Information level agreements for enterprise cloud data

In some example implementations, a method may include receiving, at a broker, authorization to access at least one cloud service provider; receiving, at the broker, a message representative of at least one of a submission of data to or a request for data from the at least one cloud service provider; determining, by the broker based on a classification of the data, whether to authorize the at least one of the submission of data to or the request for data from the at least one cloud service provider; and forwarding, by the broker based on the determining, the at least one of the submission of data to or the request for data from the at least one cloud service provider, wherein the receiving authorization, the receiving the message, the determining, and the forwarding are implemented by at least one processor. Related systems, methods, and articles of manufacture are also provided.

TECHNICAL FIELD

This disclosure relates generally data classification of cloud data.

BACKGROUND

Although the focus of cloud computing has primarily been on providing Software as a Service, providers of cloud services (“cloud service providers”) have to be able to handle a wide variety of consumption models including so-called “big data” and data from heterogeneous data sources. Big data and heterogeneous data sources may include public data sources, such as RSS feeds, Twitter feeds, social media content, and the like. These public data sources allow big data analysis, providing analytical information, which may be of benefit to an end-user.

SUMMARY

In some example implementations, there is provided a method. The method may include receiving, at a broker, authorization to access at least one cloud service provider; receiving, at the broker, a message representative of at least one of a submission of data to or a request for data from the at least one cloud service provider; determining, by the broker based on a classification of the data, whether to authorize the at least one of the submission of data to or the request for data from the at least one cloud service provider; and forwarding, by the broker based on the determining, the at least one of the submission of data to or the request for data from the at least one cloud service provider, wherein the receiving authorization, the receiving the message, the determining, and the forwarding are implemented by at least one processor.

In some variations, one or more of the features disclosed herein including the following features can optionally be included in any feasible combination. The broker may interface at least one system and the at least one cloud service provider. The broker may include one or more rules to classify data for the at least one system. The broker may classify data based on the one or more rules, the one or more rules classifying data into categories including private data accessible to only the at least one system, public data accessible publically, and peer-sharable data accessible to the at least one system and at least one other system designated by the at least one system. The at least one cloud service provider may include a private cloud storing data classified as private, a public cloud storing data classified as public, and a business cloud storing data classified as sharable among peers.

Articles are also described that comprise a tangibly embodied machine-readable medium embodying instructions that, when performed, cause one or more machines (for example, computers, etc.) to result in operations described herein. Similarly, computer systems are also described that can include a processor and a memory coupled to the processor. The memory can include one or more programs that cause the processor to perform one or more of the operations described herein.

DETAILED DESCRIPTION

While public data sources and its analysis may help identify trends and assist in decision-making, it may be considered problematic to base strategic business decisions solely on public sources of data. Accordingly, private data (for example, private business data, peer business data, and the like) may need to be combined with public data to offer enhanced analysis and thus enhanced decision making. For example, a system processing public data and private data, such as a company's private data and/or data from a company's peers, may achieve better analytic results, when compared to a business system that analyzes only public data or only private data.

In some example implementations, the subject matter disclosed herein relates to making private data available to a system that is also configured to process public data and the like. For example, the subject matter disclosed herein may provide a classifier to classify data into one or more categories to allow distinguishing portions, or pieces, of data that are classified as public data, private business data, peer shareable data, and/or any other category. This classification of data enables the system to provide to, or access data from, a corresponding cloud service. Moreover, the classification may be performed in accordance with one or more information level agreements defining the classification of different types of data or specifically identified data.

FIG. 1depicts an example of a system105, such as a business system, an enterprise resource planning system, a business intelligence system, and/or any other type of system.

The system105may be coupled via one or more networks to one or more cloud service providers, such as a public cloud162, a private cloud164, and a business cloud164. The public cloud162may include a cloud service provider storing information that is publically accessible, and thus not proprietary, private, and/or sensitive. The private cloud164may include a cloud service provider storing information that is private to a business/company, and thus not generally considered sharable outside of the company. And, business cloud164may include a cloud service provider storing information that is not public but shareable within a restricted group, such as peer company's of the company using system105. In the case of peer-sharable data, system105may include in one or more information level agreements the identity of documents and/or types of documents that can be shared and the systems, or identities of, peers authorized to share the peer-sharable data.

System105may also include, or be coupled to, a broker150. Broker150may control the handling of data and, in particular, how the data may be retrieved from a cloud service provider and/or how the data is stored. In some example implementations, the broker150may include rules, such as one or more information level agreements, specifying the types or identities of data that can be shared and specifying the classification levels of different types of data.

The system105may further include a classifier110for classifying data into one or more categories to enable providing data to and/or accessing data from one or more cloud service providers. Although the classifier110is shown at system105, the classifier110may also be located at broker150as well.

System105may be configured to selectively share (for example, under the programmatic control of a user of the business system and the one or more information level agreements) only the data that system105considers sharable via a certain type of cloud. In some example implementations, the sharing of private business data is performed selectively based on classifier110classifying data into one or more levels as disclosed herein. Furthermore, these levels may be specified in one or more information level agreements defining and/or regulating the sharing of data with the clouds162-166.

In some example implementations, portions of information are classified, as noted, by classifier110. For example, classifier110may classify data according to one of a plurality of levels. To illustrate further, the classifier100may classify a certain company's discount list as “private” or level1as the company would not want to share or make public the discounts it gives to its customers. In this example, the data information representative of the discount list may be assigned a classification level of “private” and/or assigned a level “1” classification174. Continuing with the example, the company may, however, consider sales volume for a certain product group in a certain region of the world to be sensitive but not as sensitive as the “private” data, so the sales volume may be assigned a classification level of “2”176, which may represent data that can be shared with a restricted group, such as peer companies. And, the company may assign a classification level of “3”172to information that can be shared publically, and thus not considered private, sensitive, and the like. An example of the type of data that can be classified as “publically” sharable (for example, level3) is revenue that has been disclosed in a quarterly or end-of-year report. Moreover, the classification may be performed in accordance with an information level agreement specifying the levels of access the identities or types of users/entities authorized to access each level, the types of information associated with the levels. For example, the information level agreement may specify the types or identities of data that are private. Specifically, the information level agreement may define that discount list should be treated as level1, private, or the information level agreement may include document identifiers for all of the level1, private data, which in this example would include the discount list, as well as any other levels being used at system100.

Tables 1 and 2 below depict examples of data classified by classifier110. In the example of Tables 1 and 2, the data submitted to and retrieved from the cloud service provider are classified as level2(see, for example, “<InformationLevel>2</InformationLevel>”).

In some example implementations, a broker150may control the handling of data and, in particular, how the data may be retrieved from a cloud service provider, and/or how the data is stored. For example, broker150may evaluate the classification assigned to portions of data and determine whether the data can be stored in a given cloud. For example, broker150may have a set of rules, such as one or more information level agreements, enabling broker150to store data classified as private, level1data private cloud164. Broker150may have a set of rules, such as one or more information level agreements, enabling the broker150to store data classified as level2date to business cloud166, and the set of rules/information level agreements may also enable the broker150to store data classified public level3to public cloud163. For example, publically shareable portions of data may be stored in a public cloud. Referring to the previous example of the company, the private cloud164may be implemented as a cloud service accessible only by the company, a shared business cloud166may be implemented as a cloud service accessible by the company and one or more of its peers, and the public cloud162may be implemented as a cloud service accessible by the company, one or more of its peers, and the public generally.

In some example implementations, a broker150may be implemented by an in-memory database, which may provide enhanced processing speed and classification/brokering, when compared to a broker implemented using other approaches, such as optical or mechanical persistent storage.

In some example embodiments, broker150may also control consumption, such as requesting data from cloud service providers. For example, data may be requested from a cloud under the control of broker150. When this is the case, broker150may mediate between the requestor, such as system105, and the information provider, such as a cloud service provider. In some example implementations, system105may send a request, such as a request formatted in accordance with Table 1, for data to broker150. The broker150analyzes the request and then calls a cloud service provider, such as cloud services162-166in order to determine whether the requesting party may receive the desired data. If so, the data is retrieved from the cloud service provider and then forwarded to the system105.

FIG. 2depicts a process200for requesting data from cloud service providers. The description ofFIG. 2also refers toFIG. 1.

At210, system105may send a message to authorize broker150to request data from one or more cloud service providers. The authorization may specify the categories or classifications of data to be requested from cloud service providers, and may specify the types or identities of cloud service providers where data can be requested. For example, the authorization may specify that only data information representative a classification level of “private” and/or assigned a level “2” classification174may be requested from a cloud service provider authorized to handle that type of data, such as business cloud166. And, these authorizations may be contained in one or more information level agreements.

At220, system105may send a request to broker150to obtain data from a cloud service provider. The request may indicate the specific data being requested, the classification of the requested data, and potential clouds containing the requested data. Table 1 represents an example of a request sent to broker150for data to be obtained from a cloud service provider, such as business cloud service provider166.

At230, the broker150checks repository299including one or more information level agreements to determine whether the request is authorized to be obtained from a certain cloud service provided and returned to systems105. For example, system105may not be allowed to request a specific level of data, such as personalized data.

At240, the status of the ILA check may be returned to system105. This status may be for example a notification of a successful check of an ILA indicating that the transfer of data is authorized and can be initiated, the status may comprise a notification that the requestor is not allowed to request this level of data, in which case no data stream is initiated

At250, the broker150may send a request for data to a cloud service provider. For example, the request may be for peer data stored at business cloud166, in which case the request is sent to a cloud service provider299, which may be an interface that obtains the requested data from business cloud166and returns, at260, the category2peer data to broker150and, at270, to system105.

In some example implementations, broker150may also control the submission of data to cloud service providers. For example, system105may send data to broker150, which determines the classification level of the data. It updates the information level agreement repository for the submitting party, such as system105, registering the amount of data and the corresponding classification level of the data being sent to the cloud. Depending on the classification level of the data being sent to the cloud, broker150may then forwards the data to a data cleansing filter, which removes company specific information.

FIG. 3depicts a process300for providing data to cloud service providers. The description ofFIG. 3also refers toFIG. 1.

At310, system105may send a message to authorize broker150to provide data to one or more cloud service providers. The authorization may specify the categories or classifications of data to be requested from cloud service providers, and may specify the types or identities of cloud service providers where data can be requested. For example, the authorization may specify that only data information representative a classification level of “private” and/or assigned a level “2” classification174may be requested from a cloud service provider authorized to handle that type of data, such as business cloud166.

At320, system105may send a data submission to broker150data to be posted to a cloud service provider. Table 2 represents a submission via broker150of data to be provided to a cloud service provider, such as business cloud service provider166.

The broker150may check, based on one more information level agreements, the data provided by system105to make sure it only includes a classification authorized to be posted to a cloud service provider. For example, the data posted may comprise public data to be posted to a public cloud. In this example, broker150may provide, at330, the data to be posted to a data cleansing filter399that searches for data not authorized for release. In this example, data cleansing filter399may search for private or peer data and, if found, delete the date before submission at340to a cloud service provider299.

When cloud service provider299posts the data, cloud service provider297may acknowledge receipt at350. The broker150may then update the repository299, so that the metadata (for ILA) for system105indicates that certain data has been authorized and posted to a cloud. The broker150may also acknowledge the posting to the cloud by sending a message at370to business system105.

As used herein, the term “user” can refer to any entity including a person or a computer.