Multi-tenant Database Segmentation for Data Security and Efficiency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional database systems face challenges in efficiently providing common data to disparate entities while isolating entity-specific data and managing complex access control, leading to data leakage and inefficiencies due to duplication and synchronization issues.
Innovation Solution
A multi-tenant database system architecture that uses a common container for shared data and tenant-specific containers, with a grant mechanism allowing efficient and transparent access to common and tenant-specific data, utilizing design-time and run-time containers and cloud-based services for data management and access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a monolithic data storage architecture is used to store common data and entity-specific data together, then data access is simplified, but data security deteriorates due to data leakage across users and entities
Solution Approach 1:
The patent segments the monolithic data storage into separate logical partitions: common data storage for shared data and entity-specific data storage for tenant-isolated data. This segmentation allows simplified access to common data while maintaining security through physical or logical isolation of entity-specific data, resolving the contradiction between ease of access and data security.
2Reliability
If common data is duplicated within each entity's data storage to prevent access to other entities' data, then data security is improved, but system efficiency deteriorates due to duplication and synchronization complexity
Solution Approach 1:
The patent introduces an intermediary layer (common data storage with controlled access mechanisms) that allows multiple entities to access the same common data without duplication. This intermediary structure maintains data security through access controls while eliminating the need for redundant copies, thus improving system efficiency while preserving security.
3Reliability
If complex authorization logic and access control lists are implemented to enforce data access rules in a monolithic storage system, then data security is improved, but system complexity deteriorates
Solution Approach 1:
The patent segments authorization logic into two simple components: entity-specific data storage with automatic tenant isolation and common data storage with standardized access controls. This segmentation eliminates the need for complex authorization logic by design, as the architectural structure itself enforces security boundaries while maintaining simple access mechanisms.
4Reliability
If physical separation of application data for each entity is implemented to prevent data leakage, then data security is improved, but data management efficiency deteriorates due to duplication of common data
Solution Approach 1:
The patent implements segmentation by creating separate storage areas for entity-specific data (providing security through isolation) while maintaining a shared common data storage area (providing efficiency through elimination of duplication). This segmented architecture simultaneously achieves both data security and management efficiency.
Solution Approach 2:
The common data storage structure serves multiple entities simultaneously, providing universal access to shared data without requiring separate copies for each entity. This multi-functional design improves data management efficiency while the access control mechanisms maintain security boundaries.
Data Source
AI summary
Systems and methods provide a common data container storing common data, a first data container storing first data associated with a first tenant, where the first container is accessible only to the first tenant, and where the first container is associated with read access to the common data of the common data container, and a second data container storing second data associated with a second tenant, where the second container is accessible only to the second tenant, and where the second container is associated with read access to the common data of the common data container, and where the common data container is not accessible to the first tenant or to the second tenant.