Two-Factor Access Control for Multitenant Data Isolation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current multitenant application platforms face challenges in securely managing access to data across different users and organizations, particularly when external users need to collaborate, as existing systems lack efficient data isolation and authentication controls, leading to potential security breaches and administrative burdens.

Innovation Solution

Implementing a two-factor access control paradigm with data isolation at the application level and user partitioning, allowing data owners to control access through a specific entry point, enabling granular access management and ensuring authentication meets the tenant's security requirements, even for external users.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If external users are granted access to enterprise data through cloud-based multitenant platforms, then collaboration capability is improved, but data security and access control reliability deteriorate

Engineering Contradiction:

Improvecollaboration capabilityVSAvoiddata security

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The system segments users into different partitions (enterprise users vs. external users) with distinct authentication requirements. Each partition has its own authentication service that can be independently configured, allowing external users to access data while maintaining separate security controls for each user group.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces an intermediary authentication service that sits between external users and enterprise data. This intermediary service validates external users through their own domain's authentication mechanism while preventing direct access to enterprise resources, thus enabling collaboration without compromising data security.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Measurement precision

If administrators manually configure access permissions for external users in the application, then access control precision is improved, but administrative burden and time consumption worsen

Engineering Contradiction:

Improveaccess control precisionVSAvoidadministrative time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The system performs preliminary authentication of external users through their domain's authentication service before granting access to enterprise data. This preliminary action automatically establishes access permissions based on the user's domain credentials, eliminating the need for administrators to manually configure each external user's access rights.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

External users authenticate themselves through their own domain's authentication service without requiring administrator intervention. The system automatically recognizes authenticated external users and grants appropriate access to enterprise data, making the access control process self-service rather than administrator-managed.

Inventive Principle:

Principle #25Self-service

3Ease of operation

If external users are authenticated by their own domain with simple credentials, then ease of operation is improved, but authentication security worsens

Engineering Contradiction:

Improveuser convenienceVSAvoidauthentication security

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system applies different authentication quality requirements to different user partitions. Enterprise users require strong authentication with the enterprise's authentication service, while external users are authenticated through their own domain's service with simpler credentials. Each partition has its own authentication quality standard appropriate to its security requirements.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS12199967B2Data isolation and two-factor access control

Publication Date: 2025.01.14 OPEN TEXT SA ULC

AI summary

Systems, methods and computer program products for controlling access to data owned by an application subscriber using two-factor access control and user partitioning are disclosed. In one embodiment, applications are executed on a multi-tenant application platform in which user partitions designate associated users and authentication services for those users. Tenants may subscribe to the applications and may allow access to the subscriptions through designated entry points. Users that are authenticated according to the corresponding user partition and access the application through the designated entry point are allowed to access the application through the tenant's subscription.