Tenant-Aware In-Memory Data Grid Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In high transaction volume computer systems, existing in-memory data grids lack multi-tenancy support and integrated security measures, leading to potential data access issues between shared memory spaces of different organizations, compromising data privacy and security in cloud-based deployments.
Innovation Solution
A tenant-aware in-memory data grid system is implemented, which includes a data grid configured to store data in memory, a request manager to handle data grid labels and tenant identifiers, and a security provider for authentication and authorization, ensuring that each organization's data is isolated and secure through the use of tenant identifiers and subject-aware caching.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a single instance of the application is shared across multiple tenants in a cloud-based deployment, then system resource utilization and productivity are improved, but data security and privacy between tenants are compromised
Solution Approach 1:
The patent segments the shared data grid space by introducing tenant identifiers that partition data access logically. Each tenant's data is segmented within the shared memory space through namespace isolation, allowing multiple tenants to coexist securely in a single application instance without actual physical separation.
Solution Approach 2:
The patent introduces an intermediary security layer between tenants accessing the shared data grid. This intermediary mechanism validates tenant credentials and enforces access control policies, mediating all data access requests to ensure tenants can only access their own data while sharing the underlying infrastructure.
2Reliability
If separate software instances are deployed for each tenant to ensure data security, then data privacy is improved, but system overhead and complexity increase
Solution Approach 1:
The patent merges multiple tenant environments into a single shared data grid instance while maintaining logical separation through tenant identifiers. This combining approach eliminates the need for separate software instances for each tenant, reducing system overhead and complexity while preserving data privacy through virtualization and access control mechanisms.
3Reliability
If traditional authentication and authorization mechanisms are added to the data grid, then security is improved, but processing speed and performance decrease
Solution Approach 1:
The patent performs authentication and authorization actions preliminarily by establishing tenant context and credentials before data grid operations. The security provider pre-validates tenant identities and sets up access control policies in advance, so that subsequent data access operations within the tenant's namespace can proceed with minimal security checking overhead.
Data Source
AI summary
A system with a tenant aware in-memory data grid includes a data grid configured to store data in memory. A request manager is configured to receive a data grid label and a tenant identifier and to request a data grid entry based on the data grid label and tenant identifier. A data grid controller is configured to receive a request for data from the data grid based on a combined data grid label and tenant identifier. A security provider is configured to authenticate and authorize the request for data.