US9270743B2

US9270743B2 - Systems and methods for distributed rules processing

Info

Publication number: US9270743B2
Application number: US14/527,348
Authority: US
Inventors: Benjamin A. Frenkel
Original assignee: Pegasystems Inc
Current assignee: Pegasystems Inc
Priority date: 2011-02-18
Filing date: 2014-10-29
Publication date: 2016-02-23
Anticipated expiration: 2031-02-18
Also published as: US8880487B1; US20150127736A1

Abstract

The invention provides in some aspects a distributed rules processing system that includes a first and second digital data processors that are coupled to one another by one or more networks. A rules base and a transactional data base are each coupled to one of the digital data processors; both may be coupled to the same digital data processor or otherwise. One or more coordination modules (e.g., “proxies”), each of which is associated with a respective one of the digital data processors, makes available to a selected one of those digital data processors from the other of those digital data processors (i) one or more selected rules from the rules base, and/or (ii) one or more data from the transactional database on which those rules are to be executed. The selected digital data processor executes one or more of the selected rules as a rules engine, executes one or more of the selected rules using a rules engine, and/or processes one or more data from the transactional database with rules executing on a rules engine.

Description

BACKGROUND OF THE INVENTION

The invention relates to digital data processing and, more particularly, for example, to distributed processing of rules bases.

Computer systems that facilitate business operations based on information specific to an industry or enterprise are well known in the art. These typically rely on rules identifying situations that are expected to arise during enterprise operation and the applicable responses. Such systems have been used in a range of applications, from health care to automotive repair. The rules on which they rely come from experts in the field, from the collective experience of workers on the “front line,” or a combination of these and other sources.

Though many computer systems of this sort incorporate application-specific knowledge directly into source code (using, for example, a sequence of “if . . . then . . . else” statements, or the like), more complex systems store that knowledge separately from the programs that access it. Some use “rules bases” that store application-specific information in tables, database records, database objects, and so forth. Examples of systems of this type are disclosed in commonly assigned U.S. Pat. No. 5,826,250, entitled “Rules Bases and Methods of Access Thereof” and U.S. Pat. No. 7,640,222, entitled “Rules Base Systems and Methods with Circumstance Translation,” the teachings of both of which are incorporated herein by reference.

These and other rules-based business process management (BPM) applications are commonly used in enterprise computing, for example, where they facilitate a range of business operations, from marketing to manufacturing to distribution to technical support. By way of example, a BPM application can implement data-processing workflows to support the processing of transactional data ranging from customer service requests received by retail and banking enterprises to the routing and resolution of health care claims by insurance enterprises.

With increasing frequency, enterprise software applications incorporate architectures that permit their use “in the cloud,” that is, over the Internet, with computing resources delivered up to each user on demand. In a sense, this extends the client-server model of past eras from the physical confines of the enterprise to the expanse of the world.

Where a common architecture of the past might provide for software that executes on a server, e.g., located at enterprise headquarters, and that processes requests entered by support personnel at the enterprise's branch offices, the new cloud architectures permit servicing of requests by servers located around the world. In operation, any given request by a user on a client device might as well be attended to by a server located in a neighboring state as in a neighboring country. Thus, while cloud applications are often initially tested behind an enterprise firewall, they are typically architected for final deployment outside that firewall, on a dynamically changing set of third-party servers (e.g., owned by Amazon, SalesForce, Google, or other cloud-computing providers).

BPM applications can be deployed in the cloud, like other enterprise applications. However since business process management often goes to the heart of the enterprise, chief executives, IT directors, and corporate boards have yet to fully embrace this model, mainly, for fear that storing rules bases and/or transactional data exposes them to theft or wrongful disclosure.

Other software applications are evolving similarly. Those that traditionally ran solely on the “desktop,” are now increasingly being executed in the cloud. Word processing is one example. Microsoft, Google and other software providers would as soon enterprise (and other) customers store documents and execute word processing via the cloud, as via locally deployed desktop applications. Unfortunately, this results in uneven usage of information technology resources, with network infrastructure and desktop computers being alternately overwhelmed and underutilized, depending on the cycle of the day, month and year.

An object of this invention is to provide improved systems and methods for digital data processing. A more particular object is to provide improved systems and methods for business process management, for example, rules processing.

A further object is to provide such improved systems and methods as facilitate deployment of BPM and other rules-processing applications on multiple digital data processors.

A still further object is to provide such improved systems and methods as facilitate such deployment in distributed environments, such as, for example, in cloud computing environments.

Yet a still further object is to provide such improved systems and methods as provide better security for BPM and other rules-processing applications in such distributed environments.

Still yet a further object is to provide such improved systems and methods as better utilize computing and networking resources in applications so distributed.

SUMMARY OF THE INVENTION

The foregoing are among the objects attained by the invention, which provides in some aspects a distributed rules processing system that includes first and second digital data processors that are coupled to one another by one or more networks. A rules base and a transactional data base are each coupled to one of the digital data processors; both may be coupled to the same digital data processor or otherwise.

One or more coordination modules (e.g., “proxies”), each of which is associated with a respective one of the digital data processors, makes available to a selected one of those digital data processors from the other of those digital data processors (i) one or more selected rules from the rules base, and/or (ii) one or more data from the transactional database on which those rules are to be executed. The selected digital data processor executes one or more of the selected rules as a rules engine, executes one or more of the selected rules using a rules engine, and/or processes one or more data from the transactional database with rules executing using a rules engine.

According to related aspects of the invention, the first and second digital data processors of a distributed rules processing system, e.g., of the type described above, can be disposed remotely from one another and can coupled for communication by the Internet, as well optionally by local area networks, wide area networks, and so forth. A firewall and/or other such functionality that is coupled to one or more of those networks prevents the selected digital data processor from accessing from the other digital data processor (i) the selected rules and/or (i) the data on which those rules are to be executed.

Further related aspects of the invention provide a distributed rules processing system, e.g., of the type described above, wherein one or more of the coordination modules make the selected rules and/or data available to the selected digital data processor from the other digital data processor in response to a request from the rules engine.

Thus, by way of example, in a system according to the foregoing aspects of the invention, the first digital data processor can include a rules base, e.g., for processing credit card information. The second digital data processor can, likewise, include a data base of transactional data, e.g., pertaining to opening of credit card account, purchases against the credit cards, refunds, and so forth.

According to one operational scenario of such a system (and to illustrate methods according to further aspects of the invention) a rules engine operating, for example, on the first digital data processor can utilize a proxy operating, for example, on the second digital data processor to access transactional data that is “behind the firewall” on the second digital data processor for processing by the rules engine with rules already accessible to the first data data processor (e.g., on account of its inclusion of and/or coupling to the rules base).

To that end, by way of non-limiting example, in related aspects of the invention, the coordination modules (or proxies) make the selected rules and/or data available to the selected digital data processor from the other digital data processor by opening one or more communications ports on that other digital data processor.

Continuing the above example, in a related operational scenario, a coordination module executing on the first data processor can respond to transactional data base access requests generated by the rules engine to determine whether that data base is coupled to the first digital data processor and, if not, to cooperate with the coordination module on the second digital data processor to make the transactional data available to the rules engine from the second digital data processor.

Conversely, according to the operational scenario of a system paralleling those described in the examples above, a rules engine executing on the second digital data processor can utilize a proxy operating, for example, on the first digital data processor, to access rules necessary to process transactional data already accessible to the data processor (e.g., on account of its inclusion of and/or coupling to the transactional data base).

In other related aspects, the invention provides a distributed rules processing system, e.g., of the type described above, in which one or more of the coordination modules make the selected rules and/or data available to the selected digital data processor from the other digital data processor in response to a request from that other digital data processor.

In further related aspects of the invention, a request made from the other digital data processor in a distributed rules processing system, e.g., of type described above, is made by a rules engine executing on that other digital data processor.

Continuing the example above (and to illustrate methods according to still further aspects of the invention), in a system according to the foregoing aspects of the invention, a rules engine operating on the first digital data processor can utilize the proxy operating on the second digital data processor to access some transactional data in the data base on the second digital data processor for processing by the rules engine on the first digital data processor (and/or, conversely, to store transactional data processed by that rules engine to that transactional data base). It can also effect, through use of that proxy and/or its counterpart on the first digital data processor, transfer of selected rules to the second digital data processor for execution by its rules engine, e.g., on other data stored (and/or to be stored) in the transactional database.

These and other aspects of the invention are evident in the drawings and in the description that follows.

BRIEF DESCRIPTION OF THE DRAWINGS

A more complete understanding of the invention may be attained by reference to the drawings, in which

FIG. 1 depicts a digital data processing system for distributed rules processing according to one practice of the invention;

FIG. 2 depicts a method of operation of a coordination module in a system of FIG. 1; and

FIG. 3 depicts operation of a coordination module in a system according to the invention within a multi-tenant cloud-based environment.

DETAILED DESCRIPTION OF THE ILLUSTRATED EMBODIMENT

FIG. 1 depicts a digital data processing system 10 for distributed processing in a rules-based system according to one practice of the invention. The illustrated system includes client (or “tenant”)

digital data processors

12, 14 that are coupled via network 16 for communication with server digital data processor 18.

The client

digital data processors

12, 14 are conventional desktop computers, workstations, minicomputers, laptop computers, tablet computers, PDAs or other digital data processing apparatus of the type that are commercially available in the marketplace and that are suitable for operation in the illustrated system as described herein, all as adapted in accord with the teachings hereof.

The server digital data processor 18 is, likewise, a digital data processing apparatus of the type commercially available in the marketplace suitable for operation in the illustrated system as described herein, as adapted in accord with the teachings hereof. Though the server 18 is typically implemented in a server-class computer, such as a minicomputer, it may also be implemented in a desktop computer, workstation, laptop computer, tablet computer, PDA or other suitable apparatus (again, as adapted in accord with the teachings hereof).

Network

16 comprises one or more networks suitable for supporting communications among and between illustrated

digital data processors

12, 14, 18. Illustrated network 16 comprises one or more public networks, specifically, the Internet, though, in other embodiments, it may include (instead or in addition) one or more other networks of the type known in the art, e.g., local area networks (LANs), wide area networks (WANs), metropolitan area networks (MANs), and or Internet(s).

Illustrated client computer 12 comprises central processing, memory, storage and input/output units and other constituent components (not shown) of the type conventional in the art that are configured to form application 12 a, transaction database 12 b, rules base 12 c, and coordination module 12 d, in accord with the teachings hereof. One or more of these constituent components, and/or portions thereof, may be absent in various embodiments of the invention. Thus, for example, as suggested by dashed lines, the digital data processor 12 may not include a rules base. Conversely, it may include a portion of a rules base but not transaction database or it may include neither. In other embodiments, it may include a coordination module 12 d (described below) but not a transaction database, rules base or an application, all by way of non-limiting example.

The central processing, memory, storage and input/output units of client digital data processor 12 may be configured to form and/or may be supplemented by other elements of the type known in the art desirable or necessary to support elements 12 a-12 d in accord with the teachings hereof, as well as to support other operations of the digital data processor 12. These can include, by way of non-limiting example, peripheral devices (such as keyboards and monitors), operating systems, database management systems, and network interface cards and software, e.g., for supporting communications between digital data processor 12 and other devices over network 16.

Digital data processor

12 is coupled to network 16 via firewall 12 e. This is a conventional device of the type known in the art (as otherwise configured in accord with the teachings hereof) suitable for blocking unauthorized access, yet, permitting authorized access, to the digital data processor 12, including (but not limited to) data and rules bases 12 b, 12 c.

Firewall 12 e, which is constructed and operated in the conventional manner known in the art, may comprise a “hardware” (or stand-alone) firewall and/or it may comprise a software firewall configured from the constituent and/or other components of digital data processor 12, again, in the conventional manner known in the art.

The constituent components of illustrated client digital data processor 14 may similarly be configured in accord with the teachings hereof to form application 14 a, transaction database 14 b, rules base 14 c, and coordination module 14 d. As well, they may be supplemented by other elements of the type known in the art desirable or necessary to support elements 14 a-14 d in accord with the teachings hereof, as well as to support other operations of the digital data processor 14. The client digital data processor 14 may also include a firewall 14 e, e.g., constructed and operated like device 12 e, discussed above, to block unauthorized access, yet, permit authorized access, to the digital data processor 14, including (but not limited to) data and rules bases 14 b, 14 c.

Although

digital data processors

12 and 14 are depicted and described in like manner here, it will be appreciated that this is for sake of generality and convenience: in other embodiments, these devices may differ in architecture and operation from that shown and described here and/or from each other, all consistent with the teachings hereof. Moreover, it will be appreciated that although only two closely

positioned client devices

12, 14 are shown, other embodiments may have greater or fewer numbers of these devices disposed near and/or far from one another, collocated behind one or more common firewalls 12 e, 14 e or otherwise.

Like client

digital data processors

12, 14, server digital data processor 18 comprises central processing, memory, storage and input/output units and other constituent components (not shown) of the type conventional in the art that are configured in accord with the teachings hereof to form rules engine 18 a, transaction database 18 b, rules base 18 c, and coordination module 18 d, one or more of which (and/or portions thereof) may be absent in various embodiments of the invention. The digital data processor 18 may also include a firewall 18 e, e.g., constructed and operated like device 12 e, discussed above, to block unauthorized access, yet, permit authorized access, to the digital data processor 18, including (but not limited to) data and rules bases 18 b, 18 c.

Although only a single server digital data processor 18 is depicted and described here, it will be appreciated that other embodiments may have greater or fewer numbers of these devices disposed near and/or far from one another, collocated behind one or more common firewalls 18 e or otherwise. Indeed, in preferred such embodiments, the digital data processor 18 is configured as a server on a “cloud” platform, e.g., of the type commercially available from Amazon, SalesForce, Google, or other cloud-computing providers. As above, those other servers may differ in architecture and operation from that shown and described here and/or from each other, all consistent with the teachings hereof.

Rules bases 12 c, 14 c, 18 c comprise conventional rules bases of the type known in the art (albeit configured in accord with the teachings hereof) for storing rules (e.g., scripts, logic, controls, instructions, metadata etc.) and other application-related information in tables, database records, database objects, and so forth. Preferred such rules and rules bases are of the type described in the aforementioned incorporated-by-reference U.S. Pat. No. 5,826,250, entitled “Rules Bases and Methods of Access Thereof” and U.S. Pat. No. 7,640,222, entitled “Rules Base Systems and Methods with Circumstance Translation,” though, rules and rules bases that are architected and/or operated differently may be used as well.

As noted above, not all of these rules bases may be present in any given embodiment. Conversely, some embodiments may utilize multiples rules bases, e.g., an enterprise-wide rules base 18 c on the server 18 and domain-specific rules bases on the

client devices

12, 14, all by way of example. Moreover, to the extent that multiple rules bases are provided in any given embodiment, they may be of like architecture and operation as one another; though, they may be disparate in these regards, as well.

In some embodiments, rules may comprise meta-information structures. These are structures that can include data elements and/or method elements. The latter can be procedural or declarative. In the former regard, for example, such a structure may be procedural insofar as it comprises one or more of a series or ordered steps. In the latter regard, such a structure may be declarative, for example, insofar as it sets forth (declares) a relation between variables, values, and so forth (e.g., a loan rate calculation or a decision-making criterion), or it declares the desired computation and/or result without specifying how the computations should be performed or the result achieved. By way of non-limiting example, the declarative portion of a meta-information structure may declare the desired result of retrieval of a specified value without specifying the data source for the value or a particular query language (e.g., SQL, CQL, .QL etc.) to be used for such retrieval. In other cases, the declarative portion of a meta-information structure may comprise declarative programming language statements (e.g., SQL). Still other types of declarative meta-information structures are possible.

While some rules may comprise meta-information structures that are wholly procedural and others may comprise those that are wholly declarative, the illustrated embodiment also contemplates rules that comprise both procedural and declarative meta-information structures, i.e., rules that have meta-information structure portions that are declarative, as well as meta-information structure portions that are procedural.

Furthermore, rules of the illustrated embodiment that comprise meta-information structures may also reference and/or incorporate other such rules, which themselves may, in turn, reference and/or incorporate still other such rules. As a result, editing such rule may affect one or more rules (if any) that incorporate it.

An advantage of rules that comprise meta-information structures over conventional rules is that they provide users with the flexibility to apply any of code-based and model-driven techniques in the development and modification of software applications and/or computing platforms. Particularly, like models in a model-driven environment, meta-information structures comprise data elements that can be used to define any aspect of a complex system at a higher level of abstraction than source code written in programming languages such as Java or C++. On the other hand, users may also embed programming language statements into meta-information structures if they deem that to be the most efficient design for the system being developed or modified. At run-time, the data elements of the meta-information structures along with programming language statements (if any) are automatically converted into executable code by a rules engine (e.g., 18 a).

Thus, in some embodiments, rules may be the primary artifacts that get created, stored (e.g., in a rules base) or otherwise manipulated to define and/or modify the overall functionality of rules-based applications that may automate and/or manage various types of work in different business domains at run-time. By way of non-limiting example, a plurality of rules stored in a rules base (e.g., 12 c, 14 c, 18 c) may be configured to define all aspects (e.g., user interface, decision logic, integration framework, process definition, data model, reports, security settings etc.) of a software application. Such a software application may include specialized software that is used within a specific industry or a business function (e.g., human resources, finance, healthcare, telecommunications etc.), or it may include a cross-industry application (e.g., a project management application), or any other type of software application. As the software application executes on a digital data processor (e.g. any of 12, 14 and 18), any portion of the rules that define the application may be retrieved from a rules bases (e.g. any of 12 c, 14 c and 18 c) and processed/executed (e.g., using a rules engine 18 a as defined below) in response to requests/events signaled to and/or detected by the digital data processor at run-time.

Transactional data bases

12 b, 14 b, 18 b comprise conventional data bases of the type known in the art (albeit configured in accord with the teachings hereof) for storing corporate, personal, governmental or other data that may be any of generated, stored, retrieved and otherwise processed (hereinafter, collectively referred to as “processed”) by rules in one or more of the rules bases 12 c, 14 c, 18 c. The data may be financial data, customer records, personal data, run-time data related to an application, or other type of data and it may be stored in tables, database records, database objects, and so forth.

As above, not all of the illustrated transactional data bases may be present in any given embodiment. Conversely, some embodiments may utilize multiple transactional database bases, e.g., an enterprise-wide data base 18 b on the server 18 and branch-office specific data bases on the

client devices

12, 14, all by way of example. Moreover, to the extent that multiple transactional data bases are provided in any given embodiment, they may be of like architecture and operation as one another; though, they be disparate in these regards, as well.

Illustrated digital data processor 18 also includes rules engine 18 a of the type conventionally known in the art (albeit configured in accord with the teachings hereof) for use in processing/executing rules from a rules base in order to process data in (and/or for storage to) a transactional database, e.g., in connection with events signaled to and/or detected by the engine. Preferred such rules engines are of the type described in the aforementioned incorporated-by-reference U.S. Pat. No. 5,826,250, entitled “Rules Bases and Methods of Access Thereof” and U.S. Pat. No. 7,640,222, entitled “Rules Base Systems and Methods with Circumstance Translation” and/or U.S. patent application Ser. No. 11/681,269, filed Mar. 2, 2007, entitled “Proactive Performance Management For Multi-User Enterprise Software Systems,” the teachings too of which are incorporated by reference herein—all as adapted in accord without the teachings hereof.

The rules engine 18 a may be implemented in a single software program, in multiple software programs/modules, or a combination of software modules/programs. Moreover, it may comprise programming instructions, scripts, or rules (e.g., rules stored in rules base 18 c) and/or a combination thereof.

Though, in the illustrated embodiment in FIG. 1, the rules engine 18 a executes on the server 18, in other embodiments, the techniques described herein may be employed to execute the rules engine 18 a on or over multiple digital data processors (e.g., 12, 14 and 18). For instance, the rules engine 18 a may initially be invoked for execution on a single digital data processor (e.g., 18). Subsequently, portions of it (or, potentially, the entirety of it) may be apportioned, distributed and executed over multiple digital data processors using the techniques described herein.

Such distributed execution of the rules engine can be advantageous, by way of non-limiting example, when execution of an enterprise-wide BPM application necessitates access to sensitive corporate or personal data during intermediate processing steps. For example, in an enterprise with decentralized record-keeping, the rules engine 18 a can be utilized to generate a summary report that requires analysis of sensitive personnel-related data maintained in local branch offices. To that end, the engine 18 a executes rules for performing preparatory tasks, such as, zeroing out data collection variables and identifying local offices to be queried. The engine 18 a also retrieves from rules base 18 c or otherwise generate rules that will serve as rules engines (e.g., 12 a, 14 a) customized or otherwise suited for execution on digital

data processing equipment

12, 14 at those offices, as well as rules for execution on those

engines

12 a, 14 a to analyze (and anonymize) sensitive data from the respective offices. Both the rules engine-defining rules and the data analysis rules are distributed to the

equipment

12, 14, where they perform these functions and send the requisite information back to server 18 for reporting the BPM application executing there. Such distributed execution has the advantage of permitting the BPM application executing using engine 18 a to generate an enterprise-wide report, without necessitating the transmission of sensitive data outside the confines of the local offices.

By way of further example, the rules engine 18 a can have two distinct portions, e.g., one that embodies the algorithm for rule selection (e.g., in the manner of the rule finder disclosed in U.S. Pat. No. 5,825,260, assigned to the assignee hereof and incorporated by reference herein), and the other that generates/executes the executable code once the requisite rule has been selected. The rules engine 18 a (or other functionality) can apportion and distributed these portions separately as required.

Take, for example, an instance where server 18 gets a request for executing a “loan validation” process for a specific context. Server 18 stores rules for multiple versions of the “loan validation” process for different contexts. However, the server does not have the computing power to execute the ‘rule finder’ algorithm to select the right version and/or the server doesn't have the code generation portion of the engine to execute the selected rule. Server retrieves the rules for all versions of “loan validation” process and transmits them along with the rule selection portion of the engine to a remote digital data processor that has installed thereon the code generation portion of a rules engine. Upon receiving the rule finder portion of the engine along with the rules for all versions, the correct loan validation process is selected and executed on the target digital data processor.

The foregoing are examples those skilled in the art will appreciate that still other ways of implementing/executing the rules engine 18 a are possible. By way of non-limiting example, the rules engine 18 a may have additional distinct components/portions that can be apportioned and distributed separately. These may include (but are not limited to) a data access component used for processing data during rule execution, a session management component for keeping track of activity across sessions of interaction with a digital data processor and/or a performance monitoring component for monitoring and interacting with various system resources/event logs in order to manage performance thresholds. Still other types of distinct components/portions may be part of the rules engine 18 a.

Applications

12 a and 14 a, of

digital data processors

12, 14, respectively, may too comprise rules engines of the type described above, as adapted in accord with the teachings hereof. These applications may be configured (e.g., at least partially using rules stored in a rules base as described above) as stand-alone applications and/or may be embedded in (or coupled) to other software applications, e.g., web browsers. While in some embodiments,

such applications

12 a, 14 a are architected and operated similarly to rules engine 18 a, in other embodiments they embody a subset of the functionality of engine 18 a, e.g., suited to the processing resources and/or demands of the

digital data processors

12, 14 upon which they operate. Instead or in addition,

such applications

12 a, 14 a can comprise other functionality than that provided in rules engine 18 a, again, for example, suited to the processing resources and/or demands of the

digital data processors

12, 14 upon which they operate.

For sake of simplicity, the discussion that follows focuses on aspects of operation of rules engine 18 a; it will be appreciated that other rules engines (e.g., 12 a, 14 a in certain embodiments) may operate similarly in these regards.

As noted above, rules engine 18 a processes/executes rules from a rules base in order to process data in (and/or for storage to) a transactional database. In instances where the engine 18 a executes rules from rules base 18 c in order to process data in (and/or store data to) database 18 b, the engine 18 a may operate in the conventional manner known in the art. However, where any of (i) the data to be accessed (or stored) is resident in a

data base

12 b, 14 b of another of the digital data processors, (ii) the rules to be executed (including, potentially, those defining the rules engine 18 a or a portion thereof) are contained in a rules base 12 c, 14 c of another of those digital data processors, and (iii) the rules (again, potentially, those defining the rules engine 18 a or a portion thereof) are to be executed using the

rules engine

12 a, 12 b of another of those digital data processors, the rules engine 18 a works with one or more of the coordination modules to effect the desired processing. Even in instances where the rules, portions of the engine, and/or data required to effect the desired processing is local to digital data processor 18, the rules engine 18 a may work with the coordination modules (e.g., 12 d, 14 d, 18 d) to effect the desired processing over multiple digital data processors (e.g., for access to more computing resources/power) in accord with the teachings hereof.

In this regard,

coordination modules

12 d, 14 d, 18 d comprise functionality resident on (and/or coupled to) each of the

respective processors

12, 14, 18 that facilitate access to and transfer of rules, the rules engine or portion thereof, or data (and, preferably, all three) between the digital data processors. In this regard, operation of the module(s) 12 d, 14 d, 18 d can include one or more of (i) obviating obstacles presented by firewalls 12 e, 14 e, 18 e or other functionality to such inter-processor accesses and transfers, (ii) effecting such access and transfers, and (iii) querying a digital data processor to determine whether it has resources (e.g., a rules base, a transactional data base, a portion of or the entire rules engine, and/or computing power) to facilitate the completion of a task (e.g., by executing a given one or more rules on a given set of data).

As above, not all of the

coordination modules

12 d, 14 d, 18 d are utilized in all embodiments. Conversely, other embodiments may utilize additional such modules, e.g., one module per digital data processor for facilitating rules access/transfer between digital data processors, one module for facilitating transaction access/transfer, and so forth. Likewise, some such modules could be directed to querying digital data processors for resources, while others are directed to access and transfers. These and other such variations are within the ken of those of ordinary skill in the art based on the teachings hereof.

The

modules

12 d, 14 d, 18 d may comprise stand-alone functionality stored and executing within each respective

digital data processors

12, 14 18. Alternatively, they may comprises functionality that is embedded in the rules engine 18 a and/or

applications

12 a, 14 a and/or into other applications or operating system functions resident on the

respective devices

12, 14, 18. Moreover, in embodiments that include multiple

such modules

12 d, 14 d, 18 d, functionality may be distributed and/or divided among them.

Still further, although the

modules

12 d, 14 d, 18 d are shown forming part of the respective

digital data processors

12, 14, 18 in the illustrated embodiment, in other embodiments one or more of those modules may execute on still other digital data processors (not shown) that are in communication coupling with the

respective processors

12, 14, 18 and that otherwise provide the functionality described here.

Operation of a coordination module 18 d in accord with one practice of the invention is illustrated in FIG. 2. It will be appreciated that the sequence of steps shown in that drawing and discussed below is by way of example and that other embodiments may perform the same or different functions using alternate sequences of steps.

In step 20, the module, which may be coupled to a local rules engine 18 a, responds to a request for access to a rule by determining if that rule is present in a rules base 18 c local to the digital data processor 18—and, for example, it is therefore accessible to a local engine 18 a without crossing the firewall 12 e, 14 e of another digital data processor. The module 18 d can make that determination by checking for the presence of the local rules base 18 c and/or, if present, by determining if the requested rule itself is present. Alternatively, or in addition, the module 18 d can make the determination by checking parameters or other indicators of rule presence, e.g., in the rule request signaled to any of the module 18 a and the engine 18 a and/or request made by the engine 18 a. The parameters or other indicators of rule presence may also be found in a registry of the digital data processor 18 and/or elsewhere.

If the determination of step 20 is in the affirmative, operation proceeds to step 22, where the module 18 d determines if data implicated by the rule (e.g., data to be processed by the rule or otherwise necessary for its execution) is present in a data base 18 b local to the digital data processor 18—and, again, for example, it is therefore accessible to the local engine 18 a without crossing the firewall 12 e, 14 e of another digital data processor. The module 18 d can make that determination by checking for the presence of the local data base 18 b and/or, if present, by determining if the requested data are present. Alternatively, or in addition, the module 18 d can make the determination by checking parameters or other indicators of data presence, e.g., in the rule request signaled to any of the module 18 d and the engine 18 a and/or request made by the engine 18 a. The parameters or other indicators of rule presence may also be found in a registry of the digital data processor 18 and/or elsewhere.

If the determination of step 22 is affirmative, operation proceeds to step 24, where the module 18 d determines if the portion of rules engine (e.g., 18 a) that is required to execute the requested rule is present locally on digital data processor 18. To this end, the module can query for local presence on digital data processor 18 of component(s)/module(s) that make up requisite portions(s) of rules engine. In other embodiments, e.g., where those requisite portion(s) are implemented using rules, the module 18 d can determine, for example, if those rules are locally present by querying a local database/repository (e.g., rules base 18 c, transaction data base 18 b). Alternatively, or in addition, the module can check parameters or other indicators of engine presence, e.g., in the rule request signaled to any of the module 18 d and the engine 18 a and/or request made by the engine 18 a, in a registry of the digital data processor 18 and/or elsewhere.

If the determination of step 24 is in the affirmative, operation proceeds to step 26, where the module 18 d determines if the rule is to be executed locally, i.e., on digital data processor 18 or whether it is to be executed remotely, e.g., on

digital data processors

12, 14. The module 18 d can make that determination using a variety of methods including, but not limited to, querying a local rules engine (e.g., 18 a) and/or by checking parameters or other indicators, e.g., in the rule request signaled to any of the module 18 d and the engine 18 a and/or request made by the engine 18 a. The parameters or other indicators of rule presence may also be found in a registry of the digital data processor 18 and/or elsewhere. Alternatively, or in addition, the module 18 d can make the determination based on load-balancing, network speed and traffic, data coherency or other factors within the ken of those of ordinary skill in the art based on the teachings hereof.

If the determination in

steps

20, 22, 24 and 26 is in the affirmative—that is, all resources required to execute the requested rule are present locally at digital data processor 18 and the rule is to be executed there, the determination in step 28 is affirmative and the operation proceeds to step 30, where the module 18 d defers to local engine 18 a for execution of the requested rule on the required data. The engine 18 a (or the required portion thereof) proceeds by accessing the rule and data in the local rules and data bases 18 b, 18 c, and by executing the rule to process the data accordingly.

If the determination in any of

steps

20, 22 and 24 is in the negative—that is, if any of the requested rule, required data and engine (or portion thereof) are not locally present on digital data processor 18, the operation proceeds to step 32, where the module queries one or more other digital data processors (e.g., 12, 14) to determine the location(s) of any of the requested rule, required data and engine (or portion thereof). By way of non-limiting example, the module 18 d can determine the location of the requested rule (and corresponding rules base), required data and engine (or portion thereof) by checking parameters or other indicators, e.g., in the rule request signaled to any of the module 18 d and the engine 18 a and/or request made by the engine 18 a, in a registry of the digital data processor 18 and/or elsewhere. Alternatively, or in addition, module 18 d can query the

digital data processors

12, 14 directly to determine if any of the required/requested resources are maintained by them. Preferably, this is accomplished by communication between module 18 d and its

counterparts

12 d, 14 d on each of

digital data processors

12, 14—which

modules

12 d, 14 d can, themselves, query the local

digital data processor

12, 14 for the requisite resource(s).

If the determination in step 32 is in the negative for any of the required/requested resources, the operation proceeds to and terminates at step 38 where the coordination module returns an error message in response to the requested rule indicating the absence or unavailability of any of the requested rule, required data and engine (or portion thereof).

If the determination in step 32 is in the affirmative for any of the requested/required resources that were not already present locally at digital data processor 18 (as previously determined by steps 20-24), the operation proceeds to step 26 to make the decision of local versus remote execution of the requested rule as described above. If the determination in step 26 is affirmative, at least one of the requested rule, required data and engine (or portion thereof) that is located remotely at another digital data processor (e.g., 12 or 14) as identified in step 32, is retrieved in step 40 before executing the requested rule locally on digital data processor 18 in step 30. As indicated by the callout 46, such retrieval is performed by the module 18 d, following a negative determination in step 28 by (i) validating that the one or more digital data processors identified in step 32 (e.g., 12 and/or 14) will grant access to the requested/required resource(s) and, (ii) retrieving that/those resource(s) from those one or more digital data processors (i.e., 12 and/or 14) to digital data processor 18.

In regard to step 40(i), the module 18 d can validate that the one or more identified digital data processors will grant access by querying the digital data processor(s) identified in step 32 accordingly. This can be done, for example, through communication with the

module

12 d, 14 d of the identified digital data processor, which module can validate the presence of any of the requested/required resource (if it has not already done so). In some embodiments, the validating module (e.g., 12 d or 14 d) can open a communications port in the respective digital data processor and can prepare the requested/resource for access via that port.

In regard to step 40(ii), the module 18 d retrieves and/or transfers the requested/required resource from the one or more identified digital data processors to digital data processor 18 for local execution. In some embodiments, a local rules engine 18 d (if already present) may access the requested/required resource (e.g., data, transaction database, rule and/or rules base) directly from the identified digital data processor, e.g., via a port opened in step 40(i). In other embodiments, the module 18 d may also transfer one or more requested/required resources to an identified digital data processor (e.g., 12 or 14) for the requested processing to be performed remotely at the identified digital data processor. Alternatively, or in addition, the module 18 d may also notify the identified digital data processor (e.g., 12 or 14) and, preferably, its respective coordination module, identified in step 32, passing to it the relevant information for the requested processing to be performed (e.g., identity of the rule to be executed). The identified digital data processor may perform the requested processing using the resources/information provided to it. In other embodiments where the required resources are not transferred along with the relevant information, the identified digital data processor may perform the requested processing by utilizing the methodology of FIG. 2 itself in order to access the required resources in connection therewith. The discussion that follows provides further details about this step.

Upon completion of step 40, control transfers to any of

steps

30, 42 or 44 depending upon the outcome of the previous steps in the operation of the coordination module 18 d, as indicated in the drawing. Thus, continuing with the current example of retrieving requested/required resources in step 40 from one or more identified digital data processors (e.g., 12 and/or 14) for local execution at digital data processor 18, control transfers to step 30 to complete the requested processing. However, if the determination in step 26 is in the negative—that is, it is determined that the requested rule is to be executed remotely, then the appropriate location for the completion of such remote processing is based upon a combination of steps 34-44 as well as the outcome of previous steps 20-24.

By way of non-limiting example, despite the local presence of all the requested/required resources on digital data processor 18 (i.e., affirmative responses in steps 20-24), a negative determination in step 26 may be due to parameters or other indicators in a local registry of the digital data processor 18 and/or e.g., in the rule request signaled to any of the module 18 d and the engine 18 a and/or request made by the engine 18 a. In this case, there is no previously identified location from step 32. Thus, the response to step 34 is in the negative and the operation proceeds to step 36 where the module 18 d determines if there is another digital data processor (e.g., 12, 14) suited for executing the requested rule. In some embodiments, it makes that determination by querying the local rules engine 18 a and/or by checking the parameters or other indicators as mentioned above. Alternatively, or in addition, the module 18 d can make the determination based on load-balancing, network speed and traffic, availability of the required/requested resources (or portions thereof) on one or more other digital data processors, data coherency or other factors within the ken of those of ordinary skill in the art based on the teachings hereof. For example, a query during the operation at step 36 (or at a prior step) may reveal that an alternative digital data processor with higher computing power than processor 18 and/or another digital data processor identified in a local registry, has all of the required/requested resources. In that case, module 18 d may simply notify the alternative digital data processor (and/or its coordination module) to perform the requested processing as opposed to performing it locally or remotely at the other digital data processor that was identified in the local registry. More generally, this example is also reflective of some embodiments discussed throughout this document that may involve scenarios and/or steps where duplicate versions, or at least versions that are comparable in terms of functionality, of one or more requested/required resources may exist at multiple locations

If the determination in step 36 is negative, the operation proceeds to and terminates at step 38 in the illustrated embodiment where the coordination module 18 d returns an error message indicating the absence or unavailability of a suitable digital data processor for remote execution of the requested processing/rule. In other embodiments, if the requested/required resources are present locally, the coordination module may ignore the negative outcome of step 26 and execute the requested rule locally as default if a suitable remote digital data processor (e.g., 12 and 14) is not identified in step 36.

If the determination in step 36 is in the affirmative, coordination module 18 d any of transfers the requested/required resources from the digital data processor 18 and/or provides the relevant information to the other identified digital data processor in step 36 e.g., by employing the methodology discussed above in connection with steps 40(i) and (ii). In some embodiments, coordination module 18 d may only transfer a portion of the requested/required resources if it is determined (as mentioned above) that another identified digital data processor(s) already possesses the remaining portion of the requested/required resources. Once any such transfer and/or notification is completed in step 40 from digital data processor 18, processing is completed by executing the requested rule remotely in step 44 at the other digital data processor that is identified in step 36.

Preceding the negative determination in step 26, a negative outcome in any of steps 20-24 indicates that at least one of the requested/required resources is not locally present on digital data processor 18 and that one or more digital data processors (e.g., 12 and/or 14) may have been identified in step 32 to locate such requested/required resource as previously discussed. In situations where (i) at least one but not all of the determinations in steps 20-24 are in the affirmative, (ii) the determination in step 26 is in the negative, and (iii) the determination in step 34 is affirmative, the operation proceeds to remotely execute the requested rule. If only one digital data processor was identified in step 32, then module 18 d transfers the portion of the requested/required resources at digital data processor 18 (e.g., by employing the methodology discussed above in connection with steps 40(i) and (ii)) to the single digital data processor identified in step 32, where the remaining requested/required resources are located. Once that transfer is completed in step 40, the requested rule/processing is performed remotely in step 42 at the location identified in step 32.

In other embodiments, two or more locations may be identified in step 32 e.g., the required data may be located at digital data processor 12 and the engine may be located at digital data processor 14. In such embodiments, where the step 26 response is negative and the step 34 response is affirmative, module 18 d may prioritize all available location options based upon various factors including, but not limited to, prioritization criteria specified in the rule request signaled to module 18 d and/or the engine 18 a, prioritization rules stored in rules base 18 c and/or elsewhere on digital data processor 18. Alternatively, or in addition, module 18 d may prioritize all available location options based upon the relative computing resources (e.g., CPU, memory etc.) at each location, network traffic or any other factors within the ken of those of ordinary skill in the art based on the teachings hereof. In any event, module 18 d will transfer the portion of the requested/required resources from digital data processor 18 to the highest priority location and once the transfer(s) is completed in step 40, the requested rule/processing is performed remotely at that location in step 42.

A negative determination in step 26 may be followed by a negative determination in step 34. Following the combined negative determinations, an attempt is made via step 36 (as described above) to identify one or more digital data processors other than local processor 18 or the one or more digital data processors identified in step 32.

By way of example, a request may be signaled to coordination module 18 d to execute one or more rules that define a plurality of reports. These report rules may be stored locally in rules base 18 c and the rules engine 18 a required to execute the requested report rules may also be locally present on server digital data processor 18. However, the determination in step 22 may be in the negative because the data to be processed by the requested report rules is not locally present. In such an instance, operation proceeds to step 32 where the coordination module 18 d attempts to locate the one or more digital data processors that maintain the required data for reports execution. In one embodiment, the coordination module 18 d identifies the location of such digital data processors (e.g., 12, 14) by querying a local registry on digital data processor 18 using parameters or other indicators of data location specified in the rule request that was signaled to the coordination module 18 d. The query of the local registry may, for example, reveal that a portion of the required data is located in the transaction database 12 b on digital data processor 12 and the remaining portion of the required data is located in the transaction database 14 b on digital data processor 14. Next, operation proceeds to step 26 where it may be determined, for example, that the reports will not be executed locally at digital data processor 18 because a pre-requisite for such local execution is data retrieval from

digital data processors

12 and 14 over a very slow network connection (e.g., 16). In such an instance, a negative outcome of step 26 is followed by a determination in step 34 of whether to execute the requested report rules remotely on

digital data processor

12, 14 or at both locations. This determination may be based on various factors including, but not limited to, load balancing and the correlation between the requested report rules and the required data for requested rule execution at each location. Thus, for example, if CPU speed is sufficient for both digital data processors 12, 14 (e.g., as determined by the registry query mentioned above) and the requested rules can be apportioned to be separately executed at both locations, the operation may proceed through

steps

34, 40 and 42 such that the respective portions of the report rules along with the required engine 18 a may be transferred appropriately to

digital data processors

12 and 14 for remote execution. Alternatively, the determination in step 34 may be that the requested report rules cannot be independently executed at different locations. In that case, the required data and/or transaction data base (e.g., 12 b, 14 b) is retrieved and/or transferred, along with the requested report rules and engine 18 a, to a single digital data processor for execution. In that case, the transfer destination may, for example, be determined based upon a higher CPU speed or any other factor.

As previously mentioned, a retrieval and/or transfer of rules, engine or data between

digital data processors

12, 14 and 18 can be accomplished by employing the methodology discussed above in connection with steps 40(i) and 40(ii). Thus, for example, after the determination in step 34 is in the affirmative, the location(s) of the required data for the report rules may be validated (if not already done) through communication between

coordination modules

12 d, 14 d and 18 d. In some embodiments, the validating module (e.g., 12 d or 14 d) can open a communications port in the respective digital data processor and can prepare the required data for access via that port.

Once the ports are opened, the

digital data processors

12, 14 and 18 can freely communicate information among each other in step 40(ii). Thus, if it has been determined that digital data processor 12 is to execute the requested report rules, module 18 d retrieves the required data portion and/or transaction data base 14 b from digital data processor 14 and transfers it to the digital data processor 12. Furthermore, the requested report rules and the required engine 18 a are transferred from digital data processor 18 to the target digital data processor 12. Once such retrieval and transfer is completed, the requested report rules are executed in step 42.

In some embodiments, local registries, files or databases (e.g., 12 b, 12 c, 14 b, 14 c, 18 b, 18 c) on any of

digital data processors

12, 14 and 18 are updated following the retrieval and/or transfer of rules, rule bases, engine (or any portion thereof), data and transaction data bases from/to such digital data processors. This allows

digital data processors

12, 14 and 18 to handle future requests for rule execution accurately and/or efficiently. By way of illustration, once the requested report rules and engine 18 a are transferred from digital data processor 18 to digital data processor 12 in the example above, the local registries on any of

digital data processors

12, 18 can be updated to reflect such transfer. The operation of coordination module 18 d is adjusted accordingly to respond to subsequent requests for execution of those report rules that are any of signaled to and received by the module and/or digital data processor 18.

It will be appreciated that the illustrated embodiment of the operation of coordination module 18 d in FIG. 2 is merely exemplary and that certain steps may be omitted, modified or re-ordered without departing from the scope of the disclosure herein. In some embodiments, for example, any of the

modules

12 d, 14 d and 18 d may be configured differently based on the business and/or technical requirements that drive the use of the techniques and systems described herein.

By way of non-limiting example, the systems and techniques described herein may be used for provisioning a computing platform as a service (e.g., commercially available Platform-as-a-Service or “PaaS” offerings) over the internet to multiple concurrent users (e.g., from different companies or “tenant” organizations) for application development, testing and/or deployment in a way that provides more flexibility and ease of use without sacrificing data security as compared to the conventional technology/tools available on the market today.

In one such embodiment, the server 18 depicted in FIG. 1 is configured as a cloud-based computing platform comprising hardware and software components (e.g., business process management software) that are used by users 11 from one or more tenant organizations over the internet (e.g., network 16) to develop, test and/or deploy their enterprise applications. Such shared use of resources among multiple tenant organizations on a cloud-based server (e.g., 18) allows each respective tenant to quickly develop, test and deploy their applications while avoiding the cost and complexity of buying the underlying hardware and software components and hosting them in their own data centers.

Despite its many benefits, the multi-tenant architecture have traditionally presented significant challenges related to data security and integration between cloud-based application(s) and the legacy systems/resources located within each of the respective tenants' data centers. These challenges are exacerbated by the business need of many of the tenant organizations who want to take the hybrid approach of leveraging a cloud-based platform (e.g., server 18) to develop/test their application(s) and eventually migrating them for deployment within the respective data centers, and vice versa. Given the prior state of the technology, one major drawback of this hybrid approach is that the integration configuration of the tenant application(s) with respect to other applications and/or systems (e.g., data bases) has to be updated each time the tenant application is migrated in/out of the tenant data center.

Thus, for example, enterprise software applications are typically developed and tested by tenants on a server by creating and/or modifying a plurality rules that may be stored in a rules base present on the server. These rules can define all aspects of such tenant applications including their integration with other applications and/or systems, some of which may be located behind tenant firewalls in the tenant's data center. Thus, in order to enable communication between a tenant application on server and other applications, systems and/or functionality located behind tenant firewalls (hereinafter collectively referred to as “tenant legacy systems”), the integration rules for the tenant applications might attempt to obviate the obstacles presented by the firewalls, e.g., by opening multiple ports in the tenant firewall depending upon, e.g., the integration method (e.g., SOAP, .NET, JAVA, EJB etc.) and/or the type of tenant legacy system (e.g., SQL database, web service etc.) that is being linked to the tenant application. If that same tenant application is then subsequently deployed within the tenant's data center (i.e., within the tenant firewalls), the integration rules for that application must be reconfigured to establish the direct link between the tenant application and the tenant legacy systems without any intermediate firewall.

Similarly, a tenant may develop and test its application within its data center before migrating it outside its firewall for deployment on a cloud-server. At run-time of the application, a rules engine on the server might execute one or more of the plurality of rules that define the application in response to requests/events received by server e.g., from users within a tenant data center. The data processed during run-time by such rules could potentially either be stored in the database local to the server or it may be stored in remote tenant data bases that may not be accessible to server (e.g., due to firewalls) to effect the desired processing. In such a system, the conventional prior art approach would require that the integration rules of the tenant application be reconfigured upon migration of the tenant application to the cloud-based server in order to avoid any errors/interruptions during execution of such tenant applications on cloud-based servers due to inaccessibility of the required data and/or other resources.

Systems and techniques described herein overcome these drawbacks, for example, when configured as described below, by allowing tenant organizations to simulate their data center environment on an external cloud-based infrastructure (e.g., server 18), thus obviating the need to reconfigure the integration framework of the tenant application(s) upon migration.

This and other benefits of the systems and techniques described herein become apparent in embodiments of the type illustrated FIG. 1 which are configured such that digital data processor 18 operates as a server on a “cloud” platform, e.g., of the type commercially available from Amazon, SalesForce, Google, or other cloud-computing providers. In such embodiments,

digital data processors

12 and 14 can be, for example, different “tenant” digital data processors that are in communication with the server 18 over network(s) to access resources (e.g., rules, applications, modules, database, rules bases, data, code, scripts, hardware etc.) that may be either “generic” (i.e., available to users/systems associated with all tenants that are able to connect to the server 18) or “tenant-specific” (i.e., only accessible to users/systems associated with a particular tenant).

As a departure from the conventional approach mentioned above, embodiments of the invention configured as described herein allow tenant organizations to build seamless integration between their enterprise application(s) and the tenant legacy systems without having to reconfigure the application(s) multiple times depending upon where the application(s) is developed, tested and/or deployed. This is accomplished by establishing communication between coordination modules that are installed on the cloud-based server (or wherever the application is developed, tested and/or deployed outside the tenant firewall) as well as within each tenant's data center.

Accordingly, for example, the first time a user 11 signals/sends a request (e.g., HTTP request or otherwise) using digital data processor (e.g., 12, 14, 11 a) to access any of the resources that are located on the server 18, any of the coordination module 18 d and engine 18 a first authenticate the user by e.g., matching parameters or other indicators of user identification in the request with data related to authorized tenant users previously stored in any of the local data bases (e.g., 18 b, 18 c), registries, files and elsewhere. If the user is authenticated/verified as an authorized user who is able to access resources on server 18 on behalf of a tenant organization, a coordination module (e.g., 12 d, 14 d) can be transmitted back in response to their initial request. The coordination module that is transmitted back (e.g., 12 d, 14 d) may be installed on any digital data processor (e.g., 12, 14, 11 a) located behind/protected by the firewall of the tenant organization that the user is associated with. In one embodiment, the coordination module transmitted back to the authorized tenant user may be installed in the web browser of the digital data processor being used by the tenant user to communicate with server 18. Upon installation, the coordination module (e.g., 12 d, 14 d) may prompt the user to provide information related to the tenant legacy systems that may need to be integrated with the tenant application(s) on server 18. This information is then be transmitted to server 18 where it is stored in any of the local data bases (e.g., 18 b, 18 c), registries, files and elsewhere.

Thus, when an authorized user starts to develop and test applications on server 18 on behalf of tenant organizations and stores the legacy system information for that tenant on the server 18, any of the authorized developers associated with that tenant organization can configure integration rules for tenant application(s) on server 18 in exactly the same way as if they were developing the integration rules on a digital data processor located within that tenant's data center. Similarly, even if the integration rules were first built within that tenant's data center and then later migrated to server 18, the legacy system information on server 18 coupled with the communication between coordination module 18 d and the coordination module located within the tenant's data center (e.g., 12 d, 14 d) obviate the need to reconfigure the integration rules to maintain the integration links that are defined by such rules.

FIG. 3 illustrates operation of an embodiment of the invention and particularly, for example, operation of module 18 d on digital data processor 18 at run-time within a multi-tenant cloud-based environment as described above. In one such embodiment, the module 18 d can be configured to omit a few steps and simplify its operation as compared to the illustrated embodiment in FIG. 2. Namely steps 20, 24, 34, 36 and 44 of the operation depicted in FIG. 2 are omitted in here FIG. 3 for various reasons. For example, the platform-as-a-service business model by its very nature typically requires that the service provider (e.g., salesforce.com, Google etc.) provision all required hardware and software components to its tenants. Thus, the coordination module may not need to verify the local presence of all required portions of rules engine 18 a in step 24. In fact, all requests by users for rule execution on behalf of the tenants at run-time may initially be signaled to and/or received by engine 18 a. After the authentication/verification process (as described above) for the user making the request, the rules engine 18 a may also verify the availability of the requested rule before working with module 18 d to access the required data in step 22. Therefore, even though rules engine 18 a may employ the same techniques as step 20 illustrated in FIG. 2 to verify the local presence of the requested rule, that step 20 can be omitted from the simplified operation of module 18 d in the illustrated embodiment.

Once the verification process related to user authentication and local rule presence is completed, coordination module 18 d will respond to requests for data access in substantially the same way as described previously in connection with FIG. 2. That is, the module 18 d will verify the local presence of the required data on server 18 using the techniques discussed previously. If locally present, the module will typically defer to the local engine 18 a for local execution the rule on the required data through steps 26-30. On the other hand, if the required data and/or database are not locally present, the coordination module 18 d will attempt to identify the location of the required data in step 32 by checking any of the tenant information, user information, parameters and other indicators of data presence e.g., in the request signaled to the engine 18 a and/or the module 18 d. In addition or instead, the module 18 d may also check integration rules (if any) that may be referenced by or otherwise related to the requested rule and/or the tenant legacy system information that may be found in a registry, data base or elsewhere on the digital data processor 18. Once the appropriate tenant location of the required data is identified in step 32, the coordination module 18 d may retrieve the data for local execution of the requested rule(s) and/or transfer the requested rule(s) to the identified tenant location for execution, all as previously discussed in connection with steps 26-30 and 40, 42 and 46 depicted FIG. 2.

It will be appreciated that while effecting any of notifications, transfers and retrieval of data and/or rules in step 40 of the illustrated embodiment, the coordination module 18 d may only open a single port in the tenant firewall. That is a more secure approach than opening multiple ports (e.g., based on integration methods etc.) as required by the conventional approach described above.

It will be appreciated that steps 34, 36 and 44 from the operation depicted in FIG. 2 are also omitted from the illustrated embodiment in FIG. 3 for the sake of simplicity. It is entirely possible, for example, that the identified tenant location (e.g., digital data processor 12) in step 32 may not have the required resources (e.g., computing power and/or rules engine) for the requested rule(s) execution. In that case, the coordination module 18 d may work with the local coordination module (e.g., 12 d) at the appropriate tenant data center to identify one or more other digital data processors with the necessary resources within that data center for the execution of the requested rules(s).

Described above are systems and methods meeting the foregoing objects. It will be appreciated that the embodiment illustrated and described herein are merely examples of the invention and other embodiments incorporating changes thereto fall within the scope thereof.

Claims

In view thereof, what is claimed is:

1. A distributed processing system comprising:

a server digital data processor coupled to a rules base that stores a plurality of rules that define an application, wherein the server digital data processor operates on a cloud platform,

an integration link used for communication of one or more data between the application and a tenant legacy system during execution of the application, wherein at least one integration rule among the plurality of rules defines the integration link, and wherein the tenant legacy system comprises at least one of a database and a web service that is communicatively coupled to the server digital data processor,

one or more coordination modules associated with a respective one of the server digital data processor and the tenant legacy system that facilitate the communication between the tenant legacy system and the application in accordance with the integration rule and other tenant legacy system information accessible to the server digital data processor, and

a firewall that is coupled to the one or more networks and that interrupts the integration link between the application and the tenant legacy system, absent intervention of the one or more coordination modules and the other tenant legacy system information accessible to the server digital data processor,

wherein a tenant data center environment is simulated such that the one or more coordination modules and the tenant legacy system information accessible to the server digital data processor obviate a need to reconfigure the integration rule, so as to maintain the integration link regardless of execution of the application on the server digital data processor or a tenant digital data processor, and wherein the tenant legacy system is directly accessible to the tenant digital processor without the firewall preventing such access.

2. The system of claim 1, wherein the one or more coordination modules facilitate the communication between the tenant legacy system and the application by making available the tenant legacy information to the server digital data processor in response to a request from a rules engine executing on at least one of the server digital data processor and the tenant digital data processor.

3. The system of claim 2, wherein the one or more coordination modules make available the tenant legacy information to the server digital data processor by opening one or more communications ports on the firewall.

4. The system of claim 3, wherein the one or more coordination modules make available the tenant legacy information to the tenant digital data processor by opening a single communications port on the firewall and obviate a need to open a plurality of communications ports on the firewall.

5. The system of claim 1, wherein the one or more coordination modules retrieve the tenant legacy information for use in execution of one or more selected rules from the rules base coupled to the server digital data processor.

6. The system of claim 1, wherein the one or more coordination modules transfer one or more selected rules from the rules base coupled to the server digital data processor for execution on the tenant digital data processor.

7. The system of claim 1, wherein the at least one integration rule defines the integration link according to at least one of a Simple Object Access Protocol (SOAP) integration method, a .NET integration method, a Java integration method, and an Enterprise Java Beans (EJB) integration method.

8. The system of claim 1, wherein the server digital data processor transmits the one or more coordination modules to the tenant digital data processor in response to a request to access one or more resources available to the server digital data processor.

9. The system of claim 8, wherein the server digital data processor installs the one or more transmitted coordination modules in a web browser executing on the tenant digital data processor.

10. A method of distributed rules processing, the method comprising:

coupling a server digital data processor to a rules base that stores a plurality of rules that define an application, wherein the server digital data processor operates on a cloud platform,

defining an integration link for communication of one or more data between the application and a tenant legacy system during execution of the application, wherein at least one integration rule among the plurality of rules defines the integration link, and wherein the tenant legacy system comprises at least one of a database and a web service that is communicatively coupled to the server digital data processor,

facilitating the communication between the tenant legacy system and the application, via one or more coordination modules associated with a respective one of the server digital data processor and the tenant legacy system, in accordance with the integration rule and other tenant legacy system information accessible to the server digital data processor, and

simulating a tenant data center environment such that the one or more coordination modules and the tenant legacy system information accessible to the server digital data processor obviate a need to reconfigure the integration rule, so as to maintain the integration link regardless of execution of the application on the server digital data processor or a tenant digital data processor, wherein the tenant legacy system is directly accessible to the tenant digital processor without a firewall preventing such access, and

wherein the firewall is coupled to the one or more networks and interrupts the integration link between the application and the tenant legacy system, absent intervention of the one or more coordination modules and the other tenant legacy system information accessible to the server digital data processor.

11. The method of claim 10, wherein the facilitating the communication between the tenant legacy system and the application comprises making available, via the one or more communication modules, the tenant legacy information to the server digital data processor in response to a request from a rules engine executing on at least one of the server digital data processor and the tenant digital data processor.

12. The method of claim 11, wherein the making available the tenant legacy information to the server digital data processor comprises opening one or more communications ports on the firewall.

13. The method of claim 12, wherein the making available the tenant legacy information to the tenant digital data processor comprises opening a single communications port on the firewall so as to obviate a need to open a plurality of communications ports on the firewall.

14. The method of claim 10, further comprising retrieving the tenant legacy information, via the one or more coordination modules, for use in execution of one or more selected rules from the rules base coupled to the server digital data processor.

15. The method of claim 10, further comprising transferring one or more selected rules from the rules base coupled to the server digital data processor, via the one or more coordination modules, for execution on the tenant digital data processor.

16. The method of claim 10, wherein the at least one integration rule defines the integration link according to at least one of a Simple Object Access Protocol (SOAP) integration method, a .NET integration method, a Java integration method, and an Enterprise Java Beans (EJB) integration method.

17. The method of claim 10, further comprising transmitting the one or more coordination modules from the server digital data processor to the tenant digital data processor, in response to a request to access one or more resources available to the server digital data processor.

18. The method of claim 17, further comprising installing the one or more transmitted coordination modules, via the server digital data processor, in a web browser executing on the tenant digital data processor.