API Gateway Multi-Tenancy Data Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing APIs and service delivery systems face challenges in providing secure, scalable, and multi-tenant access to backend IT systems, particularly in isolating application data stores for different applications to ensure security, data integrity, and integration across diverse user management and service capabilities.
Innovation Solution
An API and services engine that uses an API gateway to identify requesting applications through authorization tokens, routing service requests to shared service libraries, which abstract complexities and manage application-specific data stores, enabling application-level multi-tenancy and load balancing across distributed server clusters.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If shared service libraries are used to provide common services across multiple applications, then service reusability and scalability are improved, but data isolation and security between applications deteriorate
Solution Approach 1:
The patent implements segmentation by separating service logic from data storage. Shared service libraries provide common functionality (caching, security, search) while application-specific data stores maintain isolation. The service request routing mechanism segments data access based on application identifiers, allowing secure multi-tenancy where services are shared but data remains isolated.
Solution Approach 2:
The patent introduces an intermediary layer (service engine with routing logic) between shared service libraries and application data stores. This intermediary receives service requests, identifies the requesting application via authorization tokens, and routes requests to appropriate data stores. The intermediary enables secure access to shared services while maintaining data isolation through application-level multi-tenancy.
2Reliability
If application-level multi-tenancy is implemented to isolate data stores, then security and data integrity are improved, but system complexity and device complexity deteriorate
Solution Approach 1:
The patent implements universality through shared service libraries that provide multiple functions (caching, security, search, rules) across different applications. The service engine acts as a universal router that handles all service requests regardless of application, maintaining a single unified architecture that reduces complexity compared to separate monolithic systems for each application.
Solution Approach 2:
The patent uses copying by creating application-specific data store views or partitions that replicate the same underlying data structure but with application-level isolation. Instead of copying entire systems, the patent copies only the data access layer, allowing multiple applications to share infrastructure while maintaining logical separation through copied data views.
3Reliability
If centralized service routing is used to manage multi-tenancy, then data isolation is improved, but service request processing time and speed deteriorate
Solution Approach 1:
The patent applies preliminary action by pre-establishing authorization tokens and application identifiers during the authentication phase. These identifiers are stored and reused in subsequent service requests, eliminating the need for repeated authentication and routing decisions. The service engine maintains cached mappings between authorization tokens and application data stores, enabling fast routing without real-time complex queries.
Data Source
AI summary
In some examples, an application programming interface (API) and services engine is configured to determine, in response to receiving a service request from an application, an application identifier for the service request based at least on an authorization token included in the service request, wherein the application identifier identifies an application that issued the service request; select, based at least on the application identifier, an application data store uniquely associated with the application that issued the service request; and process the service request using data stored by the selected application data store.