Patent Application
20130212122
The present disclosure relates generally to shared database objects and more particularly to a system and method for controlling access to a shared database object using multi-tenancy reverse striping.
In existing systems, implementation of multi-tenancy in a database may be accomplished using a technique called striping, wherein each row of a database comprises a column containing a value that indicates the tenant that may access the data in the row. Users may then be associated with the various tenants, making it possible to structure database queries to return only those results from the rows that a user is authorized to access through his association with the tenant indicated. However, in such systems, it is not easy to implement shared access to certain database objects due to their nature, or to change access authorization to database objects from one group of tenants to another.
According to one embodiment of the present disclosure, a method includes receiving a query from a user, the query requesting access to a database object in a first database table, the database object comprising a first column and a second column. The method also includes determining whether the user is authorized to access the database object based on the first column, and determining whether the user is authorized to access the database object based on the second column. The method further includes allowing the user to access to database object in response to determining the user is authorized to access the database object based on the first column or the second column.
Technical advantages of the present disclosure include allowing for the sharing of database objects among different groups of tenants. Particular embodiments of the present disclosure may allow for reverse striping of a multi-tenant database, wherein an object may specify those tenants allowed to access it in addition to specifying its own tenant. Some embodiments may seamlessly merge with a multi-tenant striping system, making it easier for a service provider such as a service provider to transfer access rights to an object from one group of tenants to another
Other technical advantages of the present disclosure will be readily apparent to one skilled in the art from the following figures, descriptions, and claims. Moreover, while specific advantages have been enumerated above, various embodiments may include all, some, or none of the enumerated advantages.
For a more complete understanding of certain embodiments of the present invention and features and advantages thereof, reference is now made to the following description taken in conjunction with the accompanying drawings, in which:
Embodiments of the present disclosure and its advantages are best understood by referring to
In existing systems, implementation of multi-tenancy in a database may be accomplished using striping, wherein each row of a database comprises a column containing a value that indicates the tenant that may access the data in the row. Users may then be associated with the various tenants, making it possible to structure database queries to return only those results from the rows that a user is authorized to access through his association with the tenant indicated. However, in such systems, it is not easy to implement shared access to certain database objects due to their nature, or to change access authorization to database objects from one group of tenants to another.
For example, a MSP may wish to allow all tenants to access a configuration item (CI) such as a storage area network (SAN). The MSP may accomplish this using the striping method discussed above by indicating itself as the tenant for such object, and allowing all tenants to access those rows where the MSP is listed as the tenant. However, the MSP may wish to allow only certain tenants to access certain objects, while maintaining exclusive access to certain other objects. The striping method discussed may not be able to sufficiently delineate access authorization between the various tenants and the MSP itself.
Accordingly, at least one aspect of the present disclosure may allow for reverse striping, wherein an object may specify those tenants allowed to access it in addition to specifying its own tenant. Such a system may seamlessly merge with the striping system discussed above, making it easier for a service provider such as a MSP to transfer access rights to an object from one group of tenants to another. For example, in particular embodiments, a database row in a first database table may contain a first additional column indicating the tenant that owns the data in the row (i.e. striping). The database row may also contain a second additional column indicating a group of tenants allowed to access the data in the row (i.e. reverse striping).
In such embodiments, the value in the first additional column may be NULL or may be a foreign key reference to a second database table containing all known tenants. Likewise, the value in the second additional column may be NULL or may be a foreign key reference to a third database table containing all known tenant groups. A fourth database table may then define tenant group membership, and may contain foreign key references to the second and third database tables. In certain embodiments, each query submitted by a user may be modified to test both the striping and reverse striping restrictions such that the user is only allowed to access those rows if he is either: (1) authorized to access the row as a member of the tenant indicated in the first additional column, or (2) authorized to access the row as a member of the group of tenants indicated in the second additional column.
Datacenter 104 may refer to a collection of hardware resources such as a computer system 106 and/or storage 108. Computer system 106 includes a processor 122, memory 124, and an interface 126. As an example, and not by way of limitation, computer system 106 may comprise an embedded computer system, a system-on-chip (SOC), a single-board computer system (SBC) (such as, for example, a computer-on-module (COM) or system-on-module (SOM)), a desktop computer system, a laptop or notebook computer system, an interactive kiosk, a mainframe, a mesh of computer systems, a mobile telephone, a personal digital assistant (PDA), a server, or a combination of two or more of these. Where appropriate, computer system 106 may include one or more computer systems; be unitary or distributed; span multiple locations; span multiple machines; or reside in a cloud, which may include one or more cloud components in one or more networks.
Processor 122 may refer to any suitable device operable to execute instructions and manipulate data to perform operations for computer system 120. Processor 122 may include, for example, any type of central processing unit (CPU).
Memory 124 may comprise one or more tangible, computer-readable, and/or computer-executable computer readable medium, and may store data, information, and/or instructions operable to be executed by processor 122. Examples of memory include computer memory (for example, Random Access Memory (RAM) or Read Only Memory (ROM)), mass computer readable media (for example, a hard disk), removable computer readable media (for example, a Compact Disk (CD) or a Digital Video Disk (DVD)), and/or other computer-readable medium.
Interface 126 may refer to any suitable device operable to receive input for computer system 120, send output from computer system 120, perform suitable processing of the input or output or both, communicate to other devices, or any combination of the preceding. Interface 126 may include appropriate hardware (e.g. modem, network interface card, etc.) and software, including protocol conversion and data processing capabilities, to communicate through a LAN, WAN, or other communication system that allows computer system 120 to communicate to other devices. Interface 126 may include one or more ports, conversion software, or both.
Storage 108 may provide additional data storage capacity and may include database and/or network storage, or any other suitable tangible, computer-readable storage media. In certain embodiments, storage 108 may include network resources, such as a storage area network (SAN) or network-attached storage (NAS).
Network 110 may refer to any interconnecting system capable of transmitting audio, video, signals, data, messages, or any combination of the preceding. Network 110 may include all or a portion of a public switched telephone network (PSTN), a public or private data network, a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), a local, regional, or global communication or computer network such as the Internet, a wireline or wireless network, an enterprise internet, or any other suitable communication link, including combinations thereof. Network 110 may connect a plurality of tenants 112.
In particular embodiments, database table 210 may contain at least three columns for each object in the table. For example, database table 210 may include columns for indicating an ID of the object, a tenant with control of the object, and tenants using the object, as illustrated. In some embodiments, the ID column may comprise a primary key reference, while the tenant and tenants_using columns may each comprise foreign key references to tenant table 220 and tenants_using table 230, respectively. In some embodiments, database table 210 may include additional columns such as a Name column indicating a name of the database object. For example, the name of each object may be listed in the Name column, such as Computer, Disk 1, Disk 2, Disk 3, and Disk 4, as illustrated. Tenant table 220 may include at least one column for each object in the table.
In particular embodiments, tenant table 220 may include a first column for indicating an ID of the tenant, as illustrated. In some embodiments, tenant table 220 may also include a column for indicating a name for each tenant in the table. For instance, the name of each tenant listed in the table may be included in the name column, such as Tenant A, Tenant B, Tenant C, and MSP as illustrated.
Tenant_group table 230 may include at least one column for each tenant group listed in the table. In particular embodiments, tenant_group table 230 may include a first column for indicating an ID of the tenant group, as illustrated. In some embodiments, tenant_group table 230 may also include an additional column for indicating a name for each tenant group in the table. For example, tenant group AB includes Tenants A and B, but not C, while tenant group ABC includes Tenants A, B, and C.
Tenant_group_member table 240 may include at least three columns for each object in the table. In particular embodiments, tenant_group_member table 240 may include columns for indicating an ID of the tenant group member object, a tenant group of the tenant group member object, and the specific tenant in the tenant group for the tenant group member object, as illustrated. In some embodiments, a tenant group member object may be created for each tenant listed in a tenant group. For example, tenant group AB may have two objects in tenant_group_member table 240—one for Tenant A, and one for Tenant B. Likewise, tenant group ABC may have three objects in tenant_group_member table 240—one for Tenant A, one for Tenant B, and one for Tenant C. In some embodiments, the tenant column may contain a foreign key reference to tenant table 220. Similarly, in some embodiments, the tenant_group column may contain a foreign key reference to tenant_group table 230.
As is explained in further detail below, the database table structure shown in
In some embodiments, the database object may comprise a first column and second column. For example, the database object may comprise a first column indicating the tenant that owns the object or has control over the object, and a second column indicating a group of tenants that have access to the database object. In some embodiments, the first column and second column may each comprise a foreign key reference to another database table. Referring to
At step 320, it is determined whether the user is authorized to access the database object based on the first column of the database object. In particular embodiments, this may be accomplished by determining a first value in the first column of the database object and determining whether the user has access based on the first value.
For example, referring to
If it is determined that the user does not have access based on the first value, the method continues to step 330, where it is determined whether the user is authorized to access the database object based on the second column of the database object. In particular embodiments, this may be accomplished by determining a second value in the second column of the database object and determining whether the user has access based on the second value.
For example, referring to
In further embodiments, determining whether the user is authorized to access the database object based on the second column of the database object may be accomplished by accessing a row in a second database table. In certain embodiments, the row in the second table may comprise a third column and a fourth column. In some embodiments, it may be determined whether the second value matches a third value in the third column. In further embodiments, if the second value is found to match the third value, it may then be determined whether the user has access to the database object based on a fourth value in the fourth column.
For example, referring to
Although the present disclosure has been described in several embodiments, a myriad of changes, substitutions, and modifications may be suggested to one skilled in the art, and it is intended that the present disclosure encompass such changes, substitutions, and modifications as fall within the scope of the present appended claims.
