Hierarchical Audit Access Control in Multi-Tenant Data Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data management systems struggle to efficiently manage access authorization for audit information in multi-tenancy environments, particularly in hierarchical multi-level scenarios, leading to potential security breaches and inefficiencies in data retrieval and management.
Innovation Solution
A data management system (DMS) determines access permissions for audit information based on authentication domains and computing object hierarchies, ensuring that users can only access authorized data within their assigned tenant or subtenant levels, and filters audit reports using tenant IDs to enhance security and efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a multi-tenancy data management system allows broad access to audit information for comprehensive monitoring, then the completeness of audit coverage is improved, but the security risk and unauthorized access potential increase
Solution Approach 1:
The system segments audit information access by creating distinct authentication domains (enterprise domain, tenant domain, subtenant domain) that partition the audit data space. Each domain contains specific audit records accessible only to authorized users within that domain, preventing unauthorized cross-tenant access while maintaining complete audit coverage within each segmented domain.
Solution Approach 2:
The system applies different access control policies to different portions of audit information based on the user's authentication domain. Users can access audit records with full detail within their authorized domain (local quality of complete access), while access to other tenants' audit records is restricted (different local quality of limited access), thus achieving both completeness where needed and security where required.
2Object-affected harmful factors
If the system implements strict access control policies for audit information in hierarchical multi-tenancy scenarios, then the security level is improved, but the complexity of access authorization management increases
Solution Approach 1:
The system adds a hierarchical dimension to access control by organizing tenants and subtenants in nested authentication domains. Instead of managing complex pairwise access permissions between all users, the system manages access control along the hierarchical dimension (enterprise → tenant → subtenant), simplifying authorization management while maintaining strict security boundaries at each level.
Solution Approach 2:
The authentication domain structure serves multiple functions simultaneously: it organizes multi-tenant hierarchy, defines access boundaries, controls audit information visibility, and manages user permissions. This universal structure handles various access control scenarios (tenant-to-tenant, subtenant-to-tenant, enterprise-wide) through a single unified mechanism, reducing overall system complexity.
3Loss of information
If the system retrieves audit information for multiple tenants without filtering, then the data retrieval completeness is improved, but the processing time and system efficiency worsen
Solution Approach 1:
The system performs preliminary filtering of audit information based on the user's authentication domain before retrieval operations. By pre-establishing which audit records belong to which authentication domain and caching these mappings, the system avoids retrieving and then filtering large volumes of unrelated audit data, thus reducing retrieval time while maintaining completeness of authorized information.
4Adaptability or versatility
If the system allows users to access audit information across multiple tenant levels, then the versatility of the system is improved, but the risk of data leakage between tenants increases
Solution Approach 1:
The authentication domain acts as an intermediary layer between users and audit information across tenant boundaries. Users do not directly access another tenant's audit records; instead, access is mediated through the authentication domain hierarchy which verifies authorization, filters appropriate records, and presents only authorized information to the user, thus enabling versatile access while preventing data leakage.
Data Source
AI summary
Methods, systems, and devices for data management are described. A data management system (DMS) may provide backup services for multiple tenants. The DMS may receive a request to provide a first user of the DMS with audit information associated with an entity of the DMS. The DMS may identify context information for a log-in session associated with the request. The context information may include an identifier (ID) of a tenant associated with the request. The DMS may identify, based on the ID of the tenant, authorization information associated with the tenant. The authorization information may indicate that the tenant has access to a set of entities within a hierarchy associated with the DMS. The DMS may determine whether to output the requested audit information to the first user based on a hierarchical relationship, within the hierarchy, between the tenant and the entity.