Native Multi-Tenant Database Encryption with Tenant-Supplied Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current multi-tenant database systems lack tenant-level encryption and management features, leading to potential data leakage and increased liability for providers, as customers have limited control over their encrypted data and access revocation.
Innovation Solution
Implementing a database-native, tenant-level encryption scheme that uses customer-supplied keys for encrypting data, allowing for independent encryption and decryption of each tenant's data within a shared database instance, while maintaining operational encryption and decryption for other tenants' data and metadata.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Use of energy by moving object
If a single database instance is used to manage data for multiple tenants, then computing resource efficiency is improved, but data security and tenant isolation are worsened
Solution Approach 1:
The patent segments data at the tenant level within a single database instance by introducing tenant-level encryption. Each tenant's data is encrypted with a unique key, allowing logical separation of data while maintaining physical storage in a shared instance. This resolves the contradiction by enabling multiple tenants to share computing resources while their data remains securely isolated through encryption segmentation.
Solution Approach 2:
The patent introduces an encryption layer as an intermediary between the shared database instance and individual tenants. This intermediary mechanism allows the database system to provide secure data access to multiple tenants without requiring physical separation of data stores. The encryption layer mediates between resource sharing needs and security requirements, enabling both efficiency and security.
2Reliability
If customer-supplied keys are used for encryption, then data control and security are improved, but system complexity and key management overhead are worsened
Solution Approach 1:
The patent implements self-service key management where each customer provides their own encryption keys for tenant data. This allows customers to maintain control over their data without requiring the database provider to manage complex key infrastructure. The self-service approach resolves the contradiction by placing key management responsibility with the customer while simplifying the provider's role to merely facilitating encrypted storage and retrieval.
3Reliability
If tenant-level encryption is implemented, then data security and access control are improved, but performance and operational overhead are worsened
Solution Approach 1:
The patent applies local quality by encrypting only the data portions of database pages with tenant-specific keys, while leaving metadata and page headers unencrypted or encrypted with different keys. This selective encryption approach allows for efficient access control at the tenant level without requiring encryption/decryption of entire database structures, thereby maintaining performance while improving security.
Solution Approach 2:
The patent implements partial encryption by applying encryption only to the necessary data portions rather than the entire database instance. This partial action approach resolves the performance contradiction by minimizing the overhead of encryption operations to only where needed, while still providing comprehensive security for tenant data.
Data Source
AI summary
A database system includes a persistent storage system, a memory storing metadata defining a tenant object and a plurality of database artifacts, a first instance of the tenant object, the first instance associated with a first plurality of the database artifacts including first data associated with the first instance of the tenant object, and a second instance of the tenant object, the second instance associated with a second plurality of the database artifacts including second data associated with the second instance of the tenant object. A processing unit is to execute program code of a database instance to cause the database system to encrypt the first data associated with the first instance of the tenant object using a first public encryption key and store the encrypted first data in the persistent storage system, and encrypt the second data associated with the second instance of the tenant object using a second public encryption key and store the encrypted second data in the persistent storage system.