Serverless Tenant Isolation via Cryptographic Token Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-tenant cloud-based systems, existing technologies face challenges in securely isolating data access for different tenants while allowing shared functionality, leading to inefficiencies in application execution and increased administrative overhead.
Innovation Solution
A system that uses a serverless processor and authorization component to generate and manage public and private keys, creating access tokens and transaction tokens for secure communication between tenants and a virtual environment, ensuring isolated data access within a common processing space.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If multi-tenant cloud-based architectures are used to improve collaboration and integration, then data security and isolation may be compromised
Solution Approach 1:
The patent implements segmentation by creating distinct virtual environments for each tenant within the shared cloud infrastructure. Each tenant is assigned a unique virtual environment that corresponds to a dedicated portion of the common data store, effectively segmenting access paths while maintaining physical sharing of resources. This resolves the contradiction by enabling collaboration through shared infrastructure while ensuring data security through logical isolation.
Solution Approach 2:
The patent introduces an authorization component as an intermediary between tenants and the common data store. This intermediary verifies tenant identities, validates access requests, and enforces isolation policies using cryptographic key pairs and access tokens. The authorization component acts as a mediator that enables safe collaboration by strictly controlling and monitoring all access interactions, thus maintaining data security while allowing integration.
2Reliability
If traditional server architectures are used to ensure secure data access, then operational costs and administrative overhead increase
Solution Approach 1:
The patent implements a universal authorization component that serves multiple functions: identity verification, access token generation, transaction token validation, and isolation enforcement. This single multi-functional component replaces what would otherwise require separate administrative systems for key management, authentication, and access control. By consolidating these functions, the system maintains strong data security while significantly reducing administrative overhead and operational complexity.
Solution Approach 2:
The patent implements self-service through automated cryptographic key pair generation and access token issuance. The serverless processor automatically generates public-private key pairs for each tenant and the authorization component automatically issues access tokens without human intervention. This automation eliminates manual administrative tasks for key management and access control, reducing operational costs and complexity while maintaining security through consistent, rule-based enforcement.
3Reliability
If data isolation is enforced for each tenant, then shared functionality and collaboration efficiency decrease
Solution Approach 1:
The patent resolves this contradiction by adding a dimensional layer of abstraction between the shared infrastructure and tenant data. Instead of isolating tenants in separate physical systems (one dimension), the patent creates virtual environments that operate in an additional logical dimension. This allows tenants to share the same physical infrastructure and access common services while maintaining isolation through the added virtualization dimension, thus preserving both data isolation and collaboration efficiency.
Data Source
AI summary
A system for authorizing a serverless application function having a plurality of tenants, each tenant may include one or more entities that share a common access to a processing space and a data store. The system includes a gateway that receives a request from a tenant, an authorization component that access a public key assigned to the tenant, and a serverless processor that generates public and private keys for the tenant. The serverless processor also generates an access token for the first tenant that is signed using the private key and requests a transaction token from the authorization component using the access token. The authorization component transmits a transaction token to the serverless processor, which is used to make further requests to a virtual environment.