Cross-Tenancy Metric Data Transmission via Service Relay
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-tenant cloud environments with a dual-tenant architecture, metric data can only be retrieved from resources within the same tenancy, leading to a loss of operation visibility for resources residing in separate customer-owned tenancies.
Innovation Solution
Implementing a method where worker nodes in a customer tenancy are provided with a client certificate for trusted communication with service tenancy resources, allowing signed requests containing metric data to be authenticated and validated, and then preprocessing the metric data for ingestion into a telemetry service.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If metric data is only retrieved from resources within the same tenancy, then data security and tenancy isolation are maintained, but operational visibility for resources in separate customer-owned tenancies is lost
Solution Approach 1:
The patent introduces a metric relay service acting as an intermediary between customer-owned tenancies and service-owned tenancies. This relay service receives metric data from customer resources, validates it, and forwards it to the telemetry service, enabling cross-tenancy visibility while maintaining security boundaries through controlled authentication and authorization mechanisms
2Reliability
If traditional authentication models are used for cross-tenancy communication, then tenancy security boundaries are maintained, but metric data transmission between tenancies is blocked
Solution Approach 1:
The patent segments the authentication and authorization processes into distinct components: authentication of the relay service to customer resources, authorization of the relay service to forward metrics to the telemetry service, and validation of metric data integrity. This segmentation allows controlled cross-tenancy communication while maintaining security boundaries
Solution Approach 2:
The relay service implements universal authentication and authorization mechanisms that work across different tenancy boundaries. It uses client certificates for authentication and configurable authorization rules for access control, enabling a single service to mediate metric collection from multiple customer tenancies to a centralized telemetry service
Data Source
AI summary
Techniques are described for transmitting metric data between tenancies. Metric data is gathered for resources within a customer tenancy of a multi-tenant environment. This metric data is sent to a service tenancy of the multi-tenant environment, where the service tenancy is separate from the customer tenancy. The metric data is validated and preprocessed within the service tenancy to make sure that all required fields (such as key-value pairs) are located within the metric data. The preprocessed metric data is then sent to a telemetry service for analysis.