Multi-tenant storage
AssigneeVim Inc.
InventorsAsaf David, Nicolas Mendzylewski, Moran Shemesh, Chen Rozenes
Life of this patent
Estimating the term…
Abstract
A system, apparatus and product comprising: a multi-tenant layer that comprises shared resources, wherein the shared resources are accessible to multiple tenants of the storage system, wherein the shared resources comprise shared logic resources and shared data resources; and multiple single-tenant layers, wherein each single-tenant layer is associated with a respective tenant of the multiple tenants, wherein each single-tenant layer comprises a database and business logic of the respective tenant, wherein a multi-tenant encryption scheme is configured to enable secure communications with the multiple tenants without divulging sensitive information to the multi-tenant layer.
Claims20
A software storage system comprising a processor and coupled memory, said memory comprising:
- a multi-tenant layer that comprises shared resources, wherein the shared resources are accessible to multiple tenants of the storage system, wherein the shared resources comprise shared logic resources and shared data resources;
- and
- multiple single-tenant layers, wherein each single-tenant layer is associated with a respective tenant of the multiple tenants, wherein each single-tenant layer comprises a database and business logic of the respective tenant;
- wherein said processor is adapted to implement a multi-tenant encryption scheme, wherein the multi-tenant encryption scheme is configured to enable secure communications with the multiple tenants without divulging sensitive information to the multi-tenant layer, wherein the processor is adapted to implement a secure communication comprising:
- obtaining, at the multi-tenant layer, an encrypted input to be provided to a tenant, wherein the encrypted input is encrypted with a public key of the tenant,
- providing the encrypted input to the tenant,
- decrypting, at the tenant, the encrypted input using a private key of the tenant, thereby obtaining the input,
- processing, at the tenant, the input, thereby obtaining a result,
- encrypting, at the tenant, the result with a public key of the tenant, thereby obtaining an encrypted result,
- providing the encrypted result, via the multi-tenant layer, to a destination entity,
- in response to an encryption replacement request from the destination entity, decrypting the encrypted result, at the tenant, using the private key of the tenant, and re-encrypting the result with a public key of the destination entity, thereby obtaining a re-encrypted result, and
- providing the re-encrypted result to the destination entity, whereby the multi-tenant layer has no access to the input and to the result.
An apparatus comprising a processor and coupled memory, said processor being adapted to implement a multi-tenant encryption scheme, wherein the multi-tenant encryption scheme is configured to enable secure communications with multiple tenants of a software storage system without divulging sensitive information to a multi-tenant layer of the storage system, wherein the processor is adapted to:
- obtain, at the multi-tenant layer, an encrypted input to be provided to a tenant, wherein the encrypted input is encrypted with a public key of the tenant, wherein the multi-tenant layer comprises shared resources, wherein the shared resources are accessible to the multiple tenants of the storage system, wherein the shared resources comprise shared logic resources and shared data resources;
- provide the encrypted input to the tenant, wherein the tenant comprises a single-tenant layer of multiple single-tenant layers of the storage system, wherein each single-tenant layer is associated with a respective tenant of the multiple tenants, wherein each single-tenant layer comprises a database and business logic of the respective tenant;
- decrypt, at the tenant, the encrypted input using a private key of the tenant, thereby obtaining the input;
- process, at the tenant, the input, thereby obtaining a result;
- encrypt, at the tenant, the result with a public key of the tenant, thereby obtaining an encrypted result;
- provide the encrypted result, via the multi-tenant layer, to a destination entity;
- in response to an encryption replacement request from the destination entity, decrypt the encrypted result, at the tenant, using the private key of the tenant, and re-encrypt the result with a public key of the destination entity, thereby obtaining a re-encrypted result;
- and
- provide the re-encrypted result to the destination entity, whereby the multi-tenant layer has no access to the input and to the result.
A computer program product comprising a non-transitory computer readable medium retaining program instructions, which program instructions when read by a processor, cause the processor to implement a multi-tenant encryption scheme, wherein the multi-tenant encryption scheme is configured to enable secure communications with multiple tenants of a software storage system without divulging sensitive information to a multi-tenant layer of the storage system, wherein the program instructions, when executed by the processor, cause the processor to:
- obtain, at the multi-tenant layer, an encrypted input to be provided to a tenant, wherein the encrypted input is encrypted with a public key of the tenant, wherein the multi-tenant layer comprises shared resources, wherein the shared resources are accessible to the multiple tenants of the storage system, wherein the shared resources comprise shared logic resources and shared data resources;
- provide the encrypted input to the tenant, wherein the tenant comprises a single-tenant layer of multiple single-tenant layers of the storage system, wherein each single-tenant layer is associated with a respective tenant of the multiple tenants, wherein each single-tenant layer comprises a database and business logic of the respective tenant;
- decrypt, at the tenant, the encrypted input using a private key of the tenant, thereby obtaining the input;
- process, at the tenant, the input, thereby obtaining a result;
- encrypt, at the tenant, the result with a public key of the tenant, thereby obtaining an encrypted result;
- provide the encrypted result, via the multi-tenant layer, to a destination entity;
- in response to an encryption replacement request from the destination entity, decrypt the encrypted result, at the tenant, using the private key of the tenant, and re-encrypt the result with a public key of the destination entity, thereby obtaining a re-encrypted result;
- and
- provide the re-encrypted result to the destination entity, whereby the multi-tenant layer has no access to the input and to the result.
Dependencies are inferred from the claim text.