Multi-tenant agile database connector

• US 8,326,876 B1
• Filed: 03/05/2012
• Issued: 12/04/2012
• Est. Priority Date: 09/23/2011
• Status: Active Grant

• Current Assignee: Corent Technology, Inc.
• Original Assignee: Corent Technology, Inc.
• Inventors: Venkataraman, S, Oliver, Michael, Prabu P, Jeya Anantha, Syed, Shafiullah, Chate, R Scott
• Primary Examiner(s): Jalil, Neveen Abel
• Assistant Examiner(s): TORGRIMSON, TYLER J
• Application Number:
  US13/412,150
• Time in Patent Office: 274 Days
• Field of Search: None
• US Class Current: 707/784
• CPC Class Codes: G06F 16/13 File access structures, e.g. distributed indices arrangements of input from, or output to, record carriers G06F3/06
• CPC Class Codes: G06F 16/252 between a Database Management System and a front-end application

Abstract

A module provides an interface between a multi-tenant database and a non-tenant-specific application instance such that the application instance sends data access commands to the module as if it is communicating with a single-tenant database. The module translates the non-tenant-specific data access command from the non-tenant-aware application into a multi-tenant data access command, as needed, without needing to alter the non-tenant specific application instance in any way. In this manner, a single-tenant application could be used by multiple tenants in a multi-tenant environment.

Claims

1. A computer implemented system usable by first and second tenants, comprising:

a memory; and

a processor coupled to the memory, wherein the processor is configured to implement;

at least one non-tenant aware data repository;

a non-tenant aware application;

a data collection module; and

an interface module logically disposed between the non-tenant aware application and the at least one data repository, such that the non-tenant aware application is configured to operate in a tenant-aware fashion that accommodates first and second applications invoked by the first and second tenants, respectively, at one time, without requiring modification of either the non-tenant aware data repository or the non-tenant aware application, comprising;

a first input that receives a non-tenant-specific data access command from the non-tenant aware application installed on a computer system while the application is invoked by the first tenant;

a second input that receives a unique identifier associated with the tenant from a non-application source;

a handler that authorizes, through an authorization, whether the non-tenant-specific data access command is translated to a tenant-specific data access command;

a translator that, upon receipt of the authorization from the handler, translates the non-tenant-specific data access command into the tenant-specific data access command that accesses a first subset of data within the data repository accessible by the data collection module installed on the computer system, wherein the subset of data is associated with the unique identifier of the first tenant; and

a first output that transmits at least one of the non-tenant-specific data access command and the tenant-specific data access command to the data collection module as a function of the authorization from the handler,

wherein the data collection module that upon receipt of the output of the tenant-specific data access command from the interface module, sends the tenant-specific data access command to the at least one data repository, and returns a resulting data set from the at least one data repository to the non-tenant aware application, such that each of the tenants accesses only data to which that tenant is authorized.

2. The system of claim 1, wherein the first output sends the tenant-specific data access command to a standard database connector logically coupled with the data repository and the interface module.

3. The system of claim 2, wherein the standard database connector is selected from the group consisting of an ODBC driver, a JDBC driver, and an ADOdb driver.

4. The system of claim 1, wherein the data collection module accesses a device that collects real-time data to execute the tenant-specific data access command.

5. The system of claim 1, wherein the tenant-specific data access command comprises a first command and a second command, wherein the data collection module executes the first command on a first data repository and executes the second command on at least one of the first data repository and a second data repository.

6. The system of claim 1, wherein the translator accesses a security access lookup table to determine a tenant-accessible set of data sources, and ensures that the first subset of data composes the tenant-accessible set of data sources.

7. The system of claim 6, wherein the tenant-accessible set of data sources is accessible only to the tenant.

8. The system of claim 6, wherein the security access lookup table provides the tenant access to a subset of databases within the data repository.

9. The system of claim 6, wherein the security access lookup table provides the tenant access to a subset of table entries within the data repository.

10. The system of claim 1, wherein the translator parses the non-tenant-specific data access command before the step of translation.

11. The system of claim 1, wherein the translator optimizes the tenant-specific data access command in accordance with an algorithm specific to a type of the data repository.

12. The system of claim 1, wherein the translator optimizes the tenant-specific data access command in accordance with an algorithm specific to the application.

13. The system of claim 1, wherein a second subset of data is associated with a second unique identifier of the second tenant and a third subset of data is associated with a third unique identifier of a third tenant.

14. The system of claim 13, wherein the first portion of the subset of data and the second portion of the subset of data are non-overlapping.

15. The system of claim 1, further comprising:

a third input that receives a second non-tenant-specific data access command from the application while the application is invoked by the second tenant;

a fourth input that receives a second unique identifier associated with the second tenant from the non-application source;

wherein the handler authorizes whether the second non-tenant-specific data access command is translated to a second tenant-specific data access command;

wherein the translator, upon a second authorization from the handler, translates the second non-tenant-specific data access command into the second tenant-specific data access command that accesses a second subset of data within the data repository, wherein the second subset of data is specifically associated with the second unique identifier of the second tenant; and

a second output that transmits either the second non-tenant-specific data access command or the tenant-specific data access command to the data collection module as a function of the second authorization from the handler.

16. The system of claim 1, wherein the tenant-specific data access command comprises a security certificate that is specific to the tenant.

17. The system of claim 1, wherein the application sends an encryption key to the data repository to translate encrypted data sent between the application and the data repository.

18. The system of claim 17, wherein the non-tenant-specific data access command does not contain the encryption key.

19. The system of claim 1, wherein the tenant-specific data access command comprises an encryption key that encrypts an unencrypted data into encrypted data before writing the encrypted data to the first subset of data.

20. The system of claim 1, further comprising a second output that returns a result set of the tenant-specific data access command to the application.