Fine-Grained Relationship Access Control for Multi-Tenant Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authorization systems are time-consuming, error-prone, and not portable across different systems due to hand-coded logic sharing code and data stores with application logic.
Innovation Solution
A multi-tenant authorization system using standardized data types and relationship tuples, with a domain-specific language (DSL) for defining authorization models, allowing organizations to specify their own models and relationships, and enabling parallel processing through database shard distribution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authorization logic is hand-coded for each individual application, then authorization decisions can be made, but the process becomes time-consuming and error-prone
Solution Approach 1:
The patent uses template-based authorization logic that can be copied and reused across multiple applications. Instead of hand-coding authorization for each application, organizations can define authorization templates once and replicate them across different systems, reducing setup time and ensuring consistency.
Solution Approach 2:
The system allows dynamic modification of authorization parameters without requiring complete re-coding. Organizations can change authorization rules by modifying parameters in the template system, which automatically updates across affected applications, reducing both time and error risks.
2Adaptability or versatility
If authorization logic shares code and data stores with application logic, then integration is achieved, but portability across different systems is lost
Solution Approach 1:
The patent extracts authorization logic from application-specific code and data stores into a separate, standalone template system. This extracted authorization layer can be independently configured and applied across different applications without being tightly coupled to any single application's codebase, enabling portability while managing complexity through separation of concerns.
Solution Approach 2:
The authorization template system is designed to be universal and multi-functional, serving multiple applications and systems through a common interface. The templates can be applied across different contexts and platforms, making the authorization logic adaptable and portable while maintaining a unified management approach.
3Productivity
If standardized data types and relationship tuples are used across multiple tenants, then the system becomes more portable and reusable, but each organization must specify its own authorization models and relationships
Solution Approach 1:
The system performs preliminary action by providing pre-defined authorization templates and relationship tuples that organizations can select and customize. Instead of building authorization models from scratch, organizations start with prepared templates that already encode common authorization patterns, significantly improving setup efficiency while maintaining the ability to customize as needed.
Data Source
AI summary
An authorization system provides authorization services for multiple tenant organizations. The authorization is performed based on standardized data types—an authorization model, and relationship tuples—that are applicable across the different organizations. Each organization wishing to use the system for authorization specifies its own authorization model(s) (representing the types of objects that can exist within the organization, and which types of relations those objects can have) and relationship tuples (representing the existing user/object relationships within the organization). When a given organization submits an authorization query to determine whether a given user and a given object are in a given type of relation within that organization (e.g., whether the user can perform a particular action on the object), the system analyzes the authorization model and relationship tuples to make the determination. Query response latency may be reduced through techniques such as geographic distribution of servers and sharding of data so that the data for a given query can be found within the same shard.