Stack fusion architecture including distributed software clusters to enable software communication services

Patent metadata

Field	Value
Publication number	US-9672380-B2
Application number	US-201615198052-A
Country	US
Kind code	B2
Filing date	Jun 30, 2016
Priority date	Dec 5, 2014
Publication date	Jun 6, 2017
Grant date	Jun 6, 2017

Abstract

A stack fusion architecture enables a cloud provider to provide Software-as-a-Service (SaaS) offerings to multiple organizations. Each organization operates a Infrastructure-as-a-Service (IaaS) platform and is associated with an organization domain. A cluster of software/communication services is deployed to each platform. Each IaaS platform is deployed to a data center and includes compute, storage, and network resources and an IaaS operating system. Users registered to an organization domain have access limited to the cluster uniquely associated with that domain. The architecture includes a globally accessible domain-to-cluster map used to map each cluster to the associated domain. A locally accessible user-to-cluster map is stored in each cluster to map that cluster to each user registered to the domain uniquely associated with that cluster. The architecture enables communication between users provisioned on different clusters and registered to different domains without exposing private information to the cloud provider.

First claim

What is claimed is:

1. A method comprising:
in a system in which a cloud provider is configured to provide Software-as-a-Service (SaaS) offerings to multiple organizations, each organization to operate a distinct Infrastructure-as-a-Service (IaaS) platform and being associated with at least one distinct organization domain associated with the organization:
deploying to each IaaS platform a cluster of software services, including communication services, operated by the cloud provider, each cluster being uniquely associated with the organization that operates that IaaS platform;
deploying to each cluster a provisioning service to perform provisioning of users, and one of the communication services to support communications between users provisioned in one cluster and between users provisioned on different clusters;
deploying each IaaS platform to a data center, wherein each IaaS platform includes compute, storage, and network resources and an IaaS operating system;
provisioning users that belong to each organization on the cluster associated with that organization, wherein the provisioning includes storing user information for each user only on the associated cluster; and
enabling users provisioned on different clusters to communicate with each other as if the users were part of a centralized cloud communication service, without sharing respective user information with the cloud provider.

2. The method of claim 1 , further comprising:
configuring each IaaS platform remotely from the cloud provider via the IaaS operating system for that platform.

3. The method of claim 1 , wherein the deploying to each cluster further includes deploying to each cluster an authentication and authorization service to authenticate and authorize only provisioned users to invoke the other services deployed to the cluster.

4. The method of claim 1 , wherein the enabling includes:
creating a globally accessible domain-to-cluster map in order to map each cluster to the organization domain uniquely associated therewith; and
storing in each cluster a locally accessible user-to-cluster map in order to map that cluster to each user provisioned on that cluster.

5. The method of claim 4 , wherein:
the provisioning users includes storing an email address for each user including an organization domain to which the user belongs and a user identifier; and
the enabling includes:
receiving a request to communicate with a user using a communication service, the request including a user email address of the user; and
directing the request to the communication service in the cluster uniquely associated with the organization domain to which the user belongs based on the user email address, the domain-to-cluster map, and one of the user-to-cluster maps.

6. The method of claim 1 , wherein the provisioning of a given cluster with user information identifying a given user associated with an organization includes:
receiving a user email address for the user to be provisioned, the user email address including a user identifier and the organization domain corresponding to the organization;
searching a domain-to-cluster map stored with the cloud provider for the cluster associated with the organization domain in the email address;
if the associated cluster is found as a result of the searching, constructing an address of a provisioning service deployed on the associated cluster; and
invoking the provisioning service in the associated cluster to add the private user information thereto.

7. A system comprising:
multiple infrastructure-as-a-Service (IaaS) platforms each to be operated by a corresponding one of multiple organizations and being associated with at least one organization domain claimed by the organization that is to operate that IaaS platform;
multiple clusters of software services, including communication services, deployed on corresponding ones of the IaaS platforms and being uniquely associated with the organization domain corresponding to the organization that operates that IaaS platform on which the cluster is deployed, wherein the software services include offerings from a cloud provider;
wherein each IaaS platform is deployed to a data center and includes compute, storage, and network resources and an IaaS operating system;
wherein users that belong to each organization domain are provisioned only on the cluster uniquely associated with that organization domain, such that user information for each user is stored only on the associated cluster; and
wherein users provisioned on different clusters are enabled to communicate with each other as if the users were part of a centralized cloud communication service, and without sharing respective user information with the cloud provider, wherein the users provisioned on the different clusters are enabled to communicate by:
creating a globally accessible domain-to-cluster map to map each cluster to the organization domain uniquely associated therewith; and
storing in each cluster a locally accessible user-to-cluster map to map that cluster to each user provisioned on that cluster.

8. The system of claim 7 , wherein each IaaS platform is configured remotely from the cloud provider via the IaaS operating system for that platform.

9. The system of claim 7 , further comprising a provisioning service to perform the provisioning users deployed to each cluster, and a communication service is deployed to each cluster to support communications between users provisioned in one cluster and between users provisioned on different clusters.

10. The system of claim 9 , further comprising an authentication and authorization service deployed to each cluster to authenticate and authorize only provisioned users to invoke the other services deployed to the cluster.

11. The system of claim 7 , wherein:
the users are provisioned by storing an email address for each user including an organization domain to which the user belongs and a user identifier; and
the users provisioned on different clusters are enabled to communicate with each other by:
receiving a request to communicate with a user using a communication service, the request including an email address of the user; and
directing the request to the communication service in the cluster uniquely associated with the organization domain to which the user belongs based on the user email address, the domain-to-cluster map, and one of the user-to-cluster maps.

12. The system of claim 7 , wherein a given cluster is provisioned with user information identifying a given user associated with an organization by:
receiving a user email address for the user to be provisioned, the user email address including a user identifier and the organization domain corresponding to the organization;
searching a domain-to-cluster map stored with the cloud provider for the cluster associated with the organization domain in the email address;
if the associated cluster is found as a result of the searching, constructing an address of a provisioning service deployed on the associated cluster; and
invoking the provisioning service in the associated cluster to add the private user information thereto.

13. One or more non-transitory computer readable storage mediums encoded with instructions that, when executed by one or more processors of a system in which a cloud provider is configured to provide Software-as-a-Service (SaaS) offerings to multiple organizations, each organization to operate a distinct Infrastructure-as-a-Service (IaaS) platform and being associated with at least one distinct organization domain associated with the organization, the instructions configured to cause the one or more processors

Assignees

• Cisco Tech Inc

Inventors

• Rosenberg Jonathan
• Linskey Patrick
• Quelle Reinhardt

Classifications

• H04L51/28

  Electricity · mapped topic

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/102

  Entity profiles · CPC title

• G06F8/60

  Software deployment · CPC title

• H04L12/1886

  with traffic restrictions for efficiency improvement, e.g. involving subnets or subdomains · CPC title