Controlling access to microservices within a multi-tenancy framework

Patent metadata

Field	Value
Publication number	US-11516254-B2
Application number	US-201916447733-A
Country	US
Kind code	B2
Filing date	Jun 20, 2019
Priority date	Jun 20, 2019
Publication date	Nov 29, 2022
Grant date	Nov 29, 2022

Abstract

In some examples, a system includes a network managed by a service provider and configured to provide access to one or more objects to a set of tenants each having one or more users, the service provider and the set of tenants being part of a set of entities that form a hierarchy, and a controller having access to the network. The controller is configured to obtain data indicative of a set of parameters, where the data indicative of the set of parameters is associated with an owner entity of the set of entities, generate a rule which incorporates the set of parameters, where the rule enables the controller to control access to an object of the one or more objects, and add the rule to a rules database, wherein the rules database is accessible to the controller.

First claim

What is claimed is:

1. A system comprising:
a network managed by a service provider and configured to provide access to one or more objects to a set of tenants each having one or more users, the service provider and the set of tenants being part of a set of entities that form a hierarchy of a multi-tenancy framework, wherein each entity of the set of entities that form the hierarchy is associated with at least one of a parent entity of the set of entities and one or more child entities of the set of entities, wherein each object of the one or more objects comprises a set of data that is accessible to one or more subsets of entities of the set of entities, and wherein the set of entities is separate from the one or more objects; and
a controller comprising processing circuitry and having access to the network, wherein the processing circuitry is configured to:
obtain data indicative of a set of parameters, wherein the data indicative of the set of parameters is associated with an owner entity of the set of entities, wherein the set of parameters includes an indication to share an object of the one or more objects created by the owner entity with a respective one or more subsets of entities of the set of entities, and wherein the set of parameters including the indication to share the object define the respective one or more subsets of entities based on the hierarchy such that the set of parameters define a set of relationships corresponding to each subset of entities of the one or more subsets of entities, and wherein the set of relationships corresponding to each subset of entities of the one or more subsets of entities indicate how the entities of the subset of entities are connected to each other within the hierarchy of the multi-tenancy framework,
generate a rule which incorporates the set of parameters and the set of relationships corresponding to each subset of entities of the one or more subsets of entities, wherein the rule enables the processing circuitry to control access of the set of entities to an object of the one or more objects based on the one or more subsets of entities shared with the object, and
add the rule to a rules database, wherein the rules database is accessible to the controller.

2. The system of claim 1 , wherein the processing circuitry is configured to:
receive, from a requesting entity of the set of entities, a token requesting access to the object, wherein the token includes data indicative of an identity of the requesting entity;
identify, based on information stored in the rules database, the rule corresponding to the object; and
determine, based on the set of parameters incorporated by the rule and based on the identity of the requesting entity, whether the requesting entity is granted access to the object.

3. The system of claim 2 , wherein to determine whether the requesting entity is granted access to the object, the processing circuitry is configured to:
determine that the requesting entity is granted access to the object if the requesting entity is included by the at least one subset of entities; or determine that the requesting entity is not granted access to the object if the requesting entity is not included by the at least one subset of entities.

4. The system of claim 2 , wherein the set of parameters comprises:
an indication of the owner entity associated with the rule;
an indication of a level of access to the object available to the owner entity;
the indication to share the object corresponding to the rule with the at least one subset of entities of the set of entities; and
an indication of whether to share the object with all entities of the set of entities.

5. The system of claim 4 , wherein to determine whether the requesting entity is granted access to the object, the processing circuitry is configured to:
determine, if the requesting entity is not the owner entity, that the requesting entity is granted access to the object if the requesting entity is included by the at least one subset of entities or if the set of parameters comprises an indication to share the object with all entities of the set of entities; or
determine, if the requesting entity is not the owner entity, that the requesting entity is not granted access to the object if the requesting entity is not included by the at least one subset of entities and if the set of parameters comprises an indication not to share the object with all entities of the set of entities.

6. The system of claim 4 , wherein to determine whether the requesting entity is granted access to the object, the processing circuitry is configured to:
determine, if the requesting entity is the owner entity, whether the requesting entity is granted access to the object based on the indication of the level of access to the object available to the owner entity.

7. The system of claim 4 , wherein the indication of the level of access to the object available to the owner entity comprises:
an indication that the owner entity is permitted to read the object, wherein the indication that the owner entity is permitted to read the object enables the owner entity to view data associated with the object;
an indication that the owner entity is permitted to write the object, wherein the indication that the owner entity is permitted to write the object enables the owner entity to edit the data associated with the object;
an indication that the owner entity is permitted to execute the object, wherein the indication that the owner entity is permitted to execute the object enables the owner entity to receive a service associated with the object;
an indication that the owner entity is permitted to read the object and write the object;
an indication that the owner entity is permitted to read the object and execute the object;
an indication that the owner entity is permitted to write the object and execute the object;
an indication that the owner entity is permitted to read the object, write the object, and execute the object; or
an indication that the owner entity is not permitted to read the object, write the object, and execute the object.

8. The system of claim 4 , wherein the indication to share the object with the at least one subset of entities of the set of entities comprises at least one of:
an indication to share the object with a subset of entities including a direct parent entity associated with the owner entity;
an indication to share the object with a subset of entities including one or more direct child entities associated with the owner entity;
an indication to share the object with a subset of entities including all entities of the set of entities that descend from the owner entity in the hierarchy; and
an indication to share the object with a subset of entities including all ancestor entities of the set of entities that precede the owner entity in the hierarchy.

9. The system of claim 4 , wherein each entity of the set of entities is associated with a respective scope of a set of scopes, and wherein the indication to share the object with the at least one subset of entities of the set of entities comprises:
an indication to share the object with a subset of entities including all entities to the set of entities that are associated with a scope of the set of scopes.

10. The system of claim 1 , wherein the processing circuitry is further configured to:
receive, from a creating entity of the set of entities that form the hierarchy and via an application programming interface (API), a message indicative of a request to create a new entity;
create, based on the message, the new entity such that a parent entity of the new entity is the creating entity and a child entity of the creating entity is the new entity

Assignees

• Juniper Networks Inc

Inventors

• Singh Gurminder
• Yang pei-yu
• Xie Rong

Classifications

• H04L67/12

  specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks · CPC title

• H04L67/51

  Discovery or management thereof, e.g. service location protocol [SLP] or web services · CPC title

• H04L63/104

  Grouping of entities · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L63/102

  Entity profiles · CPC title