Multi-tenant Cloud Resource Sharing via Authorization Tables
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud computing environments, existing methods for resource sharing between tenants lack flexibility in access scope and task delegation, as designating a tenant as a guest user limits the scope of access and variety of tasks that can be granted.
Innovation Solution
Establishing a sharing relationship between tenants allows for flexible access control through an authorization table, enabling tenants to define and modify access scopes, with options for publication-subscription, publication-application, and exclusive invitation-based relationships, and allowing users to access resources based on their privileges.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a tenant is designated as a guest user for resource sharing, then access control is simplified, but the scope of access and variety of tasks that can be granted is limited
Solution Approach 1:
The patent segments access control into multiple authorization levels and types (delegate, guest, partner, etc.), each with different scopes and capabilities. Instead of a single guest user model, the system divides access control into granular permission sets that can be selectively applied, allowing both simplicity for basic cases and flexibility for complex scenarios.
Solution Approach 2:
The authorization model is made dynamic through configurable authorization tables and policies that can be modified at runtime. Access scopes are not fixed but can be adjusted based on specific needs, allowing the system to adapt between simplified guest access and complex delegated access with various task permissions.
2Reliability
If identity and access management is isolated across different tenants, then security and exclusivity are improved, but resource sharing flexibility is reduced
Solution Approach 1:
The patent introduces an intermediary authorization layer between tenant isolation and resource sharing. The authorization table and policy engine act as mediators that enable controlled access across tenant boundaries while maintaining security. This intermediary mechanism allows resources to be shared through explicit authorization grants without compromising the fundamental isolation model.
Solution Approach 2:
The system applies different access control qualities to different resources and tenants locally. Each resource can have its own authorization policies, and each tenant can have customized access levels. This local differentiation allows security to be maintained where needed while enabling sharing where authorized, resolving the contradiction between isolation and flexibility.
Data Source
AI summary
In one respect, there is provided a system a data processor and a memory. The system can be configured to receive, from a first user associated with a first tenant, a request to access a resource associated with a second tenant. The first tenant and the second tenant can be tenants of a multi-tenant cloud-computing platform. The resource can be accessible via the multi-tenant cloud-computing platform. The first user can be authorized to access the resource associated with the second tenant based on a sharing relationship that allows the first user to access the resource. In response to determining that the first user is authorized to access the resource associated with the second tenant, access to the resource can be provided to the first user. Related methods and articles of manufacture, including computer program products, are also provided.