Cross-tenant data leakage isolation

• US 10,305,861 B2
• Filed: 08/29/2016
• Issued: 05/28/2019
• Est. Priority Date: 08/29/2016
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Moysi, Liran, Liran, Noam
• Primary Examiner(s): Giddins, Nelson
• Application Number:
  US15/249,554
• Publication Number:
  US 20180063089A1
• Time in Patent Office: 1,002 Days
• CPC Class Codes: G06F 16/24534 Query rewriting; Transformation
• CPC Class Codes: G06F 16/2456 Join operations
• CPC Class Codes: G06F 16/9017 using directory or table look-up use of a directory or look-up table in file systems G06F16/13
• CPC Class Codes: G06F 16/903 Querying for retrieval from the web G06F16/953
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A method and proxy device for cross-tenant data leakage isolation in a multi-tenant database are provided. The method includes monitoring, by a proxy device, traffic flows between a server executing at least one cloud-based application and the multi-tenant database, wherein the proxy device is communicatively connected between the server and the multi-tenant database; capturing, by the proxy device, at least a request to access the multi-tenant database, wherein the request is communicated using a database-specific protocol; analyzing the request to determine if the request is legitimate; upon determining that the request is not legitimate, modifying the request to point to a global-tenant table and to designate a unique tenant identifier, wherein the unique tenant identifier corresponds to a tenant-specific table name designated in the global-tenant table; and sending the modified request to the multi-tenant database using the database-specific protocol.

Claims

1. A method for cross-tenant data leakage isolation in a multi-tenant database, comprising:

monitoring, by a proxy device, traffic flows between a server executing at least one cloud-based application and the multi-tenant database, wherein the proxy device is communicatively connected between the server and the multi-tenant database;

capturing, by the proxy device, at least a request to access the multi-tenant database, wherein the request is communicated using a database-specific protocol;

analyzing the request to determine if the request is illegitimate, wherein an illegitimate request is not addressed to a global-tenant table including records of individual database tables of tenants in the multi-tenant database;

upon determining that the request is not legitimate, modifying the request to point to a global-tenant table and to designate a condition with a unique tenant identifier having permissions to access the table identified in the received query, wherein the unique tenant identifier corresponds to a tenant-specific table name designated in the global-tenant table, and wherein the global-tenant table is shared across multiple machines; and

sending the modified request to the multi-tenant database using the database-specific protocol.

2. The method of claim 1, wherein analyzing the request further comprises:

identifying at least a query embedded in the request;

identifying a type of a command of the query; and

determining whether the command affects the global-tenant database.

3. The method of claim 2, wherein modifying the request further comprises:

upon determining that the query command affects the global-tenant database, changing the type of the command.

4. The method of claim 1, wherein the request is determined to be legitimate if the query embedded in the request is addressed to the global-tenant table and designates at least a unique tenant identifier as a condition.

5. The method of claim 1, further comprising:

capturing, by the proxy device, at least a response from the multi-tenant database, wherein the response including returned data;

analyzing the response to determine if the returned data relates to the global-tenant table;

upon determining that the returned data relates to the global-tenant table, modifying the response to designate at least one tenant-specific table name that the returned data belongs to; and

sending the modified response to the server.

6. The method of claim 1, wherein analyzing the response further comprises:

determining at least a query embedded in a request corresponding to the captured request;

identifying a type of a command of the query of the corresponding request; and

determining whether the command of the query of the corresponding request relates to the global-tenant database.

7. The method of claim 1, further comprising:

creating the global-tenant table.

8. The method of claim 7, further comprising:

associating a unique tenant identifier with each individual database table of tenants of the multi-tenant database;

joining all of the individual database tables of the tenants to create the global-tenant table; and

adding, to the global-tenant table, a column designating a tenant identifier of the tenant associated with each individual database table.

9. The method of claim 1, wherein the global-tenant table includes records of individual database tables of tenants in the multi-tenant database, wherein the record of each individual database tenant table is associated with a unique tenant identifier of a respective tenant.

10. The method of claim 1, further comprising:

performing at least one optimization process to optimize performance of accessing and maintaining the global-tenant database.

11. The method of claim 1, wherein the database specific protocol includes at least one of:

a Wire protocol and a hypertext transfer protocol.

12. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a method, the method comprising:

monitoring, by a proxy device, traffic flows between a server executing at least one cloud-based application and the multi-tenant database, wherein the proxy device is communicatively connected between the server and the multi-tenant database;

capturing, by the proxy device, at least a request to access the multi-tenant database, wherein the request is communicated using a database-specific protocol;

analyzing the request to determine if the request is illegitimate, wherein an illegitimate request is not addressed to a global-tenant table including records of individual database tables of tenants in the multi-tenant database;

upon determining that the request is not legitimate, modifying the request to point to a global-tenant table and to designate a condition with a unique tenant identifier having permissions to access the table identified in the received query, wherein the unique tenant identifier corresponds to a tenant-specific table name designated in the global-tenant table, and wherein the global-tenant table is shared across multiple machines; and

sending the modified request to the multi-tenant database using the database-specific protocol.

13. A proxy device for cross-tenant data leakage isolation in a multi-tenant database, the proxy device is communicatively connected between a server executing a cloud-based application and the multi-tenant database, comprising:

a processing circuitry; and

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the proxy device to;

monitor traffic flows between the server and the multi-tenant database;

capture at least a request to access the multi-tenant database, wherein the request is communicated using a database specific protocol;

analyze the request to determine if the request is illegitimate, wherein an illegitimate request is not addressed to a global-tenant table including records of individual database tables of tenants in the multi-tenant database;

modify the request to point to a global-tenant table and designate a condition with a unique tenant identifier having permissions to access the table identified in the received query, upon determination that the request is not legitimate, wherein the unique tenant identifier corresponds to the tenant-specific table name designated in the global-tenant table, and wherein the global-tenant table is shared across multiple machines; and

send the modified request to the multi-tenant database using the database specific protocol.

14. The proxy device of claim 13, wherein the proxy device is further configured to:

identify at least a query embedded in the request;

identify a type of a command of the query; and

determine whether the query affects the global-tenant database.

15. The proxy device of claim 14, wherein the proxy device is further configured to:

change a type of the query, upon determination that the query affects the global-tenant database.

16. The proxy device of claim 13, wherein the request is determined legitimate if the query embedded in the request is addressed to the global-tenant table and designates a unique tenant identifier of the global-tenant table as a condition.

17. The proxy device of claim 13, wherein the proxy device is further configured to:

capture at least a response from the multi-tenant database, wherein the response including returned data;

analyze the response to determine if the returned data relates to the global-tenant table;

modify the response to designate at least one tenant-specific table name that the returned data belongs to, upon determination that the returned data relates to the global-tenant table; and

send the modified response to the server.

18. The proxy device of claim 17, wherein the proxy device is further configured to:

determine at least a query embedded in a request corresponding to the captured request;

identify a type of a command of the query of the corresponding request; and

determine whether the command of the query of the corresponding request relates to the global-tenant database.

19. The proxy device of claim 13, wherein the proxy device is further configured to:

create the global-tenant table.

20. The proxy device of claim 13, wherein the proxy device is further configured to:

associate a unique tenant identifier with each individual database table of tenants of the multi-tenant database;

join all of the individual database tables of the tenants to create the global-tenant table; and

add, to the global-tenant table, a column designating a tenant identifier of the tenant associated with each individual database table.

21. The proxy device of claim 13, wherein the global-tenant table includes records of individual database tenant tables of tenants in the multi-tenant database, wherein the record of each individual database tenant table is associated with a unique tenant identifier of a respective tenant.

22. The proxy device of claim 13, wherein the proxy device is further configured to:

perform at least one optimization process to optimize performance of accessing and maintaining the global-tenant database.