Policy Enforcement Service for Distributed Application Resource Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Multi-tenant database systems face service disruptions due to users consuming excessive resources, leading to system overload and potential service degradation, as existing solutions lack effective mechanisms for real-time policy enforcement and user suspension.
Innovation Solution
Implementing a Policy Enforcement as a Service (PEaaS) framework that tracks user infractions and enforces resource-protection policies by defining thresholds for user requests and resource access, allowing for automatic suspension of users who exceed these limits, thereby preventing system overload.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If service providers attempt to detect and suspend offending client devices causing service disruptions, then service stability is improved, but system complexity and response time increase
Solution Approach 1:
The patent introduces a policy enforcement service as an intermediary component that mediates between the multi-tenant database system and client devices. This service handles the detection and suspension of offending clients, separating this functionality from the core database system. The policy enforcement service receives requests from the database system, evaluates them against stored policies, and executes appropriate actions, thereby reducing the complexity burden on the core system while maintaining service stability.
Solution Approach 2:
The patent implements preliminary action by pre-storing enforcement policies in the policy enforcement service before they are needed. Policies defining thresholds for resource consumption and suspension criteria are established in advance. When a client exceeds these pre-defined thresholds, the system can immediately enforce suspension without needing to analyze complex rules in real-time, thus improving response speed while maintaining reliability.
2Reliability
If real-time policy enforcement is implemented to prevent resource exhaustion, then service continuity is improved, but processing overhead increases
Solution Approach 1:
The policy enforcement service operates autonomously to evaluate requests against stored policies and enforce actions without requiring continuous intervention from the core database system. The service maintains its own policy repository and enforcement logic, allowing it to self-manage the monitoring and enforcement process. This reduces the processing overhead on the main system while ensuring continuous service through automated real-time enforcement.
Solution Approach 2:
The patent extracts the policy enforcement functionality from the core multi-tenant database system into a separate dedicated service. This extraction removes the processing overhead of real-time policy evaluation and enforcement from the main system's critical path. The separated service handles resource consumption monitoring and enforcement independently, allowing the core system to focus on its primary functions while maintaining service continuity through the dedicated enforcement mechanism.
3Object-generated harmful factors
If user resource consumption is monitored and enforced, then fairness among users is improved, but system complexity increases
Solution Approach 1:
The policy enforcement service is designed as a universal mechanism that can enforce multiple different policies across various tenants and resource types through a single unified system. Rather than implementing separate enforcement mechanisms for each tenant or resource type, the service stores and evaluates multiple policies against a common framework. This universal approach ensures fair resource consumption control across all users while minimizing system complexity by consolidating enforcement logic into one multi-functional component.
Data Source
AI summary
Systems, methods, and computer-readable media for providing a Policy Enforcement as a Service (PEaaS) are described. A processor may, in response to identification of a suspension of user(s) for one of one or more services, generate a suspension value indicative of the suspension and transmit the suspension value to a corresponding one of third party platforms of the service(s), respectively. The suspension value usable by the corresponding third party platform to determine whether to deny request(s) from the user for the distributed service, or not. A service of the service(s) comprises a distributed service provided by a plurality of hosts. In response to the service corresponding to the suspension including the distributed service, the suspension value may be transmitted to the first host, and the suspension value may be propagated to the one or more second hosts, respectively. Other embodiments may be described and/or claimed.