Microservice Context Isolation via Shared Libraries in Multi-Tenant Clouds
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional microservice management systems in multi-tenant cloud environments face inefficiencies and security vulnerabilities due to the complexity of managing tenant data across multiple services, leading to data leaks and increased workload on individual microservices.
Innovation Solution
A context enforcement system utilizing a shared library that provides context functions such as initialization, holding, and enforcement across microservices, ensuring secure and efficient isolation of tenant data by verifying requests, storing context information, and enforcing compatibility before operations are performed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If conventional microservice management systems are used to provide shared resources to multiple tenants, then resource utilization and scalability are improved, but data security and tenant isolation are worsened due to complexity in managing tenant data across services
Solution Approach 1:
The patent segments tenant context information into isolated contexts that are separately managed for each tenant. The context propagation mechanism divides the multi-tenant system into isolated context zones, ensuring that each tenant's data remains segregated while allowing shared resource access. This segmentation resolves the contradiction by maintaining both high resource utilization and strong data security through context-based isolation.
Solution Approach 2:
The patent introduces a context propagation mechanism as an intermediary layer between microservices and tenant data. This intermediary manages context information flow, verifying and enforcing tenant isolation at each service boundary. The context mechanism acts as a mediator that enables secure data access across services without compromising tenant isolation, thus resolving the security concern while maintaining productivity.
2Adaptability or versatility
If microservices are maintained by separate engineering teams globally geo-located, then service specialization and functionality are improved, but system complexity and coordination difficulty are worsened
Solution Approach 1:
The patent implements a universal context propagation mechanism that works across all microservices regardless of which engineering team maintains them. This universal approach provides a standardized method for managing tenant context information across the entire distributed system, reducing coordination complexity while preserving service specialization. Each team can independently implement the context mechanism in their services without affecting others.
Solution Approach 2:
The patent changes the parameter of context management from service-specific implementations to a standardized context propagation approach. By establishing uniform context handling parameters and protocols across all services, the system reduces complexity associated with multiple teams while maintaining the adaptability and specialization of individual microservices through consistent context isolation rules.
3Productivity
If context information is propagated across multiple microservices, then operational efficiency is improved, but data leak risks are worsened due to increased exposure surfaces
Solution Approach 1:
The patent applies preliminary anti-action by pre-establishing context isolation rules and verification mechanisms before context information is propagated across microservices. The context propagation mechanism verifies tenant context at each service boundary in advance, preventing potential data leaks before they can occur. This proactive approach maintains operational efficiency while neutralizing data leak risks through预先 established security measures.
Solution Approach 2:
The context propagation mechanism serves as an intermediary that controls and monitors context information flow between microservices. It verifies tenant context at each transmission point, ensuring that context information is properly isolated and authorized before being passed to the next service. This intermediary approach enables efficient operations while preventing data leaks through systematic verification at each boundary.
Data Source
AI summary
This disclosure relates to a context enforcement system that efficiently and securely protects tenant context information that travels across microservices in a multi-tenant distributed cloud computing system and protects against data leaks that often occur in conventional microservice management systems. For example, the context enforcement system ensures secure external and internal communications and context isolation by providing various shared library functions to microservices of a multi-tenant distributed cloud computing system. Additionally, the shared library provided by the context enforcement system improves the efficiency of the multi-tenant distributed cloud computing system by allowing microservices to focus on target operations rather than also maintaining and performing additional redundant functions.