Back to results
US 9,959,423 B2Granted
Security and data isolation for tenants in a business data system
AssigneeMicrosoft Technology Licensing, LLC
InventorsVijeta Johri, Amar Nalla, Madan G. Natu
Life of this patent
Estimating the term…
Abstract
A multi-tenant hosting system receives business data and tenant-identifying data, from a tenant. The data from multiple different tenants is stored on a single database, but the data corresponding to each tenant is partitioned by marketing the data with a partition identifier, within the database. Therefore, the hosting system only allows individual tenants to have access to their own data.
Claims20
A computer-implemented method of servicing a data manipulation request in a multi-tenant data store, each tenant being an organization with multiple users, comprising:
- displaying a tenant creation administrator display with user input mechanisms that receive user inputs to create a given tenant in a business data application that has at least one other tenant, other than the given tenant;
- displaying a security administrator designation display with user input mechanisms that receive user inputs identifying a client at the given tenant as a security administrator that identifies security rules for users associated with the given tenant;
- receiving a data manipulation request, in the business data application, from a requesting client including tenant identification data identifying the requesting client as being from the given tenant;
- and
- servicing the data manipulation request, using a computer processor, from the multi-tenant data store that stores first data in association with the given tenant and second data in association with the at least one other tenant, the first data for the given tenant being partitioned in the multi-tenant data store from the second data for other tenants, based on the associations, to restrict access to the first data by the at least one other tenant, the data manipulation request being serviced by confining the data manipulation request to data stored in association with the given tenant, based on the tenant identification data.
2 more elements
A business data system, comprising:
- a server layer that hosts a same business data application for a first tenant and a second tenant, each tenant being an organization with a plurality of different clients, the server layer configured to:
- receive first data from the first tenant and second data from the second tenant,
- store the first and the second data on a multi-tenant data store, and
- partition the first data from the second data so the first data is inaccessible to the second tenant and the second data is inaccessible to the first tenant;
- and
- a computer processor that forms a functional part of the system and that is activated by, and facilitates the functionality of, the server layer.
3 more elements
A computer readable storage medium, storing computer readable instructions which, when executed by a computer, cause the computer to perforin a method, comprising:
- organization with multiple users, comprising:
- displaying a tenant creation administrator display with user input mechanisms that receive user inputs to create a given tenant in a business data application that has at least one other tenant, other than the given tenant;
- displaying a security administrator designation display with user input mechanisms that receive user inputs identifying a client at the given tenant as a security administrator;
- receiving a data manipulation request, in the business data application, from a requesting client including tenant identification data identifying the requesting client as being from the given tenant and identifying data to be manipulated;
- and
- servicing the data manipulation request, using the business data application, from the multi-tenant data store that stores data for the given tenant and the at least one other tenant in, the data for the given tenant being partitioned in the multi-tenant data store from data for other tenants, the data manipulation request being serviced by confining the data manipulation request to data for the given tenant, based on the tenant identification data, wherein servicing the data manipulation request further comprises:
- accessing security rules for the given tenant, based on the tenant identification data in the data manipulation request;
- implementing the security rules for the given tenant while servicing the data manipulation request;
- and
- maintaining a separate copy of cached data in cache memory, based on the data identified in the data manipulation request, for each tenant.
7 more elements
Dependencies are inferred from the claim text.