Authenticating accesses to a shared datastore of a multi-tenant computer system

Patent metadata

Field	Value
Publication number	US-12411971-B2
Application number	US-202318482407-A
Country	US
Kind code	B2
Filing date	Oct 6, 2023
Priority date	Jun 3, 2021
Publication date	Sep 9, 2025
Grant date	Sep 9, 2025

Abstract

A multi-tenant computer system authenticates access to a shared datastore by a shared service running on the multi-tenant computer system. The shared service is operable to access the shared datastore to execute requests from a plurality of multi-tenant cloud computing services. The requests include an indication of a particular tenant and a particular tenant grouping indicator. Requests are authenticated by cryptographically verifying the request and verifying that the particular tenant is associated with the particular tenant grouping indicator. In response to authenticating a request, the shared service accesses the shared datastore to execute the first request.

First claim

What is claimed is:

1. A method of authenticating accesses to a shared datastore, the method comprising:
running, at a computer system, a shared service operable to access the shared datastore to execute requests from a plurality of multi-tenant cloud computing services including a first multi-tenant cloud computing service;
storing, at the computer system, a tenant grouping indicator that is indicative of a grouping of a first tenant of the first multi-tenant cloud computing service with one or more tenants of other ones of the plurality of multi-tenant cloud computing services that are permitted to access a set of resources managed by the shared service, wherein the first tenant is the only tenant associated with the tenant grouping indicator that is allowed to request that additional tenants of the plurality of multi-tenant cloud computing services be associated with the tenant grouping indicator;
receiving, at the computer system from the first multi-tenant cloud computing service, a first request to the shared service, wherein the first request includes a first token that includes a first indication of the first tenant and the tenant grouping indicator;
in response to verifying that the first tenant is associated with the tenant grouping indicator, accessing, by the shared service, the shared datastore to execute the first request, wherein the accessing includes sending, to the shared datastore, a second token that includes an indication of the shared service and the first token; and
wherein the second token is usable by the shared datastore to authenticate the first request, authenticate the accessing by the shared service, and verify that the first tenant is associated with the tenant grouping indicator.

2. The method of claim 1 , wherein the first token includes an indication of a primary tenant associated with the tenant grouping indicator and an indication of the shared service, and wherein the second token includes an indication that the second token is a proxy token and targets the shared datastore.

3. The method of claim 1 , further comprising:
determining, by the computer system, that the first request is authorized using a hierarchy of data protection scopes that includes a shared service tenant group data protection scope that corresponds to the tenant grouping indicator.

4. The method of claim 1 , further comprising:
storing, at the computer system, a second indication of a second tenant of a second multi-tenant cloud computing service of the plurality of multi-tenant cloud computing services, wherein the second tenant is associated with the tenant grouping indicator; and
based on authenticating a second request from the second multi-tenant cloud computing service, accessing, by the shared service running on the computer system, the shared datastore to execute the second request;
wherein the first tenant and the second tenant correspond to the same entity; and wherein the accessing of the shared datastore to execute the first request includes writing a value to the shared datastore and the accessing of the shared datastore to execute the second request includes reading the value from the shared datastore.

5. The method of claim 1 , further comprising:
storing, at the computer system, a second indication of a second tenant of a second multi-tenant cloud computing service of the plurality of multi-tenant cloud computing services, wherein the second tenant is associated with the tenant grouping indicator; and
wherein tenancy in the first multi-tenant cloud computing service is defined by a first set of parameters and tenancy in the second multi-tenant cloud computing service is defined by a second set of parameters.

6. The method of claim 1 , wherein the accessing of the shared datastore to execute the first request includes accessing a particular directory of the shared datastore corresponding to the shared service and the tenant group indicator and updating a value stored in the particular directory, wherein the particular directory is logically isolated from other directories corresponding to other tenant group indicators.

7. The method of claim 1 , further comprising:
running, at the computer system, a second shared service operable to:
access the shared datastore to execute requests from the plurality of multi-tenant cloud computing services; and
authenticate requests made to the second shared service from the plurality of multi-tenant cloud computing systems using the tenant grouping indicator;

wherein tenant grouping is the only representation of trust relationships between tenants of the plurality of multi-tenant cloud computing services used by the shared service and the second shared service to authenticate requests.

8. A non-transitory computer-readable storage medium storing program instructions that are capable of being executed by a computer system to perform operations comprising:
running a shared service operable to access a shared datastore to execute requests from a plurality of multi-tenant cloud computing services including a first multi-tenant cloud computing service;
storing a tenant grouping indicator that is indicative of a grouping of a first tenant of the first multi-tenant cloud computing service with one or more tenants of other ones of the plurality of multi-tenant cloud computing services that are permitted to access a set of resources managed by the shared service;
receiving, from the first multi-tenant cloud computing service, a first request to the shared service, wherein the first request includes a first token that includes an indication of the first tenant and the tenant grouping indicator;
determining that the first request is authorized using a hierarchy of data protection scopes that includes a shared service tenant group data protection scope that corresponds to the tenant grouping indicator;
in response to verifying that the first tenant is associated with the tenant grouping indicator, accessing the shared datastore to execute the first request, wherein the accessing includes sending, to the shared datastore, a second token that includes an indication of the shared service and the first token; and
wherein the second token is usable by the shared datastore to authenticate the first request, authenticate the accessing by the shared service, and verify that the first tenant is associated with the tenant grouping indicator.

9. The non-transitory computer-readable storage medium of claim 8 ,
wherein the first token includes an indication of a primary tenant associated with the tenant grouping indicator and an indication of the shared service, and wherein the second token includes an indication that the second token is a proxy token and targets the shared datastore.

10. The non-transitory computer-readable storage medium of claim 8 ,
wherein the first tenant is the only tenant associated with the tenant grouping indicator that is allowed to request that additional tenants of the plurality of multi-tenant cloud computing services be associated with the tenant grouping indicator.

11. The non-transitory computer-readable storage medium of claim 8 ,
wherein the operations further comprise:
storing a second indication of a second tenant of a second multi-tenant cloud computing service of the plurality of multi-tenant cloud computing services, wherein the second tenant is associated with the tenant grouping indicator; and
based on authenticating a second request from the second multi-tenant cloud computing service, accessing the shared datastore to execute the second request;
wherein the first tenant and the second tenant correspond to the same entity; and wherein the accessing of the shared datastore to execute the first requ

Assignees

• Salesforce Inc

Inventors

• Kwong Helen
• Busjaeger Benjamin

Classifications

• G06F21/604

  Tools and structures for managing or administering access control systems · CPC title

• G06F21/602

  Providing cryptographic facilities or services · CPC title

• H04L63/104

  Grouping of entities · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title