Domain-Separated Service Catalog Data Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In a multi-customer cloud service catalog setup, existing technologies fail to ensure that only specific catalog items are accessible to the intended customer, leading to data isolation and security concerns when using a single instance for all users.
Innovation Solution
Implementing a domain-separated service catalog where global items are accessible to all users, while domain-specific items are restricted to their respective domains, using separate or shared catalog item data tables with a domain field to differentiate access, allowing users to navigate, add, and order items within their domain.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a single instance service catalog is used for multiple customers, then all catalog items are accessible to all customers, but data isolation and security are compromised
Solution Approach 1:
The service catalog is segmented into multiple domain-specific catalogs, where each domain (customer) has its own isolated catalog instance. This segmentation ensures that catalog items in one domain are not accessible to other domains, thereby maintaining data isolation and security while allowing each domain to have full access to its own catalog items.
Solution Approach 2:
The system introduces a domain dimension to the catalog architecture, transforming it from a flat single-instance structure to a multi-dimensional structure where catalogs are organized by domain. This dimensional change enables simultaneous global accessibility (across domains) and local isolation (within domains) by adding the domain identifier as an additional organizational layer.
2Reliability
If domain-separated catalogs are implemented, then data isolation and security are improved, but system complexity increases
Solution Approach 1:
The catalog system is designed with universal components that can function across multiple domains. Shared elements such as catalog item templates, approval workflows, and management interfaces are made domain-agnostic, allowing the same system architecture to serve multiple domains without requiring separate implementations for each domain, thereby reducing overall complexity.
Solution Approach 2:
Instead of creating entirely separate catalog systems for each domain, the patent uses copying mechanisms where catalog items can be replicated across domains through templates. This allows domain-specific catalogs to be generated from standardized templates, reducing the complexity of manual catalog creation and maintenance while maintaining data isolation.
3Adaptability or versatility
If global catalog items are made accessible to all users, then catalog versatility is improved, but access control complexity increases
Solution Approach 1:
The patent applies local quality by allowing different access control rules to apply to different catalog items based on their domain classification. Global catalog items have uniform access rules (accessible to all domains), while domain-specific items have localized access rules (accessible only to their owning domain). This differentiation simplifies access control by providing clear, context-dependent rules rather than complex universal permission systems.
Data Source
AI summary
A domain separated service catalog may include global catalog items and domain-specific catalog items. Global catalog items may be accessible to all users of a catalog. Catalog item data for global catalog items may be stored in a catalog item data table. Domain separated catalog items may only be accessible within the domain with which they are associated. Catalog item data for domain separated catalog items may also be stored in the catalog item data table. When a user associated with a domain opens the service catalog, data for catalog items may be retrieved from the catalog item data table. The catalog may then be populated with the global catalog items and the domain specific catalog items.