Abstract: A system and method for rotating private encryption keys for tenants of a database system has been developed. First, three separate public-private encryption keys are generated for a tenant of the database system. The three separate private encryption keys for the tenant are then stored in cloud-based storage. A defined cadence is created to rotate the private encryption keys for the tenant. The three separate private encryption keys for the tenant are defined as a a past private key, a present private key and a future private key. Next, the public encryption key is stored for the tenant in a global tenant directory. The present private key and the public encryption key are retrieved to encrypt and decrypt data from the tenant. The three separate private encryption keys are rotated at the defined cadence, where the past private key is discarded, the present private key becomes a new past private key, the future private key becomes a new present private key, and a new future private key is generated.

Abstract: A method and system uses a test cloud system for monitoring cloud to cloud performance. The method includes initiating a first trust relationship by the test cloud system with a first target cloud system, receiving a success indicator for the trust relationship, in response to the first target cloud verifying the test cloud system is whitelisted, generating a security token using a private key of the test cloud system, and invoking a function of an application programming interface of the first target cloud using the security token to validate functionality of the function of the application programming interface of the first target cloud.

Abstract: A method and system of data deduplication for data streams in a multi-tenant system. The method receives, at a data accuracy manager, an event from an activity tracking component, determine whether the event is recorded in a probabilistic model that tracks previously received events from the activity tracking component, where the probabilistic model can accurately identify the event has not been previously received with a possible false positive response where the event has been previously received, determines whether information for the event is stored in a metric storage, where the metric storage is a database of metrics derived from the previously received events, and discards the event in response to determining that the event is recorded in the probabilistic model and in the metric storage.

Abstract: A method and system that perform cluster node work assignments for tenants in a multi-tenant system. The method includes selecting a partition of a cluster tenant tracking structure having a hierarchical namespace and virtual nodes representing each tenant by a cluster node foreman controller, searching the selected partition for a tenant that is unlocked in the cluster tenant tracking structure, and initiating work for the tenant by the cluster node.

Abstract: A method enables data aggregation in a multi-tenant system. The method includes receiving, at a data aggregation manager, an event from an activity tracking component, generating, by the data aggregation manager, a first hash value based on a first identifier in the event, generating, by the data aggregation manager, a second hash value based on a second identifier in the event, and storing event message information to an entry of a metric storage database in a partition according the first hash value and the second hash value.

Abstract: A method and system manage synchronization of data streams in a multi-tenant system. The method includes tracking by a flow control mechanism a recent flow rate of at least one data stream, determining by the flow control mechanism whether the flow rate of the at least one data stream varies from at least one related data stream, and adjusting by the flow control mechanism a throughput of the at least one data stream to correlate with the at least one related data stream, in response to determining that the at least one data stream has varied from the at least one related data stream.

Abstract: Managing mutations in a data lake environment. A mutation request to cause write operations that modify data objects or structures within an environment for collecting unformatted raw data is received. The environment has at least a data table and a notification table. An entry is written to the data table with a streaming job configured to receive and process the mutation request. Entries to the data table specify at least records indicating changes to objects in the environment based on ingestion processing for the environment for collecting unformatted raw data and based on the mutation request. A corresponding entry is written to the notification table in response to a successful write attempt to the data table. The notification table entry has information about data table entries for a specified period. At least one data consumer is notified that the data table has been modified.

Abstract: Managing mutations in a data lake environment. A mutation request to cause write operations that modify data objects or structures within an environment for collecting unformatted raw data is received. The environment has at least a data table and a notification table. An entry is written to the data table with a streaming job configured to receive and process the mutation request. Entries to the data table specify at least records indicating changes to objects in the environment based on ingestion processing for the environment for collecting unformatted raw data and based on the mutation request. A corresponding entry is written to the notification table in response to a successful write attempt to the data table. The notification table entry has information about data table entries for a specified period. At least one data consumer is notified that the data table has been modified.

Abstract: A method and system of data deduplication for data streams in a multi-tenant system. The method receives, at a data accuracy manager, an event from an activity tracking component, determine whether the event is recorded in a probabilistic model that tracks previously received events from the activity tracking component, where the probabilistic model can accurately identify the event has not been previously received with a possible false positive response where the event has been previously received, determines whether information for the event is stored in a metric storage, where the metric storage is a database of metrics derived from the previously received events, and discards the event in response to determining that the event is recorded in the probabilistic model and in the metric storage.

Abstract: A method and system manage synchronization of data streams in a multi-tenant system. The method includes tracking by a flow control mechanism a recent flow rate of at least one data stream, determining by the flow control mechanism whether the flow rate of the at least one data stream varies from at least one related data stream, and adjusting by the flow control mechanism a throughput of the at least one data stream to correlate with the at least one related data stream, in response to determining that the at least one data stream has varied from the at least one related data stream.

Abstract: A method enables data aggregation in a multi-tenant system. The method includes receiving, at a data aggregation manager, an event from an activity tracking component, generating, by the data aggregation manager, a first hash value based on a first identifier in the event, generating, by the data aggregation manager, a second hash value based on a second identifier in the event, and storing event message information to an entry of a metric storage database in a partition according the first hash value and the second hash value.

Abstract: A method and system that perform cluster node work assignments for tenants in a multi-tenant system. The method includes selecting a partition of a cluster tenant tracking structure having a hierarchical namespace and virtual nodes representing each tenant by a cluster node foreman controller, searching the selected partition for a tenant that is unlocked in the cluster tenant tracking structure, and initiating work for the tenant by the cluster node.

Abstract: A computer that is programmed with collaboration software receives a new value of an attribute (or property or characteristic) which is specific to a label (or tag or category) as applied to an object managed by the computer. The computer does not use the new value to overwrite a corresponding old value in existing metadata. Instead, the computer is programmed to hold the new value in an incremental label application for the object. The computer is further programmed to respond to a request for the object's label application, by retrieving the incremental label application, and a full application of said label to said object. The computer uses attribute values in the incremental label application to update corresponding attribute values in a copy of the full label application, in a time sequence based on the time of creation of incremental label applications, thereby to generate a current label application.

Abstract: The technology performs database access control in a manner that decreases computational cost of the database access control with an object type definition of a database object that permit multiple parent objects. The system determines whether to grant a user access to a database object via a first set of access control paths that do not rely on whether the user has permission to access a minimum number of parent objects of the database object. Responsive to a determination not to grant the user access via the first set of access control paths, the system determines whether to grant the user access to the database object via a second set of access control paths that determine whether the user has permission to access the minimum number of parent objects of the database object.

Abstract: The technology performs database access control in a manner that decreases computational cost of the database access control with an object type definition of a database object that permit multiple parent objects. The system determines whether to grant a user access to a database object via a first set of access control paths that do not rely on whether the user has permission to access a minimum number of parent objects of the database object. Responsive to a determination not to grant the user access via the first set of access control paths, the system determines whether to grant the user access to the database object via a second set of access control paths that determine whether the user has permission to access the minimum number of parent objects of the database object.

Abstract: A computer that is programmed with collaboration software receives a new value of an attribute (or property or characteristic) which is specific to a label (or tag or category) as applied to an object managed by the computer. The computer does not use the new value to overwrite a corresponding old value in existing metadata. Instead, the computer is programmed to hold the new value in an incremental label application for the object. The computer is further programmed to respond to a request for the object's label application, by retrieving the incremental label application, and a full application of said label to said object. The computer uses attribute values in the incremental label application to update corresponding attribute values in a copy of the full label application, in a time sequence based on the time of creation of incremental label applications, thereby to generate a current label application.