Multi-tenant authorization framework in a data management and storage cluster

Patent metadata

Field	Value
Publication number	US-11010487-B2
Application number	US-201916453274-A
Country	US
Kind code	B2
Filing date	Jun 26, 2019
Priority date	Jun 14, 2018
Publication date	May 18, 2021
Grant date	May 18, 2021

Abstract

A data management and storage (DMS) cluster of peer DMS nodes manages resources of a multi-tenant environment. The DMS cluster provides an authorization framework that provides user access which is scoped to the resources within a tenant organization and the privileges of the user within the organization. To authorize an action on a resource by a user, the DMS cluster determines determine user authorizations associated with the user defining privileges of the user on the resources of the multi-tenant environment, and organization authorizations associated defining resources of the multi-tenant environment that belong to the organization. The DMS cluster authorizes the action when the user authorizations and organizations authorized indicate that the action on the resource is authorized.

First claim

The invention claimed is:

1. In a data management and storage (DMS) cluster, a method for authorizing actions by a user, the method comprising:
determining user authorizations associated with the user;
determining an organization associated with the user;
determining organization authorizations associated with the organization;
determining whether the user authorizations and the organization authorizations indicate that a first action by the user on a resource is authorized, the user authorizations comprising inherited authorizations from group authorizations based on a hierarchal relationship within the organization;
responsive to determining that the first action by the user on the resource is authorized, executing the action on the resource, wherein the resource is a virtual machine, and executing the action on the resource includes capturing a first snapshot of the virtual machine;
storing the first snap shot in a data store associated with a particular DMS node among peer DMS nodes;
assigning a second action to the particular DMS node, the second action including capturing a second snapshot of the virtual machine, and comparing the first and second snapshots; and
generating images based on the captured first and second snapshots; and
storing the images in a data structure in the data store.

2. The method of claim 1 , wherein determining whether the user authorizations and the organization authorizations indicate that the action by the user on the resource is authorized includes:
determining whether the user authorizations and the organization authorizations indicate that the action by the user on a parent resource of the resource is authorized; and
determining that the action by the user on the resource is authorized responsive to the determination that the action by the user on the parent resource is authorized.

3. The method of claim 1 , wherein determining whether the user authorizations and the organization authorizations indicate that the action by the user on the resource is authorized includes determining whether privileges of the user includes the action and the privileges of the organization includes access to the resource.

4. The method of claim 1 , wherein determining the organization associated with the user includes referencing an authorization table to identify one or more organizations of the multitenant environment associated with the user.

5. The method of claim 1 , wherein determining whether the user authorizations and the organization authorizations indicate that the action by the user on the resource is authorized includes:
generating a user authorization context including each authorization associated with the user;
generating an organization authorization context including each authorization associated with the organization; and
determining whether the action on the resource is authorized based on whether the user authorization context and the organization authorization context authorize the action by the user on the resource.

6. The method of claim 1 , wherein executing the action on the resource includes providing the resource to a user interface accessible to the user.

7. The method of claim 1 , further comprising:
receiving a request to perform the action for the user on the resource; and
responsive the request, determining whether the user authorizations and the organization authorizations indicate that the action by the user on the resource is authorized.

8. The method of claim 1 , wherein:
determining the user authorizations includes referencing an authorization table to generate an authorization context that includes each user authorization associated with the user; and
determining whether the user authorizations and the organization authorizations indicate that the action by the user on the resource is authorized includes referencing the authorization context for the action and for the resource.

9. The method of claim 8 , wherein determining the user authorizations includes:
determining a group to which the user belongs, and wherein the generated authorization context includes an authorization associated with the group.

10. The method of claim 1 , wherein:
determining the organization authorizations includes referencing an authorization table to generate an authorization context that includes each authorization associated with the organization; and
determining whether the user authorizations and the organization authorizations indicate that the action by the user on the resource is authorized includes referencing the authorization context for the action and for the resource.

11. The method of claim 10 , wherein determining the organization authorizations includes:
determining a parent organization of the organization, and wherein the generated authorization context includes an authorization associated with the parent organization.

12. A data management and storage (DMS) cluster, comprising:
peer DMS nodes; and
a distributed data store implemented across the peer DMS nodes;
wherein the peer DMS nodes are configured to collectively implement:
determining user authorizations associated with a user;
determining an organization associated with the user;
determining organization authorizations associated with the organization;
determining whether the user authorizations and the organization authorizations indicate that a first action by the user on the resource is authorized, the user authorizations comprising inherited authorizations from group authorizations based on a hierarchal relationship within the organization;
responsive to determining that the first action by the user on the resource is authorized, executing the action on the resource, wherein the resource is a virtual machine, and executing the action on the resource includes capturing a first snapshot of the virtual machine;
storing the first snap shot in a section of the distributed data store associated with a particular DMS node among the peer DMS nodes;
assigning a second action to the particular DMS node among the peer DMS nodes, the second action including capturing a second snapshot of the virtual machine, and comparing the first and second snapshots; and
generating images based on the captured first and second snapshots; and
storing the images in a data structure in the distributed data store.

13. The DMS cluster of claim 12 , wherein determining whether the user authorizations and the organization authorizations indicate that the action by the user on the resource is authorized includes:
determining whether the user authorizations and the organization authorizations indicate that the action by the user on a parent resource of the resource is authorized; and
determining that the action by the user on the resource is authorized responsive to the determination that the action by the user on the parent resource is authorized.

14. The DMS cluster of claim 12 , wherein the action on the resource includes at least one of:
capturing a snapshot of a virtual machine; or
providing the resource to a user interface accessible to the user.

15. The DMS cluster of claim 12 , wherein:
determining the user authorizations includes referencing an authorization table to generate an authorization context that includes each user authorization associated with the user; and
determining whether the user authorizations and the organization authorizations indicate that the action by the user on the resource is authorized includes referencing the authorization context for the action and for the resource.

16. The DMS cluster of claim 15 , wherein determining the us

Assignees

• Rubrik Inc

Inventors

• Noe Matthew Edward
• Han Seungyeop
• Kumar Arohi

Classifications

• G06F21/604

  Tools and structures for managing or administering access control systems · CPC title

• H04L63/104 Primary

  Grouping of entities · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title