Data Segmentation for Multi-Tenant Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing multi-tenant computing environments face challenges in controlling and auditing access to resources, particularly in large environments with dozens of clients and thousands of users, leading to potential administrator errors and data security breaches.
Innovation Solution
The implementation of a data-based access control system that segments data into virtual partitions and associates users and resources with these segments, verifying that users and resources are aligned before granting access, thereby preventing administrator errors and ensuring data security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a traditional access control system (RBAC or ACL) is used to manage user permissions in large multi-tenant environments, then user access management can be implemented, but administrator errors increase and data security reliability deteriorates
Solution Approach 1:
The patent segments data into distinct data segments corresponding to different tenants or data owners. Each data segment is independently managed with its own access control policies. This segmentation prevents administrator errors from affecting entire systems and isolates security breaches to specific segments, thereby improving reliability while maintaining ease of operation through modular management.
Solution Approach 2:
The patent introduces a data segment verification mechanism as an intermediary layer between traditional access control systems and actual data access. This intermediary verifies that users have proper authorization to access specific data segments, adding a safety check that prevents erroneous access without complicating the underlying access control system.
2Ease of operation
If access control lists (ACL) directly map users to resources in large multi-tenant environments, then user-resource access can be controlled, but auditing and error control become difficult
Solution Approach 1:
By segmenting data into organized data segments with clear ownership and access policies, the patent reduces auditing complexity. Instead of auditing numerous individual user-resource mappings in a large ACL system, administrators can audit access at the data segment level, significantly simplifying the auditing process while maintaining comprehensive access control.
3Adaptability or versatility
If hundreds of roles are defined in an RBAC system to cover all access scenarios, then comprehensive access control is achieved, but system complexity and configuration difficulty increase
Solution Approach 1:
The patent replaces the need for numerous granular roles by segmenting data into data segments with inherent access control attributes. Instead of creating hundreds of roles to cover every access scenario, the system uses data segment-based access control where permissions are determined by data segment properties and user associations with those segments, dramatically reducing system complexity while maintaining comprehensive access control coverage.
Solution Approach 2:
Instead of organizing access control around user roles (traditional RBAC approach), the patent inverts the approach by organizing access control around data segments. This inversion simplifies the system by making data the center of access control logic rather than users, reducing the need for complex role hierarchies and configurations.
Data Source
AI summary
The present disclosure provides systems, methods, and computer program products for controlling and securing access to a computing environment comprising a plurality of resources that access data. An example method can comprise (a) segmenting the data into a plurality of data segments; (b) associating a user of a plurality of users of the computing environment with one or more data segments of the plurality of data segments; and (c) providing an access control system that defines access to the plurality of resources comprising a first resource. The first resource can be associated with one or more data segments of the plurality of data segments. The method can further comprise (d) determining whether the user has permission to access the first resource using the access control system. The determining can comprise verifying whether the user and the first resource are associated with at least one same data segment.