Maintaining data security in a multi-tenant microservice environment

Patent metadata

Field	Value
Publication number	US-12373587-B2
Application number	US-202217881073-A
Country	US
Kind code	B2
Filing date	Aug 4, 2022
Priority date	Aug 4, 2022
Publication date	Jul 29, 2025
Grant date	Jul 29, 2025

Abstract

A microservices platform that includes a plurality of microservices for providing data processing functions for data of multiple tenants may be implemented. Each tenant of the multiple tenants may be provided with an assigned binary large object (blob) data store in a blob storage platform that is only accessible by a corresponding tenant using a corresponding tenant identifier. Furthermore, each tenant of the multiple tenants may be assigned a corresponding local database at each microservice of the plurality of microservices that is only accessible by the corresponding tenant using the corresponding tenant identifier.

First claim

What is claimed is:

1. One or more non-transitory computer-readable media storing computer-executable instructions that upon execution cause one or more processors to perform acts comprising:
implementing a microservices platform that includes a plurality of microservices for providing data processing functions for data of multiple tenants;
providing each tenant of the multiple tenants with an assigned binary large object (blob) data store in a blob storage platform that is only accessible by a corresponding tenant using a corresponding tenant identifier;
assigning each tenant of the multiple tenants a corresponding local database at each microservice of the plurality of microservices that is only accessible by the corresponding tenant using the corresponding tenant identifier; and
using metadata stored in the corresponding local database to access the assigned blob data store.

2. The one or more non-transitory computer-readable media of claim 1 , wherein the acts further comprise:
receiving, from a user device, a data processing request for one or more data files in which the data processing request is associated with a tenant identifier of a tenant;
retrieving particular metadata from a particular local database of a microservice in which the particular local database corresponds to tenant identifier received from the user device;
accessing a particular blob data store that is identified by the tenant identifier in relation to the one or more data files based at least on the particular metadata stored in the particular local database; and
performing data processing as requested in the data processing request on the one or more data files.

3. The one or more non-transitory computer-readable media of claim 2 , wherein the one or more data files are identified by the tenant identifier as belonging to the tenant, and wherein the performing includes storing the one or more data files in the particular blob data store, providing the user device with access to the one or more data files as stored in the particular blob data store, retrieving the one or more data files from the particular blob data store, modifying the one or more data files in the particular blob data store, or deleting the one or more data files from the particular blob data store.

4. The one or more non-transitory computer-readable media of claim 3 , wherein the one or more data files include a video file, providing includes providing an Azure shared access signature (SAS) token that enables the user device to playback the video file for a limited amount of time.

5. The one or more non-transitory computer-readable media of claim 4 , wherein the providing further includes providing the user device with access to the video file via the Azure SAS token and Azure private endpoints.

6. The one or more non-transitory computer-readable media of claim 2 , wherein the particular metadata includes database management data that enables at least one of access to the particular blob data store of the tenant or the one or more data files as stored in the particular blob data store.

7. The one or more non-transitory computer-readable media of claim 2 , wherein the particular blob data store is a cloud-based blob data store or a localized blob data store that is installed locally on a premise of the tenant.

8. The one or more non-transitory computer-readable media of claim 2 , wherein the receiving the data processing request includes:
receiving a data processing request that includes a user identifier of a user from a user device;
retrieving a tenant identifier that corresponds to the user identifier of the user;
associating the data processing request with the tenant identifier;
determining a particular microservice of the plurality of microservices that is to receive the data processing request based on one or more request parameters; and
routing the data processing request associated with the tenant identifier to the particular microservice such that the particular microservice executes the data processing request on data associated with the tenant identifier.

9. The one or more non-transitory computer-readable media of claim 8 , wherein the associating includes at least one of supplementing the data processing request with an additional data field that holds the tenant identifier or inserting the tenant identifier into a database connection string of the data processing request.

10. The one or more non-transitory computer-readable media of claim 8 , wherein the one or more request parameters include a data processing operation type identifier that matches a type of operation performed by the particular microservice.

11. The one or more non-transitory computer-readable media of claim 1 , wherein the acts further comprise:
receiving a search request for searching a multi-tenant search database for data related to a tenant, in which the data of the multiple tenants stored in the multi-tenant search database are indexed using the tenant identifiers of the multiple tenants; and
embedding a tenant identifier of the tenant in a database connection string of the search request to access the data related to the tenant.

12. The one or more non-transitory computer-readable media of claim 1 , wherein the multiple tenants include a plurality of law enforcement agencies.

13. A system, comprising:
one or more processors; and
memory including a plurality of computer-executable components that are executable by the one or more processors to perform a plurality of actions, the plurality of actions comprising:
implementing a microservices platform that includes a plurality of microservices for providing data processing functions for data of multiple tenants;
providing each tenant of the multiple tenants with an assigned binary large object (blob) data store in a blob storage platform that is only accessible by a corresponding tenant using a corresponding tenant identifier;
assigning each tenant of the multiple tenants a corresponding local database at each microservice of the plurality of microservices that is only accessible by the corresponding tenant using the corresponding tenant identifier; and
using metadata stored in the corresponding local database to access the assigned blob data store.

14. The system of claim 13 , wherein the plurality of actions further comprise:
receiving, from a user device, a data processing request for one or more data files in which the data processing request is associated with a tenant identifier of a tenant;
retrieving particular metadata from a particular local database of a microservice in which the particular local database corresponds to tenant identifier received from the user device;
accessing a particular blob data store that is identified by the tenant identifier in relation to the one or more data files based at least on the particular metadata stored in the particular local database; and
performing data processing as requested in the data processing request on the one or more data files.

15. The system of claim 14 , wherein the one or more data files are identified by the tenant identifier as belonging to the tenant, and wherein the performing includes storing the one or more data files in the particular blob data store, providing the user device with access to the one or more data files as stored in the particular blob data store, retrieving the one or more data files from the particular blob data store, modifying the one or more data files in the particular blob data store, or deleting the one or more data files from the particular blob data store.

16. The system of claim 14 , wherein the

Assignees

• Getac Technology Corp
• Whp Workflow Solutions Inc

Inventors

• Adeel Muhammad
• Guzik Thomas

Classifications

• G06F16/2219

  Large Object storage; Management thereof · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title