Relationship-Tuple Authorization for Multi-Tenant Access Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authorization systems are time-consuming, error-prone, and not portable across different systems due to hand-coded logic sharing both code and data stores, making it difficult to manage authorization processes efficiently in multi-tenant environments.
Innovation Solution
A multi-tenant authorization system using standardized data types and relationship tuples, with a domain-specific language (DSL) for defining authorization models, allows organizations to specify their own models and relationship tuples, enabling efficient and portable authorization decisions across tenants.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hand-coded authorization logic is used for each individual application, then authorization decisions can be made, but the process becomes time-consuming and error-prone
Solution Approach 1:
The patent uses templates to define authorization logic once and then copies/reuses these templates across multiple applications and tenants. Instead of hand-coding authorization logic for each application, the system creates reusable authorization templates that can be instantiated multiple times, significantly reducing setup time and improving consistency and accuracy across the platform.
Solution Approach 2:
The system allows dynamic configuration of authorization parameters through templates, where the same authorization logic can be adapted to different scenarios by changing parameters rather than rewriting the entire authorization logic. This enables flexible customization while maintaining the benefits of standardized templates.
2Adaptability or versatility
If hand-coded authorization logic shares code and data stores with application logic, then integration is achieved, but portability across different systems is lost
Solution Approach 1:
The patent extracts authorization logic from application-specific code and data stores into a separate, standalone authorization service. This extraction allows the authorization system to be portable across different applications and systems while maintaining its own independent data stores and logic, reducing coupling and improving adaptability.
Solution Approach 2:
The authorization templates are designed to be universal and multi-functional, capable of serving multiple applications and tenants with the same underlying logic. This universality enhances portability across systems while the modular template structure manages complexity through standardization.
3Productivity
If traditional authorization systems are used in multi-tenant environments, then authorization can be provided, but computational efficiency and parallelism are reduced
Solution Approach 1:
The patent segments the authorization data into separate tenants with isolated data stores, ensuring multi-tenant isolation and security. Each tenant has its own authorization data while the authorization service itself is shared, enabling parallel processing across tenants without interference, thus improving computational efficiency while maintaining reliability.
Solution Approach 2:
The system performs preliminary actions by pre-defining authorization templates and relationship tuples in advance. This allows the authorization service to quickly evaluate pre-computed relationships during runtime, improving processing speed while the template-based isolation ensures multi-tenant security and reliability.
Data Source
AI summary
An authorization is performed based on data types—an authorization model, and relationship tuples—that are applicable across different organizations. Each organization wishing to use a system for authorization specifies its own authorization models representing types of objects that can exist within the organization and types of relations those objects can have. When a given organization submits an authorization query to determine whether a given user and a given object are in a given type of relation within that organization, the system analyzes the authorization model and relationship tuples to make the determination. Query response latency may be reduced through techniques such as geographic distribution of servers and sharding of data so that the data for a given query can be found within the same shard.