Hierarchical Tenant Data Access Using Partitioned Database Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to effectively segregate and manage data access in hierarchical multitenancy structures, particularly in companies with parent-child relationships, while maintaining data security and performance.
Innovation Solution
A hierarchical multitenancy architecture that uses separate data partitions within a single physical database, combined with a database interceptor and unique tenant identification, to enforce data access policies based on company hierarchy, ensuring parent entities can access child data but not sibling or parent data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If each company has its own physical database, then data security and isolation are improved, but system complexity and cost increase
Solution Approach 1:
The patent merges multiple physical databases into a single shared physical database while maintaining logical data isolation through schema-level partitioning. Each company (tenant) has its own schema that is isolated from other schemas, achieving both data security and resource sharing. This resolves the contradiction by combining database instances while preserving security boundaries.
Solution Approach 2:
The patent segments the database into separate schemas, each dedicated to a specific company or tenant. This schema-level segmentation provides strong data isolation and security while allowing all schemas to reside in a single physical database instance, reducing overall system complexity compared to separate physical databases.
2Productivity
If each company shares the same physical database, then system performance and resource utilization are improved, but data security and access control become difficult to enforce
Solution Approach 1:
The patent implements schema-level segmentation where each company has its own isolated schema. This segmentation enables strong data security and access control while allowing all schemas to share the same physical database infrastructure, maintaining high system performance and resource utilization efficiency.
Solution Approach 2:
The patent introduces a database interceptor as an intermediary layer between application code and the database. This interceptor enforces access control policies by intercepting SQL statements and verifying whether the executing user has permission to access the target schema, thereby maintaining data security without requiring separate physical databases.
3Reliability
If hierarchical data access is implemented, then data security based on relationships is improved, but query complexity and performance degradation occur
Solution Approach 1:
The patent performs preliminary action by pre-calculating and storing hierarchical access rights in the database interceptor. When a query is executed, the interceptor checks pre-established access rules between users and schemas, avoiding complex real-time access control calculations and maintaining query performance while enforcing hierarchical data access policies.
Data Source
AI summary
A computer-implemented method is provided for enforcing data access control policies in a hierarchical structure of a plurality of entities. The method includes receiving a data access request from a client in association with a target entity in the hierarchical structure and generating, by a security gateway, an internal access token comprising a business context that determines an identification of the target entity associated with the client and a data partition in the database corresponding to the target entity. The method also includes verifying, by a data access layer of a microservice module, the data access request against the data access control policies for the hierarchical structure using the internal access token to determine one or more permitted data partitions for access by the client. The method further includes granting the client access to the permitted data partitions if the verifying is successful.