Unified Authentication System for Multitenant Data Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Multitenant services face challenges in cost-effectively implementing secure data access control, as conventional methods require dedicated design, development, and maintenance, and existing solutions do not adequately address the risk of data leakage between tenants.
Innovation Solution
A unified authentication system that manages access control using role information to determine permissions for URL, API, and data access, allowing for secure and efficient distribution of resources without increasing dedicated costs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a dedicated server is provided for each tenant, then data security and isolation are improved, but cost increases
Solution Approach 1:
The patent merges multiple dedicated servers into a single shared server that hosts multiple tenants. The server is configured to provide services to multiple tenants simultaneously, eliminating the need for separate dedicated servers for each tenant while maintaining security through software-based isolation mechanisms.
Solution Approach 2:
The server is designed with multi-functionality to serve multiple tenants with different service requirements. It can dynamically allocate resources and access rights to different tenants based on their roles and permissions, allowing a single server to perform the function of multiple dedicated servers.
2Quantity of substance
If data of multiple tenants is managed by a shared server, then cost is reduced, but data leakage risk increases
Solution Approach 1:
The patent segments data access rights and server resources by creating distinct access control zones for each tenant. Through role-based access control (RBAC), the system divides permissions into specific roles (e.g., admin, user) that can access different data and functions, preventing unauthorized access and data leakage between tenants while sharing the same physical server.
Solution Approach 2:
The patent introduces an access control mechanism as an intermediary layer between tenants and the shared server resources. This intermediary system (including authentication modules, authorization servers, and role management) mediates all data access requests, verifying tenant identity and permissions before allowing access, thus preventing data leakage without requiring physical data separation.
3Reliability
If a specialized access control method is developed for multitenant service, then data isolation is improved, but development and maintenance costs increase
Solution Approach 1:
The patent applies a universal access control method that can handle multiple access control scenarios (URL access, API execution, data distribution) through a single role-based framework. The same role management mechanism serves all access control needs, eliminating the requirement for separate specialized control systems for each access type and reducing overall system complexity.
Solution Approach 2:
The patent uses parameter changes in role definitions and access rights to achieve different isolation levels and access controls. By dynamically adjusting role parameters (such as permission scopes, access levels, and resource allocation) rather than creating separate control systems, the system achieves flexible data isolation with reduced development and maintenance complexity.
4Ease of operation
If role-based access control is used, then ease of operation is improved, but fine-grained control capability deteriorates
Solution Approach 1:
The patent segments access control into hierarchical roles (e.g., tenant-level roles, user-level roles) and permission sets. This segmentation allows administrators to assign broad roles for ease of operation while maintaining the ability to apply fine-grained permissions within those roles for precise control, combining operational simplicity with detailed security requirements.
Solution Approach 2:
The patent implements dynamic role-based access control where roles and permissions can be dynamically adjusted based on user needs and organizational requirements. The system can dynamically assign, modify, and revoke roles without requiring complex reconfiguration, maintaining ease of operation while enabling fine-grained control through flexible role management capabilities.
Data Source
AI summary
In order to prevent leakage of data possessed by a tenant to other tenants in multitenant service, it is necessary to control access. However, the conventional access control method is designed and developed to meet a specified request. Thus, costs for a dedicated design, development, administration, and maintenance need to be considered. Such costs can be reduced by using role information for each of a plurality of services and determining whether to allow or not allow access in a uniform manner.