# US 12,182,295 B2 · Metadata storage architecture and data aggregation

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,182,295 B2
- Document ID: US12182295B2
- Status: Granted
- Kind: B2
- Application number: 17/681,074
- Filed: 2022-02-25
- Published: 2022-07-28
- Granted: 2024-12-31
- Earliest claimed: 2019-07-31
- Assignees: JFrog Ltd.
- Applicants: JFrog Ltd.
- Inventors: Yoav Landman
- Web page: https://patentgrep.com/patent/US12182295B2

## CPC

- G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries}
- G06F 8/71: Version control (security arrangements therefor G06F21/57); Configuration management
- G06F 8/77: Software metrics
- G06F 16/212: {with details for data modelling support}
- G06F 16/2228: {Indexing structures}
- G06F 16/245: Query processing
- G06F 16/258: {Data format conversion from or to a database}
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- G06Q 30/0185: {Product, service or business identity fraud}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

The present disclosure is associated with operation of a metadata server for package management including development and deployment of software. To illustrate, a metadata server stores a database model including multiple data structures that each include one or more entries of multiple data objects and a set of mapping rules defining links between different data structures of the multiple data structure. A method of operating the metadata server includes determining access permissions for an entity. The access permissions correspond to authorization to access a set of the multiple data structures. The method further includes identifying and executing a mapping rule to authorize a link between two or more data structures. The method further includes accessing a portion of requested metadata from the two or more data structures that have an authorized active link, and providing an output of the portion of the requested metadata arranged according to an output format.

## Claims

### Claim 1

A method for operating a metadata server for package management including development and deployment of software, the method comprising:
at a metadata server storing a database model including a plurality of data structures with entries of multiple data objects, a set of mapping rules each executable to define links between one or more data structures of the plurality of data structures, and a set of operation rules for executing operations on the database model, performing:
receiving, by one or more processors, a user identifier for an entity;
determining, by the one or more processors, access permissions for the entity, based on the user identifier;
executing, by the one or more processors, one or more mapping rules of the set of mapping rules, the one or more mapping rules executed to authorize one or more active links between a set of data structures of the plurality of data structures that the entity is authorized to access, the one or more mapping rules selected by the one or more processors in accordance with the access permissions for the entity, the one or more active links enabling a search of the set of data structures based on a single search request from the entity;
receiving, by the one or more processors, a search request from the entity for metadata related to a software package;
searching, by the one or more processors, the set of data structures linked via the one or more active links to identify at least a portion of the metadata that the entity is authorized to access in response to the search request, the set of data structures linked via the one or more active links including one or more software package data structures of the plurality of data structures and one or more version data structures each associated with a corresponding mapping rule of the set of mapping rules that, when executed by the one or more processors, authorize one or more corresponding active links to the one or more software package data structures, the one or more software package data structures storing first metadata that indicates software package types of software packages represented by the one or more software package data structures, and the one or more version data structures storing second metadata that indicates one or more versions of the software packages represented by the one or more version data structures; and
providing, by the one or more processors, an output including the identified portion of the metadata to the entity.

### Claim 2 (depends on 1)

The method of claim 1, wherein the portion of the metadata includes a software package name, a number of repositories, a name of one or more repositories, a number of downloads, a number of versions, a last modified indicator, one or more keyword tags, a description, license information, a checksum, release notes information, a rating indicator, review information, an owner, or a combination thereof.

### Claim 3 (depends on 1)

The method of claim 1, further comprising sending, to the entity and prior to receiving the search request, one or more search options corresponding to a software package search or a version search, wherein the one or more search options include a software package name, a software package type, a version name, a repository name, a checksum, a keyword tag, a description, or a combination thereof, and wherein the request corresponds to a selection of at least one of the one or more search options.

### Claim 4 (depends on 1)

The method of claim 1, wherein the one or more software package data structures further comprise corresponding software package identifiers, names, and qualifiers, and the one or more version data structures further comprise corresponding software package-specific immutable information.

### Claim 5 (depends on 4)

The method of claim 4, wherein each of the one or more software package data structures include a package type field that indicates a software package type of the corresponding software package data structure, the software package type comprising one of Bower, Chef, CocoaPods, Conan, Conda, CRAN, Debian, Docker, Git LFS, Go, Helm, Maven, npm, NuGet, Opkg, P2, PHP, Composer, Puppet, PyPI, RPM, RubyGems, SBT, Vagrant, and VCS.

### Claim 6 (depends on 5)

The method of claim 5, wherein each of the one or more version data structures include software package-specific immutable information associated with the software package type indicated by the package type field of a linked software package data structure.

### Claim 7 (depends on 1)

The method of claim 1, wherein determining the access permissions further comprises:
determining, by the one or more processors, one or more active licenses corresponding to the entity, based on the access permissions for the entity; and
identifying, by the one or more processors, the one or more mapping rules for execution based on the access permissions.

### Claim 8 (depends on 1)

The method of claim 1, further comprising receiving a second search request from the entity, the second search request selected from the group consisting of download, upload, create, build, delete, replace, update, query, list, and deploy.

### Claim 9 (depends on 1)

The method of claim 1, wherein the output includes, for each version of the software package, build information corresponding to the respective version of the software package and vulnerability information corresponding to the respective version of the software package.

### Claim 10 (depends on 1)

The method of claim 1, further comprising, for each received search request:
executing the set of operation rules to generate event data; and
initiating storage of one or more portions of the event data at one or more data structures of the plurality of data structures.

### Claim 11

A system for operating a metadata server for package management including development and deployment of software, the system comprising:
at least one memory storing instructions and a database model including a plurality of data structures with entries of multiple data objects, a set of mapping rules each executable to define links between one or more data structures of the plurality of data structures, and a set of operation rules for executing operations on the database model; and
one or more processors coupled to the at least one memory, the one or more processors configured to execute the instructions to cause the one or more processors to:
receive a user identifier for an entity;
determine access permissions for the entity, based on the user identifier;
execute one or more mapping rules of the set of mapping rules, the one or more mapping rules executed to authorize one or more active links between a set of data structures of the plurality of data structures that the entity is authorized to access, the one or more mapping rules selected by the one or more processors in accordance with the access permissions for the entity, the one or more active links enabling a search of the set of data structures based on a single search request from the entity;
receive a search request from the entity for metadata based on and related to a software package;
search the set of data structures linked via the one or more active links to identify at least a portion of the metadata that the entity is authorized to access in response to the search request, the set of data structures linked via the one or more active links including one or more software package data structures of the plurality of data structures and one or more version data structures each associated with a corresponding mapping rule of the set of mapping rules that, when executed by the one or more processors, authorize one or more corresponding active links to the one or more software package data structures, the one or more software package data structures storing first metadata that indicates software package types of software packages represented by the one or more software package data structures, and the one or more version data structures storing second metadata that indicates one or more versions of the software packages represented by the one or more version data structures; and
provide an output including the identified portion of the metadata to the entity.

### Claim 12 (depends on 11)

The system of claim 11, wherein the database model comprises a strong type model.

### Claim 13 (depends on 11)

The system of claim 11, wherein the one or more software package data structures further comprise corresponding descriptions, website uniform resource locators, created information, license information, modified information, latest version information, version information, download counts, follower counts, ratings, tags, user properties, software package information sources, or a combination thereof.

### Claim 14 (depends on 13)

The system of claim 13, wherein the one or more version data structures further comprise corresponding file data structures, vulnerability data structures, software package information source data structures, read me data structures, version release notes data structures, or a combination thereof.

### Claim 15 (depends on 11)

The system of claim 11, wherein:
the plurality of data structures further include a vulnerability data structure, a licensing information data structure, a build information data structure, and a file-level information data structure; and
the one or more software package data structures have authorized active links to the vulnerability data structure, the licensing information data structure, the build information data structure, the file-level information data structure, or a combination thereof, based on execution of the one or more mapping rules.

### Claim 16

A non-transitory computer-readable storage medium storing instructions that, when executed by one or more processors, cause the one or more processors to perform operations for operating a metadata server for package management including development or deployment of software, the metadata server storing a database model including a plurality of data structures with entries of multiple data objects, a set of mapping rules each executable to define links between one or more data structures of the plurality of data structures, and a set of operation rules for executing one or more operations on the database model, the operations comprising:
receiving a user identifier for an entity;
determining access permissions for the entity, based on the user identifier;
executing one or more mapping rules of the set of mapping rules, the one or more mapping rules executed to authorize one or more active links between a set of data structures of the plurality of data structures that the entity is authorized to access, the one or more mapping rules selected by the one or more processors in accordance with the access permissions for the entity, the one or more active links enabling a search of the set of linked data structures based on a single search request from the entity;
receiving a search request from the entity for metadata based on and related to a software package;
searching the set of data structures linked via the one or more active links to identify at least a portion of the metadata that the entity is authorized to access in response to the search request, the set of data structures linked via the one or more active links including one or more software package data structures of the plurality of data structures and one or more version data structures each associated with a corresponding mapping rule of the set of mapping rules that, when executed by the one or more processors, authorize one or more corresponding active links to the one or more software package data structures, the one or more software package data structures storing first metadata that indicates software package types of software packages represented by the one or more software package data structures, and the one or more version data structures storing second metadata that indicates one or more versions of the software packages represented by the one or more version data structures; and
providing an output including the identified portion of the metadata to the entity.

### Claim 17 (depends on 16)

The non-transitory computer-readable storage medium of claim 16, wherein, for each software package having multiple versions, a single version of the software package is designated as a primary package and each other version of the software package is designated as a secondary package.

### Claim 18 (depends on 16)

The non-transitory computer-readable storage medium of claim 16, wherein the output is provided according to an output format that defines an ordered arrangement of the identified portion of the metadata.

### Claim 19 (depends on 16)

The non-transitory computer-readable storage medium of claim 16, wherein the operations further comprise determining user access permissions for a user corresponding to the user identifier, the user access permissions for the user being different from the access permissions for the entity.