multi-tenancy in private clouds

Cloud ComputingMulti-tenancy

Patrick Nicolashttp://patricknicolas.blogspot.comhttp://www.slideshare.net/pnicolas

https://github.com/prnicolasNov 7, 2007

Introduction

This presentation is an introduction to the different modes of deployment of multi-tenant application in the cloud, taking into account security, access control, scalability, performance and maintainability.

Elements of Multi-tenancy

There are 3 key elements to consider in deploying a multi-tenant SaaS that defines the degree of isolation in a cloud environment between tenants.• Access policies• Application deployment• Data access and privacy

Access policies

Proxies or web traffic managers are used to control access to cloud resources.

Client source

Users’ credentials

Targetresources

Externalcontenttenant

tenant

Application deployment options

They are several options for deploying application servers to support multiple concurrent tenants in a cloud environment

• Isolated business logic• Virtualized application servers• Shared virtual servers• Shared application servers

Isolated Business Logic

Each tenant accesses a dedicated physical server running a specific, customized business process (100% isolation)

tenant

Virtualization

Each tenant accesses an application server and database running on a dedicated virtual machine. Virtual machines may share the same underlying physical server.

tenant

Shared Virtualization

Each tenant accesses a dedicated application server with database running on a shared virtual machine.

tenant

Shared Application Server

Several tenants share the same application server running on the same virtualized environment. The execution of the business logic is done through dedicated thread or processed, providing limited isolation

tenant

Data: Deployment vs. Privacy

There are 5 configurations for deploying databases multi-tenant environment in a secure and private manner: • Dedicated hosts• Shared virtualized hosts• Dedicated database on shared hosts• Dedicated database instances on

shared databases• Shared Schema

Data on Dedicated Host

In this configuration the database resides in a dedicated server, providing tenant with a fully isolated data access

tenant

Data on Virtual Machine

The tenant accesses his/her data from separate databases running on a dedicated virtual machine but sharing a host.

tenant

Databases on Shared Virtualization

In this configuration the tenants access dedicated databases sharing the same virtual machine, with very limited isolation.

tenant

Shared Databases

The tenants manage their data residing on different tables within the same database instance. Although very cost effective for the cloud provider, this solution provides the customer with very limited privacy and isolation

tenant

Strategy

A cloud provider has to balance the different objectives, constraints when building a platform with resources shared among tenants:• Regulatory constraints• Data isolation• Maintenance costs• Schema extensibility• Business continuity and recovery• Liability regarding security

Costs vs. Data Privacy

It is obvious that greater application and data isolation increases deployment costs while sharing resources represents risks for data thief and loss

Data privacy risks

Dedicatedhost Database

on virtual machine

Databaseon shared

Shareddatabase

Design

The key requirements to build a first class, robust multi-tenant SaaS are• Data protection and liability• Scalability and costs• Customization and reusability• High availability

Mitigating Risks

The SaaS architect is responsible for setting up the defense perimeter to protect data from unintentional access or attack, for a configuration with a limited isolation. The toolbox should include• Filtering proxies (OAuth, NAT,

Reputation,..)• Access control lists (SAMM, Kerberos,

Identity management, …)• Cryptology

Data Distribution

The distribution of data is the most important factor in the scalability of a SaaS application that serve large amount of content. The most common techniques are• Dynamic provisioning• Partitioning• Sharding• Indexing• Caching

multi-tenancy in private clouds

Technology

continuous availability for private database clouds

openstack - powered private clouds

architecting scalable private clouds

deployment of private, hybrid & public clouds with...

architecting private and hybrid clouds - wordpress.com

private clouds will use hybrid infrastructure

sd-wan for public & private clouds - velocloud

build private clouds with proxmoxve distributive

redundant virtual private clouds

hybrid and private clouds -...

bonding your private network to salesforce clouds

private, hybrid and public clouds

gigaspaces – paas for public & private clouds

build clouds the way the world™s biggest public and...

public and private clouds - storage networking … and...

open source private clouds – eucalyptus

the evolution of private clouds

managing private and hybrid clouds for data … private and...

uncovering the security implications of cloud multi...

implementing private database clouds