Scope-based certificate deployment

Patent metadata

Field	Value
Publication number	US-11075765-B2
Application number	US-201916418337-A
Country	US
Kind code	B2
Filing date	May 21, 2019
Priority date	Aug 4, 2016
Publication date	Jul 27, 2021
Grant date	Jul 27, 2021

Abstract

The techniques described herein facilitate scope-based certificate deployment for secure dedicated tenant access in multi-tenant, cloud-based content and collaboration environments. In some embodiments, a method is described that includes receiving an incoming authentication request from an access system, wherein the authentication request includes metadata, extracting the metadata from the authentication request, and processing the metadata to identify a tenant corresponding to the request. A tenant-specific certificate associated with the tenant is then accessed and provided to the access system for validation by a third-party certificate authority.

First claim

What is claimed is:

1. A method of operating a front-end access server to a multi-tenant cloud-based content service to facilitate scope-based certificate deployment in the multi-tenant cloud-based content service, the method comprising:
receiving, by the front-end access server, a tenant-specific certificate from a dedicated tenant system of a first tenant of the multi-tenant cloud-based content service, wherein the front-end access server provides dedicated access control to the multi-tenant cloud-based content service;
scoping, by the front-end access server, the tenant-specific certificate to the first tenant, the scoping comprising:
providing the tenant-specific certificate to the multi-tenant cloud-based content service,
receiving, from the multi-tenant cloud-based content service, a listing of machine identifiers of identified machines used to store tenant data for the first tenant,
deploying the tenant-specific certificate to the identified machines, and
storing an association between the identified machines and the tenant-specific certificate;

receiving, by the front-end access server, a request for authentication including metadata from an access system of the first tenant;
processing, by the front-end access server, the metadata to identify the first tenant and the tenant-specific certificate associated with the first tenant;
providing, by the front-end access server, the tenant-specific certificate to the access system for authentication on the multi-tenant cloud-based content service.

2. The method of claim 1 , wherein the tenant-specific certificate comprises one or more of a Secure Socket Layer (SSL) certificate, an email encryption certificate, or a code signing certificate.

3. The method of claim 1 , wherein the tenant-specific certificate comprises a certificate issued to the first tenant by a third-party certificate authority.

4. The method of claim 1 , further comprising deploying global certificates to the machines.

5. The method of claim 1 , further comprising:
receiving a request from the access system, wherein fulfilling the request requires accessing a back-end service;
identifying a shared certificate corresponding to the back-end service; and
authenticating with the back-end service using the shared certificate.

6. The method of claim 1 , further comprising authenticating a server using the tenant-specific certificate.

7. The method of claim 1 , further comprising:
receiving, by an Application Program Interface (API), a request to change a type of a first certificate from a global certificate to a scope-based certificate.

8. The method of claim 7 , further comprising:
responsive to receiving the request to change the type of the first certificate, identifying machines on which the first certificate is deployed; and
reimaging the machines on which the first certificate is deployed.

9. A computer readable storage medium having program instructions stored thereon which, when executed by one or more processors, cause the one or more processors to:
receive a tenant-specific certificate from a dedicated tenant system of a first tenant of a multi-tenant cloud-based content service;
scope the tenant-specific certificate to the first tenant by causing the one or more processors to:
provide the tenant-specific certificate to the multi-tenant cloud-based content service,
receive, from the multi-tenant cloud-based content service, a listing of machine identifiers of identified machines used to store tenant data for the first tenant,
deploy the tenant-specific certificate to the identified machines, and
store an association between the identified machines and the tenant-specific certificate;

trigger an interrupt responsive to receiving a request for authentication from an access system of the first tenant, wherein the authentication request includes metadata;
process the metadata to identify the first tenant and the tenant-specific certificate associated with the first tenant; and
provide the tenant-specific certificate to the access system for authentication on the multi-tenant cloud-based content service.

10. The computer readable storage medium of claim 9 , wherein the tenant-specific certificate comprises one or more of a Secure Socket Layer (SSL) certificate, an email encryption certificate, or a code signing certificate.

11. The computer readable storage medium of claim 9 , wherein the tenant-specific certificate comprises a certificate issued to the first tenant by a third-party certificate authority.

12. The computer readable storage medium of claim 9 , wherein the instructions, when executed by the one or more processors, further cause the one or more processors to deploy global certificates to the machines.

13. The computer readable storage medium of claim 9 , wherein the instructions, when executed by the one or more processors, further cause the one or more processors to
receive a request from the access system, wherein fulfilling the request requires accessing a back-end service;
identify a shared certificate corresponding to the back-end service; and
authenticate with the back-end service using the shared certificate.

14. The computer readable storage medium of claim 9 , wherein the instructions, when executed by the one or more processors, further cause the one or more processors to, responsive to receiving a request to change a type of a first certificate from a global certificate to a scope-based certificate:
modify the type of the first certificate,
identify machines on which the first certificate is deployed; and
reimage the machines on which the first certificate is deployed.

15. A method of operating a front-end access server to a multi-tenant cloud-based content service to facilitate scope-based certificate deployment in the multi-tenant cloud-based content service, the method comprising:
receiving, by the front-end access server, at least one scope-based certificate, wherein the front-end access server provides dedicated access control to the multi-tenant cloud-based content service;
scoping, by the front-end access server, each of the at least one scope-based certificate to a respective scope within the multi-tenant cloud-based content service, wherein the scoping comprises, for each of the at least one scope-based certificates:
providing the respective scope-based certificate to the multi-tenant cloud-based content service,
receiving, from the multi-tenant cloud-based content service, a listing of machine identifiers of identified machines used to store tenant data for the respective tenant associated with the respective scope-based certificate,
deploying the respective tenant-specific certificate to the identified machines, and
storing an association between the identified machines and the respective tenant-specific certificate;

receiving, by the front-end access server, a request for authentication from an access system, wherein the request includes metadata;
processing, by the front-end access server, the metadata to identify a scope-based certificate of the at least one scope-based certificate, the scope-based certificate corresponding to the request;
and
providing, by the front-end access server, the scope-based certificate to the access system for authentication on the multi-tenant cloud-based content service.

16. The method of claim 15 , wherein the respective scope of the scope-based certificate comprises one or more of a particular region or content farm.

17. The method of claim 15 , wherein the scope-based certificate comprises one or more of a Secure Socket Layer (SSL)

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Rathinasabapathy Mangalam
• Simek Patrick
• Zeng xinghuo
• Miglani Harpreet
• Silva Roshane

Classifications

• H04L9/3263 Primary

  involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title

• H04L9/3265

  using certificate chains, trees or paths; Hierarchical trust model · CPC title

• H04L9/3268 Primary

  using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL] · CPC title

• H04L9/30

  Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy · CPC title

• H04L9/14

  using a plurality of keys or algorithms · CPC title