Secure isolation of tenant resources in a multi-tenant storage system using a security gateway

A computer system comprising:

• one or more processors;
• one or more non-transitory computer readable storage media;
• computer program instructions;
• the computer program instructions being stored on the one or more non-transitory computer readable storage media;
• the computer program instructions comprising instructions to:
• receive a first request submitted by a first user in a multi-tenant computing system;
• extract from the first request a first tenant ID associated with a tenant from among a plurality of tenants in the multi-tenant computing system;
• spawn a first request processor, wherein the first tenant ID is utilized by the first request processor to determine resource access privileges associated with the first tenant ID;
• spawn a subtenant authenticator;
• examine, by the subtenant authenticator, user credential data associated with the first request to determine whether the first user is authorized to access the one or more target resources;
• and
• service the first request by providing access to one or more target resources identified in the first request, in response to determining that the first tenant ID is associated with a first tenant with privileges to access the one or more target resources.

A computer program product comprising logic code embedded in a non-transitory data storage medium for maintaining resource isolation in a multi-tenant computing system, wherein execution of the logic code on a computer causes the computer to:

• receive a first request submitted by a first user in a multi-tenant computing system;
• extract from the first request a first tenant ID associated with a tenant from among a plurality of tenants in the multi-tenant computing system;
• spawn a first request processor, wherein the first tenant ID is utilized by the first request processor to determine resource access privileges associated with the first tenant ID;
• spawn a subtenant authenticator;
• examine, by the subtenant authenticator, user credential data associated with the first request to determine whether the first user is authorized to access the one or more target resources;
• and
• service the first request by providing access to one or more target resources identified in the first request, in response to determining that the first tenant ID is associated with a first tenant with privileges to access the one or more target resources.