Multi-Level Database Partitioning for Multi-Tenant Data Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database partitioning methods are inadequate for complex, multi-national organizations with multiple levels of data separation, leading to consistency and redundancy issues, and fail to provide advanced control over data access in multi-tenancy scenarios.
Innovation Solution
A method of partitioning data within a database that allows for multi-level partitions by defining and assigning data to multiple partitions, with access control based on specific partition assignments, using additional columns in data tables to denote partition assignments, and a data structure with partition parameters for each data entry to manage complex access permissions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is partitioned by company or organisation in the prior art, then security is improved by allowing users to only access data assigned to their organisation's partition, but data consistency and redundancy problems occur and more storage space is required
Solution Approach 1:
The patent segments data access control into multiple independent partition dimensions (e.g., company partition, department partition, project partition). Each partition is defined by separate criteria and can be independently configured. This allows fine-grained security control where users can be assigned to specific combinations of partitions, enabling precise access control without replicating entire datasets across partitions.
Solution Approach 2:
The patent introduces multiple partition dimensions beyond simple organisational boundaries. Instead of a single partition dimension, the system supports multiple orthogonal dimensions (company, department, project, location, etc.), creating a multi-dimensional partitioning space. This allows data to be logically divided along different axes without physical replication, improving security while maintaining storage efficiency.
2Reliability
If data is partitioned by company or organisation in the prior art, then security is improved by allowing users to only access data assigned to their organisation's partition, but consistency problems occur and more storage space is required
Solution Approach 1:
The patent segments the partitioning logic into independent dimensional criteria rather than monolithic organisational partitions. Each dimension (company, department, project) can be independently managed and updated without affecting others, maintaining consistency within each dimension while enabling complex cross-dimensional access patterns through user assignment rules.
Solution Approach 2:
By introducing multiple independent partition dimensions, the system achieves data consistency through dimensional independence. Each dimension maintains its own consistency rules and can be updated separately, while the combination of dimensions provides comprehensive security control. This multi-dimensional approach prevents consistency conflicts that arise in single-dimension partitioning.
3Ease of manufacture
If simple partitioning methods are used in the prior art, then implementation is easier, but complex multi-national organisations with multiple levels of data separation cannot be supported
Solution Approach 1:
The patent segments partitioning into independent, configurable dimensions that can be selectively applied based on organisational needs. Each dimension can be independently enabled or disabled, allowing simple organisations to use minimal partitioning while complex multi-national organisations can activate multiple dimensions (company, country, department, project) to match their hierarchical structure.
Solution Approach 2:
The patent implements dynamic partitioning where the number and type of partition dimensions can be adjusted based on organisational requirements. Users can be dynamically assigned to different combinations of partitions across multiple dimensions, allowing the system to adapt to varying organisational structures from simple single-company setups to complex multi-national hierarchies without requiring system redesign.
4Reliability
If multiple partitions are defined with advanced access control, then data access control is improved for multi-tenancy scenarios, but system complexity increases
Solution Approach 1:
The patent segments access control into independent partition dimensions and user assignment rules. Each partition dimension and user assignment is a discrete, manageable unit that can be configured independently. This modular approach allows complex multi-tenancy scenarios to be built by combining simple, well-defined partition and assignment elements rather than requiring monolithic access control logic.
Solution Approach 2:
The patent creates a universal partitioning framework that handles multiple access control scenarios through a single consistent mechanism. The same multi-dimensional partition structure supports single-tenancy, multi-tenancy, hierarchical organisations, and flat structures uniformly. User assignments to partition combinations provide a universal method for defining access rights across all scenario types, reducing the need for separate complex access control mechanisms.
Data Source
AI summary
Systems, methods, and machine-readable memories are provided for partitioning a multi-tenant database between tenants. A first level partition of data in a table within the database is defined. A second level partition of the data in the table within the database is defined. A request is received from an entity associated with a tenant to access a first datum stored in the database. The tenant is determined to be assigned to one or both of the first level partition and the second level partition. Access to the first datum is granted to a first entity where the tenant corresponds to the first tenant and the first datum corresponds to the first level partition parameter value. Access to the first datum is granted to a second entity where the tenant corresponds to the second tenant and the first datum corresponds to the second level partition parameter value.