Isolating Network Stacks for Pluggable Databases
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In a multitenant container database management system, existing technologies face challenges in isolating network stacks for pluggable databases, leading to potential network vulnerabilities and limitations in customizing network settings, as multiple tenants share the same network stack.
Innovation Solution
Implementing separate isolated network stacks for each pluggable database or group of databases by assigning a unique network stack to database sessions, utilizing operating system namespaces to partition network resources and provide custom network settings without requiring additional hardware, thereby enhancing isolation and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If multiple pluggable databases share the same network stack in a container database, then resource utilization is improved, but network security and isolation are worsened
Solution Approach 1:
The patent divides the shared network stack into separate isolated network stacks for each pluggable database or group of databases. This segmentation allows each database to have its own network namespace with unique IP addresses, routing tables, and firewall rules, thereby maintaining resource efficiency while improving network security and isolation between tenants.
Solution Approach 2:
The patent introduces a new dimension of network isolation by implementing network namespaces at the operating system level. This adds a layer of abstraction between the physical network infrastructure and the pluggable databases, enabling logical separation of network resources without requiring additional physical hardware, thus resolving the contradiction between resource sharing and security isolation.
2Reliability
If separate isolated network stacks are implemented for each pluggable database, then network security and customization are improved, but system complexity increases
Solution Approach 1:
The patent leverages the operating system's native network namespace functionality to provide isolated network stacks. By reusing existing OS capabilities rather than implementing a custom network isolation mechanism, the system achieves enhanced security and customization while minimizing the increase in system complexity. The solution is universal and can be applied across different database configurations.
Solution Approach 2:
The patent creates isolated network stacks by copying and duplicating the base network stack structure for each pluggable database or group. This copying approach allows each tenant to have a complete, independent network namespace with all necessary components (IP addresses, routing tables, sockets), simplifying the implementation while maintaining strong isolation boundaries.
3Adaptability or versatility
If unique network stacks are assigned to pluggable databases, then network customization flexibility is improved, but resource overhead increases
Solution Approach 1:
The patent implements a dynamic approach where network stacks can be flexibly assigned at the database group level rather than strictly at the individual database level. This allows administrators to optimize resource usage by sharing isolated network stacks among multiple databases that have similar network requirements, thereby reducing overall resource overhead while maintaining the customization and isolation benefits for each group.
Data Source
AI summary
Techniques are described herein for isolating a network stack in a multitenant container DBMS. A first and second pluggable database are established within a container database. A first network stack is assigned to the first pluggable database and a second network stack is assigned to the second pluggable database. A request is received to connect to the first pluggable database and a connection is established to the first pluggable database using the first network stack. A request is received to connect to the second pluggable database and a connection is established to the second pluggable database using the second network stack.