Containerized Isolated Data Storage for Multi-Tenant Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Shared database architectures in cloud environments pose a security risk due to the potential for a security breach in one user account to compromise entire databases, as applications often require elevated rights to access user-specific information, leading to a high impact of data theft across multiple accounts.
Innovation Solution
Implementing secure containerized user-specific isolated data storage using a multi-layered file system like OverlayFS, where each user has a separate database instance on a container with a write-protected lower storage layer and an upper storage layer for modifications, ensuring that each user's data is isolated and accessed only through account-specific authentication, thereby limiting damage from security breaches.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a shared database architecture is used to store user data in cloud environments, then resource utilization and scalability are improved, but security risk increases due to potential breaches compromising entire databases
Solution Approach 1:
The patent divides the shared database into separate isolated containers, each storing data for a specific user account. This segmentation allows multiple users to share the same physical infrastructure while maintaining logical separation, thus improving resource utilization while reducing security risk since a breach in one container cannot compromise other containers.
Solution Approach 2:
The patent introduces an intermediary layer (the container isolation mechanism) between the application and the underlying storage infrastructure. This intermediary enables secure multi-tenant cloud storage by mediating access controls and preventing direct access to other users' data, thereby maintaining security while allowing shared resource usage.
2Object-affected harmful factors
If isolated containers are used for each user account, then security is improved by limiting breach impact, but device complexity increases due to multiple database instances
Solution Approach 1:
The patent creates a universal container template that can be replicated for multiple users. Each container instance serves the same function (storing user data) but maintains isolation. This multi-functionality approach allows the system to handle multiple users with identical security requirements without manually configuring each user's storage, thereby reducing complexity while maintaining security.
Solution Approach 2:
The patent uses copying to create isolated container instances for each user account. Instead of manually setting up separate database instances, the system copies a standardized container template, which automatically provides isolation and security. This copying mechanism simplifies the management of multiple isolated environments while maintaining consistent security boundaries.
3Stability of the object's composition
If write-protected lower storage layers are used in containerized storage, then data integrity is improved, but ease of operation decreases due to restricted write access
Solution Approach 1:
The patent introduces a layered storage architecture with multiple dimensions of access control. The lower storage layer is write-protected to maintain data integrity, while the upper storage layer allows write operations. This dimensional separation enables the system to simultaneously enforce data integrity at the lower layer while providing ease of operation at the upper layer, resolving the contradiction between stability and operability.
Data Source
AI summary
Secure containerized user specific isolated data storage is disclosed. For example, a first isolated guest is instantiated, including a first account specific database with a write-protected schema, a write-protected first lower storage layer and a first upper storage layer. A first account is authenticated with the first isolated guest. A first change to the first account specific database is saved in the first upper storage layer based on executing a first database command from the first account. A second isolated guest is instantiated, including a second account specific database with the write-protected schema, a write-protected second lower storage layer and a second upper storage layer. The second account is authenticated with the second isolated guest. A second change to the second account specific database is saved in the second upper storage layer based on executing the second database command from the second account.