Relationship-Based Authorization Models for Multi-Tenant Query Speed
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authorization systems are time-consuming, error-prone, and not portable across different systems due to hand-coded logic sharing both code and data stores, making it difficult to manage authorization processes efficiently in multi-tenant environments.
Innovation Solution
A multi-tenant authorization system using standardized data types and relationship tuples, specified through a domain-specific language (DSL), allows organizations to define their authorization models autonomously, with features like computational parallelism and distributed data storage to improve query processing time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authorization logic is hand-coded for each individual application, then authorization decisions can be made for specific systems, but the process becomes time-consuming and error-prone
Solution Approach 1:
The patent uses template-based authorization logic that can be copied and reused across multiple applications and tenants. Instead of hand-coding authorization for each system, standardized authorization templates are created once and then instantiated across numerous systems, dramatically reducing setup time while maintaining consistency and accuracy through the standardized template structure
Solution Approach 2:
The system allows authorization logic to be parameterized through configuration files and metadata that can be adjusted without rewriting the core authorization code. By changing parameters such as tenant identifiers, resource types, and permission levels in configuration files, the same authorization engine can adapt to different applications and requirements, reducing both setup time and errors
2Adaptability or versatility
If authorization logic shares code and data stores with application logic, then integration is straightforward, but portability across different systems is lost
Solution Approach 1:
The patent extracts authorization logic from application-specific code and data stores into a separate, standalone authorization service. This extracted authorization system uses its own standardized data models and configuration files, allowing it to be ported across different applications and tenants without being coupled to any single application's internal structure, thereby improving portability while managing complexity through separation of concerns
Solution Approach 2:
The authorization system is designed as a universal, multi-tenant platform that can serve multiple applications and organizations simultaneously. By creating a universal authorization engine that works across different tenants and applications through standardized interfaces and configuration, the system achieves portability without requiring separate authorization logic for each system, managing complexity through reuse rather than duplication
3Adaptability or versatility
If multiple authorization models are used for phased rollout, then flexibility is improved, but query processing complexity increases
Solution Approach 1:
The patent segments the authorization model into versioned configurations that can be independently managed and deployed. Different versions of authorization models can coexist and be applied to different tenants or resource types, enabling phased rollouts where new authorization logic can be tested and deployed incrementally without affecting the entire system, while managing complexity through clear version separation
4Speed
If relationship tuples are stored in a single data store, then data consistency is maintained, but query processing time increases
Solution Approach 1:
The patent segments the relationship tuple data store into multiple distributed shards or partitions. Each shard stores a subset of the relationship tuples, allowing authorization queries to be processed in parallel across multiple data stores. This segmentation improves query processing speed by distributing the computational load while maintaining data consistency through standardized schemas and coordinated access patterns across the distributed stores
Data Source
AI summary
An authorization system provides authorization services for multiple tenant organizations. The authorization is performed based on standardized data types—an authorization model, and relationship tuples—that are applicable across the different organizations. Each organization using the system for authorization specifies its own authorization model(s) (representing the types of objects that can exist within the organization, and which types of relations those objects can have) and relationship tuples (representing the existing user/object relationships within the organization). When an organization submits an authorization query to determine whether a given user and a given object are in a type of relation within that organization, the system analyzes the authorization model and relationship tuples to make the determination. Query response latency may be reduced through techniques such as geographic distribution of servers and sharding of data so that the data for a given query can be found within the same shard.