Tenant user management in cloud database operation

Patent metadata

Field	Value
Publication number	US-2022286465-A1
Application number	US-202117194141-A
Country	US
Kind code	A1
Filing date	Mar 5, 2021
Priority date	Mar 5, 2021
Publication date	Sep 8, 2022
Grant date	—

Abstract

A method of tenant user management in cloud database operation can be implemented. The method can receive an original job request from a user for a database service, wherein the original job request can include a login credential of the user. The method can authenticate the login credential of the user by a scheduler, verify the user has privileges for the original job request by the scheduler, create a modified job request from the original job request by the scheduler based on a predefined role corresponding to the privileges of the user, send the modified job request from the scheduler to a database service platform, and allocate an instance of database service to the user in response to the modified job request.

First claim

1 . A computer-implemented method comprising:
authenticating a login credential of a user by a scheduler, wherein the login credential is included in an original service request of the user for a database service; determining the user has privileges for the original service request by the scheduler; creating a modified service request from the original service request by the scheduler based on a predefined role corresponding to the privileges of the user; and forwarding, by the scheduler, the modified service request to a DBaaS platform, wherein an instance of database service can be assigned to the user in response to the modified service request.

2 . The method of claim 1 , wherein determining the user has privileges for the original service request comprises determining predefined privileges of the user contain requested privileges of the service request.

3 . The method of claim 1 , further comprising mapping the user to the predefined role, wherein the predefined role comprises a combination of privileges for accessing the DBaaS platform.

4 . The method of claim 3 , further comprising mapping a predefined public user to the predefined role, wherein the public user has an encrypted login credential that has been pre-authenticated to access the DBaaS platform.

5 . The method of claim 4 , wherein creating the modified service request comprises replacing the login credential of the user with the encrypted login credential of the public user in the service request.

6 . The method of claim 1 , wherein authenticating the login credential of the user comprises authenticating the user by the scheduler and authenticating the scheduler by the DBaaS platform.

7 . The method of claim 6 , wherein authenticating the user by the scheduler comprises decrypting a cookie stored on the scheduler using a private key of the user.

8 . The method of claim 7 , wherein authenticating the user by the scheduler further comprises changing the login credential of the user and refreshing the cookie stored on the scheduler.

9 . The method of claim 8 , wherein refreshing the cookie comprises:
sending a public key from the scheduler to the user; validating the public key by the user; sending the login credential of the user to the scheduler; determining an asymmetric encryption algorithm by the scheduler; generating an encrypted login credential by the user using the asymmetric encryption algorithm determined by the scheduler; sending the encrypted login credential from the user to the scheduler; and storing the encrypted credential in the cookie by the scheduler.

10 . The method of claim 1 , further comprising logging the service request, results of user authentication, and the predefined role corresponding to the privileges of the user.

11 . A system comprising:
memory; one or more hardware processors coupled to the memory; and one or more computer readable storage media storing instructions that, when loaded into the memory, cause the one or more hardware processors to perform operations comprising: authenticating a login credential of a user by a scheduler, wherein the login credential is included in an original service request of the user for a database service; determining the user has privileges for the original service request by the scheduler; creating a modified service request from the original service request by the scheduler based on a predefined role corresponding to the privileges of the user; forwarding, by the scheduler, the modified service request to a DBaaS platform; and assigning an instance of database service to the user in response to the modified service request.

12 . The system of claim 11 , wherein determining the user has privileges for the original service request comprises determining predefined privileges of the user contain requested privileges of the service request.

13 . The system of claim 11 , wherein the operations further comprise mapping the user to the predefined role, wherein the predefined role comprises a combination of privileges for accessing the DBaaS platform.

14 . The system of claim 11 , wherein the operations further comprise mapping a predefined public user to the predefined role, wherein the public user has an encrypted login credential that has been pre-authenticated to access the DBaaS platform.

15 . The system of claim 14 , wherein creating the modified service request comprises replacing the login credential of the user with the encrypted login credential of the public user in the service request.

16 . The system of claim 11 , wherein authenticating the login credential of the user comprises authenticating the user by the scheduler and authenticating the scheduler by the DBaaS platform.

17 . The system of claim 16 , wherein authenticating the user by the scheduler comprises decrypting a cookie stored on the scheduler using a private key of the user.

18 . The system of claim 17 , wherein authenticating the user by the scheduler further comprises changing the login credential of the user and refreshing the cookie stored on the scheduler.

19 . The system of claim 11 , further comprising logging the service request, results of user authentication, and the predefined role corresponding to the privileges of the user.

20 . One or more computer-readable media containing program instructions for causing a computer to perform a method comprising:
authenticating a login credential of a user by a scheduler, wherein the login credential is included in an original service request of the user for a database service; determining the user has privileges for the original service request by the scheduler; mapping the user to a predefined role, wherein the predefined role comprises a combination of privileges for accessing the DBaaS platform; mapping a predefined public user to the predefined role, wherein the public user has an encrypted login credential that has been pre-authenticated to access the DBaaS platform; creating a modified service request by the scheduler by replacing the login credential of the user with the encrypted login credential of the public user in the service request; forwarding, by the scheduler, the modified service request to a DBaaS platform; and assigning an instance of database service to the user in response to the modified service request.

Assignees

• Sap Se

Inventors

• Du long
• Hou Haoxing
• Zhang Le
• Zhang Jun

Classifications

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L67/10 Primary

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• H04L9/32

  including means for verifying the identity or authority of a user of the system {or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials} · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title