Multitenant Site User Partitions for Secure Cross-Organization Access

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing multitenant systems face challenges in securely isolating data access for external users and controlling authentication levels, leading to potential unauthorized access and data management issues when sharing files across different organizations.

Innovation Solution

Implementing a multitenant platform with site-level user partitioning and authentication services, allowing organizations to define user partitions and control access at the site level, enabling differentiated authentication and data isolation for users with a single email address across multiple sites.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If a global user account system is used in multitenant environments, then user authentication is simplified and unified, but security control and data isolation between different organizations are weakened

Engineering Contradiction:

Improveuser authenticationVSAvoidsecurity control

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The patent segments the global user account system into tenant-specific user partitions. Each tenant can have its own user partition that isolates user accounts and authentication mechanisms to that specific tenant. This allows different tenants to maintain separate security controls while still using the unified multitenant platform, resolving the contradiction between simplified authentication and secure data isolation.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent implements local quality by allowing each tenant to define its own authentication requirements and security policies within its user partition. Each tenant's data and users are treated with different authentication standards according to their specific needs, enabling customized security control while maintaining the overall unified platform architecture.

Inventive Principle:

Principle #3Local quality

2Adaptability or versatility

If external users are allowed access to enterprise data, then collaboration and file sharing are enabled, but unauthorized access and data management issues increase

Engineering Contradiction:

Improvefile sharing capabilityVSAvoidunauthorized access

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The patent segments access control at the tenant level, creating separate user partitions for different organizations. External users can be granted access to specific tenant data through controlled mechanisms, but the segmentation ensures they cannot access data from other tenants. This enables file sharing capability while preventing unauthorized access across different organizations.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces tenant-level authentication services as intermediaries between external users and enterprise data. These intermediary authentication mechanisms verify external user identities and authorize their access to specific tenant data, controlling the harmful effects of unauthorized access while maintaining the benefits of file sharing and collaboration.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Reliability

If user partitions are implemented at the site level, then data isolation and security control are improved, but system complexity increases

Engineering Contradiction:

Improvedata isolationVSAvoidsystem architecture

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent implements user partitions at the site level within the multitenant platform, making the partitioning mechanism universal across all tenants. The same user partition infrastructure serves all tenants, providing data isolation and security control without requiring separate complex systems for each tenant. This multi-functional approach improves data isolation while managing system complexity through a unified implementation.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS12561468B2Methods and systems for tenancy in a multitenant environment

Publication Date: 2026.02.24 OPEN TEXT SA ULC

AI summary

Systems, methods and computer program products for controlling access to an organization's data in a multitenant environment are provided. An organization hierarchy is defined at a multitenant platform, the organization hierarchy comprising an organization and a plurality of sites owned by the organization, each of the plurality of sites representing a data isolation boundary for the organization's data. The sites are associated with subscriptions to applications of the multitenant platform. The organization can designate user partitions within the sites, each user partition designating a corresponding set of site users and a corresponding authentication service. The multitenant platform enables access to each subscription of a site only if a site user is authenticated by the authentication service designated in the user partition corresponding to the site user.