Client identification for enforcing computer resource quotas

Patent metadata

Field	Value
Publication number	US-10063601-B2
Application number	US-201615076195-A
Country	US
Kind code	B2
Filing date	Mar 21, 2016
Priority date	Mar 21, 2016
Publication date	Aug 28, 2018
Grant date	Aug 28, 2018

Abstract

A system, method, and apparatus are provided for identifying clients or consumers of one or more controlled resources within a computing environment (e.g., a data center, a computing cluster). The resources may be controlled via the enforcement of quotas, wherein different clients have different quotas for the controlled resource(s). A client associated with a given call to a resource is identified using a tuple formed from identifiers of multiple services in the call stack, such as a first service (e.g., a front-end or user-facing service) and an immediate service (e.g., a final service in the stack prior to receipt of the call at a gateway, broker, or other entity that manages access to the controlled resources).

First claim

What is claimed is:

1. A method of enforcing quotas on a computing resource, the method comprising:
receiving, at a gateway controlling access to one or more resources, a call addressed to a first resource using identities of multiple services that processed the call prior to the gateway to identify a client associated with the call, including a first service and an immediate service; and
applying a quota associated with the first resource and the client to determine whether to forward the call to the first resource;
wherein the first service is an initial service that processes the call within a computing environment comprising the one or more resources; and
wherein the immediate service is a final service that processes the call within the computing environment, prior to receipt of the call by the gateway.

2. The method of claim 1 , wherein applying the quota comprises:
determining whether the client has exceeded the quota; and
when the client has not exceeded the quota, forwarding the call to the first resource.

3. The method of claim 2 , wherein applying the quota further comprises:
updating a measure of the client's use of the first resource.

4. The method of claim 1 , wherein:
the first service is a user-facing service.

5. The method of claim 1 , wherein at least one additional service within the computing environment processes the call between the first service and the immediate service.

6. The method of claim 1 , wherein the one or more resources include a database storing a graph of a social network.

7. An apparatus for enforcing quotas on a computing resource, the apparatus comprising:
at least one processor; and
memory storing instructions that, when executed by the at least one processor, cause the apparatus to:
receive, at a gateway controlling access to one or more resources, a call addressed to a first resource;
use identities of multiple services that processed the call prior to the gateway to identify a client associated with the call, including a first service and an immediate service; and
apply a quota associated with the first resource and the client to determine whether to forward the call to the first resource;
wherein the first service is an initial service that processes the call within a computing environment comprising the one or more resources; and

wherein the immediate service is a final service that processes the call within the computing environment, prior to receipt of the call by the gateway.

8. The apparatus of claim 7 , wherein applying the quota comprises:
determining whether the client has exceeded the quota; and
when the client has not exceeded the quota:
forwarding the call to the first resource; and
updating a measure of the client's use of the first resource.

9. The apparatus of claim 7 , wherein:
the first service is a user-facing service.

10. The apparatus of claim 7 , wherein at least one additional service within the computing environment processes the call between the first service and the immediate service.

11. A system for enforcing quotas on a computing resource, the system comprising:
a gateway module comprising a non-transitory computer readable medium storing instructions that, when executed, cause the system to receive, at a gateway controlling access to one or more resources, a call addressed to a first resource;
a client identification module comprising a non-transitory computer readable medium storing instructions that, when executed, cause the system to use identities of multiple services that processed the call prior to the gateway to identify a client associated with the call, including a first service and an immediate service; and
a quota module comprising a non-transitory computer readable medium storing instructions that, when executed, cause the system to apply a quota associated with the first resource and the client to determine whether to forward the call to the first resource;
wherein the first service is an initial service that processes the call within a computing environment comprising the one or more resources; and
wherein the immediate service is a final service that processes the call within the computing environment, prior to receipt of the call by the gateway.

12. The system of claim 11 , wherein applying the quota comprises:
determining whether the client has exceeded the quota; and
when the client has not exceeded the quota:
forwarding the call to the first resource; and
updating a measure of the client's use of the first resource.

13. The system of claim 11 , wherein:
the first service is a user-facing service.

14. The system of claim 11 , wherein at least one additional service within the computing environment processes the call between the first service and the immediate service.

15. The method of claim 1 , wherein at least one of the first service and the immediate service is not a general service.

16. The method of claim 1 , wherein the first service is a service internal to the computing environment.

17. The apparatus of claim 7 , wherein at least one of the first service and the immediate service is not a general service.

18. The apparatus of claim 7 , wherein the first service is a service internal to the computing environment.

19. The system of claim 11 , wherein at least one of the first service and the immediate service is not a general service.

20. The system of claim 11 , wherein the first service is a service internal to the computing environment.

Assignees

• Linkedin Corp
• Microsoft Technology Licensing Llc

Inventors

• Yu Yan
• Mcclean John A
• Miller Brent D
• Kreps Edward J

Classifications

• G06F21/31

  User authentication · CPC title

• H04L63/12

  Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32) · CPC title

• H04L47/78

  Architectures of resource allocation · CPC title

• H04L43/08

  Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters · CPC title

• H04L65/1096 Primary

  Supplementary features, e.g. call forwarding or call holding (systems providing special services or facilities to telephony subscribers H04M3/42) · CPC title