Multi-tenancy Authorization Framework for Hierarchical Data Resources
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data management systems face challenges in efficiently managing multi-tenancy scenarios with hierarchical resource authorization, particularly in ensuring secure and granular access control across multiple levels of tenants and subtenants, leading to potential information leakage and unauthorized access.
Innovation Solution
Implementing a multi-tenancy authorization framework that uses role-based access control (RBAC) to assign permissions at the object level, respecting the hierarchical relationship among computing objects, allowing top-level resource assignments to implicitly include descendant resources and enabling different permissions for various objects, thus enforcing in-depth access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If role-based access control (RBAC) is implemented with object-level permissions for multi-tenancy, then security and access control granularity are improved, but system complexity increases
Solution Approach 1:
The patent segments the authorization system into multiple hierarchical levels (global organization, tenant, subtenant, user) with distinct permission scopes. Each level has its own RBAC policies and computing object assignments, allowing security to be enforced at granular levels without requiring complete system redesign. This segmentation resolves the contradiction by making complex security manageable through modular hierarchical structure.
Solution Approach 2:
The patent introduces a hierarchical dimension to the RBAC system, adding levels of organization (global→tenant→subtenant→user) and resource types (data sources, backup policies, storage resources). This multi-dimensional authorization framework allows security to be enforced along multiple axes simultaneously, resolving the complexity-security tradeoff by organizing permissions in a structured hierarchy rather than flat complex matrices.
2Ease of operation
If hierarchical resource assignment is implemented where top-level assignments include descendant resources, then ease of resource management is improved, but precision of access control may be reduced
Solution Approach 1:
The patent implements dynamic permission inheritance where descendants automatically receive permissions from ancestors, but this inheritance can be selectively overridden at any level. The system dynamically adjusts the effective permissions based on the most specific assignment, allowing easy top-level management while maintaining precise control where needed. This resolves the contradiction by making the system adaptable to different precision requirements.
Solution Approach 2:
The patent allows different levels of the hierarchy to have different permission qualities. While top-level assignments provide broad access for ease of management, individual descendants can have customized permission sets that override or supplement inherited permissions. This local customization capability ensures precise access control at specific resources while maintaining easy management at higher levels.
3Adaptability or versatility
If multi-level tenancy with hierarchical relationships is supported, then adaptability of the system is improved, but difficulty of access control enforcement increases
Solution Approach 1:
The patent performs preliminary authorization setup during system configuration, where global organizations, tenants, and subtenants are pre-configured with their RBAC policies and computing object assignments. This preliminary action creates a structured authorization framework that simplifies ongoing access control enforcement, resolving the contradiction by preparing the access control structure in advance rather than computing it dynamically for each access request.
Solution Approach 2:
The patent introduces an intermediary authorization layer between users and resources that translates hierarchical relationships into effective permissions. This intermediary component (the authorization system) manages the complexity of multi-level tenancy by mediating access requests, resolving the contradiction by isolating the complexity in a dedicated mediation layer rather than distributing it throughout the entire system.
4Productivity
If automatic assignment of descendant resources is implemented, then productivity of resource management is improved, but loss of manual control increases
Solution Approach 1:
The patent implements self-service automatic assignment where descendant resources automatically receive appropriate permissions based on their hierarchical relationship with assigned ancestors. This self-service mechanism eliminates manual configuration of each descendant resource, improving productivity while maintaining control through the structured RBAC framework that governs the automatic assignments.
Data Source
AI summary
Methods, systems, and devices for data management are described. A data management system (DMS) may implement multi-tenancy role based access control (RBAC). A DMS that provides backup and recovery to multiple tenants may assign a data management cluster to a tenant organization, or specific resources from a data management cluster to a tenant, allowing multiple tenants to share a single data management cluster. The assignment of resources of the data management cluster respects the hierarchical relationship among computing objects, for example, assigning a top-level resource to a tenant implicitly assigns the descendent resources that descend from that top-level resource to the tenant.