Multi-tenant Database Data Sharing Architecture
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database systems face challenges in efficiently managing and sharing user data across multiple applications and platforms, particularly in multi-tenant environments where data access and security permissions need to be dynamically managed.
Innovation Solution
A multi-tenant database system architecture that enables seamless sharing of user data by integrating a compute service manager, execution platform, and database, allowing applications to connect and access data from various sources while enforcing security and access controls.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a multi-tenant database system is implemented to enable data sharing across applications, then data accessibility and collaboration are improved, but system complexity and security management burden increase
Solution Approach 1:
The system segments data access control into multiple layers: tenant-level isolation, application-level permissions, and row-level security policies. This hierarchical segmentation allows complex multi-tenant data sharing requirements to be managed through modular, manageable units rather than a monolithic access control system.
Solution Approach 2:
The patent introduces intermediate components including a query processor that mediates between applications and underlying data, and a policy engine that acts as an intermediary between security requirements and data access operations. These intermediaries abstract the complexity of multi-tenant security management from both applications and data storage.
2Reliability
If security permissions are dynamically managed for each application, then access control precision is improved, but processing overhead and system performance decrease
Solution Approach 1:
The system performs preliminary actions by pre-compiling security policies into executable access rules and pre-establishing tenant isolation contexts. This allows security checks to be performed efficiently during query execution without the overhead of dynamic policy interpretation, maintaining both security precision and performance.
Solution Approach 2:
The patent creates copies of security policies in optimized formats suitable for different execution contexts. Security policies are copied and transformed into executable access control lists (ACLs) and row-level security filters that can be applied efficiently during query processing, reducing the computational burden of real-time security evaluation.
3Ease of manufacture
If data is organized into traditional rows, columns, and tables, then data structure simplicity is maintained, but flexibility in supporting diverse application data models decreases
Solution Approach 1:
The patent implements a universal data layer that can represent multiple data models (relational, hierarchical, document, graph) using a unified storage format. This universal layer maintains the simplicity of traditional table structures for storage while providing flexible access paths and abstractions that support diverse application data models, allowing a single system to serve multiple data organization requirements.
Data Source
AI summary
A request to share cloud data associated with a first account in a database system with an application is received. Based on the request, second-party application data and third-party data that is accessible by the first account is identified. The second-party application data comprises application data corresponding to a second application provided by a second-party application provider. The third-party data corresponds to a second account maintained by the database system. The second account corresponds to a third-party data provider. The application is enabled to access the cloud data associated with the first account based on the request. The cloud data comprises customer data associated with the first account, second-party application data, and the third-party data.