Dynamic Instance Provisioning for Multi-Tenant Data Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Single-tenant applications are difficult to reuse in multi-tenant environments due to data model incompatibilities, leading to costly code rewrites or data leakage between tenant accounts, as they often lack multi-tenant data access isolation.
Innovation Solution
A process dynamically provisions and terminates instances of single-tenant applications based on workload, using a multi-tenant translator that assigns instances to client devices, augments database queries with tenant metadata, and employs a reverse proxy to filter data access, ensuring each tenant's data is isolated and dynamically scales instances accordingly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If single-tenant application code is reused in multi-tenant environments, then development costs are reduced and time-to-market is improved, but data isolation between tenants cannot be ensured and data leakage occurs
Solution Approach 1:
The patent segments the multi-tenant system into isolated execution environments where each tenant's workload is assigned to dedicated application instances. The containerization technology divides the shared infrastructure into separate, isolated spaces, ensuring that data and code from different tenants cannot interfere with each other while still using the same underlying hardware resources.
Solution Approach 2:
The patent introduces a workload assignment service as an intermediary layer between the multi-tenant platform and single-tenant applications. This service manages instance provisioning, assigns tenants to specific instances, and handles instance lifecycle management, thereby enabling data isolation without requiring modifications to the original application code.
2Reliability
If multiple instances of single-tenant application are provisioned for multi-tenant use, then data isolation between tenants is improved, but resource utilization decreases and costs increase
Solution Approach 1:
The patent implements dynamic instance management where the number and allocation of application instances adjust automatically based on workload demands. The system monitors tenant activity and dynamically provisions or deprovisions instances, and reassigns tenants between instances, ensuring that computational resources are efficiently utilized while maintaining data isolation when needed.
Solution Approach 2:
The patent creates a universal platform that can accommodate both single-tenant and multi-tenant deployment models using the same underlying infrastructure. The system can dynamically switch between different isolation levels and instance allocation strategies, allowing a single platform to serve multiple purposes and tenant types without requiring separate dedicated infrastructure for each.
3Reliability
If single-tenant application is modified to support multi-tenant data models, then data isolation is improved, but development complexity and cost increase
Solution Approach 1:
The patent creates isolated copies of the single-tenant application instance for each tenant or tenant group, rather than modifying the original application code. Each instance maintains its own isolated memory space and execution context, effectively copying the necessary isolation properties without requiring changes to the application's source code or data models.
Data Source
AI summary
Provided is a process, including: assigning different instances of a single-tenant application among a plurality of instances of the single-tenant application to different computing sessions with different client computing devices associated with different tenant user accounts; while the plurality of instances of the single-tenant application are executing, determining that a workload of the plurality of instances of the single-tenant application satisfies a first threshold condition; in response to the determination, automatically provisioning an added instance of the single-tenant application; and assigning the added instance of the single-tenant application to a session with a given client computing device.