Tenant-Specific Audit View in Multi-Tenant Cloud Infrastructure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-tenant cloud environments, audit logs are not easily traceable to individual tenants, and there is a lack of isolation between tenant data, hindering compliance and forensic analysis, which is a barrier to the wider adoption of cloud computing.
Innovation Solution
The method involves using federated single sign-on (F-SSO) to derive a tenant identifier based on identity information, annotating audit events with this identifier, and storing them in an audit repository, allowing for a single tenant view of audit data to be retrieved and displayed, ensuring that audit information is not leaked between or across tenants.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If audit logs are maintained in a multi-tenant cloud environment to reduce IT costs and complexities, then resource utilization and service delivery are improved, but tenant data isolation and traceability are compromised
Solution Approach 1:
The patent segments audit log data by tenant using unique tenant identifiers. Each audit log entry is annotated with the tenant ID, allowing the system to maintain a unified multi-tenant audit repository while enabling complete logical separation of tenant data through filtering operations based on these identifiers.
Solution Approach 2:
The patent introduces tenant identifiers as an intermediary element that bridges the unified multi-tenant audit infrastructure and individual tenant data isolation requirements. This intermediary enables the system to maintain cost-effective shared resources while providing each tenant with isolated, traceable audit data through the mediator's filtering capability.
2Device complexity
If traditional audit log generation methods are used in multi-tenant environments, then system complexity is reduced, but the ability to trace and disseminate audit information to individual tenants is lost
Solution Approach 1:
The patent applies preliminary action by annotating audit log entries with tenant identifiers at the time of log generation. This pre-tagging approach ensures that tenant-specific information is captured upfront, eliminating the need for complex post-processing operations to trace or attribute audit data to specific tenants later.
3Loss of information
If audit APIs are augmented to annotate logs with tenant identifiers, then tenant-specific audit visibility is improved, but development cost and change management impact increase
Solution Approach 1:
The patent makes the audit logging system universal by designing it to handle multi-tenant environments through a standardized tenant identifier annotation mechanism. This universal approach allows the same audit infrastructure to serve all tenants without requiring tenant-specific customization, reducing development costs while maintaining complete tenant visibility.
Data Source
AI summary
A method correlates audit information in a multi-tenant computing infrastructure. The method leverages a user's authentication to the infrastructure, such as via federated single sign-on (F-SSO) from an identity provider. Preferably, the user's tenant identifier in the environment is derived based on identity information obtained during the F-SSO exchange. This tenant identifier is propagated to one or more other components in the infrastructure that are accessed by the user. As audit event from multiple components in the computing infrastructure are generated, these audit events are annotated with the tenant identifier and stored in an audit repository. In response to a request to view the tenant's audit data, a collection of tenant-specific audit events are then retrieved from the audit repository and displayed in a single tenant view. This approach ensures that audit event information is not leaked inadvertently between tenants.