Audit Information Authorization Across Multi-Tenant Hierarchies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data management systems struggle to efficiently manage access authorization for audit information in multi-tenancy environments, particularly in hierarchical multi-tenancy scenarios, leading to potential security breaches and inefficiencies in data retrieval and management.
Innovation Solution
A multi-tenancy data management system (DMS) determines access permissions for audit information based on authentication domains and computing object hierarchies, ensuring that users can only access authorized data by identifying tenant IDs and filtering audit reports accordingly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a multi-tenancy data management system stores audit information for multiple tenants in a shared environment, then data retrieval efficiency is improved, but security risks increase due to potential unauthorized access between tenants
Solution Approach 1:
The patent segments audit information by tenant ID, creating logically separated data structures within the shared storage system. Each tenant's audit records are tagged with unique identifiers, enabling the system to efficiently retrieve only the relevant tenant's data while maintaining physical storage efficiency. This segmentation approach resolves the contradiction by allowing fast targeted retrieval without compromising security boundaries between tenants.
Solution Approach 2:
The patent introduces an intermediary access control mechanism that mediates between the shared storage system and individual tenants. This intermediary layer verifies tenant identities and filters audit information based on authorization rules, allowing efficient access to relevant data while preventing unauthorized cross-tenant access. The intermediary resolves the security-efficiency contradiction by acting as a security gatekeeper that enables legitimate fast access while blocking unauthorized requests.
2Reliability
If the system implements comprehensive access authorization checks for audit information, then security is improved, but system complexity increases due to multi-level tenant hierarchies
Solution Approach 1:
The patent implements preliminary action by pre-establishing authentication domains and computing object hierarchies during system initialization and tenant onboarding. Access authorization rules are predefined and cached, allowing the system to make rapid authorization decisions during runtime without complex real-time calculations. This preliminary setup reduces operational complexity while maintaining comprehensive security checks.
Solution Approach 2:
The patent resolves complexity by introducing hierarchical dimensions to the authorization model, organizing tenants and subtenants in structured levels with clear inheritance relationships. Instead of managing complex many-to-many authorization rules, the system uses dimensional hierarchy where parent tenant permissions automatically cascade to subtenants. This dimensional organization simplifies the authorization logic while maintaining comprehensive security coverage across multi-level hierarchies.
Data Source
AI summary
Methods, systems, and devices for data management are described. A data management system (DMS) may provide backup services for multiple tenants. The DMS may receive a request to provide a first user of the DMS with audit information associated with an entity of the DMS. The DMS may identify context information for a log-in session associated with the request. The context information may include an identifier (ID) of a tenant associated with the request. The DMS may identify, based on the ID of the tenant, authorization information associated with the tenant. The authorization information may indicate that the tenant has access to a set of entities within a hierarchy associated with the DMS. The DMS may determine whether to output the requested audit information to the first user based on a hierarchical relationship, within the hierarchy, between the tenant and the entity.