Multi-Tenant Microservices Data Isolation with Tokenized Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-tenant microservice environments, ensuring data security for multiple tenants is challenging, particularly in contexts like law enforcement, where unauthorized access to data can compromise the effectiveness of policing activities and criminal prosecution.
Innovation Solution
Implementing a multi-tenant microservices platform with tenant-specific blob data stores and local databases accessible only through unique identifiers, combined with JSON web tokens and Azure shared access signatures, ensures that each tenant can only access their own data, while using a communication broker service to manage data distribution and prevent data processing bottlenecks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a multi-tenant microservices platform is used to serve multiple customers, then productivity and resource utilization are improved, but data security and access control become more difficult to ensure
Solution Approach 1:
The patent segments data storage by implementing tenant-specific blob data stores and local databases for each tenant. This segmentation ensures that each tenant's data is physically separated and can only be accessed by authorized microservices with valid authentication tokens, thereby maintaining data security while serving multiple tenants on a unified platform.
Solution Approach 2:
The patent introduces authentication tokens (JSON web tokens and Azure shared access signatures) as intermediaries between tenants and data resources. These tokens mediate access control by embedding tenant identifiers and permissions, allowing microservices to verify authorization before accessing any tenant's data, thus ensuring security in a multi-tenant environment.
2Reliability
If tenant-specific data stores with unique identifiers are implemented, then data security is improved, but device complexity and system configuration become more complex
Solution Approach 1:
The patent implements a universal authentication mechanism that works across all tenants and microservices. The same token generation, validation, and tenant identifier embedding process is used throughout the platform, providing a multi-functional solution that handles authentication, authorization, and data routing simultaneously, thereby reducing overall system complexity despite the multi-tenant architecture.
3Ease of operation
If centralized data storage is used, then ease of operation and data access are improved, but data security and tenant isolation deteriorate
Solution Approach 1:
The patent segments centralized storage into tenant-specific blob data stores and local databases, maintaining physical isolation while allowing centralized management. Each segment is accessible only through authenticated requests with tenant-specific tokens, ensuring both ease of operation through unified access patterns and security through enforced isolation.
Solution Approach 2:
Authentication tokens serve as intermediaries that enable easy data access while maintaining tenant isolation. The tokens embed tenant identifiers and permissions, allowing microservices to access the correct tenant's data automatically without complex routing logic, thus preserving ease of operation while ensuring security.
Data Source
AI summary
A microservices platform that includes a plurality of microservices for providing data processing functions for data of multiple tenants may be implemented. Each tenant of the multiple tenants may be provided with an assigned binary large object (blob) data store in a blob storage platform that is only accessible by a corresponding tenant using a corresponding tenant identifier. Furthermore, each tenant of the multiple tenants may be assigned a corresponding local database at each microservice of the plurality of microservices that is only accessible by the corresponding tenant using the corresponding tenant identifier.