Multi-tenant Authentication via Intermediate Registry and Trust Groups
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-tenant database systems, tenants often face challenges in accessing data from other tenants without knowing the identity of the tenant that possesses the required data, leading to difficulties in authenticating and authorizing cross-tenant requests, which hinders data sharing and access control.
Innovation Solution
An intermediate database system facilitates authentication and authorization by using trust groups, where tenants are grouped based on business units, and employs asymmetric keys for signature verification and encryption to ensure secure data access, allowing requests to be directed to the appropriate tenant without revealing sensitive information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If tenants directly access data from other tenants without knowing the tenant identity, then data sharing capability is improved, but authentication and authorization reliability deteriorates
Solution Approach 1:
The patent introduces a registry as an intermediary component that stores public keys and trust group membership information. When a tenant needs to access data from another tenant, the registry mediates the authentication process by providing the necessary cryptographic credentials without requiring the requesting tenant to know the identity of the data-owning tenant. This resolves the contradiction by enabling data sharing while maintaining authentication reliability through the intermediary's verification mechanism.
Solution Approach 2:
The patent changes the authentication parameter from direct tenant identity verification to trust group-based verification using asymmetric keys. Instead of requiring knowledge of the specific tenant identity, the system uses cryptographic parameters (public keys and trust group memberships) to authenticate requests. This parameter change enables data sharing across unknown tenants while maintaining security through cryptographic verification.
2Object-affected harmful factors
If tenant identities are hidden to protect sensitive information, then data security is improved, but authentication capability deteriorates
Solution Approach 1:
The patent uses public keys as copies of tenant identities that can be shared without exposing the actual tenant identity. The registry stores and distributes these public key copies, allowing authentication to proceed using the copy rather than the original sensitive identity information. This resolves the contradiction by enabling authentication capability through the use of identity copies while maintaining data security through identity concealment.
3Adaptability or versatility
If cross-tenant requests are authenticated without knowing the destination tenant, then data sharing flexibility is improved, but system complexity increases
Solution Approach 1:
The registry serves multiple functions: storing public keys, verifying trust group memberships, and facilitating authentication. This multi-functional design reduces overall system complexity by consolidating authentication-related operations into a single universal component rather than requiring separate mechanisms for each function. The universal registry enables flexible cross-tenant data sharing while managing system complexity through functional consolidation.
Data Source
AI summary
Disclosed are some implementations of systems, apparatus, methods and computer program products for facilitating the authentication of computing system requests with an unknown destination across tenants of at least one multi-tenant database system. Authentication is facilitated using an intermediate system that is accessible by and independent from the tenants of the multi-tenant database system.