Determing a permission of a first tenant with respect to a second tenant

Patent metadata

Field	Value
Publication number	US-2016337365-A1
Application number	US-201415112394-A
Country	US
Kind code	A1
Filing date	Jan 20, 2014
Priority date	Jan 20, 2014
Publication date	Nov 17, 2016
Grant date	—

Abstract

A first representation is provided of privileges among a plurality of tenants of a system. The tenants have relationships according to a hierarchy that includes multiple hierarchical levels of the tenants, where at least one of the privileges specifies a permission of a first tenant to perform a task with respect to a second tenant. The first representation is independent of a representation of the relationships among the plurality of tenants. In response to a request from the first tenant to perform a task with respect to the second tenant, a system determines, based on the first representation, whether the first tenant is permitted to perform the task with respect to the second tenant.

First claim

What is claimed is:

1 . A method comprising:
storing, by a system including a processor, a first representation of privileges among a plurality of tenants of the system, the plurality of tenants having relationships according to a hierarchy that includes a plurality of hierarchical levels of the tenants, wherein at least one of the privileges specifies an access permission of a first of the tenants at a first of the hierarchical levels to a resource of a second of the tenants at one of the hierarchical levels, and wherein the first representation is independent of a representation of the relationships among the plurality of tenants; and in response to a request from the first tenant for the resource of the second tenant, determining, by the system based on the first representation, whether the first tenant is permitted to access the resource of the second tenant.

2 . The method of claim 1 , wherein the at least one privilege specifies the access permission of the first tenant to the resource of the second tenant at a second, different one of the hierarchical levels.

3 . The method of claim 1 , wherein the at least one privilege specifies the access permission of the first tenant to user identity data of the second tenant, the user identity data for authorizing access of a cloud service or cloud resource provided by the system.

4 . The method of claim 1 , wherein a second of the privileges specifies a permission of the first tenant to modify the second tenant, the method further comprising:
in response to a request by the first tenant to modify the second tenant, determining, by the system based first representation, whether the first tenant is permitted to modify the second tenant.

5 . The method of claim 4 , wherein the second privilege specifies a permission of the first tenant to modify the second tenant by adding or removing a sub-tenant of the second tenant.

6 . The method of claim 1 , further comprising:
dynamically modifying the first representation to change the privileges among the plurality of tenants, without changing the representation of the relationships among the plurality of tenants.

7 . The method of claim 1 , wherein storing the first representation comprises storing access control information in at least one access control list.

8 . The method of claim 1 , wherein storing the first representation comprises using a cryptographic mechanism to control the privileges.

9 . The method of claim 1 , wherein the storing and the determining is performed by an identity management system that performs authorization of access of a cloud service or cloud resource of the system.

10 . A system comprising:
at least one processor to:
receive a request from a first tenant of a system to perform a task with respect to a second tenant of the system;
in response to the request, access a first representation of privileges among a plurality of tenants, the plurality of tenants having relationships according to a hierarchy that includes a plurality of hierarchical levels of the tenants, wherein the privileges specify permissions of the tenants at the respective hierarchical levels to perform tasks with respect to other tenants at the respective hierarchical levels, and wherein the first representation is independent of a representation of the relationships among the plurality of tenants; and
determine, based on the first representation, whether the first tenant is permitted to perform the task with respect to the second tenant.

11 . The system of claim 10 , wherein determining whether the first tenant is permitted to perform the task with respect to the second tenant comprises determining whether the first tenant is permitted to access a resource of the second tenant.

12 . The system of claim 10 , wherein determining whether the first tenant is permitted to perform the task with respect to the second tenant comprises determining whether the first tenant is permitted to add or remove a sub-tenant of the second tenant.

13 . The system of claim 10 , wherein the system is a cloud system, and the cloud system further comprising an identity management engine including the at least one processor, the identity management system to authorize access of a cloud service or cloud resource of the cloud system by a user of one of the plurality of tenants.

14 . The system of claim 10 , wherein the first representation includes a tenant privilege hierarchy that specifies privilege relationships among the plurality of tenants, the tenant privilege hierarchy including a plurality of hierarchical levels at which the respective tenants are provided.

15 . An article comprising at least one non-transitory machine-readable storage medium storing instructions that upon execution cause a cloud system to:
receive a request from a first tenant of the cloud system to perform a task with respect to a second tenant of the cloud system, the cloud system including at least one cloud resource or at least one cloud service shareable by a plurality of tenants, and the cloud system further including an identity management system to authorize access of the at least one cloud resource or at least one cloud service; in response to the request, access a first representation of privileges among the plurality of tenants, the plurality of tenants having relationships according to a hierarchy that includes a plurality of hierarchical levels of the tenants, wherein the privileges specify permissions of the tenants at the respective hierarchical levels to perform tasks with respect to other tenants at the respective hierarchical levels, and wherein the first representation is independent of a representation of the relationships among the plurality of tenants; and determine, based on the first representation, whether the first tenant is permitted to perform the task with respect to the second tenant.

Assignees

• Hewlett Packard Development Co Lp
• Hewlett Packard Development Co Lp

Inventors

• Beiter Michael B

Classifications

• G06F9/468 Primary

  Specific access rights for resources, e.g. using capability register · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L63/101 Primary

  Access control lists [ACL] · CPC title

• H04L67/16

  Electricity · mapped topic

• H04L67/51

  Discovery or management thereof, e.g. service location protocol [SLP] or web services · CPC title