Permission architecture for remote management and capacity instances

Patent metadata

Field	Value
Publication number	US-10063537-B2
Application number	US-201514970773-A
Country	US
Kind code	B2
Filing date	Dec 16, 2015
Priority date	Dec 19, 2014
Publication date	Aug 28, 2018
Grant date	Aug 28, 2018

Abstract

When a user inputs an action request, such as a requested command, to be performed on a target machine, a management system receives the request and verifies it with a separate authentication and permission system. The authentication and permission system verifies signatures on the request and signs it and generates an approved workflow package. The approved workflow package is sent to the target machine.

First claim

What is claimed is:

1. A permission computing system, comprising:
a processor; and
memory storing instructions executable by the processor, wherein the instructions, when executed, configure the permission computing system to provide:
a signature verification engine configured to:
receive, from a remote multi-tenant management system, a signed user access request that is signed by a remote client system corresponding to a user, the user access request identifying the user and requesting access to a target resource on a target machine in a remote multi-tenant capacity system to perform a task on the target resource;
verify a first signature on the user access request as belonging to the multi-tenant management system and verify a second signature as belonging to the remote client system;

a set of user access accounts;
an approval requesting system configured to identify whether the user needs approval from another user to perform the task;
a role-based access control system configured to access the user access accounts and verify that the user is authorized to perform the task; and
a capability token service configured to:
based at least in part on the signature verification engine verifying the first and second signatures and the role-based access control system verifying that the user is authorized to perform the task,
sign the task with a service component signing certificate;
generate an approved task package indicating that the permission computing system has authorized the user to access the target resource on the target machine to perform the task; and
output the approved task package to an approved request queue in the remote multi-tenant management system.

2. The permission computing system of claim 1 wherein the remote client system signs the user access request with a user access signing certificate, and further comprising:
a certificate component configured to receive a request for a user access signing certificate and verify that the corresponding user is a member of a given group that is authorized to receive a user access signing certificate and, if so, return the user access signing certificate to the remote client system in response to the request for the user access signing certificate.

3. The permission computing system of claim 2 wherein the request for the user access signing certificate is encrypted with a key in a public/private key pair, and further comprising:
a key component configured to use at least one key in the public/private key pair to decrypt the request for the user access signing certificate.

4. The permission computing system of claim 2 and further comprising:
an identity management system configured to access user access accounts and server access accounts to identify group membership information, the certificate component configured to access the identity management system to determine whether the user corresponding to the remote client system is a member of the given group.

5. A computer implemented method, comprising:
receiving, at a permission computing system from a remote multi-tenant management system, a signed user access request that is signed by a remote client system corresponding to a user, the user access request identifying the user and requesting access to a target resource on a target machine in a remote multi-tenant capacity system to perform a task on the target resource;
verifying a first signature on the user access request as belonging to the multi-tenant management system;
verifying a second signature as belonging to the remote client system;
identifying whether the user needs approval from another user to perform the task;
accessing a user access account;
verifying that the user is authorized to perform the task based on the user access account; and
based at least in part on the verification of the first and second signatures and the verification that the user is authorized to perform the task,
signing the task with a service component signing certificate;
generating an approved task package indicating that the permission computing system has authorized the user to access the target resource on the target machine to perform the task; and
output the approved task package to an approved request queue in the remote multi-tenant management system.

6. The computer implemented method of claim 5 wherein the remote client system signs the user access request with a user access signing certificate, and further comprising:
receiving a request, from the remote client system, for a user access signing certificate;
verifying that the corresponding user is a member of a given group that is authorized to receive a user access signing certificate; and
if so, returning the user access signing certificate to the remote client system in response to the request for the user access signing certificate.

7. The computer implemented method of claim 6 wherein the request for the user access signing certificate is encrypted with a key in a public/private key pair, and further comprising:
using a key in the public/private key pair to decrypt the request for the user access signing certificate.

8. The computer implemented method of claim 7 wherein verifying that the corresponding user is a member of a given group comprises:
accessing user access accounts and server access accounts to identify group membership information, to determine whether the user corresponding to the remote client system is a member of the given group.

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Zhu Liqiang
• Dani Rajalakshmi

Classifications

• H04L63/126

  the source of the received data · CPC title

• H04L63/105

  Multiple levels of security · CPC title

• H04L63/104 Primary

  Grouping of entities · CPC title

• H04L63/102 Primary

  Entity profiles · CPC title

• H04L63/083 Primary

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title