JP3474453B2 - Method and system for securely synchronizing multiple copies of workspace elements in a network - Google Patents

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to computer networks, and more particularly to a system for safely synchronizing multiple copies of workspace (work area) elements such as files in a secure network. Regarding the method.

[0002]

Data consistency is an important concern for computer users. For example, a user may dare to use an older version when maintaining many individually modifiable copies of a document. Moreover, by the time the user becomes aware of the data inconsistency, communication errors or data loss between the parties may have occurred. In such cases, the user must spend more time reconciling the unmatched data.

[0003]

The problem of data inconsistency is exacerbated when multiple copies of a document are maintained at different network locations. For example, with network security systems such as traditional firewall technology,
The user can only access certain ones of these network locations. However, without access to other sites, the user cannot be sure that the versions on accessible sites are up to date.

Therefore, there is a need today for a system and method for providing data consistency to users and for synchronizing multiple copies of workspace elements such as documents, especially in a secure network environment. ing.

[0005]

To solve the above problems, the present invention provides a system and method for synchronizing multiple copies of workspace elements in a secure network environment. To do. The secure network environment includes a wide area server connected to a large number of clients. By using the system and method of the present invention, these clients are able to
rewall: Automatically sync workspace data across multiple sites, whether or not they are protected by a firewall.

The system according to the invention comprises an overall synchronization module provided at the client site,
The global synchronization module operates within the first firewall and consults the first version information to determine if the first workspace element has changed. The system further comprises a synchronization agent provided on the wide area server, the synchronization agent operating outside the first firewall and providing an individually modifiable copy of the first workspace element. Send second version information to the global sync module indicating whether it has been modified. A sync start module provided at the client site operates within the first firewall and activates the global sync module and sync agent when predetermined criteria are met. The system further comprises means for generating a preferred version from the first workspace element and the copy by comparing the first version information and the second version information,
Means for storing the preferred version in a first storage and a second storage.

In addition, the system also performs processing if both the workspace element and the copy have changed since the last (ie, latest) synchronization date and time. Correspondingly, content-based synchronization modules
Determine a preferred version or perform a response operation such as storing the first workspace element and the copy in the first storage and the second storage.

The method according to the present invention is characterized by checking the first version information indicating whether the first workspace element stored in the first storage in the firewall has been modified. Generating test results,
By examining a second version information indicating whether an individually modifiable copy of the first workspace element stored in a second storage outside the firewall has been modified. , Generating a second inspection result. The method further comprises activating a synchronization process from within the firewall when a predetermined criterion is met, and based on the first and second inspection results, the first workspace element. And generating a preferred version from the copy, and storing the preferred version in the first storage and the second storage.

The system and method of the present invention enables the synchronization of workspace data between multiple sites using a trusted third party. Thus, client users who maintain worksites, homesites, offsite and wide area server sites can synchronize workspace data or portions thereof among all four sites. Further, the global synchronization module may be configured to perform the work at the user's request, at a particular date and time, such as while the user is commuting, or after a particular action, such as a logoff or logon by the user. A predetermined criterion may be set to control when the sync start module should start the sync process so as to synchronize the space data. Since the system and method according to the present invention operate on the Internet, the above synchronization is possible over any distance. Also, since the synchronization is initiated from within the firewall, typical firewalls that block incoming communication do not interfere with the synchronization of workspace data. Also, since the user's preference can be preset, the system and method according to the present invention
It can operate without being accompanied by the client user.

[0010]

BEST MODE FOR CARRYING OUT THE INVENTION An embodiment of the present invention will be described in detail below with reference to the accompanying drawings. FIG. 1 is a block diagram showing a (secure) data synchronization network 100 having a security function, which is connected to a wide area (global) server 120 via a communication channel 110 such as the Internet. Includes a first site such as. The wide area server 120 is also connected to a second site such as a corporate local area network (LAN) 135 via a communication channel 125 such as the Internet. The wide area server 120 is protected by a wide area fire wall 115, and the corporate LAN 1
35 is protected by a corporate fire wall 130.

The corporate LAN 135 is a corporate signal bus 1
40, the corporate signal bus 140 connects the corporate firewall 130 with an email server 145 having email data 165 and file data 170.
File server 150 having, calendar data 17
5 to the calendar server 155, and the desktop computer 160 having the user data 180. The email data 165, the file data 170, the calendar data 175, the user data 180, and a part thereof may be stored in various different positions, for example, may be stored locally in the desktop computer 160. . The email data 165, the file data 170, the calendar data 175, and the user data 180 are merely examples, and are collectively referred to as “workspace data” below. As will be appreciated by those skilled in the art, the "workspace data" may include other types of data such as application programs. Further, each of the email data 165, the file data 170, the calendar data 175, and the user data 180 may be divided into workspace elements, where each of the workspace elements has specific version information 225 (FIG. 2). Will be described later). Therefore, each email, file, calendar, etc. can be referred to as a workspace element in the workspace data.

Individually modifiable copies of workspace data 185 (here workspace data 123
Means that the wide area server 1 can be easily accessed by the user from the remote computer terminal 105.
Stored in 20. The workspace data 123 that is a copy is an individually modifiable copy of each workspace element in the workspace data 185 and an individually modifiable copy of the version information 255 (FIG. 2) (here, version information 124. Is included).

The network 100 further comprises a synchronization means, which is the corporate LAN 135.
It includes a basic system 190 stored internally (eg, desktop computer 160) and a synchronization agent 126 preferably stored external to corporate firewall 130 (preferably wide area server 120). The basic system 190 and the synchronization agent 126 work together to synchronize the workspace data 185 with the workspace data 123. Generally, the basic system 190 manages the workspace data 185 in the corporate LAN 135, and the synchronization agent 1
26 manages the workspace data 123 in the wide area server 120. The base system 190 preferably initiates and controls data synchronization, as described in more detail below with reference to FIG.

The remote computer terminal 105
May include a smart phone or personal data assistant (PDA) such as the PalmPilot system by US Robotics, Inc. Although not specifically shown, the remote computer terminal 105 may include a second basic system similar to the basic system 190, which will be described in detail later with reference to FIG. To Therefore, the second basic system of the remote computer terminal 105 cooperates with the synchronization agent 126 to transfer the workspace data stored in the terminal 105 to the workspace data 123 stored in the wide area server 120.
Is to be synchronized with. Like the corporate LAN 135, the second basic system of the remote computer terminal 105 preferably initiates and controls data synchronization with the wide area server 120 for reasons described below. In this way, the workspace of the remote computer terminal 105 is synchronized with the workspace 123 and the workspace 185.

FIG. 2 is a block diagram showing details of the service server 200, in which the e-mail server 14 is shown.
5, file server 150, calendar server 155 and desktop computer 160 are each merely examples. The service server 200 is a Motorola Pow
er PC (registered trademark) microprocessor or Intel Pen
CPU2, such as a tium (R) microprocessor
It is equipped with 05. An input device 210 such as a keyboard and a mouse and an output device 215 such as a CRT display are connected to the CPU 205 via a signal bus 220.
It is connected to the. Furthermore, the communication interface 22
5 (eg Ethernet port), data storage device 230
(Eg ROM or magnetic disk), and RAM2
35, the CPU 205 via the signal bus 220
It is connected to the.

The operating system 240 includes a program for controlling the processing by the CPU 205, and is typically stored in the data storage device 230 and loaded into the RAM 235 for execution. The service engine 245 includes programs for performing particular services, such as for maintaining an email database, a calendar database, a bookmarks database, or other file database. For service execution, the service engine 245 typically stores service data 250 (e.g., stored in the data store 230).
It operates based on email data 165, file data 170, calendar data 175 or user data 180). The service data 250 includes version information 255 indicating the date and time of the last (most recent) change. Each time a change is made, the service engine 24
5 updates the version information 255. The service data 25 is stored in the data storage device 230.
The memory portion storing 0 is hereinafter referred to as "service storage portion".
Say.

FIG. 3 shows the desktop computer 16
0 is a block diagram showing the details of 0. The desktop computer 160 includes a CPU 305 and an input device 310.
, Output device 315, and communication interface 325
, A data storage device 330, and a RAM 335, all of which are connected to the signal bus 320. The operating system 340 is the CPU 3
A program for controlling the processing by 05 is included, and is typically stored in the data storage device 330 and loaded into the RAM 335 and executed. The desktop service engine 345 (ie, the particular service engine 245 of FIG. 2) has version information 35.
It includes a service program for managing user data 180 (ie, specific service data 250 of FIG. 2) including 0 (ie, specific version information 255 of FIG. 2). The desktop service engine 345 is also stored in the data storage device 330,
It may be loaded into the RAM 335 and executed. The user data 180 may be stored in the data storage device 330. As described above with respect to FIG. 1, the basic system 190 uses the workspace data 1
85 (including user data 180) is synchronized with the workspace data 123. Also, the basic system 190 may be stored in the data storage device 330, loaded into the RAM 335, and executed.

FIG. 4 is a block diagram showing the details of the basic system 190. The basic system 190 includes a communication module 405, a user interface module 410, a locator module 415, a synchronization start module 420, and a general synchronization. Module 425,
A content-based synchronization module 430. For simplicity, each module has one signal bus 4
They are shown as communicating with each other via 40.

The communication module 405 includes a routine for compressing data and the communication interface 3
25 (FIG. 3) and a routine for communicating with the synchronization agent 126 (FIG. 1). In addition, the communication module 405 is
0 and wide area firewall 115 to establish a secure communication channel, secure socket layer (SS
L: Includes routines for applying Secure Socket Layer) and user identification and authentication (ie, digital authentication) techniques. An example of the communication module 405 is a TCP / IP stack or AppleTalk (registered trademark) protocol.

The user interface module 4
10 includes a routine for communicating with a user, and may include a conventional GUI (Graphical User Interface). The user interface module 410
Interacts with other desktop computer 160 elements such as those described herein.

The locator module 415 includes a routine for specifying the memory location of the workspace element in the workspace data 185 and the memory location of the workspace element in the workspace data 123. Such workspace element memory location identification can be accomplished using intelligent software, that is, using preset memory addresses or system records, or
It may be performed using a dialog box for asking the user. Therefore, the locator module 415 is
A workspace element in the email data 165, a workspace element in the file data 170, a workspace element in the calendar data 175, and the user data 1
The memory address of the workspace element in 80 and the memory address of the corresponding workspace element in the workspace data 123 are determined. The locator module 415 is
The workspace element memory location may be identified at system boot-up or after each communication with the global server 120 to maintain the updated memory location of the workspace element.

The sync start module 420 includes a routine for determining when to start the workspace data 123 and workspace data 185. For example, the synchronization start module 42
0 means that when a user requests, when a predetermined time elapses at a specific date and time, when a predetermined number of changes occur, after an action such as logoff by the user, or
The data synchronization processing may be started when the same reference conditions as those described above occur. The sync start module 420 initiates the data sync process by instructing the global sync module 425 to begin executing its routine. Note that the typical corporate firewall 130 blocks incoming communication from outside and allows outgoing communication, so the synchronization agent 12
Communication with 6 is preferably initiated from within the corporate LAN 135.

The global sync module 425 routines to request version information 124 from the sync agent 126 (FIG. 1), and the version information to determine which version has changed. It includes a routine to compare 255 with the last sync signature 435, such as the last date and time.
In addition, the global synchronization module 425 compares the version information 124 and the version information 255 to determine whether one or both of the particular workspace elements have had their version information changed. And a routine for performing the appropriate synchronization response operation. The appropriate synchronization response action may be to send a modified version (as the preferred version) of a workspace element in the workspace data 185, or to edit only the modifications to another storage unit. May be included. As another example of a suitable sync response operation, instructing the content-based sync module 430 to execute a routine as described below when a harmonized match between two modified versions is required. The action to do may be included.

It should be noted that the synchronization agent 126 preferably examines the version information 124 and sends only the version information 124 that has been determined to have changed since the last synchronization signature 435. This technique allows the processor power to be used efficiently and avoids unnecessary data transmission over the communication channel 125. Therefore, the overall synchronization module 425 in the corporate LAN 135
Compares the received version information 124 with the version information 255 and determines whether a harmonized match between both version information is necessary. When the data synchronization is completed, the global synchronization module 425 may use the final synchronization signature 435.
To update.

A synchronization module 430 based on the above content
Contains a routine for reconciling two or more modified versions of all the same workspace elements in the workspace data 123, 185. For example, if both the original and the copy of the user workspace element have been individually modified since the last sync, the content-based sync module 430 may prompt the user to choose which version of the modified versions is preferred. May be requested to be selected or responded based on preset preferences. This preset preference is one that stores both versions in both stores, or one that changes each modified version stored in both stores into one that combines the modified parts into one preferred version. May be

FIG. 5 is a block diagram showing details of synchronization agent 126, which includes communication module 505 (similar to communication module 405 described above with reference to FIG. 4) and general synchronization module. 510 (similar to the overall synchronization module 425 described above with reference to FIG. 4). The communication module 505 includes routines for compressing data and routines for communicating with the base system 190 via the communication interface 125. In addition, the communication module 505 includes routines for establishing a secure communication channel through the wide area firewall 115 and the corporate firewall 130.

The global sync module 510 has a routine for comparing the version information 124 with the final sync signature 435 and a routine for sending the version information 124 determined to be modified to the global sync module 425. Includes and. The global sync module 510 may maintain a copy (not shown) of its final sync signature 435. Alternatively, the sync request from the base system 190 may include a copy of the final sync signature 435. The global synchronization module 510 further includes a routine for receiving a preferred version of a workspace element of the workspace data 185 from the global synchronization module 425, and a preferred version of a workspace element of the workspace data 185. And a routine for sending to the global synchronization module 425.

FIG. 6 shows a network 1 having a safety function.
00, the workspace data 123, 185
6 is a flowchart illustrating a method 600 for synchronizing multiple copies of a. According to the method 600, in a first step 605, the locator module 415
Specifies the memory location of the workspace element in the workspace data 123, 185. As mentioned above, locating the memory location of this workspace element may be performed using intelligent software or dialog boxes. In the next step 610, the user interface module 410
Allows the selection of workspace elements in the workspace data 123, 185 to be synchronized by the global synchronization module 425.

In step 615, the sync start module 420 determines whether a predetermined criterion indicating that the workspace element selected in step 610 should start syncing is met. N
If O, then the method 600 returns to step 615. If yes, then in step 617, the communication modules 405, 505 cause the wide area server 12 to
0 and the desktop computer 160 to establish a secure communication channel. In the next step 620, the global sync module 510 detects the modified workspace by comparing the version information 124 of each selected workspace element in the workspace data 123 with the final sync signature 435. Then, the workspace determined to be changed is sent to the global synchronization module 425.
Further, in step 620, the global sync module 425 detects the modified workspace by comparing the version information 124 of each selected workspace element in the workspace data 123 with the final sync signature 435. To do. In this embodiment, if the last change was made after the date and time of the last signature, it is considered that the workspace element has been changed.

The workspace data 123 or 1
If no modified workspace elements are detected at 85, then at step 650 the global sync modules 425 and 510 cause the final sync signature 4
35 and the method 600 ends. If a modified workspace element is detected in the workspace data 123 or 185, then in step 625 the global synchronization module 425
Determine if two or more versions of the same workspace element have changed since the last sync.

If there is only one modified version, then in step 630 the corresponding global synchronization module 425 or 510 sends the updated preferred version of the workspace element to the other store. Then, in step 635, it is determined whether all workspace elements selected in step 610 have been examined. If yes, the method 600 jumps to step 650.
If no, the method 600 returns to step 620.

If there are more than one modified version, then in step 640 the global sync module 425 reconciles these modified versions with the content-based sync module 430. This harmony matching operation may include requesting a command from the user or performing a response operation such as storing both versions in both said storages based on a preselected preference. .

In step 645, the global sync modules 425 and 510 send the preferred version of the workspace element, or an edit of the changes, to the other store. That is, if the preferred version is a workspace element in the workspace data 185, the global sync module 425 may update the preferred version or modified portion to update an old workspace element in the workspace data 123. Send to Global Sync Module 510. If the preferred version is a workspace element in the workspace data 123, the global sync module 510 updates the old workspace element in the workspace data 185 to:
Send the preferred version or changes to the global sync module 425. The method 600 then jumps to step 635.

The above description of the preferred embodiments of the present invention is merely an example, and various modifications of the above-described embodiments and methods are possible. For example, the wide area server 1
Although illustrated as a single device, 20 may include a number of networked computers. Although not described in detail, the remote computer terminal 105 can synchronize a copy of the workspace element stored therein with the workspace element of the workspace data 123 stored in the wide area server 120. it can. The components of this invention may be implemented using a programmed general purpose digital computer, using application specific integrated circuits, or using a network of interconnected conventional components and circuits. .

[0035]

As described above, the present invention can safely synchronize multiple copies of workspace elements in a secure network.

[Brief description of drawings]

FIG. 1 is a block diagram showing a secure data synchronization network having a safety function according to the present invention.

FIG. 2 is a block diagram showing details of the service server shown in FIG.

FIG. 3 is a block diagram showing details of the desktop computer shown in FIG.

FIG. 4 is a block diagram showing details of the basic system shown in FIG.

FIG. 5 is a block diagram showing details of the synchronization agent of FIG.

FIG. 6 is a flowchart illustrating an example of a method for synchronizing multiple copies of workspace data in a secure network.

[Explanation of symbols]

105 Remote computer terminal 115 wide area firewall 120 wide area server 123 workspace data 124 Version information 126 Sync Agent 130 corporate firewall 185 workspace data 190 Basic system 420 Synchronous start module 425 Global Synchronization Module 510 Global synchronization module

─────────────────────────────────────────────────── ─── Continuation of the front page (72) Inventor Mark D. Riggings United States 95123 California, San Jose, Moraga Avenue 5818 (72) Inventor Prasad Waggle United States 95051 California, Santa Clara, Purneridge Avenue 2831 (72) Inventor Christine Sea Inn United States 94404 California, Foster City, Moonsail Lane 1204 (56) Reference JP-A-7-319748 (JP, A) JP-A-8-241236 (JP, A) JP-A-63-201845 (JP, A) JP 8-314835 (JP, A) JP 5-260052 (JP, A) (58) Fields investigated (Int. Cl. ⁷ , DB name) G06F 12/00 G06F 13/00 G06F 17 / 60

Claims (25)

(57) [Claims] 1. A first inspection result is generated from (a) first version information indicating whether or not a first workspace element stored in a first storage unit in a fire wall has been changed. And (b) a second individually modifiable copy of the first workspace element indicating whether or not a modification stored in a second storage outside the firewall has been modified. Generating a second inspection result from the version information; (c) activating steps (a) and (b) from within the fire wall when a predetermined criterion is met; (d) Generating a preferred version from the first workspace element and the copy based on the first check result and the second check result; and (e) setting the preferred version to the first description. Parts and method based on a computer and a step of storing in the second storage unit. 2. The method according to claim 1, wherein the second storage unit is provided on a wide area server located outside the firewall and protected by a wide area firewall. 3. The first version information is the first version information.
2. The method of claim 1, wherein the workspace element includes a date and time when the copy was last modified, and the second version information includes a date and time when the copy was last modified. 4. The method of claim 3, wherein the step of generating the first check result comprises the step of comparing the first version information with the date and time of the last synchronization. 5. The method of claim 3, wherein the step of generating the second test result comprises the step of comparing the second version information with the date and time of the last synchronization. 6. The method according to claim 1, further comprising a step of updating the first version information each time the first workspace element is changed, before the step of generating the first inspection result. The method described. 7. The method further comprising the step of updating the second version information each time the copy is modified prior to the step of generating the second check result.
The method described in. 8. If only one of said first workspace element and said copy is modified, said step of generating said one of said first workspace element and said copy is preferred. The method of claim 1 including selecting as a version. 9. The first workspace element,
The first version information, the copy and the second
The method of claim 1, further comprising detecting version information of the. 10. An overall synchronization module for operating in a first firewall and looking up first version information to determine whether a first workspace element has been modified, said first A sync agent for operating outside of the firewall of the first workspace element to send second version information to the global sync module indicating whether an individually modifiable copy of the first workspace element has been modified; A synchronization start module that operates in the first firewall and activates the overall synchronization module and a synchronization agent when predetermined criteria are met; the first version information and the second version information; Means for generating a preferred version from the first workspace element and the copy by comparing System and means for storing the preferred version in the first storage unit and the second storage unit. 11. The system of claim 10, further comprising a communication module for communicating through the first firewall. 12. The synchronization agent and the second
11. The system according to claim 10, wherein the storage unit is provided on a wide area server protected by a wide area firewall. 13. The system of claim 12, further comprising a communication module for communicating through the first firewall and the wide area firewall. 14. The first version information includes a date and time when the first workspace element was last modified, and the second version information includes a date and time when the copy was last modified. The system according to claim 10. 15. The system of claim 14, wherein the global sync module compares the first version information with the date and time of the last sync. 16. The synchronization agent compares the second version information with the date and time of the last synchronization.
The system according to 4. 17. The system of claim 10, further comprising means for updating the first version information each time the first workspace element changes. 18. The second copy every time the copy is changed.
11. The system of claim 10, further comprising means for updating version information of the. 19. If only one of the first workspace element and the copy has changed,
11. The system of claim 10, wherein the means for generating selects the one of the first workspace element and the copy as the preferred version. 20. The first storage unit, the first workspace element, the first version information, the first version information, the second storage unit, the copy, and the second version information. 11. The system of claim 10, further comprising a locator module for detecting. 21. A first for generating a first inspection result from first version information indicating whether or not the first workspace element stored in the first storage section in the firewall has been changed. 1 means and a second version of the individually modifiable copy of the first workspace element indicating whether or not the one stored in the second storage outside the firewall has been modified Second means for generating a second inspection result from the information; and means for activating the first means and the second means from within the firewall when a predetermined criterion is met. Means for generating a preferable version from the first workspace element and the copy based on the first inspection result and the second inspection result; and the preferable version in the first storage unit. Preliminary second
And a means for storing in a storage unit of the system. 22. (a) Generate a first inspection result from first version information indicating whether or not the first workspace element stored in the first storage section in the fire wall has been changed. And (b) a second individually modifiable copy of the first workspace element indicating whether or not a modification stored in a second storage outside the firewall has been modified. Generating a second inspection result from the version information; (c) activating steps (a) and (b) from within the fire wall when a predetermined criterion is met; (d) Generating a preferred version from the first workspace element and the copy based on the first check result and the second check result; and (e) setting the preferred version to the first version.憶部 and second and storing in the storage unit formed by storing a program code for causing a computer to execute, a storage medium readable by a computer. 23. (a) Generate a first inspection result from first version information indicating whether or not the first workspace element stored in the first storage section in the fire wall has been changed. And (b) a second individually modifiable copy of the first workspace element indicating whether or not a modification stored in a second storage outside the firewall has been modified. Generating a second inspection result from the version information; (c) activating steps (a) and (b) from within the fire wall when a predetermined criterion is met; (d) Determining that both the first workspace element and the copy have been modified based on the first and second inspection results; and (e) the first workspace element. Method based on a computer and a step of storing both pre said copy to said first storage unit and the second storage unit. 24. A first for generating a first inspection result from first version information indicating whether or not the first workspace element stored in the first storage section in the firewall has been changed. 1 means and a second version of the individually modifiable copy of the first workspace element indicating whether or not the one stored in the second storage outside the firewall has been modified From the information, a means for activating the first means and the second means from within the firewall when a second means for generating a second inspection result and a predetermined criterion are satisfied; Means for determining that both the first workspace element and the copy have been changed based on the first inspection result and the second inspection result; and the first workspace element and the copy. And a means for storing both of them in the first storage unit and the second storage unit. 25. A wide area server operating outside a firewall, a memory for storing first workspace data and corresponding first version information, and the first work. A space client and a synchronization agent for managing the first version information and communicating with a remote client; a remote client operating within the firewall, the second workspace data , And a memory for storing second version information corresponding thereto, and by cooperating with the synchronization agent by examining the first version information and the second version information, Means for synchronizing the first workspace data with the second workspace data;
A synchronization start means for starting synchronization of workspace data between the wide area server and a remote client;