in some embodiments, the communication connection 620 may be a BLUETOOTH connection to a wireless headset that includes a speaker and a microphone. Thus, in these embodiments, the BLUETOOTH transceiver device may be an audio output device, as described elsewhere herein.

[0047] Computer-readable instructions stored on a computer-readable medium are executable by the processing unit 602 of the computer 610. Hard drives (magnetic disk or solid state), CD-ROM, and RAM are some examples of articles that include non-transitory computer-readable media. For example, various computer programs 625 or apps, such as virtual machine software, one or more applications and modules that perform one or more of the methods illustrated and described herein, or apps or applications that run on a server, mobile device, within a virtual machine, or accessible via a web browser, may be stored on a non-transitory computer-readable medium.

[0048] A further exemplary embodiment is in the form of a data management system. The data management system of such an embodiment includes a computer processor, a network interface device, a data storage device, and instructions stored on the data storage device and defining modules of the data management system. The instructions of such an embodiment are executable by the computer processor on data local to the data management system and accessible via the network interface device. These modules include a policy repository module, a distributor service module, and a policy engine module.

[0049] In some embodiments, the policy repository module stores data defining at least one policy that restricts replication of data by a distributor service from a publisher node having a first association to a subscriber node having a second association. The distributor service module, in some embodiments, replicates data from the publisher node to each subscriber node upon occurrence of a data event configured to invoke data replication from the publisher node to the subscriber node, subject to compliance with the policy defined in the data stored in the policy repository module.

[0050] In addition, the policy engine generally enforces policies defined in data stored in the policy repository module to restrict distribution of data by the distributor service module, for example, the policy engine validates new or changes to existing data replication subscriptions before storing them, taking into account policies stored in the policy repository, such that only valid subscriber node data replication subscriptions are allowed to be stored.

[0051] Those skilled in the art will readily appreciate that various other changes in the details, materials, and arrangements of parts and method steps described and illustrated to explain the principles of the inventive subject matter may be made without departing from the principles and scope of the inventive subject matter as expressed in the appended claims.

Claims

1. A step of receiving a new data distribution restriction, which, when implemented, creates a data distribution restriction or modifies a current data distribution restriction, and which, when implemented, restricts distribution of particular data by a publisher data storage node to subscriber data storage nodes that do not have at least one associated property; In response to receiving the new data delivery restriction, querying a subscription repository by a policy inspector about subscriptions to the particular data by subscriber data storage nodes that do not have the at least one associated property, resulting in identified existing subscriptions; suspending the identified existing subscriptions by the policy inspector; storing, by the policy inspector, the received new data delivery restrictions in a policy repository, such that subsequent modifications to the existing subscriptions and creation of new subscriptions to the particular data provided by the publisher data storage node are conditionally restricted by the new data delivery restrictions; storing, by the policy inspector, data in the subscription repository, the data defining a new subscription at the subscriber data storage node to a publisher data storage node at the publisher data storage node that is verified to comply with the new data delivery restrictions; A method comprising:

2. A method as described in claim 1, wherein the specific data is data of a type that complies with one or both of privacy requirements and security requirements.

3. A method as described in claim 1, wherein the data identifying the at least one associated property is data identifying at least one geographic or political area of ​​the publisher data storage node and the subscriber data storage node.

4. The method of claim 1, further comprising: storing, on a data storage device, data identifying a data source and designating the data source as a publisher node to which other nodes can subscribe, and an identity property associated with the source; storing data on the data storage device identifying subscriber data storage nodes that have subscribed to the data on the data storage device and identity properties associated with the subscriber data storage nodes; receiving input from the publisher data storage node requesting a subscription by a different subscriber data storage node; obtaining identity property data from the data storage device that identifies the identity properties of the publisher data storage node and the different subscriber data storage nodes; obtaining from the data storage device any identity property-related policies associated with the identity property of one or both of the publisher data storage node and the different subscriber data storage node and the subscriber data storage node, each identity property-related policy restricting distribution of data from the publisher data storage node accessed by the subscriber data storage node and the different subscriber data storage node having the identity property; receiving and storing data defining new location-related policies on said data storage device; applying the new location-related policy to subscriptions stored on the data storage device to identify subscriptions that violate the new location-related policy; suspending the subscriptions that violate the new location-related policy; A method comprising:

5. The method according to claim 4, (i) validating the requested subscription taking into account the obtained identity property related policies; if said verification is successful, storing data enabling said requested subscription in said data storage device and transmitting a success indication over a network in response to said received subscription request; or (ii) if the verification fails, sending an error indication over the network in response to the received subscription request and ignoring the subscription request. The method further comprises:

6. A method as described in claim 4, further comprising the step of receiving input identifying the data source via a network and storing it on the data storage device, the input identifying the data source as storing a type of data that complies with at least one of privacy and security requirements that restrict access to and distribution of data stored by the data source.

7. The method of claim 4, wherein the data source includes at least one of a database instance, a database table, and a column of a database table.

8. The method of claim 4, comprising: the identity properties identify the locations of the publisher data storage node and the subscriber data storage node, respectively; the identity property-related policy is a location-related policy; the identity property-related policies include at least one policy that restricts distribution of data from, to, or between locations and enforces at least one of privacy, security, and export control regulations; method.

9. A method as described in claim 8, wherein the location-related policies restricting the distribution of data from, to, or between locations include at least one policy that implements a consumer privacy policy of the entity on which the method is executed.

10. A network interface device; a data storage device for storing data associated with a data replication subscription by a subscriber data node to a publisher data storage node; a policy repository storing data defining policies restricting replication of data by a distributor service, said replication being from a publisher data storage node having a first association to a subscriber data storage node having a second association; a policy repository for replicating data from a publisher data storage node to each subscriber data storage node, the distributor service being configured to invoke data replication from the publisher data storage node to the subscriber data storage node upon the occurrence of a data event, the data event conforming to a policy defined in data stored in the policy repository, the publisher data storage node and the subscriber data storage node being coupled to the distributor service through the network interface device; Policy Engine and 1. A data management system comprising: applying the policies in the policy repository to restrict distribution of data by the distributor service; querying the data storage device for subscriptions that violate the new policy resulting in identified existing subscriptions; The data management system suspends the identified existing subscription.

11. A data management system as described in claim 10, wherein the policy engine validates new data replication subscriptions or changes to existing data replication subscriptions before storing them, taking into account the policy, so that only valid subscriber data storage node data replication subscriptions are stored.

12. A data management system as described in claim 10, wherein the first association and the second association associate the publisher data storage node and the subscriber data storage node with the respective geographic areas within which the publisher data storage node and the subscriber data storage node are physically located.

13. A data management system as described in claim 12, wherein the geographic area includes one or both of a geographic area and a political area.

14. A data management system as described in claim 13, wherein the policy repository stores data defining at least one policy that restricts data distribution based on one or both of the geographic area and political area of ​​the publisher data storage node.

15. The data management system of claim 14, wherein at least one policy further restricts data distribution based on the geographic and political area of ​​the subscriber data storage node.

16. A data management system as described in claim 14, wherein one policy restricting distribution of data based on one or both of geographic area and political area is a requirement imposed by a government restricting data distribution.

17. A data management system as described in claim 14, wherein a policy restricting distribution of data based on one or both of geographic area and political area definitions is associated with a particular subset of data stored by at least one publisher data storage node.

18. A method performed by a policy inspector module, comprising: In response to receiving data indicating a new data delivery restriction, querying a subscription repository for existing subscriptions (i) to the particular data affected by the new data delivery restriction and (ii) associated with subscriber data storage nodes that do not have at least one associated property, wherein the identified existing subscriptions result in the new data delivery restriction, which, when implemented, restricts delivery of the particular data by a publisher data storage node to the subscriber data storage nodes that do not have the at least one associated property; suspending the identified existing subscription; A method comprising:

19. The method of claim 18, wherein the particular data is of a type that complies with one or both of privacy and security requirements.

20. The method of claim 18, wherein the new data distribution restriction is a geographic restriction.

21. A method as described in claim 20, further comprising the steps of: (i) identifying a first distribution policy associated with the subscriber data storage node, the first distribution policy indicating a geographic region from which the subscriber data storage node is restricted to receive data; and (ii) identifying a second distribution policy associated with a publisher data storage node associated with the identified existing subscription, the second distribution policy indicating a geographic region from which the subscriber data storage node is restricted to send data.

22. The method of claim 21, wherein the new data delivery restriction is a change to one of the first delivery policy or the second delivery policy.

23. A method as described in claim 21, further comprising the step of, in response to receiving a storage command indicating that the specific data should be stored, determining whether either the first distribution policy or the second distribution policy would be violated before storing the specific data based on the storage command.

24. The method of claim 21, further comprising the step of determining whether the existing subscription complies with the first delivery policy and the second delivery policy before storing the existing subscription.

25. A computer processor; The memory where the instructions are stored wherein the instructions, when executed by the computer processor, cause the computer processor to: In response to receiving data indicating a new data delivery restriction, querying a subscription repository for existing subscriptions (i) to the particular data affected by the new data delivery restriction and (ii) associated with subscriber data storage nodes that do not have at least one associated property, wherein the identified existing subscriptions result in the new data delivery restriction, which, when implemented, restricts delivery of the particular data by a publisher data storage node to the subscriber data storage nodes that do not have the at least one associated property; suspending the identified existing subscription; and The system implements a policy inspector module that performs the above.

26. A system as described in claim 25, wherein the specific data is data of a type that complies with one or both of privacy requirements and security requirements.

27. ​​A system as described in claim 25, wherein the new data distribution restriction is a geographic restriction.

28. The system of claim 27, further comprising identifying (i) a first distribution policy associated with the subscriber data storage node, the first distribution policy indicating a geographic region from which the subscriber data storage node is restricted to receive data, and (ii) a second distribution policy associated with a publisher data storage node associated with the identified existing subscription, the second distribution policy indicating a geographic region from which the subscriber data storage node is restricted to send data.

29. The system of claim 28, wherein the new data distribution restriction is a change to either the first distribution policy or the second distribution policy.

30. The system of claim 28, further comprising, in response to receiving a storage command indicating that the specific data should be stored, determining whether either the first distribution policy or the second distribution policy would be violated before storing the specific data based on the storage command.

31. The system of claim 28, further comprising determining whether the existing subscription complies with the first delivery policy and the second delivery policy before storing the existing subscription.

32. A network interface device; a data storage device that stores data associated with a data replication subscription by (i) a subscriber data node to data stored on (ii) a publisher data storage node; a policy repository storing data defining a first distribution policy and a second distribution policy governing replication of data by a distributor service; A policy engine that executes the actions a data management system comprising: In response to receiving data indicating a new data delivery restriction, querying a subscription repository for existing subscriptions (i) to the particular data affected by the new data delivery restriction and (ii) associated with subscriber data storage nodes that do not have at least one associated property, wherein the identified existing subscriptions result in the new data delivery restriction, which, when implemented, restricts delivery of the particular data by a publisher data storage node to the subscriber data storage nodes that do not have the at least one associated property; suspending the identified existing subscription; and a data management system, including:

33. A data management system as described in claim 32, wherein the specific data is data of a type that complies with one or both of privacy requirements and security requirements.

34. A data management system as described in claim 32, wherein the new data distribution restriction is a geographical restriction.

35. A data management system as described in claim 34, wherein the operations further include identifying (i) a first distribution policy associated with the subscriber data storage node, the first distribution policy indicating a geographic region from which the subscriber data storage node is restricted to receive data, and (ii) a second distribution policy associated with a publisher data storage node associated with the identified existing subscription, the second distribution policy indicating a geographic region from which the subscriber data storage node is restricted to send data.

36. The data management system of claim 35, wherein the new data distribution restriction is a change to either the first distribution policy or the second distribution policy.

37. A data management system as described in claim 32, wherein the operation further includes, in response to receiving a storage command indicating that the specific data should be stored, determining whether either the first distribution policy or the second distribution policy would be violated before storing the specific data based on the storage command.

Images