In-Memory Data Grid Partitioning for Multi-Tenant Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing multitenant application server environments face challenges in efficiently managing data separation and resource isolation across different tenants, particularly in cloud-based environments, where scalable and secure data access is crucial.
Innovation Solution
The system employs an in-memory data grid, such as Oracle Coherence, with partitioning that allows for runtime and administrative subdivisions of the application server domain, enabling data separation between tenants through domain partition names and shared data grid services, while allowing for read-shared/write-specific access to ensure isolation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If data grid services are shared across multiple partitions, then resource utilization is improved, but data isolation between tenants deteriorates
Solution Approach 1:
The patent segments data grid services into read-shared and write-specific components. Read operations can be shared across partitions while write operations maintain partition-specific isolation. This segmentation allows resource sharing for reads while preserving data isolation for writes, resolving the contradiction between resource utilization and data isolation.
Solution Approach 2:
The patent applies different access qualities to different data operations. Read operations have shared access quality across partitions, while write operations have partition-specific isolation quality. This local differentiation enables efficient resource utilization for reads while maintaining reliable data isolation for writes.
2Reliability
If write-specific access is provided to data grid services, then data isolation between tenants is improved, but resource sharing capability deteriorates
Solution Approach 1:
The patent segments data grid services into read-shared and write-specific components. By separating read and write access paths, the system can share read resources across partitions while maintaining write isolation within partitions, thus preserving both data isolation and resource sharing capabilities.
Solution Approach 2:
The patent merges read-shared and write-specific access mechanisms into a unified data grid service framework. This combination allows the system to simultaneously support cross-partition read sharing and partition-specific write isolation, resolving the contradiction between data isolation and resource sharing.
3Adaptability or versatility
If domain partition names are used for data separation, then multi-tenancy support is improved, but system complexity increases
Solution Approach 1:
The patent makes the domain partition name mechanism universal by using it for multiple purposes: data separation, tenant identification, and access control. This multi-functionality reduces the need for separate mechanisms, thereby reducing overall system complexity while enhancing multi-tenancy support.
Solution Approach 2:
The domain partition name acts as an intermediary that mediates between multiple tenancy requirements. It serves as a single point of coordination for data separation, tenant isolation, and resource management, simplifying the system architecture while enabling robust multi-tenancy.
Data Source
AI summary
In accordance with an embodiment, the system supports use of an in-memory data grid or other distributed memory environment, for example Oracle Coherence. A partition provides a runtime and administrative subdivision or slice of an application server domain. An application can be deployed to a particular partition, or otherwise associated with a particular domain partition name. The domain partition name can be used by the data grid to enable a separation of data between different partitions or between tenants associated with those partitions. In some embodiments, one or more data grid services, for example caches and clustered services, can be shared across multiple partitions. Alternatively, the data grid can provide read-shared/write-specific access to data grid services, in which multiple partitions can share an initial set of data, but their subsequent modifications to that data are then isolated from each other.