Graph Database Tenant Permission Allocation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current graph database implementations face inefficiencies in data management and storage when multiple tenants within an organization require different subsets of data, leading to cumbersome management and processing inefficiencies due to the need for duplicating shared information.
Innovation Solution
A method for allocating permissions in a graph database that allows multiple tenants to share an overarching graph, where a superuser defines vertex and edge types, and allocates permissions to users based on these types, enabling access to specific subgraphs, thereby controlling data visibility and access rights.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is duplicated for each tenant to ensure data access control, then data security and access control are improved, but storage efficiency and processing performance deteriorate
Solution Approach 1:
The patent segments the graph database into multiple isolated graph instances, where each tenant receives a dedicated graph containing only the data and relationships relevant to their specific needs. This segmentation approach allows each tenant to have full access control over their own graph while sharing the underlying database infrastructure, thereby maintaining data security without requiring duplication of entire datasets across all tenants.
Solution Approach 2:
The patent implements local quality by customizing each tenant's graph instance with specific vertex types, edge types, and data subsets tailored to their requirements. Rather than providing uniform access to all data, each tenant's graph is locally optimized to contain only the relevant portions of the overall data model, improving storage efficiency while maintaining appropriate access control.
2Reliability
If multiple separate graphs are created for each tenant, then data access control is improved, but device complexity and management overhead increase
Solution Approach 1:
The patent creates a universal graph database platform that serves multiple tenants through a common infrastructure. The system provides multi-functionality by supporting both data sharing and data isolation capabilities within the same database instance, allowing administrators to manage multiple tenant graphs through unified tools and interfaces rather than requiring separate database systems for each tenant.
Solution Approach 2:
The patent introduces an intermediary layer (the graph database management system) that mediates between the underlying data storage and individual tenant access requirements. This intermediary handles graph creation, data population, access control, and query routing, thereby simplifying tenant management while maintaining strong access control boundaries.
3Loss of energy
If data is shared across tenants without duplication, then storage efficiency is improved, but data security and tenant isolation deteriorate
Solution Approach 1:
The patent segments the shared data into isolated graph instances for each tenant, where each graph contains only the specific data and relationships that tenant is authorized to access. This segmentation enables efficient storage by avoiding full data duplication while maintaining security through logical isolation - each tenant's graph is independently managed and accessed, preventing unauthorized data exposure.
4Measurement precision
If custom graphs are created for each tenant's specific data requirements, then data relevance and access precision are improved, but processing overhead and time increase
Solution Approach 1:
The patent applies preliminary action by pre-configuring each tenant's graph instance with the appropriate vertex types, edge types, and initial data subsets before the tenant begins using the system. This upfront configuration work, including defining the graph schema and populating relevant data, eliminates the need for complex real-time filtering and data processing during tenant operations, thereby reducing processing time while maintaining high data access precision.
Data Source
AI summary
Systems, methods, and software described herein provide enhancements for managing permissions in a shared graph. In one implementation, a graph management system identifies a request to classify a first subgraph in the graph for access by a tenant of a plurality of tenants, wherein the request indicates one or more vertex types and/or one or more edge types for the first subgraph. The graph management system further identifies one or more vertices and/or one or more edges in the graph that qualify for the first subgraph based on the indicated one or more vertex types and/or one or more edge types, and allocates permissions to at least one user associated with the tenant to access the first subgraph.