Cross cloud tenant discovery

Patent metadata

Field	Value
Publication number	US-10469479-B2
Application number	US-201715621993-A
Country	US
Kind code	B2
Filing date	Jun 13, 2017
Priority date	Jun 13, 2017
Publication date	Nov 5, 2019
Grant date	Nov 5, 2019

Abstract

A computer-implemented method for a security endpoint of a non-isolated computing environment includes receiving a request related to a non-isolated application. The method includes querying a directory service according to a domain name of a user specified in the request. The directory service stores a mapping between domain names and computing environments, including isolated computing environments and the non-isolated computing environment. The method includes receiving, from the directory service, an indication of a first computing environment. The method includes generating and sending a response to allow the user to be authenticated to the application. In response to the first computing environment being the non-isolated computing environments, the response indicates that the user belongs to the non-isolated computing environment. In response to the first computing environment being one of the isolated computing environments, the response indicates that the user does not belong to the non-isolated computing environment.

First claim

The invention claimed is:

1. A computer-implemented method for a security endpoint of a non-isolated public cloud computing environment that permits data access in accordance with a non-isolated scope, the method comprising:
receiving a request related to an application, wherein the application operates in the non-isolated public cloud computing environment, and wherein the request identifies a domain name of a user;
in response to receiving the request, querying a directory service according to the domain name of the user, wherein the directory service stores a mapping between a plurality of domain names and a plurality of computing environments, wherein the plurality of computing environments includes the non-isolated public cloud computing environment and a plurality of isolated sovereign cloud computing environments, and wherein the plurality of isolated sovereign cloud computing environments restrict data access in accordance with an isolated scope;
subsequent to querying the directory service, receiving, from the directory service, an indication of a first computing environment of the plurality of computing environments to which the user belongs; and
in response to receiving the indication of the first computing environment from the directory service, generating and sending a response to allow the user to be authenticated to the application, wherein:
in response to the first computing environment being the non-isolated public cloud computing environment, the response indicates that the user belongs to the non-isolated public cloud computing environment, and
in response to the first computing environment being one of the plurality of isolated sovereign cloud computing environments, the response indicates that the user does not belong to the non-isolated public cloud computing environment.

2. The method of claim 1 , wherein the security endpoint is a security token service.

3. The method of claim 1 , wherein the indication of the first computing environment uniquely identifies the first computing environment.

4. The method of claim 1 , wherein the indication of the first computing environment identifies a security endpoint of the first computing environment.

5. The method of claim 4 , wherein the indication of the first computing environment specifies a location of the security endpoint of the first computing environment.

6. The method of claim 5 , wherein the indication of the first computing environment specifies a fully qualified domain name of the security endpoint of the first computing environment.

7. The method of claim 1 , wherein, in response to the first computing environment being one of the plurality of isolated sovereign cloud computing environments, the response includes the indication of the first computing environment.

8. The method of claim 1 , wherein:
the request is a discovery request received from the application by the security endpoint; and
the response is a discovery response transmitted to the application by the security endpoint.

9. The method of claim 1 , wherein:
the request identifies a user principal name (UPN) of the user, and
the domain name of the user is a substring of the UPN.

10. The method of claim 1 , wherein the mapping further maps each domain name in the plurality of domain names to a corresponding cloud environment to which said each domain name belongs.

11. The method of claim 1 , wherein the method further includes:
synchronizing data included in the mapping, wherein the data is synchronized between a first tenant domain data store of the directory service and a second tenant domain data store, which is located within a particular isolated sovereign cloud computing environment included in the plurality of isolated sovereign cloud computing environments, such that both the first tenant domain data store and the second tenant domain data store include a full copy of the data included in the mapping.

12. A security endpoint of a non-isolated public cloud computing environment that permits data access in accordance with a non-isolated scope, the security endpoint comprising:
a computer-readable storage device configured to store computer-executable instructions; and
a processing device configured to execute the computer-executable instructions, which upon execution by the processing device, control the security endpoint to perform:
receiving a request related to an application, wherein the application operates in the non-isolated public cloud computing environment, and wherein the request identifies a domain name of a user;
in response to receiving the request, querying a directory service according to the domain name of the user, wherein the directory service stores a mapping between a plurality of domain names and a plurality of computing environments, wherein the plurality of computing environments includes the non-isolated public cloud computing environment and a plurality of isolated sovereign cloud computing environments, and wherein the plurality of isolated sovereign cloud computing environments restrict data access in accordance with an isolated scope;
subsequent to querying the directory service, receiving, from the directory service, an indication of a first computing environment of the plurality of computing environments to which the user belongs; and
in response to receiving the indication of the first computing environment from the directory service, generating and sending a response to allow the user to be authenticated to the application, wherein:
in response to the first computing environment being the non-isolated public cloud computing environment, the response indicates that the user belongs to the non-isolated public cloud computing environment, and
in response to the first computing environment being one of the plurality of isolated sovereign cloud computing environments, the response indicates that the user does not belong to the non-isolated public cloud computing environment.

13. The security endpoint of claim 12 , wherein the security endpoint is a security token service.

14. The security endpoint of claim 12 , wherein the indication of the first computing environment uniquely identifies the first computing environment.

15. The security endpoint of claim 12 , wherein the indication of the first computing environment identifies a security endpoint of the first computing environment.

16. The security endpoint of claim 15 , wherein the indication of the first computing environment specifies a location of the security endpoint of the first computing environment.

17. The security endpoint of claim 16 , wherein the indication of the first computing environment specifies a fully qualified domain name of the security endpoint of the first computing environment.

18. The security endpoint of claim 12 , wherein the computer-executable instructions, when executed by the processing device, control the security endpoint to perform further steps including, in response to the first computing environment being one of the plurality of isolated sovereign cloud computing environments, including the indication of the first computing environment in the response.

19. The security endpoint of claim 12 , wherein:
the request is a discovery request received from the application by the security endpoint; and
the response is a discovery response transmitted to the application by the security endpoint.

20. The security endpoint of claim 12 , wherein:
the request identifies a user principal name (UPN) of the user, and
the domain name of the user is a s

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Appiah Madan Mohan R
• Panchanathan Ganesh Kumar
• Cupial Maciej Jacek

Classifications

• G06F9/4451

  User profiles; Roaming · CPC title

• H04L63/0807

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• G06F21/41

  where a single sign-on provides access to a plurality of computers · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F21/335

  for accessing specific resources, e.g. using Kerberos tickets · CPC title