Native Multitenancy for Database Systems

Abstract

To provide database systems that provide database instance level functions on a tenant level.SOLUTION: Systems and methods comprise: creation of a first instance of a tenant object in a database instance; association of the first instance with a first plurality of database artifacts including first data associated with the first instance; creation of a second instance of the tenant object in the database instance; association of the second instance with a second plurality of database artifacts including second data associated with the second instance; and reception and response to queries on the first data associated with the first instance and to queries on the second data associated with the second instance.SELECTED DRAWING: Figure 6

Description

[Technical field]

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS This application claims priority to U.S. Provisional Patent Application No. 63 / 352,779, filed June 16, 2022, and U.S. Provisional Patent Application No. 63 / 352,811, the entire contents of which are incorporated by reference herein for all purposes. [Background technology]

[0002] Multitenancy is a software architecture pattern that facilitates sharing of computing resources among heterogeneous user groups. For example, a single multitenant application (e.g., a Software as a Service (SaaS) application) can serve multiple end-user groups (i.e., customers) within a single software instance. Such a software instance uses a much smaller computing resource footprint than would be required to provision one software instance per customer. Thus, multitenancy can provide significant cost benefits.

[0003] Data for each customer in a multi-tenant architecture is typically mapped to a corresponding tenant in the underlying data layer. This mapping allows logical separation of data in the data layer and facilitates access to the data layer by multi-tenant applications. In some multi-tenant architectures, data for each tenant is managed by a different database instance running in the same computing system (e.g., a rack server). Although these architectures provide good separation of tenant data, requiring a full database instance per tenant may not be cost-effective in some scenarios. For example, a minimal database instance may consume 32 Gb of memory, which may represent significantly more computing resources than would be required by a small tenant.

[0004] Other multitenant data architectures use a single database instance to manage data for multiple tenants. Because data in such architectures is not physically separated, multitenant applications are responsible for tracking and managing the data in a tenant-aware manner. For example, a database system may use one schema in a single instance for all tenants, where each tenant's data is partitioned via a discriminatory column. The multitenant application uses the value of the discriminatory column to identify data that belongs to a particular tenant. The database, on the other hand, is unaware of the existence of multiple tenants and behaves as if it were being accessed by a single-tenant application.

[0005] The database system advantageously provides encryption, backup / restore, replication, and migration of the data stored therein. Summary of the Invention [Problem to be solved by the invention]

[0006] What is needed is a database system that provides such database instance level functionality at the tenant level. [Brief description of the drawings]

[0007] [Figure 1] FIG. 1 is a block diagram of a database system that provides native multitenancy in accordance with some embodiments. [Diagram 2] FIG. 1 is a block diagram of a database system that provides native multitenancy in accordance with some embodiments. [Diagram 3] FIG. 1 is a block diagram of a cloud-based database architecture that provides native multitenancy in accordance with some embodiments. [Figure 4] FIG. 1 is a block diagram of a database system that provides native multitenancy in accordance with some embodiments. [Diagram 5] FIG. 1 is a flow diagram of a process for creating a tenant in a cloud database instance according to some embodiments. [Figure 6] FIG. 1 is a block diagram of a database system that provides native multi-tenancy and tenant-level encryption in accordance with some embodiments. [Figure 7] FIG. 1 is a block diagram of a cloud-based system according to some embodiments. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0008] The following description is provided to enable any person skilled in the art to make and use the described embodiments, however, various modifications will be readily apparent to those skilled in the art.

[0009] According to some embodiments, a native multitenant database system includes database-level tenant objects (e.g., database catalog objects) that facilitate the implementation of a multitenant architecture on the application layer. A tenant object is a logical collection of data and metadata artifacts attached to a tenant. Tenants can be exposed as first-class database objects (i.e., having an identity independent of any other database entity).

[0010] Database artifacts that are attached to a particular instantiation of a tenant object (i.e., a particular tenant) may include, but are not limited to, data for one or more schemas, tables, and partitions, as well as metadata that defines the tenant's tables, virtual tables, caches, remote sources, workload classes used to manage resource usage of the tenant's database objects, and views on database users. Advantageously, the lifecycle of a tenant may be decoupled from the lifecycle of its attached database artifacts. However, in some embodiments, dropping a tenant from a database instance results in dropping artifacts attached to that tenant unless those artifacts have been attached to another tenant of the database instance.

[0011] A native multitenant database system can include one or more database instances, all tenants' data, and an engine for processing the data. This single system also includes a single persistence for all tenants' data. By allowing multiple independent tenants, or more precisely customers, to be hosted on a single instance and share computing resources, the marginal cost associated with the deployment of a new tenant on a database instance is nearly zero. The latter comes at the expense of reduced isolation between different tenants. Furthermore, embodiments enable a pay-per-use model by providing finer granularity than would be required to provision individual database instances.

[0012] In cases where a tenant requires stronger data isolation than the logical isolation described above, the tenant can be deployed as the only tenant of a database instance. Such a configuration does not necessarily capture the full cost benefits of multitenancy, so the price charged for the only tenant may be higher than it would otherwise be.

[0013] The database system according to some embodiments supports requests for tenant-level database operations that would otherwise have to be performed by an application. These operations can include tenant create, tenant drop, tenant move, tenant restore from backup, tenant clone, tenant resize, and tenant resource limit. In some embodiments, the shared service exposes APIs (e.g., via REST) ​​that are called by multi-tenant applications to request these tenant-level operations from the database system, e.g., using the associated tenant id. Current database system DDLs may be extended to support granting database artifacts to tenants.

[0014] A tenant-level clone operation can be useful for onboarding new customers and providing them with template data. A clone operation is a form of tenant creation.

[0015] Some embodiments provide tenant-level recovery of point-in-time data, which recovers a particular tenant's data rather than all customers' data (i.e., the entire database instance's data). For example, if a tenant's data becomes corrupted, only the corrupted tenant's data needs to be recovered.

[0016] According to some embodiments, some users can only define artifacts that are assigned to a tenant, while other users are only allowed to perform copy / move operations. Otherwise, a malicious administrator could create a tenant, assign objects to the tenant, and then copy the tenant's contents to another system that is fully controlled by the malicious administrator. In addition, the malicious administrator could drop a tenant and delete all objects assigned to that tenant.

[0017] Embodiments may provide tenant-level encryption for encrypting data in tables attached to a tenant. This functionality encrypts each tenant's persisted data (i.e., data at rest) with an individual tenant-specific key, even though this data is not physically isolated from other tenants' data within the database instance. Thus, embodiments may enable database instance access to a repository of customer-specific keys.

[0018] Shared data and metadata (e.g., database catalogs, users, shared containers) can be encrypted in the persistence layer using a database instance-specific key. In contrast, conventional systems provide encryption of the entire persistence layer using a single database instance-specific key.

[0019] The location of a tenant, i.e., the database instance in which the tenant and its artifacts reside, is one of the tenant's characteristics and is determined by the multi-tenant application. The application may also decide to move a tenant from one database instance to a different database instance when the tenant's data size and resource consumption grows or shrinks. This move operation provides elasticity in cloud-based implementations and is preferably performed online to avoid downtime. Tenant-specific security properties, such as encryption, should be preserved during the tenant move operation.

[0020] Database resource consumption quotas can be defined at the tenant level. These quotas can address the "noisy neighbor" problem. Tenant session variables can be used to define tenant-specific usage limits on memory, threads, network I / O, disk I / O, disk size, etc., depending on the technical infrastructure's ability to measure and control such usage.

[0021] FIG. 1 is a block diagram of a system 100 according to some embodiments. The illustrated elements of the system 100, as well as all other architectures depicted herein, may be implemented using any suitable combination of computing hardware and / or processor-executable program code that is known or that becomes known. Such combinations may include one or more programmable processors (microprocessors, central processing units, microprocessor cores, execution threads), one or more non-transitory electronic storage media, and processor-executable program code. In some embodiments, two or more elements of the system 100 are implemented by a single computing device and / or two or more elements of the system 100 are co-located. One or more elements of the system 100 may be implemented as a cloud service (e.g., software as a service, platform as a service) using cloud-based resources and / or other systems that elastically allocate computing resources according to demand, need, price, and / or any other metric.

[0022] Database instance 110 provides native multitenancy according to some embodiments. Database instance 110 may be provisioned on any suitable combination of hardware and software, including one or more computer servers or virtual machines. In some embodiments, database instance 110 comprises a containerized application running within a software container. Such containers may be implemented by one or more nodes of a cluster (e.g., a Kubernetes cluster) as known in the art.

[0023] The database instance 110 includes a data engine 111 for processing data and metadata stored in a volatile (e.g., random access) memory 112. The memory 112 includes data 118 and metadata 119 for all tenants assigned to the database instance 110. Each tenant in the system 100 is described as corresponding to a customer, where a customer may be a company, a department, a workgroup, or any other group of users. A tenant may correspond to a particular cloud resource subscription / cloud service subscription of a given customer. In this regard, a customer may have more than one subscription, and therefore more than one tenant, associated with it.

[0024] Specifically, memory 112 includes a tenant instance 114 for tenant 'A' and a tenant instance 116 for tenant 'B'. Each tenant instance 114 and 116 is an instance of a tenant object defined in metadata 119. Tenant instances 114 and 116 may be stored within data 118, but are illustrated separately from data 118 for ease of understanding.

[0025] As described above, each tenant instance 114 and 116 is a collection of database artifacts. The artifacts attached to each tenant instance 114 and 116 are stored in data 118 and metadata 119. Thus, artifact A 115 attached to tenant instance 114 and artifact B 117 attached to tenant instance 116 are depicted using dotted lines to represent references to the database artifacts in data 118 and metadata 119. The database artifacts attached to a tenant instance may include, for example, one or more schemas, tables, and partitions. The database artifacts may also include metadata that defines the tenant's tables, virtual tables, caches, remote sources, workload classes used to manage resource usage of the tenant's database objects, and views on database users.

[0026] Database instance 110 also includes persistence 113 for persisting data 118 and metadata 119 of all assigned tenants (as well as separately depicted instances 114 and 116). Persistence 113 may be implemented using any persistent data storage system known or that becomes known, including but not limited to distributed data storage systems. Persistence 113 may persist transaction logs and other database artifacts known in the art.

[0027] Database instance 110 thereby provides a single data server that contains the data and metadata for all tenants of that database instance, an engine for processing the data, and a single persistence for the data and metadata. Hosting multiple independent tenants on such a single database instance facilitates sharing of computing resources with near-zero marginal cost.

[0028] Multi-tenant application 120 may comprise a SaaS application, although embodiments are not limited thereto. Multi-tenant application 120 may comprise a containerized application that may be provisioned on one or more computer servers or virtual machines and executes within a software container. Multi-tenant application 120 issues queries (e.g., SQL, MDX) to database instance 110 based on input received from users 135 of customer 130 and users 145 of customer 140.

[0029] Assume that customer A 130 corresponds to tenant A 114 of database instance 110, and customer B 140 corresponds to tenant B 116 of database instance 110. When multi-tenant application 120 receives input from user 135 of customer A 130, it can send a query to database instance 110 indicating that the query is related to tenant A 114. Similarly, when multi-tenant application 120 receives input from user 145 of customer B 140, it can send a query to database instance 110 with an indication that the query is related to tenant B 116. When database instance 110 receives a query from multi-tenant application 120, it processes the query using data engine 111 and artifacts attached to the tenant to which the query is related.

[0030] Thus, the multi-tenant application 120 can determine the tenant that corresponds to the user from whom the input is received. For example, each user can log on to the multi-tenant application 120 using a tenant-specific subscription. Thus, the multi-tenant application 120 associates the user with the tenant of the subscription to which the user logged on. In another example, communication between a user and the multi-tenant application 120 can include a tenant identification token.

[0031] The multi-tenant application 120 is also aware of which tenants are located on which database instances. In this regard, the multi-tenant application 120 can request the provisioning of database instances and the creation of tenants on the provisioned database instances. Upon receiving input from a user associated with a given tenant, the multi-tenant application 120 can determine the database instances that contain the given tenant and therefore to which corresponding queries should be directed.

[0032] The multitenant application 120 can request provisioning of a database instance and creation of a tenant on the provisioned database instance based on input received from a customer key user. According to some embodiments, the multitenant application 120 calls a provisioning service (not shown in FIG. 1 ) to provision a new database instance. The multitenant application 120 may call a tenant lifecycle management service REST API (not shown in FIG. 1 ) to create a tenant on a database instance, drop a tenant from a database instance, move a tenant to a database instance, restore a tenant from a database backup, clone a tenant to a database instance (i.e., create as a template), resize a tenant on a database instance, define tenant resource limits on a database instance, etc.

[0033] 2 illustrates a system 200 in which a multi-tenant application 120 has requested provisioning of a database instance 210 in addition to database instance 110. Database instance 210 includes its own data engine 211, memory 212, and persistence 213.

[0034] The multi-tenant application 120 has also requested the creation of Tenant C on the database instance 210. Tenant C corresponds to Customer C 230. Thus, the memory 212 includes a tenant object instance 214 for Tenant C that is attached to an artifact C 215. The artifact C 215 comprises data and metadata stored in the data 216 and metadata 217 of the memory 212. Thus, when the multi-tenant application 120 receives input from a user 235 of Customer C 230, it directs any resulting queries towards the database instance 210 because the multi-tenant application 120 knows that the database instance 210 includes Tenant C 214, which corresponds to Customer C 230.

[0035] According to some embodiments, each tenant is identified by a name that is unique within its own database instance. Thus, tenant C 214 may be named tenant A because database instances 110 and 210 operate independently. A multi-tenant application may provision multiple database instances and provide resiliency to its tenants through tenant move operations. In such cases, the application should ensure that the movement of a tenant to a target database instance does not introduce tenant name conflicts on the target database instance.

[0036] 3 illustrates a system 300 in which a multi-tenant application 310 is associated with an instance farm 320. Farm 320 includes several database instances, including instances 321 and 325. Farm 320 can provide an execution environment on which the multi-tenant application 310 can provision database instances and create tenants on the database instances.

[0037] The multitenant application 310 is aware of the database instances provisioned in the farm 320 and the tenants that reside on each database instance. Each database instance in the farm 320 is aware of the tenant of that database instance, as well as the users, schemas, and other metadata that it stores. However, a given database instance in the farm 320 is not aware of the tenants, schemas, etc. of other database instances in the farm 320.

[0038] The multi-tenant application 310 can specify memory and persistence sizes for each database instance in the farm 320 and scale these sizes as desired. The multi-tenant application 310 can also create tenants on the database instances in the farm 320, specify their initial sizes, and scale the tenant sizes as desired. As described above, the multi-tenant application 310 can also drop tenants from database instances or move tenants to database instances.

[0039] Each database instance of the system 300 may be run by a cluster (e.g., a Kubernetes cluster). Each cluster may allow the multi-tenant application 310 to provision scale-out nodes to provide additional computing resources to its database instances. Additionally, the multi-tenant application 310 may be node-aware, allowing tenant movement between nodes of the same database instance or between nodes of different database instances.

[0040] 4 is a block diagram of a system 400 that provides native multi-tenancy according to some embodiments. A database instance 450 includes tenant object instances 452 and 454 that are associated with artifacts 453 and 455 as described above. For clarity, the data engine and persistence of database instance 450 have been omitted from FIG.

[0041] Each tenant instance of database instance 450 corresponds to a respective one of customers 410. Customer A 411 includes key users 412 and business users 413, and customer N 417 includes key users 418 and business users 419. Figure 5 includes a flow diagram of a process 500 for provisioning a database instance and creating tenant instances therein, as shown in Figure 4 and in accordance with some embodiments.

[0042] Process 500, and all other processes described herein, may be embodied in the form of program code that is executable by one or more processing units (e.g., processors, processor cores, processor threads) and that is read from one or more of a non-transitory computer-readable medium, such as a hard disk drive, a volatile or non-volatile random access memory, a DVD-ROM, a flash drive, and a magnetic tape, and then stored in a compressed, uncompiled, and / or encrypted format. In some embodiments, hardwired circuitry may be used in place of or in combination with the program code to implement processes according to some embodiments. Thus, the embodiments are not limited to any specific combination of hardware and software.

[0043] At S510, a database instance in which a tenant will reside is first provisioned. Referring to the example of Figure 4, a key user 412 can access a multi-tenant application 420 and request provisioning of a database instance. This request is forwarded to a service manager 430 and a cloud service broker 440. Then, at S510, the cloud service broker 440 provisions a database instance 450 as a cloud-based resource.

[0044] At S520, a tenant object instance is created in the database instance. Continuing with the above example, key user 412 can access multi-tenant application 420 and request the creation of a tenant on database instance 450. The request is forwarded to service manager 430, service broker 460, and tenant management service 470. Tenant management service 470 then instructs database instance 450 to create tenant A instance 452 based on the tenant object defined in metadata 457. Tenant A instance 452 may be identified by a tenant id known to database instance 450 and multi-tenant application 420.

[0045] Next, at S530, the database artifacts are attached to the tenant instances created at S520. For example, the multi-tenant application 420 requests the tenant management service 470 to instruct the database instance 450 to associate tenant A instance 452 with artifact A 453. The key user 412 may have previously manipulated the multi-tenant application 420 and the service broker 460 to define artifact A 453 in the data 456 and metadata 457 of the database instance 450. All database artifacts are created by the service broker 460 but are managed by the multi-tenant application 420.

[0046] In some embodiments, a deployment infrastructure can be used to define database artifacts to be granted to tenant instances. The deployment infrastructure can provide a declarative approach to define database objects (e.g., as design-time artifacts) using containers. For example, service broker 460 can create containers corresponding to database schemas and additional metadata (e.g., users, roles, privileges), which can then be granted to tenant instances. Such containers can be isolated from each other by schema-level access privileges. Applications 420 can access any database object in the container's database schema by using the assigned per-schema technical database user.

[0047] The flow repeats until a command is received to create another tenant in the database instance at S540. For example, key user 418 of customer N 417 can access multi-tenant application 420 to request the creation of a tenant on database instance 450. This request is forwarded to service manager 430, service broker 460, and tenant management service 470, which instructs database instance 450 to create tenant N instance 454 at S520. Multi-tenant application 420 further instructs tenant management service 470 to grant predefined artifact N 455 to tenant N instance 454 at S530.

[0048] After the multi-tenant application 420 provisions database instance 450 and creates tenants 452 and 454, it can receive input from, for example, business user 413 of customer A 411. In response, application 420 directs any resulting queries to database instance 450 via tenant management services 470 to identify tenant A 452. Database instance 450 responds to the queries based on artifact A 453 of tenant instance A 452. In the case where the multi-tenant application 420 receives input from business user 419 of customer N 417, any resulting queries are directed to database instance 450 and responded to based on artifact N 455 of tenant instance N 454.

[0049] 6 is a block diagram of a system 600 that provides native multi-tenancy and tenant-level encryption according to some embodiments. Elements of system 600 that are numbered similarly to elements of system 400 (i.e., 6xx vs. 4xx) may be implemented and operate similarly.

[0050] System 600 illustrates persistence 660 of database instance 650, which was omitted from FIG. 4. Persistence 660 may be implemented using any suitable storage system or systems. Persistence 660 stores data 662, 664 for each tenant of instance 650, data 666 of instance 650 that is not assigned to a particular tenant, and metadata 668 of instance 650. Advantageously, and in contrast to conventional systems, persisted data 662 and 664 are encrypted using encryption keys (i.e., Data Encryption Keys (DEK) A and DEK N), which are specific to their corresponding tenants (i.e., customers). Additionally, persisted, unassigned data 666 and metadata 668 are encrypted using a database instance specific encryption key (i.e., DEK DB).

[0051] According to some embodiments, DEK DB is a public-private key pair that is generated as part of the creation of database instance 650. Database instance 650 uses the DEK DB's public key to encrypt data 666 and data 668 prior to storing them in persistence 660. Database instance 650 uses the DEK DB's private key to decrypt data 666 and data 668 as needed. In some embodiments, the DEK DB's private key is stored in encrypted form in secure store persistence 675.

[0052] For example, a key user 695 of a database instance provider 690 provides a key encryption key (KEK) DB to key management system 680 for storage in key vault 685. The KEK DB is used to encrypt the DEK DB's private key prior to storing it in secure store persistence 675. The KEK DB may also comprise a private-public key pair, where key vault 685 stores the KEK DB's private key while the corresponding public key is used to encrypt the DEK DB's private key prior to storing it in secure store persistence 675.

[0053] Thus, when database instance 650 wishes to decrypt data 666 or data 668, it requests the private key of the DEK DB from secure store 670. In response, secure store 670 requests key management system 680 to decrypt the stored encrypted private key of the DEK DB using the private key of the KEK DB. Database system 650 then uses the decrypted private key of the DEK DB to decrypt the desired data of data 666 or data 668.

[0054] Similarly, DEK A may comprise a public-private key pair that is generated during creation of tenant A 652. Database instance 650 uses DEK A's public key to encrypt data 662 prior to storing it in persistence 660. Database instance 650 decrypts data 662 using DEK A's private key, if necessary. In some embodiments, DEK A's private key is stored in encrypted form in secure store persistence 675.

[0055] Key user 612 of customer A 611 provides KEK A to key management system 680 for storage in key vault 685. KEK A is used to encrypt DEK A's private key prior to storing it in secure store persistence 675. KEK A may comprise a private-public key pair, where key vault 685 stores KEK A's private key while the corresponding public key is used to encrypt DEK A's private key prior to storing it in secure store persistence 675.

[0056] When database instance 650 wants to decrypt data 662, it requests the private key of DEK A from secure store 670. In response, secure store 670 requests key management system 680 to decrypt the stored encrypted private key of DEK A using the private key of KEK A. This request may be issued to an account in key management system 680 specific to customer A 611. Database instance 650 then uses the decrypted private key of DEK A to decrypt the desired data of data 662. Thus, if customer A revokes KEK A from key vault 685, database provider 690 will not be able to decrypt the stored private key DEK A and, as a result, will not be able to decrypt data 662. The above process may be performed in the case of each newly created tenant N.

[0057] Architecture 600 may provide other encryption not described herein. For example, data sent from clients to and from database instance 650 may be encrypted in transit using TLS / SSL. Additionally, individual table columns in non-persistent memory 651 may be encrypted using known techniques (e.g., using client-controlled keys).

[0058] 7 illustrates a cloud-based database deployment 700 according to some embodiments. A user device 710 may comprise any suitable computing system operable by a key user or a business user to access a cloud-based multi-tenant application. The user device 710 may store and execute web browser program code to access a uniform resource locator (URL) associated with a login page of such a multi-tenant application. The web browser may download and execute program code of a client-side component of the multi-tenant application as known in the art.

[0059] Application server nodes 720, 722, and 724 can host multitenant applications according to some embodiments. Database nodes 730, 732, and 734 can host one or more database instances accessible from multitenant applications providing native multitenancy as described herein. Each node of the deployment 700 can comprise a separate physical or virtual machine. Such virtual machines can be allocated by a cloud provider offering self-service and instant provisioning, auto-scaling, security, compliance, and identity management capabilities.

[0060] The foregoing diagrams represent logical architectures for describing processes according to some embodiments, and actual implementations may include more or different components arranged in other ways. Other topologies may be used in connection with other embodiments. Furthermore, each component or device described herein may be implemented by any number of devices communicating over any number of other public and / or private networks. Two or more of such computing devices may be located remotely from one another and may communicate with one another over any known manner of network and / or dedicated connections. Each component or device may comprise any number of hardware and / or software elements suitable for providing the functionality described herein as well as any other functionality. For example, any computing device may include a programmable processor for executing program code such that the computing device operates as described herein.

[0061] All systems and processes discussed herein may be embodied in the form of program code stored on one or more non-transitory computer-readable media. Such media may include, for example, DVD-ROMs, flash drives, magnetic tapes, and solid-state random access memory (RAM) or read-only memory (ROM) storage units. Thus, embodiments are not limited to any particular combination of hardware and software.

[0062] Elements described herein as in communication with one another may communicate, directly or indirectly, via any number of different systems for transferring data, including, but not limited to, shared memory communication, local area networks, wide area networks, telephone networks, cellular networks, fiber optic networks, satellite networks, infrared networks, radio frequency networks, and any other type of network that may be used to transmit information between devices. Furthermore, communication between the systems may occur via any one or more transmission protocols that are known or become known, such as Asynchronous Transfer Mode (ATM), Internet Protocol (IP), Hypertext Transfer Protocol (HTTP), and Wireless Application Protocol (WAP).

[0063] The embodiments described herein are for illustrative purposes only, and those skilled in the art will appreciate that other embodiments may be implemented with modifications and variations of those described above. [Explanation of symbols]

[0064] 100 Systems 110 Database Instances 111 Data Engine 112 Memory 113 Persistence 114 Tenant Instance, Tenant A 115 Artifact A 116 Tenant Instances, Tenant B 117 Artifact B 118 Data 119 Metadata 120 Multitenant Applications 130 Customer, Customer A 135 users 140 Customer, Customer B 145 users 200 Systems 210 Database Instances 211 Data Engine 212 Memory 213 Persistence 214 Tenant object instance, Tenant C 215 Artifact C 216 Data 217 Metadata 230 Customer C 235 users 300 Systems 310 Multitenant Applications 320 instance farm 321 instances 325 instances 400 Systems 410 Customer 411 Customer A 412 Key Users 413 Business Users 417 Customer N 418 Key Users 419 Business Users 420 Multitenant Applications 430 Service Manager 440 Cloud Service Broker 450 database instances 452 Tenant object instance, Tenant A instance, Tenant, Tenant A, Tenant instance A 453 Artifact, Artifact A 454 Tenant object instance, Tenant N instance, Tenant, Tenant instance N 455 Artifact, Artifact N 456 Data 457 Metadata 460 Service Broker 470 Tenant Management Service 500 processes 600 System, Architecture 611 Customer A 612 Key Users 650 Database instances, database systems 651 Non-persistent Memory 652 Tenant A 660 Persistence 662 Persistent Data 664 Persistent Data 666 Data 668 Metadata 670 Secure Store 675 Secure Store Persistence 680 Key Management System 685 Key Bolt 690 Database Instance Provider, Database Provider 695 Key Users 700 Cloud-Based Database Deployments 710 User Devices 720 Application Server Nodes 722 Application Server Node 724 Application Server Node 730 database nodes 732 database nodes 734 database nodes

Claims

1. 1. A database system comprising: Metadata that defines a tenant object and several database artifacts, a first instance of the tenant object associated with a first plurality of the database artifacts including first data related to the first instance of the tenant object; and a second instance of the tenant object associated with a second plurality of the database artifacts that includes second data related to the second instance of the tenant object; A memory for storing A processing device for executing program code for a database instance, the program code comprising: receiving and responding to queries regarding the first data associated with the first instance of the tenant object and queries regarding the second data associated with the second instance of the tenant object; receiving and responding to a request to associate a first resource consumption limit with the first instance of the tenant object and to associate a second resource consumption limit with the second instance of the tenant object; a processing device capable of performing Equipped with The first resource consumption limit is different from the second resource consumption limit. Database system.

2. 2. The system of claim 1, comprising: a persistent storage system that stores first persisted data associated with the first instance of the tenant object and second persisted data associated with the second instance of the tenant object.

3. 3. The system of claim 2, wherein the first persisted data is encrypted using a first encryption key associated with the first instance of the tenant object, and the second persisted data is encrypted using a second encryption key associated with the second instance of the tenant object.

4. 4. The system of claim 3, wherein the persistent storage system stores third persisted data not associated with either the first instance of the tenant object or the second instance of the tenant object, the third persisted data being encrypted using a third encryption key, and the metadata being encrypted using the third encryption key.

5. 2. The system of claim 1, wherein the program code is executable to cause the system to receive and respond to a request to move the first instance of the tenant object and the first plurality of the database artifacts to a second database instance, and wherein the second instance of the tenant object and the second plurality of the database artifacts are not moved to the second database instance.

6. 2. The system of claim 1, wherein the program code is executable to cause the system to receive and respond to a request to restore the first instance of the tenant object and the first plurality of the database artifacts from a backup, and the second instance of the tenant object and the second plurality of the database artifacts are not restored from the backup.

7. 1. A method comprising: creating a first instance of a tenant object in a database instance; associating the first instance of the tenant object with a first plurality of database artifacts including first data related to the first instance of the tenant object; creating a second instance of the tenant object in the database instance; associating the second instance of the tenant object with a second plurality of database artifacts including second data related to the second instance of the tenant object; receiving and responding to queries regarding the first data associated with the first instance of the tenant object and queries regarding the second data associated with the second instance of the tenant object; receiving a request to associate a first resource consumption limit with the first instance of the tenant object and to associate a second resource consumption limit with the second instance of the tenant object; in response to the request, associating a first resource consumption limit with the first instance of the tenant object and associating a second resource consumption limit with the second instance of the tenant object; The first resource consumption limit is different from the second resource consumption limit. method.

8. 8. The method of claim 7, further comprising storing first persisted data associated with the first instance of the tenant object and second persisted data associated with the second instance of the tenant object in a persistent storage system.

9. 9. The method of claim 8, wherein the first persisted data is encrypted using a first encryption key associated with the first instance of the tenant object, and the second persisted data is encrypted using a second encryption key associated with the second instance of the tenant object.

10. 10. The method of claim 9, further comprising: encrypting third persisted data not related to either the first instance of the tenant object or the second instance of the tenant object, and metadata defining the first plurality of database artifacts and the second plurality of database artifacts, using a third encryption key; and storing the encrypted third persisted data and the metadata in the persistent storage system.

11. receiving a request to migrate the first instance of the tenant object and the first plurality of database artifacts to a second database instance; in response to the request, migrating the first instance of the tenant object and the first plurality of database artifacts to the second database instance; 8. The method of claim 7, further comprising: wherein the second instance of the tenant object and the second plurality of database artifacts are not moved to the second database instance.

12. receiving a request to restore the first instance of the tenant object and the first plurality of database artifacts from a backup; in response to the request, restoring the first instance of the tenant object and the first plurality of database artifacts from the backup; 8. The method of claim 7, further comprising: wherein the second instance of the tenant object and the second plurality of database artifacts are not restored from the backup.

13. A non-transitory computer readable medium storing program code, the program code being transmitted by one or more processors to a computing system, the creating a first instance of a tenant object in a database instance; Associating the first instance of the tenant object with a first plurality of database artifacts including first data related to the first instance of the tenant object; creating a second instance of the tenant object in the database instance; associating the second instance of the tenant object with a second plurality of database artifacts including second data related to the second instance of the tenant object; receiving and responding to queries regarding the first data associated with the first instance of the tenant object and queries regarding the second data associated with the second instance of the tenant object; receiving a request to associate a first resource consumption limit with the first instance of the tenant object and to associate a second resource consumption limit with the second instance of the tenant object; in response to the request, associating a first resource consumption limit with the first instance of the tenant object and associating a second resource consumption limit with the second instance of the tenant object; and The first resource consumption limit is different from the second resource consumption limit. Non-transitory computer-readable medium.

14. The program code is executed by one or more processors on the computing system, storing first persisted data associated with the first instance of the tenant object and second persisted data associated with the second instance of the tenant object in a persistent storage system; [0023] the first persisted data is encrypted using a first encryption key associated with the first instance of the tenant object; the second persisted data is encrypted using a second encryption key associated with the second instance of the tenant object. The medium according to claim 13.

15. The program code is executed by one or more processors on the computing system, encrypting third persisted data not associated with either the first instance of the tenant object or the second instance of the tenant object, and metadata defining the first plurality of database artifacts and the second plurality of database artifacts, using a third encryption key; storing the encrypted third persistent data and the metadata in the persistent storage system; 15. The medium of claim 14, further executable to:

16. The program code is executed by one or more processors on the computing system, receiving a request to migrate the first instance of the tenant object and the first plurality of database artifacts to a second database instance; in response to the request, migrating the first instance of the tenant object and the first plurality of database artifacts to the second database instance; [0023] the second instance of the tenant object and the second plurality of database artifacts are not moved to the second database instance; The medium according to claim 13.

17. The program code is executed by one or more processors on the computing system, receiving a request to restore the first instance of the tenant object and the first plurality of database artifacts from a backup; in response to the request, restoring the first instance of the tenant object and the first plurality of database artifacts from the backup; [0023] the second instance of the tenant object and the second plurality of database artifacts are not restored from the backup; The medium according to claim 13.

Images