Controlling access to microservices within a multi-tenancy framework

Patent metadata

Field	Value
Publication number	US-12113832-B2
Application number	US-202218057057-A
Country	US
Kind code	B2
Filing date	Nov 18, 2022
Priority date	Jun 20, 2019
Publication date	Oct 8, 2024
Grant date	Oct 8, 2024

Abstract

In some examples, a system includes a network managed by a service provider and configured to provide access to one or more objects to a set of tenants each having one or more users, the service provider and the set of tenants being part of a set of entities that form a hierarchy, and a controller having access to the network. The controller is configured to obtain data indicative of a set of parameters, where the data indicative of the set of parameters is associated with an owner entity of the set of entities, generate a rule which incorporates the set of parameters, where the rule enables the controller to control access to an object of the one or more objects, and add the rule to a rules database, wherein the rules database is accessible to the controller.

First claim

What is claimed is:

1. A controller having access to a network, wherein the controller comprises:
a storage device; and
processing circuitry in communication with the storage device, wherein the processing circuitry is configured to:
receive data including an indication to share an object created by an owner entity of a set of entities with a subset of entities of the set of entities, wherein each entity of the set of entities has access to the network, wherein the set of entities form a hierarchy within the set of entities of a multi-tenancy framework in the network, and wherein the received data indicates how the entities of the subset of entities are connected to each other within the hierarchy;
generate a rule that permits each entity of the subset of entities that requests the object to access the object via the network based on the hierarchy indicated by the received data; and
save the rule to a rules database.

2. The controller of claim 1 , wherein each entity of the set of entities that form the hierarchy is associated with at least one of a parent entity of the set of entities and one or more child entities of the set of entities.

3. The controller of claim 1 , wherein the processing circuitry is further configured to:
receive, from a requesting entity of the set of entities, a token requesting access to the object, wherein the token includes data indicative of an identity of the requesting entity;
identify, based on information stored in the rules database, the rule corresponding to the object; and
determine, based on the rule and based on the identity of the requesting entity, whether the requesting entity is granted access to the object.

4. The controller of claim 3 , wherein to determine whether the requesting entity is granted access to the object, the processing circuitry is further configured to:
determine that the requesting entity is granted access to the object if the requesting entity is included by the subset of entities; or
determine that the requesting entity is not granted access to the object if the requesting entity is not included by the subset of entities.

5. The controller of claim 3 , wherein the data indicative of an identity of the requesting entity includes a set of parameters comprising:
an indication of the owner entity associated with the rule;
an indication of a level of access to the object available to the owner entity;
the indication to share the object corresponding to the rule with the subset of entities of the set of entities; and
an indication of whether to share the object with all entities of the set of entities.

6. The controller of claim 5 , wherein to determine whether the requesting entity is granted access to the object, the processing circuitry is further configured to:
determine, if the requesting entity is not the owner entity, that the requesting entity is granted access to the object if the requesting entity is included by the subset of entities or if the set of parameters comprises an indication to share the object with all entities of the set of entities; or
determine, if the requesting entity is not the owner entity, that the requesting entity is not granted access to the object if the requesting entity is not included by the subset of entities and if the set of parameters comprises an indication not to share the object with all entities of the set of entities.

7. The controller of claim 5 , wherein to determine whether the requesting entity is granted access to the object, the processing circuitry is further configured to:
determine, if the requesting entity is the owner entity, whether the requesting entity is granted access to the object based on the indication of the level of access to the object available to the owner entity.

8. The controller of claim 5 , wherein the indication of the level of access to the object available to the owner entity comprises:
an indication that the owner entity is permitted to read the object, wherein the indication that the owner entity is permitted to read the object enables the owner entity to view data associated with the object;
an indication that the owner entity is permitted to write the object, wherein the indication that the owner entity is permitted to write the object enables the owner entity to edit the data associated with the object;
an indication that the owner entity is permitted to execute the object, wherein the indication that the owner entity is permitted to execute the object enables the owner entity to receive a service associated with the object;
an indication that the owner entity is permitted to read the object and write the object;
an indication that the owner entity is permitted to read the object and execute the object;
an indication that the owner entity is permitted to write the object and execute the object;
an indication that the owner entity is permitted to read the object, write the object, and execute the object; or
an indication that the owner entity is not permitted to read the object, write the object, and execute the object.

9. The controller of claim 5 , wherein each entity of the set of entities that form the hierarchy is associated with at least one of a parent entity of the set of entities and one or more child entities of the set of entities, and
wherein the indication to share the object with the subset of entities comprises at least one of:
an indication to share the object with the subset of entities including a direct parent entity associated with the owner entity;
an indication to share the object with the subset of entities including one or more direct child entities associated with the owner entity;
an indication to share the object with the subset of entities including all entities of the set of entities that descend from the owner entity in the hierarchy; and
an indication to share the object with the subset of entities including all ancestor entities of the set of entities that precede the owner entity in the hierarchy.

10. The controller of claim 5 , wherein each entity of the set of entities is associated with a respective scope of a set of scopes, and wherein the indication to share the object with the subset of entities of the set of entities comprises:
an indication to share the object with the subset of entities including all entities to the set of entities that are associated with a scope of the set of scopes.

11. A method for controlling access to a network comprising:
receiving, by processing circuitry in communication with a storage device, data including an indication to share an object created by an owner entity of a set of entities with a subset of entities of the set of entities, wherein each entity of the set of entities has access to the network, wherein the set of entities form a hierarchy within the set of entities of a multi-tenancy framework in the network, and wherein the received data indicates how the entities of the subset of entities are connected to each other within the hierarchy, wherein the controller has access to the network, and wherein the controller comprises the storage device and the processing circuitry;
generating, by the processing circuitry, a rule that permits each entity of the subset of entities that requests the object to access the object via the network based on the hierarchy indicated by the received data; and
saving, by the processing circuitry, the rule to a rules database.

12. The method of claim 11 , wherein each entity of the set of entities that form the hierarchy is associated with at least one of a parent entity of the set of entities and one or more child entities of the set of entities.

13. The method of claim

Assignees

• Juniper Networks Inc

Inventors

• Singh Gurminder
• Yang pei-yu
• Xie Rong

Classifications

• H04L63/104

  Grouping of entities · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L67/51

  Discovery or management thereof, e.g. service location protocol [SLP] or web services · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• H04L67/12

  specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks · CPC title