Relationship-Based Authorization Models for Multi-Tenant Query Latency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authorization systems are time-consuming, error-prone, and not portable across different systems due to hand-coded logic sharing both code and data stores, making it difficult to manage authorization processes efficiently in multi-tenant environments.
Innovation Solution
A multi-tenant authorization system using standardized data types and relationship tuples, with a domain-specific language (DSL) for defining authorization models, allows organizations to specify their own models and relationship tuples, enabling efficient and portable authorization decisions across tenants.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hand-coded authorization logic is used for each individual application, then authorization decisions can be made for specific systems, but the process becomes time-consuming and error-prone
Solution Approach 1:
The patent implements a universal authorization system that serves multiple tenants and applications through standardized data types and relationship tuples. The system provides multi-functionality by handling authorization for different organizations using the same core infrastructure, eliminating the need for hand-coded logic in each application while maintaining high accuracy through standardized validation rules
Solution Approach 2:
The system changes parameters from custom hand-coded logic to standardized relationship tuples and authorization models. By parameterizing authorization decisions around standardized data types and configurable relationship tuples, the system reduces development time while maintaining reliability through consistent evaluation across all tenants
2Adaptability or versatility
If hand-coded authorization logic shares code and data stores with application logic, then integration is achieved, but portability across different systems is lost
Solution Approach 1:
The patent segments the authorization system into distinct standardized components: data types, relationship tuples, and authorization models. This segmentation allows the authorization logic to be separated from application-specific code while maintaining integration through standardized interfaces, enabling portability across different systems without oversimplifying the underlying complexity
Solution Approach 2:
The system introduces standardized relationship tuples as an intermediary layer between application logic and authorization decisions. This intermediary enables portability by providing a standard interface while managing complexity through structured tuple definitions that can be evaluated consistently across different tenants and applications
3Productivity
If relationship tuples are stored in a single database, then data consistency is maintained, but computational parallelism is reduced
Solution Approach 1:
The patent segments the database storage by distributing relationship tuples across multiple database shards. Each shard stores a subset of the relationship tuples, enabling parallel query processing while maintaining data consistency through the standardized tuple structure and consistent evaluation rules applied across all shards
Data Source
AI summary
An authorization is performed based on data types—an authorization model, and relationship tuples—that are applicable across different organizations. Each organization wishing to use a system for authorization specifies its own authorization models representing types of objects that can exist within the organization and types of relations those objects can have. When a given organization submits an authorization query to determine whether a given user and a given object are in a given type of relation within that organization, the system analyzes the authorization model and relationship tuples to make the determination. Query response latency may be reduced through techniques such as geographic distribution of servers and sharding of data so that the data for a given query can be found within the same shard.