Dynamic Schema Allocation for Multi-Tenant Identity Services
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current identity management systems in cloud environments face challenges in providing secure access and consistent security across diverse devices and user types, including unauthorized access, account hijacking, and inadequate security measures for non-employee users like customers and partners.
Innovation Solution
A multi-tenant cloud system with a dedicated and shared database schema allocation framework, implementing microservices architecture for identity and access management, and integrating with on-premise systems for unified security controls, enabling secure access across various channels and environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a unified database schema is used for all tenants, then system complexity is reduced and maintenance is easier, but security isolation between tenants is weakened and customization capability is limited
Solution Approach 1:
The patent segments the database schema into two distinct types: shared schemas for standard tenants and dedicated schemas for enterprise tenants. This segmentation allows the system to provide security isolation and customization for enterprise tenants through dedicated schemas while maintaining simplicity for standard tenants through shared schemas, thus resolving the contradiction between system complexity and security isolation.
Solution Approach 2:
The patent implements dynamic schema allocation where the system automatically determines whether to allocate a shared or dedicated schema based on tenant type and requirements. This dynamic approach allows the system to adapt its complexity level per tenant, providing enhanced security isolation when needed while maintaining overall system simplicity, thereby resolving the contradiction between fixed schema management and flexible security requirements.
2Reliability
If dedicated database schemas are allocated to all tenants, then security isolation and customization are improved, but resource utilization decreases and system complexity increases
Solution Approach 1:
The patent merges multiple standard tenants into a shared database schema when appropriate, allowing resource consolidation and improved utilization. By combining tenants that have similar security and customization requirements into shared schemas, the system maintains security isolation through logical separation while achieving better resource efficiency, thus resolving the contradiction between dedicated schema security benefits and resource utilization efficiency.
Solution Approach 2:
The patent applies different schema allocation strategies to different tenants based on their specific requirements. Standard tenants with common needs are placed in shared schemas for efficient resource utilization, while enterprise tenants with specialized requirements receive dedicated schemas for enhanced security and customization. This localized quality approach ensures that security isolation is provided only where necessary, maintaining resource efficiency overall.
3Adaptability or versatility
If dynamic schema allocation is implemented, then adaptability to different tenant requirements is improved, but system complexity and operational difficulty increase
Solution Approach 1:
The patent implements preliminary classification of tenants into different types (standard vs. enterprise) during the onboarding process. By determining the appropriate schema type in advance based on tenant characteristics and requirements, the system avoids complex runtime decisions and simplifies schema allocation management. This preliminary action enables adaptability to different tenant requirements while keeping the allocation process straightforward and manageable.
Data Source
AI summary
Embodiments are directed to a multi-tenant cloud system that provisions new customer accounts. Embodiments include a dedicated database schema and a shared database schemas. Embodiments provision a new customer account by determining whether the new customer account is a first type of account or a second type of account. When the new customer account is the first type of account, embodiments allocate the new customer account to the one of the shared database schemas. When the new customer account is the second type of account, embodiments allocate the new customer account to a dedicated schema.