Multi-tenant Data Protection via Tenant-Based Token Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Multi-tenant storage environments face challenges in protecting sensitive data due to concerns about data security and unauthorized access from other tenants, necessitating improved data protection techniques.
Innovation Solution
Implementing tenant-based token validation and data encryption methods, where users are authorized through tokens to access specific tenant data, with encryption keys used for storing and decrypting data records, ensuring only authorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If multi-tenant storage environment is used to provide storage for multiple customers, then storage capacity and resource utilization are improved, but data security and trust are worsened due to fears of unauthorized access from other tenants
Solution Approach 1:
The patent segments data by tenant, with each tenant's data encrypted using a unique encryption key. The system divides the storage space into tenant-specific encrypted volumes, ensuring that even though physical storage is shared, logical separation and encryption prevent unauthorized access between tenants. This resolves the contradiction by maintaining multi-tenant storage efficiency while ensuring data security through cryptographic isolation.
Solution Approach 2:
The patent introduces tokens as an intermediary mechanism between users and tenant data. Tokens contain encrypted tenant identifiers and are validated by the system to determine access permissions. This intermediary layer enables authorized access to specific tenant data while preventing unauthorized cross-tenant access, thus maintaining both storage efficiency and security.
2Reliability
If data is encrypted using tenant-specific encryption keys, then data security and isolation are improved, but system complexity and computational overhead are worsened
Solution Approach 1:
The patent implements a universal token validation mechanism that handles multiple tenants with a single standardized process. The same token validation logic and encryption/decryption routines are applied across all tenants, making the system scalable without proportionally increasing complexity. This universal approach maintains strong data isolation while controlling system complexity through reusable components.
Solution Approach 2:
The patent changes the parameter of access control from centralized permission checking to decentralized token-based validation. Each user receives pre-configured tokens containing their access permissions, transforming the complexity from centralized authorization logic to simpler token validation operations. This parameter change maintains data isolation while reducing operational complexity.
3Reliability
If token validation is implemented to authorize user access to tenant data, then access control and security are improved, but processing time and operational complexity are worsened
Solution Approach 1:
The patent performs preliminary token validation during the data access operation, validating the token's tenant identifier against the data's tenant identifier in a single atomic operation. This preliminary validation approach ensures that access control is enforced without requiring multiple sequential checks, thus maintaining strong access control while minimizing processing time overhead.
Data Source
AI summary
Techniques are provided for multi-tenant data protection using tenant-based token validation and data encryption. One method comprises obtaining, from a user, a data record to be stored in a multi-tenant storage environment and a token associated with the user. Each data record identifies a tenant associated with the respective data record and the user is authorized to access tenant data of at least one tenant identified in the token. An encryption key of the tenant associated with the data record is obtained and the data record is encrypted using the obtained encryption key and stored. A given data record may be read by obtaining a decryption key of the tenant associated with the given data record and decrypting the given data record using the decryption key. The token may be used to evaluate whether the user is authorized to access the tenant data of the tenant associated with the given data record.