Data Passport Credentialing for Tenant-Restricted Shared Data Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data management architectures struggle to provide fine-grained access control and compliance with tenant-specific data access, sharing, and use restrictions in multi-tenancy scenarios, potentially compromising security and compliance.
Innovation Solution
A data architecture that employs a combination of role-based access control (RBAC) and attribute-based access control (ABAC) to enforce tenant-specific access and use restrictions, using tenant identifiers and user attributes to generate views of shared data resources, while maintaining administrative structures separate from business logic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If data from multiple tenants is physically integrated in a shared data resource, then data sharing and collaboration between tenants is improved, but fine-grained access control and tenant data isolation become more difficult to enforce
Solution Approach 1:
The patent segments data access control into multiple hierarchical levels: tenant level, user level, and data element level. Each level has its own access control lists (ACLs) and permission structures, enabling fine-grained control over which users from which tenants can access which specific data elements in the shared resource.
Solution Approach 2:
The patent introduces an intermediary access control mechanism that sits between users and the shared data resource. This intermediary evaluates access requests against multiple criteria including user identity, tenant affiliation, data classification, and predefined policies, thereby enforcing data isolation while allowing legitimate sharing.
2Ease of operation
If role-based access control (RBAC) is implemented for data access, then ease of user management is improved, but fine-grained control over tenant-specific data access restrictions is reduced
Solution Approach 1:
The patent merges role-based access control (RBAC) with attribute-based access control (ABAC) and discretionary access control (DAC) mechanisms. RBAC provides high-level role assignments for ease of management, while ABAC adds attribute-level conditions (such as tenant ID, data classification, location) and DAC allows data owners to specify fine-grained permissions, achieving both simplicity and granularity simultaneously.
Solution Approach 2:
The access control system is designed to be dynamic, allowing permissions to change based on runtime conditions. User roles and access rights can be adjusted in real-time based on tenant requirements, data sensitivity levels, and compliance policies, enabling the system to adapt to different scenarios without requiring complete reconfiguration.
3Reliability
If tenant-specific data access restrictions are enforced, then data security and compliance are improved, but data sharing efficiency and user productivity decrease
Solution Approach 1:
The patent implements preliminary action by pre-configuring access control policies, data classification labels, and tenant affiliation mappings before data access operations occur. Access control lists (ACLs) and permission structures are established in advance, allowing the system to quickly evaluate and enforce restrictions without performing complex computations during runtime data operations.
Solution Approach 2:
The system enables self-service capabilities where data owners and tenant administrators can autonomously manage their own data access permissions, classify data appropriately, and configure tenant-specific restrictions without requiring manual intervention from system administrators. This automation maintains compliance while reducing overhead and improving access efficiency.
Data Source
AI summary
A computerized method includes receiving, from a user, a request to perform an operation on data stored in a shared data resource, which stores physically integrated data from multiple tenants. The method includes obtaining a credential document from the user that includes a session portion that is specific to a current session of the user and a set of restriction criteria. The method includes determining, using user attributes in the credential document, a set of tenants whose data the user is authorized to access; evaluating, based on the session portion, whether the set of restriction criteria restricts the user from performing the operation; and in response to the evaluating identifying that the user is not restricted from performing the operation, performing the operation on a subset of the shared data resource. The subset is limited to data stored in the shared data resource that corresponds to the set of tenants.