Multi-tenant Identity Management via Microservice Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current identity management systems in cloud environments face challenges in providing secure access across diverse devices and user types, with inconsistencies in security between on-premise and cloud environments leading to potential security breaches, especially when managing access for employees, customers, and partners.
Innovation Solution
A microservices-based architecture for cloud identity and access management that implements multi-tenant identity and data security, supporting secure access across hybrid cloud deployments, enabling unified security controls, and integrating with both on-premise and cloud applications through Single Sign-On (SSO) functionality, using standards like OpenID Connect, OAuth2, and SCIM for authentication, authorization, and federation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a cloud-based identity management system is implemented to provide secure access across diverse devices and user types, then accessibility and versatility are improved, but security consistency and reliability may deteriorate due to the complexity of managing multiple tenancies and access scenarios
Solution Approach 1:
The system segments the multi-tenant identity management into distinct functional microservices including authentication service, authorization service, account management service, and identity federation service. Each microservice handles specific security functions independently, allowing the system to maintain security consistency across diverse access scenarios while supporting multiple user types and devices through specialized service components.
Solution Approach 2:
The patent introduces an identity broker as an intermediary component that mediates between external identity providers and the cloud application. The broker standardizes authentication and authorization flows, ensuring security consistency across different identity sources and access scenarios. The broker implements uniform security policies and protocols regardless of the underlying identity provider or access device type.
2Productivity
If microservices architecture is used to provide scalable identity management services, then productivity and scalability are improved, but device complexity and operational complexity increase
Solution Approach 1:
The microservices are designed with universal interfaces and standardized communication protocols that allow them to function independently while maintaining system-wide consistency. Each microservice can be deployed, scaled, and managed separately, yet they all adhere to the same security policies and data models, reducing the operational complexity despite the increased number of components.
Solution Approach 2:
The identity management system implements self-service capabilities where users can autonomously manage their own identities, access requests, and permissions through user portals. This reduces the operational burden on system administrators and simplifies the management of complex multi-tenant environments, allowing the system to scale without proportionally increasing administrative complexity.
3Reliability
If multi-tenant data isolation is implemented to ensure security between tenants, then security and data protection are improved, but data retrieval efficiency and productivity may deteriorate
Solution Approach 1:
The database layer is segmented into tenant-specific data partitions or schemas, ensuring that each tenant's data is physically or logically isolated. This segmentation maintains security boundaries while allowing efficient query optimization within each partition. The system can retrieve data from specific tenant partitions without scanning entire databases, maintaining productivity despite the isolation requirements.
Solution Approach 2:
The system implements read replicas or cached copies of tenant data that can be queried without accessing the primary isolated data stores. These copies maintain data consistency through synchronization mechanisms while enabling efficient data retrieval operations. The replicas allow fast read operations without compromising the security isolation of the primary tenant data.
Data Source
AI summary
A system provides cloud-based identity and access management. The system receives a request from a client for an identity management service, authenticates the request, and accesses a microservice based on the request. The system determines, based on the request, a tenancy of the client, a tenancy of a user, and a tenancy of a resource. The system retrieves data from the determined tenancies as required to process the request, where the data is retrieved by the microservice using a connection pool that provides connections to the database. The system then performs the identity management service by the appropriate microservice responsible for processing the received request.