Data Access Agents for Multi-Tenant Security Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-tenant architectures, existing data access control methods fail to provide sufficient security, as a breach in access credentials for one user can expose data for other users, and there is a lack of effective isolation and secure data removal, especially when encryption keys are shared across users.
Innovation Solution
Implementing a secure data access control architecture that uses user-specific data access agents and encryption keys, where each data access agent has access only to its associated user's data store, and a routing application invokes these agents to manage data access on behalf of the main application, ensuring isolation and secure data storage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a single application serves multiple users in a multi-tenant architecture with shared computing or storage resources, then resource utilization efficiency is improved, but data security and isolation between users deteriorate
Solution Approach 1:
The patent divides the shared data store into multiple isolated data stores, one for each user. Each data store is accessible only to its corresponding user's data access agent, preventing cross-user data access while maintaining shared infrastructure. This segmentation resolves the contradiction by providing both resource sharing and data isolation.
Solution Approach 2:
The patent introduces data access agents as intermediaries between users and the data store. Each agent is associated with a specific user and has access only to that user's data store. The routing application acts as another intermediary to invoke the appropriate agent. This intermediary layer enables secure multi-user access without direct user-to-data-store connections.
2Device complexity
If encryption keys are shared across users for data encryption, then system complexity is reduced, but security isolation between users deteriorates
Solution Approach 1:
The patent assigns a unique encryption key to each user's data store instead of sharing a common key. Each data access agent can only access its associated user's encryption key, ensuring that even if one user's credentials are compromised, other users' data remains secure. This segmentation of encryption keys resolves the contradiction by prioritizing security isolation over system simplicity.
3Ease of operation
If a user's data access credentials are breached, then ease of operation is maintained, but data security for other users deteriorates
Solution Approach 1:
The patent isolates each user's data access credentials and data store separately. A breach in one user's credentials only affects that user's specific data store, not other users' data. This segmentation limits the scope of potential harm while maintaining straightforward access operations for each user through their dedicated agent.
Solution Approach 2:
The patent implements preliminary security measures by designing the system so that credential breaches inherently cannot affect other users due to the isolated architecture. The routing application and data access agents are configured to prevent cross-user access from the outset, counteracting potential harmful effects before they can occur.
4Reliability
If data stores are isolated for each user with user-specific data access agents, then data security is improved, but device complexity increases
Solution Approach 1:
The patent makes the data access agent a universal component that can serve any user through association with their specific data store. The routing application provides a unified interface for invoking agents. This universality reduces complexity by using a single agent design pattern for all users rather than creating unique access mechanisms for each user.
Solution Approach 2:
The patent creates isolated data stores that are copies or replicas of a template data store structure for each user. This copying approach maintains security isolation while using a standardized, repeatable pattern that reduces overall system complexity compared to designing unique storage structures for each user.
Data Source
AI summary
A computer system for secure data access control, according to some examples, may perform operations including: receiving first data from a first client associated with a first user; using a first data access agent to store the first data in a first data store, the first data access agent having access to the first data store and not having access to a second data store; receiving second data from a second client associated with a second user; and using a second data access agent to store the second data in the second data store, the second data access agent having access to the second data store and not having access to the first data store.