Dynamic schema based multitenancy

Methods, computer program products, and systems are presented. The method computer program products, and systems can include, for instance: running an application on one or more computing node, the application providing user access to a database; receiving by the application registration data from a user for registering the user into a service; in response to the receiving the registration data from the user, generating a user schema that defines access rights of the user to the database, wherein the generated user schema includes a set of shared data structure objects instantiated in a storage system associated to the application, and a set of private data structure objects.

BACKGROUND

Embodiments herein relate generally to databases and specifically to schema for databases.

Databases can be defined by an organized collection of data accessed electronically from a computer system. Databases can have associated Database Management Systems (DBMS). Database data can be organized in a series of tables having rows and columns of data. Database tables, in turn, can include one or more index. An index can be provided by a data structure that improves access to a database table.

Structured Query Language (SQL) is a domain specific language used in programming data management in a Database Management System (DBMS). SQL statements can be used for the performance of various database operations, such as INSERT, UPDATE, SELECT, and DELETE query operations. INSERT operations can be used for performance of input of a record into a database table, SELECT operations can be used to retrieve data from a database table, UPDATE operations can be used for changing a value within a database table, and DELETE operations can be used for removal of data from a database table.

Data structures have been employed for improving operation of a computer system. A data structure refers to an organization of data in a computer environment for improved computer system operation. Data structure types include containers, lists, stacks, queues, tables, and graphs. Data structures have been employed for improved computer system operation e.g. in terms of algorithm efficiency, memory usage efficiency, maintainability, and reliability.

Artificial intelligence (AI) refers to intelligence exhibited by machines. AI research includes search and mathematical optimization, neural networks, and probability. AI solutions involve features derived from research in a variety of different science and technology disciplines ranging from computer science, mathematics, psychology, linguistics, statistics, and neuroscience. Machine learning has been described as the field of study that gives computers the ability to learn without being explicitly programmed.

SUMMARY

Shortcomings of the prior art are overcome, and additional advantages are provided, through the provision, in one aspect, of a method. The method can include, for example: generating a user schema that defines access rights of the user to a database, wherein the user schema resulting from the generating includes a set of shared data structure objects instantiated in a storage system associated to an application and a set of private data structure objects; determining that a query invoked by the user on the database is a query for modification of a certain data structure object that has a current status of shared according to the user schema; and in response to the determining that the query invoked by the user on the database is a query for modification of a certain data structure object that has a current status of shared according to the user schema, updating the user schema, wherein the updating the user schema includes replicating the certain data structure object from the set of shared data structure objects into the set of private data structure objects so that the certain data structure object is provided as a storage system instantiated data structure object of the set of private data structure objects, wherein the replicating is performed so that the certain data structure object remains as a storage system instantiated data structure object of the set of shared data structure objects.

Shortcomings of the prior art are overcome, and additional advantages are provided, through the provision, in one aspect, of a method. The method can include, for example: running an application on one or more computing node, the application providing user access to a database; receiving, by the application, registration data from a user for registering the user into a service; in response to the receiving the registration data from the user, generating a user schema that defines access rights of the user to the database, wherein the generated user schema includes a set of shared data structure objects instantiated in a storage system associated to the application, and a set of private data structure objects; determining that a query invoked by the user on the database is a query for modification of certain data structure object that has a current status of shared according to the user schema; and in response to the determining that the query invoked by the user on the database is a query for modification of a certain data structure object that has a current status of shared according to the user schema, updating the user schema, wherein the updating the user schema includes replicating the certain data structure object from the set of shared data structure objects into the set of private data structure objects so that the certain data structure object is provided as a storage system instantiated data structure object of the set of private data structure objects.

In another aspect, a computer program product can be provided. The computer program product can include a computer readable storage medium readable by one or more processing circuit and storing instructions for execution by one or more processor for performing a method. The method can include, for example: running an application on one or more computing node, the application providing user access to a database; receiving, by the application, registration data from a user for registering the user into a service; in response to the receiving the registration data from the user, generating a user schema that defines access rights of the user to the database, wherein the generated user schema includes a set of shared data structure objects instantiated in a storage system associated to the application, and a set of private data structure objects; determining that a query invoked by the user on the database is a query for modification of certain data structure object that has a current status of shared according to the user schema; and in response to the determining that the query invoked by the user on the database is a query for modification of a certain data structure object that has a current status of shared according to the user schema, updating the user schema, wherein the updating the user schema includes replicating the certain data structure object from the set of shared data structure objects into the set of private data structure objects so that the certain data structure object is provided as a storage system instantiated data structure object of the set of private data structure objects.

In a further aspect, a system can be provided. The system can include, for example, a memory. In addition, the system can include one or more processor in communication with the memory. Further, the system can include program instructions executable by the one or more processor via the memory to perform a method. The method can include, for example: running an application on one or more computing node, the application providing user access to a database; receiving, by the application, registration data from a user for registering the user into a service; in response to the receiving the registration data from the user, generating a user schema that defines access rights of the user to the database, wherein the generated user schema includes a set of shared data structure objects instantiated in a storage system associated to the application, and a set of private data structure objects; determining that a query invoked by the user on the database is a query for modification of certain data structure object that has a current status of shared according to the user schema; and in response to the determining that the query invoked by the user on the database is a query for modification of a certain data structure object that has a current status of shared according to the user schema, updating the user schema, wherein the updating the user schema includes replicating the certain data structure object from the set of shared data structure objects into the set of private data structure objects so that the certain data structure object is provided as a storage system instantiated data structure object of the set of private data structure objects.

Shortcomings of the prior art are overcome, and additional advantages are provided, through the provision, in one aspect, of a method. The method can include, for example: running an application on one or more computing node, the application providing user access to a database; receiving, by the application, registration data from a user for registering the user into a service; generating a user schema that defines access rights of the user to the database, wherein the user schema resulting from the generating includes a set of shared data structure objects instantiated in a storage system associated to the application, and a set of private data structure objects; determining that a query invoked by the user on the database satisfies a condition; and in response to the determining that the query invoked by the user on the database satisfies the condition, updating the user schema.

Additional features are realized through the techniques set forth herein. Other embodiments and aspects, including but not limited to methods, computer program product and system, are described in detail herein and are considered a part of the claimed invention.

DETAILED DESCRIPTION

System100for providing database multitenancy is illustrated inFIG.1. System100can include computing environment140, hosting application270for providing access to database248, and user equipment (UE) devices120A-120Z. UE devices120A-120Z can be in communication with computing environment140via network180. Network180can be a physical network and/or a virtual network. A physical network can be, for example, a physical telecommunications network connecting numerous computing nodes or systems, such as computer servers and computer clients. A virtual network can, for example, combine numerous physical networks or parts thereof into a logical virtual network. In another example, numerous virtual networks can be defined over a single physical network.

System100can employ a schema based multitenancy architecture for defining access rights of users to database248stored in storage system240of computing environment140. Embodiments herein recognize that existing schema based multitenancy architectures can include requirements for extensive replications of database data structure objects which can consume computing resources including processing availability or processor and storage as made available by storage system240. For reduced consumption of computing resources, embodiments herein provide dynamic schema for a user defining access rights of a user to database data structure objects. Embodiments herein recognize that there is a common scenario where users register for service and perform no further interactions or essentially no further interactions with the database after an initial registration and enrollment. Embodiments herein provide for reduced consumption of computing resources in all scenarios including the described common scenario of users who are inactive after initial registration.

Each of the different UE devices120A-120Z can be associated to a different user. Regarding one or more client computer device120A-120Z, a computer device of one or more UE device120A-120Z, in one embodiment, can be a computing node device provided by a client computer, e.g., a mobile device, a smartphone or tablet, a laptop, smartwatch or personal computer that runs one or more program, e.g., a web browser for opening and viewing web pages.

Computing environment140can include a plurality of computing nodes10, which can be provided by physical computing nodes. The respective computing nodes10can have software running thereon defining computing node stacks10A-10Z. Software defining the respective instances of computing node stacks10A-10Z can be differentiated between the computing node stacks, e.g. some stacks can provide traditional bare metal machine operation, other stacks can include a hypervisor that supports a plurality of guest operating systems (OS) defining respective guest hypervisor based virtual machines (VMs), other stacks can include container based VMs, e g running on top of a hypervisor based VM or running on a computing node stack that is absent of a hypervisor. A plurality of different configurations are possible.

Computing environment140, in addition to having computing node stacks10A-10Z, can include a manager that runs an availability management process. The manager running an availability management process can adjust a hosting configuration for a given application to achieve a specified Service Level Agreement (SLA) requirement. The manager running an availability management process can adjust an availability rating for a given application, e.g., by migrating the application to a different computing node stack of computing environment140, adding instances of the application, and/or subtracting instances of application.

Referring to further aspects of computing environment140, computing environment140can include storage system240. Storage system240can include storage devices242A-242Z, which can be provided by physical storage devices. Physical storage devices of storage system240can include associated controllers. Storage devices242A-242Z can be provided, e.g., by hard disks and Solid-State Storage Devices (SSDs). Storage system240can be in communication with computing node stacks10A-10Z by way of a Storage Area Network (SAN) and/or a Network Attached Storage (NAS) link. Storage system240can be a shared storage system that is associated to application270for storing database248and to a plurality of additional nodes and applications. Storage system240, in one embodiment, can be a dedicated storage system associated to application270for storing database248.

According to one embodiment, computing environment140can include fibre channel network170providing communication between respective computing node stacks10A-10Z and storage system240. Fibre channel network170can include a physical fibre channel that runs the fibre channel protocol to define a SAN. NAS access to storage system240can be provided by computing environment network280, which can be an IP based network. A computing environment manager can be in communication with computing node stacks10A-10Z, by way of computing environment network280.

Computing environment140can be configured to provide cloud computing services. Computing environment140can be provided, e.g., by one or more data center. Application270is shown as being hosted by computing node stack10Z having a particular hosting configuration for illustrative purposes. However, it is understood that application270can be migrated to a different computing node stack or that the particular provisioning of computing node stack10Z can be dynamically changed and further instances of application270can be increased or decreased. In the particular computing node stack10Z, application270runs on a guest OS260defining a hypervisor based VM. The hypervisor based VM can run on hypervisor250, and hypervisor250in turn can runs on computing node10. Computing node10can be provided by physical computing node.

Application270can run various processes including registration process1701, database management process1702, and services process1703. Application270running registration process1701can facilitate registration and enrollment of users as registered users of system100and database248.

Application270running database management process1702can perform various functions. The various functions can include e.g. data storage, retrieval, and updating a data dictionary which data dictionary can describe and specifying schema for access of database data structure objects. Application270running database management process1702can further perform such functions as supporting transactions and concurrency, facilitating database recovery operations, enforcing constraints, supporting analysis utilities, and supporting interactions within application interface (API).

Application270running services process1703can adapt application270for a particular service, e.g., online trip reservation service, subscription service, banking or other financial service, retail service, membership service, benefits service, insurance service, social media service, and the like. Services process1703can, for example, process incoming user defined data and identify user invoked database queries based on the user defined data. Services process1703can further, e.g., adapt returned output data into a user accessible form. Returned output data can be output into a user interface of a UE device of UE devices120A-120Z.

Database248can include, e.g., data structure objects1481, data dictionary1482, and DBMS1483. Data structure objects1481can include, e.g., tables, indexes, sequences, and views. Data dictionary1482can define various schema such as including user schema. A schema can include a collection of logical structures of data or schema data structure objects. A certain user's schema can be owned by the certain user to define the certain user's access rights to data in database248and, according to one embodiment, can have a name in common with the name of the certain user. A user schema of a certain user as specified in data dictionary1482can specify that certain user's ownership and access rights to data structure objects of data structure objects1481within database248.

Database248can include database management system (DBMS)1483. DBMS1483can run database management process1702to provide the functions set forth in reference to database management process1702. According to a schema based multitenancy architecture, respective users of a database can have associated thereto respective database schema. In a schema based multitenancy architecture, isolation between users can be achieved by the providing each user an individually owned schema. Embodiments herein recognize isolation advantages associated with a schema based multitenancy architecture but also recognize limitations with implementations of schema based multitenancy architectures. Embodiments herein recognize that implementation of schema based multitenancy architectures can result in excessive computing resources consumption. Embodiments herein recognize that a schema based multitenancy architecture can result in replication of database data structure objects with the onboarding of new users that exceeds predefined limits of available database software support packages. Embodiments herein recognize that a schema based multitenancy architecture, in the case of multiple onboarding events where new users are onboarded, can result in a storage capacity of storage system240being exceeded.

Database248described in logical form in connection with data structure objects1481, data dictionary1482, and DBMS1483can be stored within storage system240of computing environment140or can be distributed amongst storage systems of a plurality of computing environments140. Embodiments herein recognize that existing schema based multitenancy architectures can include requirements for extensive replications of database data structure objects which can consume computing resources including processing availability or processor and storage as made available by storage system240. For reduced consumption of computing resources, embodiments herein provide dynamic schema for a user defining access rights of a user to database data structure objects. Database management process1702can dynamically update a user's schema during the course of deployment of database248.

Embodiments herein can include, on receiving registration data from a certain user, assigning to the certain user a user schema that defines ownership and access rights to (a) a plurality of shared data structure objects that are shared by users of system100other than the certain user and (b) zero or more storage system instantiated private data structure objects that are accessible selectively and only by the certain user.

Through the course of deployment of a database248, database management process1702run by DBMS1483can update any certain user's assigned schema in dependence on database queries invoked by the certain user. According to one embodiment, system100can be configured so that for support of updating of a certain user's schema in dependence on a user invoked query, database management process1702can replicate a data structure object from the shared data structure objects having a data structure object name value associated to the query for inclusion as a storage system instantiated private data structure object of a private data structure object set of the certain user. According to the updated schema of the certain user, access to data of a data structure object having a name value according to the replicated data structure object, subsequent to the schema update, can be through the replicated storage system instantiated data structure object made part of storage system instantiated data structure objects of the certain user's set of private data structure objects.

There is set forth herein, according to one embodiment, running application270on one or more computing node, the application providing user access to a database; receiving, by the application270, registration data from the user for registering the user into a service; in response to the receiving the registration data, assigning a user schema that defines access rights of the user to the database, wherein the user schema includes set of shared data structure objects and set of private data structure objects; determining that a query invoked by the user on the database is a query for modification of certain data structure object that has a current status of shared according to the user's schema; and in response to the determining that the query invoked by the user on the database is a query for modification of certain data structure object that has a current status of shared according to the user's schema, updating the user's schema, wherein the updating the user's schema includes replicating the certain data structure object from the set of shared data structure objects into the set of private data structure objects.

Further description of user's schema management by database management process1702is described in reference toFIGS.2A-2C.FIG.2Aillustrates assigned user schema of first and second users, A and B, at time t0.FIG.2Billustrates assigned user schema at time t0+1 for a first user and a second user, A and B, andFIG.2Cillustrates assigned schema for first and second users, A and B, at time t=t0+2.

Referring toFIG.2A,FIG.2Acan refer to the situation where user A and user B are registered and enrolled at a common time, and time t0illustrates a time of registration and enrollment for a first user, user A, and a second user, user B. At a time of registration and enrollment, database management process1702, on registration of a user, can assign respective user's schema to user A and user B, respectively. The assigned schema assigned to the first user and the second user can define access rights to data structure objects of set of shared data structure objects2201instantiated in storage system240that are shared amongst a plurality of users of database248and can define access rights to set of private data structure objects comprising zero or more storage system instantiated private data structure objects that are selectively accessible by the one user to whom the schema pertains.

Referring toFIG.2A, database management process1702at time t=t0can assign for the first user, user A, a schema defining access rights for the first user to data structure objects of set of shared data structure objects2201instantiated in storage system240and access rights to zero storage system instantiated data structure objects that are included in set of private data structure objects2202A at time t0. The assigned schema for the second user, user B, can define for the second user, user B, access to data structure objects of set of shared data structure objects2201and access to one data structure object of set of private data structure objects2202B associated to the second user. The data structure objects of set of shared data structure objects2201instantiated in storage system240can include, e.g., a plurality of tables. The plurality of shared data structure objects, e.g., plurality of shared tables, can be shared amongst a plurality of users, e.g., user A, user B, as well as one or more additional users of system100and database248. The shared data structure objects, e.g., shared tables, can be shared amongst users by way of their being made accessible to a plurality of users in accordance with assigned schema assigned to the respective users of the plurality of users.

The set of private data structure objects2202A associated to the assigned schema for user A at time t=t0can include the described example zero storage system instantiated data structure objects that consume storage locations of storage system240. The assigned set of private data structure objects2202B assigned to user B at time t=t0in the described example ofFIG.2Acan include, e.g., a single storage system instantiated data structure object, such as table2021. This single storage system instantiated table can include e.g. a table for storing registration data, e.g., name, address, social medial account data, user configuration data, permissions data, and the like. Such a table for storing registration data can be regarded to be an enrollment table.

Referring now toFIG.2B,FIG.2Billustrates a state of respective schema associated to user A and user B at a time after time t=t0, namely time t=t0+1.

Database management process1702can be configured so that respective data structure objects defining data structure objects of set of shared data structure objects2201instantiated in storage system240can be assigned name values that specify a logical order of the data structure object, e.g., table in a set of tables defining the data structure objects of set of shared data structure objects220. Database management process1702can further be configured so that when database management process1702replicates a data structure object from set of shared data structure objects2201instantiated in storage system240for inclusion in a set of zero or more data structure objects of private data structure objects associated to a certain user, the replicated data structure object is assigned a common name value with the name value of the data structure object subject to replication from the data structure objects of set of shared data structure objects2201instantiated in storage system240. Thus, every data structure object of set of shared data structure objects2201can include a name value, and every data structure object of set of private data structure objects2202A and2202B, whether logically assigned and uninstantiated or instantiated in storage system240, can have a name value that maps to a name value of set of shared data structure objects2201. Database management process1702can assign name values to data structure objects with use of a name value convention so that a shared object when replicated into a set of shared objects associated to a user retains a name value thereof, e.g., including in some instances a name value differentiated from a data structure object name value of the set of shared database objects by a suffix, prefix, or other metadata.

At time t=t0+1 as depicted inFIG.2B, both the first user, user A, and the second user, user B, have invoked database modification queries associated to one or more certain data structure object set of shared data structure objects2201instantiated in storage system240. Referring toFIG.2B, database management process1702, as a result of user A invoking a database modification query associated to table2011of data structure objects of set of shared data structure objects2201instantiated in storage system240, can replicate the2011so that the set of private data structure objects2202B defining user A's schema includes the replicated table2011now instantiated into storage system240. Database management process1702can assign the instance of table2011replicated into set of private data structure objects2202A a table name value in common with the name value of the instance of table2011instantiated as part of set of shared data structure objects2201. Further referring toFIG.2B, the second user, user B, prior to time t=t0+1 and after time t=t0has invoked a database modification query associated to table2022of set of shared data structure objects2201instantiated in storage system240. As a result of the database modification query having been invoked, database management process1702can replicate the table2022of set of shared data structure objects2201instantiated in storage system240so that the set of private data structure objects2202B associated to and defining the schema of user B now includes the replicated table2022instantiated in storage system240. Referring toFIG.2B, according to the scenario described, the schema of user A can include set of shared data structure objects2201instantiated in storage system240which, from the perspective of the first user, user A, now minus table2011and set of private data structure objects2202A which now includes table2011instantiated in storage system240.

At time t=t0+1, the updated schema assigned to user B can now define access rights to data structure objects of shared data structure objects2201instantiated in storage system240which, from the perspective of user B, are now absent of table2022and the set of private data structure objects2202B associated to user B's schema can include table2021which can be provided as an enrollment table and table2022replicated from set of shared data structure objects2201. Embodiments herein will recognize that replicated table2021and replicated table2022instantiated as part of set of private data structure objects2202B within storage system240can persist as part of set of shared data structure objects2201instantiated in storage system240that are shared amongst a plurality of users who use database248which users can include users other than user A and user B, e.g., user C through user Z.

Referring toFIG.2C,FIG.2Cillustrates states of schema owned by user A and user B at time t=t0+2. Between time t=t0+1 and t=t0+2, each of user A and user B may have invoked respective queries on database248. However, whereas the database query invoked by user A was a modification query, the database operation invoked by user B was not a modification query, e.g., was only a read-only database operation such as a SELECT query in SQL. In such a situation referred to inFIG.2C, database management process1702can dynamically adjust the schema for user A to a new state while maintaining the schema for user B in the state depicted as of time t=t0+1. Between time t=t0+1 and time t=t0+2, user A in the described scenario has invoked the modification query associated to table2012of set of shared data structure objects2201instantiated in storage system240.

As a result of the invoked modification query identified by database management process1702, database management process1702can replicate table2012of set of shared data structure objects2201instantiated in storage system240so that the set of storage system instantiated private data structure objects2202A associated to the schema for user A now includes third table2012instantiated in storage system240replicated from third table2012included within set of shared data structure objects2201instantiated in storage system240. The set of storage system instantiated private data structure objects2202B defining the private schema of user B are unchanged at the time t=t0+2 relative to time t=t0+1 due to the fact that the invoked query of user B was not a modification query.

Regarding the use case depicted in reference toFIG.2A-2C, database management process1702, for generation of a user A schema, assigns zero storage system instantiated private data structure objects instantiated in storage system240within set of private data structure objects2202A on registration and enrollment for generation of a user B schema assigns one instantiated data structure object instantiated in storage system240within set of private data structure objects2202B, namely table2021, which can be an enrollment table, on registration of user B into system100as a registered user of database248. The use case depicted inFIG.2A-2Ccan occur and be employed, e.g., where the differentiation between schemas is useful for differentiating between rights associated to different classes of users of database248. In another embodiment, database management process1702, on registration of each user, can assign a schema for the respective user set of private data structure objects that includes zero storage system instantiated private data structure objects (an empty set) as depicted by set of instantiated data structure objects2202A for user at time t=t0. In another embodiment, database management process1702, on registration and enrollment for each respective user, can generate a user schema for each user wherein the set of private data structure objects2202A,2202B for each respective user includes at least one storage system instantiated private data structure object instantiated in storage system240.

In the embodiment ofFIG.2A-2C, database management process1702dynamically updates the user schema on a gradual data structure object by data structure object basis. According to the embodiment ofFIG.2A-2C, a user invoked database modification query associated to a certain data structure object of set of shared data structure objects2201instantiated in storage system240by a certain user can trigger replication of the certain shared data structure object set of shared data structure objects2201instantiated in storage system240to the certain user's private data structure object set2202A,2202B as an instantiated data structure object instantiated in storage system240.

In the embodiment ofFIG.3A-3C, a user invoked database modification query associated to a certain data structure object of set of shared data structure objects2201can trigger replication of a plurality of data structure objects of shared data structure objects of set of shared data structure objects2201instantiated in storage system240into a set zero or more storage system instantiated private data structure objects of the user.

Referring toFIG.3A, time t=t0can refer to a registration and enrollment time at which user A and user B register into system100. At time t0in the embodiment ofFIG.3A, database management process1702can generate user schema for respective users A and B. The generated schema for the respective users can define access rights to data structure objects of set of shared data structure objects2201instantiated in storage system240and access rights to zero instantiated data structure objects of set of private data structure objects2202A and2202B (an empty set of uninstantiated private data structure objects is initially assigned in the embodiment ofFIG.3A-3B).

At time t=t0+1 in the scenario depicted inFIG.3B, each of user A and user B have invoked database queries of database248except that for user A the database query was a database modification query and for user B the database query was a read-only query. In the scenario described with reference toFIG.3B, database management process1702at time t=t0+1 has updated the schema for user A responsively to the database modification query invoked by user A associated to a certain data structure object so that set of private data structure objects2202A for user A include a plurality of storage system instantiated data structure objects instantiated in storage system240. For providing the plurality of data structure objects, database management process1702can replicate the plurality of data structure objects from set of shared data structure objects2021into set of private data structure objects2202A as storage system instantiated data structure objects. In one embodiment, database management process1702, in response to identifying a database modification query invoked by a certain user associated to a certain data structure object of set of shared data structure objects2201instantiated in storage system240, can replicate all data structure objects of set of shared data structure objects2201into set of private data structure objects2202A of user A as storage system instantiated data structure objects of set of private data structure objects2202A instantiated in storage system240.

At time t=t0+1 depicted inFIG.3B, the schema for user B remains in a state as depicted on registration at time t=t0; that is, comprises data structure objects of set of shared data structure objects2201instantiated in storage system240and zero storage system instantiated data structure objects of set of private data structure objects2202B indicating that for user B at time t=t0+1, access to database248by user B is through set of shared data structure objects2201instantiated in storage system240provided new incoming queries are non-modification queries.

Further referring to the scenario depicted inFIG.3A-3C,FIG.3A-3Cdepicts the scenario wherein before time t=t0+2 (FIG.3C) and after time t=t0+1 (FIG.3B) user B has invoked a database modification query associated to a certain data structure object of set of shared data structure objects2201instantiated in storage system240. In response to identification of the invoked modification query associated to a certain data structure object of set of shared data structure objects2201instantiated in storage system240, database management process1702can update the user schema for user B as depicted inFIG.3C.

In the scenario described with reference toFIG.3C, database management process1702at time t=t0+2 has updated the schema for user B responsively to the database modification query invoked by user B associated to a certain data structure object so that set of private data structure objects2202B for user A includes a plurality of storage system instantiated data structure objects. For providing the plurality of data structure objects, database management process1702can replicate the plurality of data structure objects from set of shared data structure objects2021into set of private data structure objects2202A as storage system instantiated data structure objects. In one embodiment, database management process1702in response to identifying a database modification query invoked by a certain user associated to a certain data structure object of set of shared data structure objects2201instantiated in storage system240, can replicate all data structure objects of set of shared data structure objects2201into set of private data structure objects2202B of user B. Any subsequent queries on database248invoked by user B can be performed on data structure objects of set of private data structure objects2202B.

Referring further toFIG.3C, the schema for other users, e.g., users of users C through Z, can continue to be defined by set of shared data structure objects2201instantiated in storage system240so that non-modification database queries invoked by users who have not previously invoked database modification queries will be performed on data structure objects of set of shared data structure objects2201instantiated in storage system240. The embodiments ofFIGS.2A-3Ccan reduce reads on data structure objects of set of shared data structure objects2201instantiated in storage system240subsequent to an initial modification query associated to a shared database data structure object. Embodiments herein can reduce storage requirements for storing database data structure objects as well as processing requirements associated with replication of database data structure objects.

The embodiments ofFIGS.2A-3Ccan avoid reads on one or more data structure object of set of shared data structure objects2201instantiated in storage system240subsequent to an initial modification query associated to a shared database data structure object, thus providing isolation between users. Embodiments herein can reduce storage system storage requirements for storing database data structure objects and can also reduce processing requirements associated with replication of database data structure objects.

A method for performance by application270interoperating with database248, UE device120A, and UE device120B is described in connection with the flowchart ofFIG.4. At block1201, UE device120A can be sending registration data for receipt by application270registration data can be user-defined registration data defined by a user who is using UE device120A. The registration data can be registration data specifying a request by the UE device120A to become a registered customer user of the service provided by application270. Registration data can include, e.g., contact information specifying contacts of a user, e.g., name, address, social media account data, and the like, permissions data, and preferences data. In response to the receipt of registration data sent at block1201, application270at block2701can generate the schema for user A of user UE device120A.

The generated schema can define the user's access rights to data of database248. As described in connection withFIG.2A-3C, generated schema for a user on registration and enrollment can include a set of shared data structure objects defined by a set of storage system instantiated shared data structure objects and a set of private data structure objects that comprises zero or more storage system instantiated private data structure objects.

In response to the receipt of registration data sent at block1201, application270, by database management process1702at block2701, can generate a schema that defines data structure object access rights of the user A using UE device120A. Generated schema for the user A using UE device120A generated at block2701can include data structure objects of set of shared data structure objects2201instantiated in storage system240and set of private data structure objects2202A,2202B as described in connection withFIG.2A-3Cwhich comprises registration and enrollment of zero or more storage system instantiated data structure objects.

Data structure objects of set of shared data structure objects2201instantiated in storage system240can be made accessible to other users of database248through respective schemas assigned to those other users by database management process1702. Storage system instantiated private data structure objects of set of private data structure objects2202A,2202B instantiated in storage system240can be made accessible only to the single user to which a generated schema is associated.

Application270at block2702can send data specifying the generated schema generated at block2701to data dictionary1482of database248, which data dictionary can be updated at block2481.

At block1211, UE device120B can send registration data for receipt by application270. The registration data sent at block1211can be user defined registration data defined by user B using UE device120B.

In response to receipt of registration data from user B, application270by database management process1702can generate the user schema for the user B using UE device120B. Generated schema generated on enrollment and registration of user B as a registered user of system100and database248can include data structure objects of set of shared data structure objects2201instantiated in storage system240and set of private data structure objects2202B as described in connection withFIG.2A-3C. The combination of storage system instantiated shared data structure objects and zero or more storage system instantiated private data structure objects define the user ownership and access rights in database248. The set of shared data structure objects2201instantiated in storage system240can be accessible by other users of database248. Any storage system instantiated data structure objects of the set of private data structure objects defining a user schema, according to one embodiment, cannot be accessed by other users of database248and can be accessed only by user B of the UE device120B.

According to one embodiment, in response to the generate schema block2703, application270can proceed to block2704. At block2704, application270can send data to data dictionary1482of database248specifying the new schema generated for user B at block2703. Database248can responsively update data dictionary1482at block2482.

After registration, user A of UE device120A and user B of UE device120B as well as other users can be engaged in sessions in which the users use database248. The users of respective UE devices120A-120Z can invoke queries on database248. For invoking a query, the user of the UE device can send user defined data and application270can responsively identify a user invoked database query. User invoked database queries can include modification database queries (DELETE, CHANGE) and non-modification, e.g., read-only queries (SELECT, READ). A user invoked query on database248can be a modification query which modifies data of the database248or alternatively can be a non-modification query on database248, which does not result in data of a data structure object being modified. Examples of modification queries can include DELETE, CHANGE. Examples of non-modification queries can include SELECT for read only operations in SQL. System100can be configured so that database management process1702can dynamically update a certain user schema associated to a certain user during the course of deployment of database248. For updating the certain user schema, database management process1702can dynamically replicate one or more data structure object within set of shared data structure objects2201instantiated in storage system240for inclusion as one more storage system instantiated data structure object of a set of private data structure objects of the user.

For dynamically updating a user schema during the course of deployment of database248, database management process1702, in response to a condition being satisfied, can dynamically increase a number of storage system instantiated data structure objects within set of private data structure objects of a user schema instantiated in storage system240. For increasing a number of storage system instantiated private data structure objects within set of private data structure objects of a user schema, database management process1702can replicate a data structure object from set of shared data structure objects2201instantiated in storage system240for inclusion in storage system instantiated private data structure objects included in set of private data structure objects of the user schema. The condition triggering a schema update can be the condition that the user has invoked a modification query associated to data structure object of set of shared data structure objects2201having a name value currently absent from storage system instantiated data structure objects of the user's set of private data structure objects.

In reference to the flowchart ofFIG.4, UE device120A and UE device120B can be engaged in user sessions at block1202and1212. At block1202, UE device120A can be sending user defined data to application270. In response to the user defined data, application270, by database management process1702, can identify the database query at block2705. The database query can be modification query, such as a DELETE query, or the database query can be a non-modification query, such as a READ query. Further, the query can be associated to certain data structure object such as a certain table. The query can be associated to a table having a certain table name value according to one embodiment.

With reference toFIG.2A-3C, tables that are replicated from set of shared data structure objects2201instantiated in storage system240to set of private data structure objects of respective users of database248can retain their table name values when they are replicated. Referring further to the flowchart ofFIG.4, UE device120B at block1212can be sending user defined data to application270to invoke a database query. In response to the user defined data received by application270, application270by database management process1702can identify the query at block2706. As with the query generated at block2705, the query can be, e.g., a modification query or a non-modification query. The query can be associated to a table name value which can be identified by application270.

Database management process1702can be configured so that respective tables of set of shared data structure objects2201instantiated in storage system240can be assigned name values that specify a logical order of the table in a set of tables defining the data structure objects of set of shared data structure objects220. Database management process1702can further be configured so that when database management process1702replicates a table from set of shared data structure objects2201instantiated in storage system240for inclusion as a storage system instantiated data structure objects of set of private data structure objects associated to a certain user, the replicated data structure object is assigned a common name value with the name value of the table subject to replication from the data structure objects of set of shared data structure objects2201. Thus, every table of set of shared data structure objects2201instantiated in storage system240can include a name value, and every data structure object of set of private data structure objects2202A and2202B, whether instantiated in storage system240or uninstantiated in storage system240, can map to a name value of set of shared data structure objects2201instantiated in storage system240.

In response to completion of block2706, application270can proceed to examination block2707to examine any incoming identified queries such as the identified queries identified at blocks2705and2706. At examination block2707and action decision block2708, application270can determine whether to update a schema for a user.

For performance of examining block2707, database management process1702using a control data structure as is shown in Table A.

Referring to Table A, the control data structure of Table A can include three columns: a user identifier column, a data structure object order identifier column, and a shared/private status column. The user identifier column specifies the user identifier for users of database248, the data structure object order identifier column specifies a data structure object order identifier, and the shared/private status column specifies a current status of a data structure object identified by the data structure object identifier. The status of status=shared can indicate that for a given user's schema, the named data structure object is included within set of shared data structure objects2201. The status of private can indicate that for the given user's schema, the named data structure object is a storage system instantiated data structure object included within set of private data structure objects for the given user.

At “generate schema” blocks2701and2703, database management process1702, on registration of a new user to database248, can initialize new rows for the user in the control data structure of Table A in accordance with the assigned schema for the user. The initial row value for Table A for a user can specify the controls described herein for the t=t0(on registration and enrollment), as set forth in connection with the examples ofFIGS.2A and3A. There can be zero initial listed storage system instantiated private data structure objects for user A in the data structure object relational mapping decision data structure of Table A on registration and enrollment in the case of user A described with reference toFIG.2A. There can be one initial listed storage system instantiated private data structure objects for user B in the control data structure of Table A on registration and enrollment in the case of user B described with reference toFIG.2A. There can be zero initial listed storage system instantiated private data structure objects for user A in the control data structure of Table A on registration and enrollment in the case of user A described with reference toFIG.3A. There can be zero initial listed storage system instantiated private data structure objects for user B in the control data structure of Table A on registration and enrollment in the case of user B described with reference toFIG.3A.

For performance of examination block2707, database management process1702can with the identification of a database query ascertain the user identifier type and data structure object name value of the query, and can look up the status of the data structure object name value from the control data structure of Table A. Based on the current status of the data structure object name value being status=shared and the query type being a modification query type, application270can update the schema of the user.

According to one embodiment, system100can be configured so that database management process1702updates the currency schema for a certain user in response to the determination that an invoked query invoked by the certain user is a modification query and further in response to the determination by the examination of the control data structure of Table A that the invoked query invoked by the user is associated to a data structure object having a data structure object order with a current shared/private status as status=shared.

Based on the described configuration, system100can update the schema for a user for increased isolation on the detecting that a user has invoked a modification query involving modification of data within the database data structure object of database248. The described design iteratively evolves for increased isolation and security in dependence on a user's use of the database.

According to one embodiment, system100can be configured so that database management process1702updates schema for a certain user in response to the determination that an invoked query invoked by the certain user is a modification query and that the invoked query invoked by the user is associated to a data structure object having a data structure object name value having a current status of status=shared. System100can update a user's schema for increased isolation on the detecting that a user has invoked a query involving modification of data within the database data structure object of database248. The described design iteratively evolves for increased isolation and security in dependence on user's use of the database.

On completion of block2707, database management process1702can proceed to block2708. At block2708, database management process1702can return an action decision based on the examining performed at block2707. The returned action decision returned at block2708can include updating the user schema in the case that (a) the user has invoked a query that is a modification query and (b) the invoked modification query is associated to a data structure object name value having a current status of status=shared in the shared/private status column of the control data structure of Table A.

At action decision block2708, database management process1702can update both the schemas of user A and user B in the case that (a) the queries generated at block2705and2706that were invoked by user A and user B, respectively, were modification database queries and (b) the data structure object having a data structure object name value associated to the queries were determined to have a status=shared based on lookup using the control data structure of Table A.

For updating a schema of user A and user B, database management process1702can replicate a storage system instantiated data structure object, e.g. a table from set of shared data structure objects2201associated to an identified modification query into a set of private data structure objects2202A,2202B as a storage system instantiated table within a set of private data structure objects2202A,2202B instantiated in storage system240and can update the control data structure of Table A so that the shared/private status of the shared/private status column associated to the replicated data structure object is changed from status=shared to status=private.

So that the control data structure of Table A reflects the change status determined at block2708, database management process1702can, at block2709, send update data to data dictionary1482of database248so that schema data for users whose schema has been updated is appropriately changed. Database248can responsively update data dictionary1482at block2484. According to one embodiment, an instance of the control data structure of Table A which specifies data of respective schema of various users can be stored in data dictionary1482.

In response to completion of block2709, database management process1702can proceed to block2710. At block2710, application270by database management process1702processes queries identified at block2705and2706so that a database action specified by the query is taken. For processing a query to perform an action of the query, database management process1702can examine the shared/private status column of the control data structure of Table A to determine a current storage system location of a data structure object having a certain data structure object name value associated to the query. Where the shared/private status of the certain data structure object name value is status=shared, the data structure object associated to a query being processed is an instantiated data structure object of set of shared data structure objects2201instantiated in storage system240. Where the shared/private status of the certain data structure object name value is status=private the data structure object associated to a query being processed is an instantiated data structure object of set of private data structure objects2202A or2202B instantiated in storage system240associated to the user invoking the query.

For processing of a query invoked by a user, database management process1702can use the control data structure of Table A to determine the data structure object status (shared or private) for performing the action of the received query. In the case that the control data structure of Table A specifies that a data structure object name value associated to query has the status of status=shared, database management process1702can perform the action of the query using a table data structure object within set of shared data structure objects2201instantiated in storage system240. In the case that the control data structure of Table A specifies that a data structure object name value associated to a query has the status of status=private, database management process1702can perform the action of the query using a storage system instantiated table data structure object within set of private data structure objects2202A or2202B instantiated in storage system240.

Processing of the database query invoked by a user can involve providing responsive feedback to user, e.g., in the form of user interface visualization as determined by specific attributes of services process1703run by application270. Accordingly, in some embodiments, application270at blocks2711and/or2712can send responsive webpage data for presentment, respectively, on a display of UE device120A and/or UE device120B. The responsive webpage data can include data values obtained from database248and/or data generated in dependence on such data values.

At block2713, application270can determine whether a deployment period for database248has expired. If database248is still deployed, application270can return to a processing stage prior to block2705to iteratively identify and process the new queries invoked by users of database248, such as users respectively associated UE devices120A-120Z.

It can be seen that during the course of deployment of database248, database management process1702can dynamically update schemas associated to various users of the database248. For example, according to the described features, database management process1702can dynamically update schemas for active users of the database248, i.e., those who actively modify data within data structure objects by way of invoking modification queries. Active users can have assigned thereto updated schemas having associated newly replicated table data structure objects replicated from set of shared data structure objects to define storage system instantiated private tables of the users not accessible by other users and highly isolated from other users for increased security. Database management process1702can avoid updating schemas and extending instantiated objects of a set of private data structure objects for inactive users, i.e., those that do not invoke modification database queries on database248after registration. Accordingly, database management process1702can update schema to extend a set of storage system instantiated private data structure objects defining the schema selectively for active users.

At return block2714, application270can wait for redeployment of database248, such as by way of deployment of the next instance of database248. UE devices120A,120B (as well as other users) can iteratively perform sending as indicated by send block1202and send block1212in order to invoke new queries on database248for the time that a session of UE device and the user associated to it is active (decision blocks1203and1213). On closing of a session, UE device120A at return block1204and UE device120B at return block1214can return to a stage prior to block1202or1212in order to wait for a new session of UE device120B to be initiated by its user.

Further description of features herein is provided in reference toFIGS.5A-5C. On user registration and account formation for user A, database management process1702can assign to user A the schema as shown inFIG.5A. The schema for user A can include set of shared data structure objects2201instantiated in storage system240shared by other users and set of private data structure objects2202A. The set of private data structure objects2202A on registration can include logically assigned private data structure objects which have not been instantiated in storage system240but which are logically assigned by way of database management process1702being configured to be capable of creating the data structure objects in storage system240in response to satisfaction of a condition. In the state depicted inFIG.5A, set of shared data structure objects2201instantiated in storage system240can include tables T1, T2, T3, and set of private data structure objects2202B can include logically assigned tables T1, T2, and T3which have not been instantiated in storage system240but which have the capacity to be instantiated in storage system240. Tables T1, T2, and T3of set of private data structure objects2202B in the uninstantiated state depicted inFIG.5Acan be regarded to be empty tables. The respective name values of tables T1, T2, T3of set of private data structure objects2202A can map to the respective name values of storage system instantiated tables T1, T2, T3of set of shared data structure objects2201instantiated in storage system240.

In this case depicted inFIG.5A, application270by database management process1702can assign set of private data structure objects2202A based on set of shared data structure objects2201instantiated in storage system240but with empty tables that are not instantiated in storage system240. For user read-only actions (SELECT query, listing some data), set of shared data structure objects2201instantiated in storage system240can be used. When it comes to data modification, application270can instantiate in storage system240and fill in just those tables that the user wants to modify on a per data structure object basis as depicted inFIGS.2A-2CandFIG.5Bor on the identification of a first modification query can instantiate in storage system240and fill in multiple, e.g., all the empty tables in the set of private data structure objects2202A, with data from the set of shared data structure objects (lazy approach), as depicted inFIGS.3A-3CandFIG.5C.

According to one embodiment, one or more object of set of shared data structure objects2201can be configured as an immutable read only table. An example of a read only table is a “roles” table with a predefined set of permissions for users. By configuration of set of shared data structure objects2201so that a certain object is immutable, the certain object from the perspective the user schema of all users of database248will remain part of set of shared data structure objects2201through the registration and enrollment period of each respective user and the deployment period of database248. Selectively configuring one or more shared object as an immutable shared object conserves computing resources by restricting object replication. In an embodiment of the “lazy approach” described herein wherein a first modification query invoked by a certain user results in multiple data structure objects from set of shared data structure objects2201being replicated for storage system instantiation into a set of private data structure objects, database management process1702, in response to identification of user invoked modification query modified by a certain user, can replicate all objects from set of shared data structure objects2201for storage system instantiation into a set of private data structure objects of the user, except for the one or more immutable shared object.

Embodiments herein recognize that applications are commonly designed to be used by multiple users at the same time. In many cases, such multi-tenant products store their data in relational databases using schema based multitenancy architecture. Embodiments herein recognize that when a user signs up, for example, at a social media website, a schema with many table data structure objects can be instantiated. Embodiments herein recognize that, in addition to users actively using the service and constantly modifying their data, there are users that just instantiate their account and stop using the website. As a result, the product database can contain schema table data structure objects that are filled with the same initial default for every user.

According to one embodiment, database248can be provided by a relational database. Where database248is provided by a relational database, queries identified at block2705and block2706by application270by database management process1702can be relational database queries, e.g., SQL queries. According to one embodiment, database248can be provided by object relational database (ORD). An ORD can include certain features associated to a relational database and certain features associated to an object oriented database. An object relational database (ORD) can feature object-relational mapping (ORM). ORM can provide for converting data between incompatible type systems using object-oriented programming languages. Database248can include ORM caching features to increase performance through localized data access. ORM caching features can include object oriented object caching features and data caching features.

Where database248is provided by an object relational database (ORD) that uses object relational mapping (ORM), queries identified by database management process1702at block2705and block2706can include user invoked object oriented language queries as well as user invoked relational database queries that are generated based on the object oriented language queries. Object oriented language queries can include, e.g., object query language (OQL) queries. Relational database queries can include, e.g., SQL queries. With use of ORM, database management process1702can generate data definition language (DDL) statements to define user invoked relational database queries, e.g., SQL queries, in dependence on the object oriented language queries. At examine block2707, application270by database management process1702can be examining the generated relational database, e.g., SQL, queries. The examining of generated relational database queries can include examining of the relational database queries for ascertaining of a database structure object associated to a query, and query type (e.g., modification query, non-modification query). With use of ORM, relational database queries can be generated based on object oriented language queries. At examine block2707, application270can be making multiple queries of control tables, e.g., including the decision data structure of Table A as indicated by receive and respond block2483.

There is set forth herein running an application270on one or more computing node, the application providing user access to a database248; receiving, by the application, registration data from a user for registering the user into a service; in response to the receiving the registration data from the user, generating a user schema that defines access rights of the user to the database, wherein the generated user schema includes a set of shared data structure objects instantiated in a storage system associated to the application, and a set of private data structure objects; determining that a query invoked by the user on the database248is a query for modification of certain data structure object that has a current status of shared according to the user's schema; and in response to the determining that the query invoked by the user on the database248is a query for modification of a certain data structure object that has a current status of shared according to the user's schema, updating the user's schema, wherein the updating the user's schema includes replicating the certain data structure object from the set of shared data structure objects into the set of private data structure objects so that the certain data structure object is provided as a storage system instantiated data structure object of the set of private data structure objects.

There is further set forth herein, according to one embodiment, a method wherein the database248is configured as an ORD having a relational database, and wherein the determining that the query invoked by the user on the database is a query for modification of the certain data structure object that has a current status of shared according to the user's schema, includes identifying an object oriented language query, generating a relational database query in dependence on the object oriented language query, and examining the generated relational database query for a reference to the certain data structure object.

According to one example, the Ruby On Rails (Active Record) platform can support handing of an object oriented language query as set forth in Table B.

By way of ORM binding object oriented objects to data structure objects of database248, the object oriented language query of Table B can generate a DDL statement to define a relational database query to result in creation of a new row in a name=‘items’ table within database248with the value “Some name” set in the ‘name’ column of the new row.

With use of an ORD, object oriented objects can be provided for storage of data of users. Classes can provide definitions (written using object orient programming language) for the data and object oriented objects can provide instances of the classes. Classes can include e.g. procedures and variables. A User class using object oriented Java programming language can be provided as shown in Table C.

When a certain user (end user) registers to create an account, database management process1702can create for the certain user a User data structure object, i.e., one instance of the User class, in order to hold data of the real user. For storage of the user data into relational database data structure objects, e.g., tables, application270by database management process1702can persist the user data using ORM. ORM can map the described User class to a table or tables inside the database248. ORM can automatically persist a user object oriented object to the data structure objects, e.g., tables, in database248. According to one embodiment, ORM can be implemented using Java Persistence API (JPA). In order to implement ORM using JPA, developers can add special annotations to mark their classes so that ORM knows that a certain object oriented object is to be persisted. With use of appropriate annotations, an ORM framework like JPA can automatically provide data definition language (DDL) statements to define relational database queries, e.g., in SQL language for execution on database248in order to create tables, insert data, etc.

The @Multitenant annotation of JPA can be used to mark certain classes so that the certain classes are mapped to objects of set of shared data structure objects2201. The @Multitenant annotation of JPA can specify that a given entity is shared amongst multiple tenants of an application. The @Multitenant annotation can be employed to specify how data for these entities is to be stored on database248for each tenant. Multitenancy can be specified at the entity or mapped superclass level.

Presented below in Table D is an example of @Multitenant annotation usage according to one embodiment.

Referring to Table D, when the Item (String name) constructor or setName method are invoked (for example, when an application user instantiates some data to invoke an object-oriented query), application270by database management process1702can generate a DDL statement to define a relational database modification query to modify the table object of set of shared data structure objects2201having the name value of name=‘name_1’ value. Using one of the described scenarios above (i.e., per object replication or multi-object replication), database management process1702, in response to the modification query, can replicate the shared table object with the name value of name=‘name_1’ into set of private data structure objects of the user for instantiation into storage system240. Further actions (UPDATE, DELETE) will occur on the new private object in accordance with the updated schema.

As set forth in connection withFIGS.2A-2C and5B, schema updates can be performed on a per object basis, or on a multi-object basis as described in connection withFIGS.3A-3CandFIG.5C. In another aspect, set of shared data structure objects2201can be configured so that one or more object of set of shared data structure objects2201is immutable and is restricted from being subject to modification by a relational database, e.g., SQL, query. According to one embodiment, one or more object of set of shared data structure objects2201can be configured as an immutable read only table. An example of a read only table is a “roles” table with a predefined set of permissions for users. By configuration of set of shared data structure objects2201so that a certain object is immutable, the certain object from the perspective the user schema of all users of database248will remain part of set of shared data structure objects2201through the registration period of each respective user and the deployment period of database248. Selectively configuring one or more shared object as an immutable shared object conserves computing resources by restricting object replication. According to one embodiment, the @Immutable annotation of JPA can be used for configuring objects of a set of shared objects2201as immutable shared objects.

Embodiments herein can dynamically increase a level of isolation defined by a user's schema in dependence on a user's use of database248. For example, as a user invokes queries that modify data of database248, database management process1702can replicate one or more storage system instantiated data structure object of set of shared data structure objects2201for storage system instantiation into set of private data structure objects of the user.

Configuring database248as an ORD that uses ORM can provide additional data security advantages. In an SQL injection attack, malicious SQL statements can be inserted into an entry field for execution, e.g., to return the database contents to the attacker. An attacker with an SQL injection attack can, e.g., tamper with existing data, change balances, void transactions, destroy the data, or make it otherwise unavailable. With ORM mapping, the set of SQL queries that can interact with a relational database can be restricted by the ORM framework, which ORM framework can translate object oriented language queries invoked by a user into SQL queries invoked by the user. With use of ORM mapping, user invoked SQL queries can be generated at an ORM framework layer rather than at an application layer accessible by an adversary user

By the ORM framework functioning to restrict the set of SQL queries that can interact with a relational database table object, the ORM framework can prevent a user from launching an SQL injection attack. With SQL queries limited by the ORM framework, there is less burden on a system software developer to design and test execution code for prevention of SQL injections.

A system of one or more computers can be configured to perform particular operations or actions by virtue of having software, firmware, hardware, or a combination of them installed on the system that in operation causes or cause the system to perform the actions. One or more computer programs can be configured to perform particular operations or actions by virtue of including instructions that, when executed by data processing apparatus, cause the apparatus to perform the actions. One general aspect includes. The computer implemented method also includes running an application on one or more computing node, the application providing user access to a database; receiving, by the application, registration data from a user for registering the user into a service; generating a user schema that defines access rights of the user to the database, where the user schema resulting from the generating includes a set of shared data structure objects instantiated in a storage system associated to the application and a set of private data structure objects; determining that a query invoked by the user on the database is a query for modification of certain data structure object that has a current status of shared according to the user schema; and in response to the determining that the query invoked by the user on the database is a query for modification of a certain data structure object that has a current status of shared according to the user schema, updating the user schema, where the updating the user schema includes replicating the certain data structure object from the set of shared data structure objects into the set of private data structure objects so that the certain data structure object is provided as a storage system instantiated data structure object of the set of private data structure objects. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the methods.

Implementations may include one or more of the following features. The computer implemented method where the updating the user schema in response to the determining includes replicating a plurality of instantiated data structure objects from the set of shared data structure objects into the set of private data structure objects so that the plurality of instantiated data structure objects are provided as a storage system instantiated data structure object of the set of private data structure objects. The updating the user schema in response to the determining includes replicating an entirety of storage system instantiated data structure objects from the set of shared data structure objects into the set of private data structure objects so that the entirety of storage system instantiated data structure objects are provided as a storage system instantiated data structure objects of the set of private data structure objects. The determining that a query invoked by the user on the database is a query for modification of certain data structure object that has a current status of shared according to the user schema includes using a decision data structure that associates data structure object name values and users to a status value that specifies whether access by the user to the data structure object is through a shared data structure object set or through a private data structure object set. The determining that a query invoked by the user on the database is a query for modification of certain data structure object that has a current status of shared according to the user schema includes using a decision data structure that associates data structure object name values and users to a status value that specifies whether access by the user to the data structure object is through a shared data structure object set or through a private data structure object set. The generating includes logically assigning the set of private data structure objects in response to the receiving, by the application, the registration data so that on registration of the user, the set of private data structure objects may include of a set of empty data structure objects that are not instantiated in a storage system associated to the application. The generating is performed in response to the receiving, by the application, the registration data. The updating the user schema includes in response to the determining replicating a plurality of storage system instantiated tables from the set of shared data structure objects so that the plurality of storage system instantiated tables are provided as storage system instantiated tables of the set of private data structure objects. The database is configured as an object relational database (ORD) having a relational database that uses object relational mapping (ORM) to bind object oriented objects to data structure objects of the relational database included in the database. The database is configured as an object relational database (ORD) having a relational database, and where the determining that the query invoked by the user on the database is a query for modification the certain data structure object that has a current status of shared according to the user schema, includes identifying an object oriented language query, generating a relational database query in dependence on the object oriented language query, and examining the generated relational database query for a reference to the certain data structure object. The database is configured as an object relational database (ORD) that uses object relational mapping (ORM) to bind object oriented objects to data structure objects of a relational database, and where an ORM framework of the ORD restricts a set of SQL queries that can interact with the relational database. The database is configured as an object relational database (ORD) that uses object relational mapping (ORM) to bind object oriented objects to data structure objects of a relational database, and where an ORM framework of the ORD restricts a set of SQL queries that can interact with the relational database. The method includes processing a user invoked query using a decision data structure that associates data structure object name values and users to a status value that specifies whether access by the user to the data structure object is through a shared data structure object set or through a private data structure object set, where the processing the user invoked query includes determining that the user invoked query is a non-modification query associated to a particular data structure object that has a current status of shared according to the user schema, and responsively reading data from the particular data structure object within the set of shared data structure objects. The set of shared data structure objects instantiated in the storage system includes at least one immutable shared data structure object that is restricted from being replicated into the set of private data structure objects as a storage system instantiated object. The set of shared data structure objects instantiated in the storage system includes at least one immutable shared data structure object that is restricted from being replicated into the set of private data structure objects as a storage system instantiated object, where the updating the user schema in response to the determining includes replicating a plurality of instantiated data structure objects other than the at least one immutable shared data structure object from the set of shared data structure objects into the set of private data structure objects so that the plurality of instantiated data structure objects are provided as a storage system instantiated data structure object of the set of private data structure objects. The method includes in response to the receiving the registration data from the user, generating the user schema that defines access rights of the user to the database so that the set of private data structure objects of the user schema on registration of the user includes zero storage system instantiated private data structure objects. The method includes in response to the receiving the registration data from the user, generating the user schema that defines access rights of the user to the database so that the set of private data structure objects of the user schema on registration of the user includes at least one storage system instantiated private data structure object, where the method includes, in response to receiving the registration data from a second user, generating a second user schema that defines access rights of the second user to the database, where the generated user schema of the second user includes a set of shared data structure objects instantiated in a storage system associated to the application, and a set of private data structure objects that may include at least one storage system instantiated private data structure object. The method includes in response to the receiving the registration data from the user, generating the user schema that defines access rights of the user to the database so that the set of private data structure objects of the user schema on registration of the user includes zero storage system instantiated private data structure object, where the method includes, in response to receiving the registration data from a second user, generating a second user schema that defines access rights of the second user to the database, where the generated user schema of the second user includes a set of shared data structure objects instantiated in a storage system associated to the application, and a set of private data structure objects that may include at least one storage system instantiated private data structure object. Implementations of the described techniques may include hardware, a method or process, or computer software on a computer-accessible medium.

One general aspect includes a computer readable storage medium readable by one or more processing circuit and storing instructions for execution by one or more processor for performing. The computer program product also includes running an application on one or more computing node, the application providing user access to a database; receiving by the application registration data from a user for registering the user into a service; in response to the receiving the registration data from the user, generating a user schema that defines access rights of the user to the database, where the generated user schema includes a set of shared data structure objects instantiated in a storage system associated to the application, and a set of private data structure objects; determining that a query invoked by the user on the database is a query for modification of certain data structure object that has a current status of shared according to the user's schema; and in response to the determining that the query invoked by the user on the database is a query for modification of a certain data structure object that has a current status of shared according to the user's schema, updating the user's schema, where the updating the user's schema includes replicating the certain data structure object from the set of shared data structure objects into the set of private data structure objects so that the certain data structure object is provided as a storage system instantiated data structure object of the set of private data structure objects. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the methods.

One general aspect includes a system including: a memory; at least one processor in communication with the memory; and program instructions executable by one or more processor via the memory to perform a method may include running an application on one or more computing node, the application providing user access to a database; receiving by the application registration data from a user for registering the user into a service; in response to the receiving the registration data from the user, generating a user schema that defines access rights of the user to the database, where the generated user schema includes a set of shared data structure objects instantiated in a storage system associated to the application, and a set of private data structure objects; determining that a query invoked by the user on the database is a query for modification of certain data structure object that has a current status of shared according to the user's schema; and in response to the determining that the query invoked by the user on the database is a query for modification of a certain data structure object that has a current status of shared according to the user's schema, updating the user's schema, where the updating the user's schema includes replicating the certain data structure object from the set of shared data structure objects into the set of private data structure objects so that the certain data structure object is provided as a storage system instantiated data structure object of the set of private data structure objects. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the methods.

Certain embodiments herein may offer various technical computing advantages involving computing advantages to address problems arising in the realm of computer networks. Embodiments herein can dynamically update a user schema during the course of deployment of a database. Embodiments herein, in response to a condition being satisfied, for increased isolation and data security, can dynamically increase a number of storage system instantiated data structure objects within a set of private data structure objects defining a user's schema. Embodiments herein can dynamically replicate one or more data structure object within a set of shared data structure objects instantiated in a storage system for instantiation of the one or more data structure objects into set of private data structure objects of the user. Embodiments herein recognize isolation advantages associated with a schema based multitenancy architecture as well as challenges associated with implementations of schema based multitenancy architectures. Embodiments herein recognize that implementations of schema based multitenancy architectures can result in excessive storage system instantiations of database data structure objects. Excessive data structure object instantiations can significantly consume processing and storage computing resources and predefined data structure object limits specified in a database software support package supporting a database can readily be violated. Embodiments herein can avoid excessive instantiations of data structure objects in a schema based multitenant architecture. Embodiments herein, in response to an invoked query invoked by a user satisfying a condition, can dynamically increase, for increased isolation and data security, a number of instantiated objects, e.g., tables within set of private data structure objects defining a user schema. With use of ORM, the set of relational database queries, e.g., SQL queries that can interact with a relational database can be restricted by the ORM framework, which ORM framework can translate object oriented language queries invoked by a user into SQL queries invoked by the user. With use of ORM mapping, SQL queries can be generated at an ORM framework layer rather than at an application layer accessible by an adversary user. By way of the ORM framework functioning to restrict the set of SQL queries that can interact with a relational database table object, the ORM framework can prevent a malicious user from launching an SQL injection attack.

FIGS.6-8depict various aspects of computing, including a computer system and cloud computing, in accordance with one or more aspects set forth herein.

Characteristics are as follows:

Service Models are as follows:

Deployment Models are as follows:

Referring now toFIG.6, a schematic of an example of a computing node is shown. Computing node10is only one example of a computing node suitable for use as a cloud computing node and is not intended to suggest any limitation as to the scope of use or functionality of embodiments of the invention described herein. Regardless, computing node10is capable of being implemented and/or performing any of the functionality set forth hereinabove. Computing node10can be implemented as a cloud computing node in a cloud computing environment, or can be implemented as a computing node in a computing environment other than a cloud computing environment.

Computer system12may be described in the general context of computer system-executable instructions, such as program processes, being executed by a computer system. Generally, program processes may include routines, programs, data structure objects, components, logic, data structures, and so on that perform particular tasks or implement particular abstract data types. Computer system12may be practiced in distributed cloud computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed cloud computing environment, program processes may be located in both local and remote computer system storage media including memory storage devices.

As shown inFIG.6, computer system12in computing node10is shown in the form of a computing device. The components of computer system12may include, but are not limited to, one or more processor16, a system memory28, and a bus18that couples various system components including system memory28to processor16. In one embodiment, computing node10is a computing node of a non-cloud computing environment. In one embodiment, computing node10is a computing node of a cloud computing environment as set forth herein in connection withFIGS.7-8.

One or more program40, having a set (at least one) of program processes42, may be stored in memory28by way of example, and not limitation, as well as an operating system, one or more application programs, other program processes, and program data. One or more program40including program processes42can generally carry out the functions set forth herein. In one embodiment, manager system110can include one or more computing node10and can include one or more program40for performing functions described with functions described with reference to application270as set forth in the flowchart ofFIG.4. In one embodiment, one or more user equipment device can include one or more computing node10and can include one or more program40for performing functions described with reference to one or more user equipment device120A-120Z as set forth in the flowchart ofFIG.4. In one embodiment, the computing node based systems and devices depicted inFIG.1can include one or more program for performing functions described with reference to such computing node based systems and devices.

Computer system12may also communicate with one or more external devices14such as a keyboard, a pointing device, a display24, etc.; one or more devices that enable a user to interact with computer system12; and/or any devices (e.g., network card, modem, etc.) that enable computer system12to communicate with one or more other computing devices. Such communication can occur via Input/Output (I/O) interfaces22. Still yet, computer system12can communicate with one or more networks such as a local area network (LAN), a general wide area network (WAN), and/or a public network (e.g., the Internet) via network adapter20. As depicted, network adapter20communicates with the other components of computer system12via bus18. It should be understood that although not shown, other hardware and/or software components could be used in conjunction with computer system12. Examples, include, but are not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archival storage systems, etc. In addition to or in place of having external devices14and display24, which can be configured to provide user interface functionality, computing node10in one embodiment can include display25connected to bus18. In one embodiment, display25can be configured as a touch screen display and can be configured to provide user interface functionality, e.g. can facilitate virtual keyboard functionality and input of total data. Computer system12in one embodiment can also include one or more sensor device27connected to bus18. One or more sensor device27can alternatively be connected through I/O interface(s)22. One or more sensor device27can include a Global Positioning Sensor (GPS) device in one embodiment and can be configured to provide a location of computing node10. In one embodiment, one or more sensor device27can alternatively or in addition include, e.g., one or more of a camera, a gyroscope, a temperature sensor, a humidity sensor, a pulse sensor, a blood pressure (bp) sensor or an audio input device. Computer system12can include one or more network adapter20. InFIG.7computing node10is described as being implemented in a cloud computing environment and accordingly is referred to as a cloud computing node in the context ofFIG.7.

Referring now toFIG.8, a set of functional abstraction layers provided by cloud computing environment50(FIG.7) is shown. It should be understood in advance that the components, layers, and functions shown inFIG.8are intended to be illustrative only and embodiments of the invention are not limited thereto. As depicted, the following layers and corresponding functions are provided:

It is contemplated that numerical values, as well as other values that are recited herein are modified by the term “about”, whether expressly stated or inherently derived by the discussion of the present disclosure. As used herein, the term “about” defines the numerical boundaries of the modified values so as to include, but not be limited to, tolerances and values up to, and including the numerical value so modified. That is, numerical values can include the actual value that is expressly stated, as well as other values that are, or can be, the decimal, fractional, or other multiple of the actual value indicated, and/or described in the disclosure.