Local write for a multi-tenant identity cloud service

Patent metadata

Field	Value
Publication number	US-11258775-B2
Application number	US-201916249045-A
Country	US
Kind code	B2
Filing date	Jan 16, 2019
Priority date	Apr 4, 2018
Publication date	Feb 22, 2022
Grant date	Feb 22, 2022

Abstract

Embodiments perform write operations in a multi-tenant cloud system that includes a first data center adapted to authenticate a first plurality of registered clients and located in a first geographic area, and a second data center adapted to authenticate a second plurality of registered clients and located in a second geographic area that is different from the first geographic area. Embodiments receive a request from a first client to perform a first write for a resource at the second data center. Embodiments generate a call to the first data center including a second write for the resource at the first data center. Embodiments retrieve data corresponding to the first write and send the retrieved data to the first data center. Embodiments write on the data based on the first write, the writing on the data including changing the data to generate changed data.

First claim

What is claimed is:

1. A multi-tenant cloud system comprising:
a first data center implemented by a first one or more processers adapted to authenticate a first plurality of registered clients and located in a first geographic area, each of the first plurality of registered clients having corresponding master first identity accounts at the first data center;
a second data center implemented by a second one or more processers adapted to authenticate a second plurality of registered clients and located in a second geographic area that is different from the first geographic area, each of the second plurality of registered clients having corresponding master second identity accounts at the second data center;
the second data center receiving a request from a first client of the first plurality of registered clients to perform a first write for a resource at the second data center, wherein the resource is replicated at the first data center and at the second data center, the first data center comprising a master region for the corresponding master first identity account of the first client and the second data center comprising a replica of the master first identity account of the first client, wherein the resource is accessed by the first client at the first data center and the generated replica of the resource is accessed by the first client at the second data center;
the second data center generating a call to the first data center, the call comprising a second write for the resource at the first data center, the second write comprising a special header, the special header indicating a write of the resource at the second data center instead of at the first data center;
the first data center retrieving data corresponding to the resource and first write and sending the retrieved data to the second data center; and
the second data center writing on the data based on the first write, the writing on the data comprising changing the data to generate changed data and changing the replicated resource, the second data center, after writing on the data, replicating the generated changed data to the first data center.

2. The multi-tenant cloud system of claim 1 , wherein the resource is accessed by the first client at the first data center via an application programming interface and after authenticating the first client at the first data center.

3. The multi-tenant cloud system of claim 1 , further comprising:
the second data center determining whether the resource supports a local write;
when the resource does not support a local write, instead of generating the call to the first data center, returning to the second data center a response to the first client that comprises a redirect Uniform Resource Locator (URL).

4. The multi-tenant cloud system of claim 1 , wherein the special header is signed using a global signing key.

5. The multi-tenant cloud system of claim 1 , wherein the request from the first client comprises a request Uniform Resource Locator (URL) that can be used to both write data and read data from the second data center.

6. The multi-tenant cloud system of claim 5 , wherein the cloud system comprises a plurality of microservices that perform identity management tasks, request URL comprises:
an identity of the first client, an identity of the resource and an identity of one of the plurality of microservices.

7. The multi-tenant cloud system of claim 1 , the changing the data comprising adding new data.

8. A method of performing write operations in a multi-tenant cloud system that comprises a first data center adapted to authenticate a first plurality of registered clients and located in a first geographic area, each of the first plurality of registered clients having corresponding master first identity accounts at the first data center, and a second data center adapted to authenticate a second plurality of registered clients and located in a second geographic area that is different from the first geographic area, each of the second plurality of registered clients having corresponding master second identity accounts at the second data center, the method comprising:
at the second data center, receiving a request from a first client of the first plurality of registered clients to perform a first write for a resource at the second data center, wherein the resource is replicated at the first data center and at the second data center, the first data center comprising a master region for the corresponding master first identity account of the first client and the second data center comprising a replica of the master first identity account of the first client, wherein the resource is accessed by the first client at the first data center and the generated replica of the resource is accessed by the first client at the second data center;
at the second data center, generating a call to the first data center, the call comprising a second write for the resource at the first data center, the second write comprising a special header, the special header indicating a write of the resource at the second data center instead of at the first data center;
at the first data center, retrieving data corresponding to the first write and sending the retrieved data to the second data center; and
at the second data center, writing on the data based on the first write, the writing on the data comprising changing the data to generate changed data and changing the replicated resource, the second data center, after writing on the data, replicating the generated changed data to the first data center.

9. The method of claim 8 , wherein the resource is accessed by the first client at the first data center via an application programming interface and after authenticating the first client at the first data center.

10. The method of claim 8 , further comprising:
determining whether the resource supports a local write;
when the resource does not support a local write, instead of generating the call to the first data center, returning a response to the first client that comprises a redirect Uniform Resource Locator (URL).

11. The method of claim 8 , wherein the special header is signed using a global signing key.

12. The method of claim 8 , wherein the request from the first client comprises a request Uniform Resource Locator (URL) that can be used to both write data and read data from the second data center.

13. The method of claim 12 , wherein the cloud system comprises a plurality of microservices that perform identity management tasks, request URL comprises:
an identity of the first client, an identity of the resource and an identity of one of the plurality of microservices.

14. The method of claim 8 , the changing the data comprising adding new data.

15. A non-transitory computer-readable medium storing instructions which, when executed by one or more processors, cause the processors to perform write operations in a multi-tenant cloud system comprises a first data center adapted to authenticate a first plurality of registered clients and located in a first geographic area, each of the first plurality of registered clients having corresponding master first identity accounts at the first data center, and a second data center adapted to authenticate a second plurality of registered clients and located in a second geographic area that is different from the first geographic area, each of the second plurality of registered clients having corresponding master second identity accounts at the second data center, the write operations comprising:
at the second data center, receiving a request from a first client of the first plurality of registered clie

Assignees

• Oracle Int Corp

Inventors

• Lander Vadim
• Balu Balakumar
• Medam Venkateswara Reddy
• Shih Kuang-Yu
• Gupta Lokesh
• Asokkumar Vasukiammaiyar
• Wilson Gregg

Classifications

• H04W12/06

  Authentication · CPC title

• H04L9/3271

  using challenge-response · CPC title

• G06F3/0622

  in relation to access · CPC title

• H04W12/63

  Location-dependent; Proximity-dependent · CPC title

• H04L9/088

  Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068) · CPC title