Transactions between services in a multi-tenant architecture

Patent metadata

Field	Value
Publication number	US-12407518-B2
Application number	US-202217683220-A
Country	US
Kind code	B2
Filing date	Feb 28, 2022
Priority date	Jun 15, 2018
Publication date	Sep 2, 2025
Grant date	Sep 2, 2025

Abstract

A method for facilitating transactions between tenants in in a multi-tenant architecture system is discussed. The method includes receiving a request, at a multi-tenant platform, from a first service of a first tenant of the multi-tenant platform to access a second service of a second tenant of the multi-tenant platform to perform a transaction, in which the request includes a first access token usable to authenticate the transaction with the first tenant. The method includes generating, by the multi-tenant platform using the first access token, a universal access token. The method includes generating, by the multi-tenant platform using the universal access token, a second access token useable to authenticate the transaction with the second tenant. The method includes using, by the multi-tenant platform, the second access token to communicate with the second service to perform the transaction.

First claim

What is claimed is:

1. A method comprising:
receiving, at a multi-tenant platform, a request from a first entity of a first tenant of the multi-tenant platform to access a second entity, among multiple second-tenant entities of a second tenant of the multi-tenant platform, to process a transaction between the first entity and the second entity, the request including authentication information usable to authenticate the transaction with the first tenant, the first tenant comprising a first identity provider for the first entity, the second tenant comprising a second identity provider for the second entity and one or more others of the multiple second-tenant entities;
generating, based at least on the authentication information and by a multi-tenant identity provider of the multi-tenant platform, an access token that includes information usable to authenticate the transaction with the first entity and the second entity, wherein the multi-tenant platform is configured for accessing, via the multi-tenant identity provider, a portion of entity data associated with one or more of the first entity and the second entity;
exchanging, by the multi-tenant platform, the access token for a tenant token for authenticating the transaction with the second tenant, the tenant token useable to authenticate the transaction with the second tenant, the tenant token being in a format of the second tenant, wherein the exchanging includes sending the access token to the second identity provider and receiving the tenant token from the second identity provider; and
communicating, by the multi-tenant platform, the tenant token with the second tenant to perform the transaction.

2. The method of claim 1 , wherein the first entity is a customer whose identity is managed by the first identity provider of the first tenant, wherein the second entity is a first merchant whose identity is managed by the second identity provider of the second tenant, wherein the others of the multiple second-tenant entities include one or more additional merchants, and wherein the transaction is between the customer of the first tenant and the first merchant of the second tenant.

3. The method of claim 1 , wherein the request includes a first access token that is usable to authenticate the transaction with the first tenant and is in a first format used by the first tenant.

4. The method of claim 3 , wherein generating the access token that includes information usable to authenticate the transaction with the first entity and the second entity includes using an internal token corresponding to the first access token.

5. The method of claim 1 , wherein a payload of the access token includes: first tenant payload information including a first indication of the first entity within the first tenant; and second tenant payload information including a second indication of the first entity within the second tenant.

6. The method of claim 1 , wherein the tenant token is generated using a second identity provider model at the multi-tenant platform; and wherein the second identity provider model corresponds to the second tenant and models how the tenant token is usable to authenticate the transaction with the second tenant.

7. The method of claim 1 , wherein a first identity provider model includes a first indication of the first entity, wherein the first entity is an end-user; wherein a second identity provider model includes a second indication of the first entity; and wherein the first identity provider model and second identity provider model are represented within a hierarchical data structure, at the multi-tenant platform, that links the first indication and second indication together.

8. The method of claim 1 , wherein the first entity is an end user; and wherein the generating the access token is in response to determining that the end user is authorized to access services of the first tenant and access services of the second tenant.

9. The method of claim 1 , wherein generating the access token includes using an internal token representing access to the first tenant.

10. A multi-tenant platform that manages multiple tenants, the multi-tenant platform configured to:
access a request from a first entity of a first tenant of the multi-tenant platform, the request to process a transaction between the first entity and a second entity, among multiple second-tenant entities of a second tenant of the multi-tenant platform, the request including authentication information usable to authenticate the transaction with the first tenant, the first tenant comprising a first identity provider for the first entity, the second tenant comprising a second identity provider for the second entity and one or more others of the multiple second-tenant entities;
generate, based at least on the authentication information and by a multi-tenant identity provider of the multi-tenant platform, an access token that includes information usable to authenticate the transaction with the first entity and the second entity, wherein the multi-tenant platform is configured for accessing, via the multi-tenant identity provider, a portion of entity data identifying one or more of the first entity and the second entity;
obtain, by the multi-tenant platform from the second identity provider and based on the access token, a tenant token for authenticating the transaction with the second tenant, the tenant token useable to authenticate the transaction with the second tenant; and
communicate, by the multi-tenant platform, the tenant token with the second tenant to perform the transaction.

11. The multi-tenant platform of claim 10 , wherein the first entity is a customer whose identity is managed by the first identity provider of the first tenant, wherein the second entity is a first merchant whose identity is managed by the second identity provider of the second tenant, wherein the others of the multiple second-tenant entities include one or more additional merchants, and wherein the transaction is between the customer of the first tenant and the first merchant of the second tenant.

12. The multi-tenant platform of claim 10 , wherein the request includes a first access token that is usable to authenticate the transaction with the first tenant and is in a first format used by the first tenant.

13. The multi-tenant platform of claim 10 , wherein a payload of the access token includes: first tenant payload information including a first indication of the first entity within the first tenant; and second tenant payload information including a second indication of the first entity within the second tenant.

14. The multi-tenant platform of claim 10 , wherein the tenant token is generated using a second identity provider model at the multi-tenant platform; and wherein the second identity provider model corresponds to the second tenant and models how the tenant token is usable to authenticate the transaction with the second tenant.

15. The multi-tenant platform of claim 10 , wherein generating the access token includes using an internal token representing access to the first tenant.

16. A non-transitory machine-readable medium having instructions stored thereon, the instructions executable to cause performance of operations comprising:
accessing a request from a first entity of a first tenant of a multi-tenant platform, the request to process a transaction between the first entity and a second entity, among multiple second-tenant entities of a second tenant of the multi-tenant platform, the request including authentication information usable to authenticate the transaction with the first tenant, the first tenant comprising

Assignees

• Paypal Inc

Inventors

• Jamkhedkar Prashant
• Ranganathan Aravindan
• Kumar Sandeep
• Aoki Norihiro
• White Justin
• Meyer Jeffrey
• Kee Kin
• Knox Joshua
• Malla Venkata Satya Ganesh Simhachalam

Classifications

• H04L9/3247

  involving digital signatures · CPC title

• H04L9/3297

  involving time stamps, e.g. generation of time stamps · CPC title

• G06F9/5011

  the resources being hardware resources other than CPUs, Servers and Terminals · CPC title

• H04L63/108

  when the policy decisions are valid for a limited amount of time · CPC title

• H04L63/0815

  providing single-sign-on or federations · CPC title