Multi-Tenant Data Access Architecture With Role-Attribute Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data management architectures struggle to provide secure, compliant, and efficient data access, sharing, and use across multiple tenants in a shared data resource, particularly in high-volume pharmacy systems, due to the need for fine-grained access controls and regulatory compliance.
Innovation Solution
A data architecture that implements a combination of role-based access control (RBAC) and attribute-based access control (ABAC) to manage data access and use at the tenant level, using tenant identifiers and user attributes to generate views of shared data resources, ensuring compliance and isolation without impacting application functionality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If data from multiple tenants is physically integrated in a shared data resource, then data sharing and collaboration efficiency is improved, but data security and compliance isolation deteriorate
Solution Approach 1:
The patent segments data access control into multiple hierarchical levels: tenant level (data use restrictions, data sharing restrictions), user level (roles and attributes), and data level (specific tables, columns, rows). This segmentation allows the system to maintain physical integration of data while implementing granular access controls that ensure security and compliance isolation for each tenant.
Solution Approach 2:
The patent introduces an intermediary access control mechanism that sits between users and the shared data resource. This intermediary evaluates user attributes, tenant restrictions, and data sensitivity to dynamically determine access permissions, enabling both data sharing and security isolation without requiring physical data separation.
2Reliability
If fine-grained access controls are implemented at tenant level, then data compliance and security are improved, but system complexity and operational overhead worsen
Solution Approach 1:
The patent implements a universal attribute-based access control framework that handles multiple compliance requirements and security policies through a single unified mechanism. The same attribute evaluation engine processes diverse access control rules across different tenants and data types, reducing system complexity compared to implementing separate control systems for each compliance requirement.
Solution Approach 2:
The patent changes the parameter of access control from static role-based permissions to dynamic attribute-based evaluations. By evaluating user attributes, tenant restrictions, and data sensitivity in real-time, the system achieves fine-grained compliance control without requiring complex hard-coded rules for each scenario, making the system more adaptable and easier to manage.
3Ease of operation
If role-based access control is used for data access management, then ease of operation is improved, but fine-grained control precision deteriorates
Solution Approach 1:
The patent merges role-based access control (RBAC) and attribute-based access control (ABAC) into a hybrid framework. RBAC provides ease of operation through predefined roles and permissions, while ABAC adds fine-grained control precision by evaluating specific user attributes, tenant restrictions, and data sensitivity. The combination allows the system to maintain operational simplicity while achieving the required access control granularity for multi-tenant compliance.
Data Source
AI summary
A computerized method includes receiving, from a user, a request to perform an operation on data stored in a shared data resource that stores physically integrated data from a plurality of tenants. The method includes determining whether the user is authorized to access the shared data resource based on a role attribute corresponding to the user. The method includes, in response to the user having access to the shared data resource storing the data, identifying user attributes associated with the user; determining, using the user attributes, a set of tenants whose data the user is authorized to access to perform the operation of the request; and generating, for the user, a view of the shared data resource. The view represents data stored in that shared data resource that corresponds to the set of tenants whose data the user is authorized to access to perform the operation of the request.