Patent ID: 9723009
Date: 2017-08-01
CPC Classifications: H04L

Claim:
1. A method for providing network security in a multi-tenant environment, the method comprising: configuring a connection-based switched fabric of the multi-tenant environment to have a database access partition accessible to a plurality of database service consumers and accessible to a plurality of database servers which provide a plurality of database services wherein each of the plurality of database services utilizes data associated with a plurality of different tenants, the data being held in a plurality of storage cells; configuring the connection-based switched fabric of the multi-tenant environment to have a storage access partition accessible to a plurality of said plurality of database servers and accessible to a plurality of storage cells, but not accessible to said plurality of database service consumers, wherein each of the plurality of database services utilizes the data associated with the plurality of different tenants held in the plurality of storage cells; securely configuring a network interface controller of each of the plurality of application servers to associate each of the plurality of database service consumers hosted on said application server in association with the plurality of different tenants with a unique database service consumer identity, such that each of the plurality of database service consumers cannot modify or spoof the unique database service identity associated with said each of the plurality of database service consumers; configuring the network interface controller of each of the plurality of application servers to include the database service consumer identity associated with each of the plurality of database service consumers hosted on said application server in each communication packet transmitted from said database service consumer towards said plurality of database services; providing an access control list to each of the plurality of database servers, wherein the access control list identifies said plurality of database services and identifies for each of said plurality of database services one or more database service consumer identities associated with one or more database service consumers allowed to access said each of said plurality of database services; discarding with a network interface of each of the plurality of database servers all communication packets received from said plurality of application servers which do not include a database service consumer identity; and using said access control list in combination with a database service consumer identity included in a communication packet received at a network interface of a database server of the plurality of database servers to prevent access of the database consumer associated with the database consumer identity to a database service of said plurality of database services unless said access control list identifies said database service consumer as allowed to access said database service.