SAML representation for multi-tenancy environments

Patent metadata

Field	Value
Publication number	US-9992186-B1
Application number	US-201514788362-A
Country	US
Kind code	B1
Filing date	Jun 30, 2015
Priority date	Jun 30, 2015
Publication date	Jun 5, 2018
Grant date	Jun 5, 2018

Abstract

In response to a request received from a client device, the user is authenticated based on user credentials extracted from the request. Upon having successfully authenticated the user, tenants and one or more roles of each of the tenants associated with the user are identified. In one embodiment, an authorization token having information identifying the plurality of tenants and their respective one or more roles of the user is generated. The information of each of the tenants and its respective roles are encrypted with a specific key corresponding to the tenant. The authorization token containing the encrypted tenants and the roles of the user is transmitted to the client device to allow the client device to determine whether the user is allowed to access a requested resource based on the authorization token.

First claim

What is claimed is:

1. A computer-implemented method for authenticating and authorizing users in a multi-tenant storage system, the method comprising:
in response to a request received from a client device for authenticating and authorizing a user, authenticating the user based on user credentials extracted from the request;
upon having successfully authenticated the user, identifying a plurality of tenants that is represented by a tenant hierarchical tree having at least one of the tenants being a child tenant of a parent tenant, one or more roles of each of the tenants, and one or more privileges of each of the roles of each of the tenants associated with the user, wherein the one or more privileges include a privilege to access one or more data files and a privilege to realign the tenant hierarchical tree, each of the one or more data files having one or more data segments stored in a deduplicated manner;
generating an authorization token having information identifying the plurality of tenants, their respective one or more roles of the user, and their respective one or more privileges of each of the roles of each of the tenants, wherein one or more portions of the information of each of the tenants, its respective roles, and its respective privileges are encrypted with one or more specific keys corresponding to each of the tenants, wherein each portion of the information is encrypted with a specific key that is associated with a specific tenant of the user; and
transmitting the authorization token containing the encrypted tenants, the roles, and the privileges of the user to the client device to allow the client device to determine whether the user is allowed to access a requested resource based on the one or more portions of the information of the authorization token.

2. The method of claim 1 , further comprising:
determining a first set of one or more roles of the user associated with a first of the plurality of tenants and a first set of one or more privileges associated with the first set of roles;
determining a second set of one or more roles of the user associated with a second of the plurality of tenants and a second set of one or more privileges associated with the second set of roles;
encrypting information representing the first set of roles and the first set of privileges into a first encrypted block using a first key that is associated with the first tenant;
encrypting information representing the second set of roles and the second set of privileges into a second encrypted block using a second key that is associated with the second tenant; and
encapsulating the first encrypted block and the second encrypted block in the authorization token.

3. The method of claim 2 , further comprising:
performing a first lookup operation in a key database based on a first tenant identifier identifying the first tenant to retrieve the first key; and
performing a second lookup operation in the key database based on a second tenant identifier identifying the second tenant to retrieve the second key.

4. The method of claim 2 , wherein the first key is a first public key of a first key pair, and wherein in order to determine whether the user is entitled to access data associated with the first tenant, the client device is required to have a first private key of the first key pair to decrypt the first encrypted block.

5. The method of claim 4 , wherein the second key is a second public key of a second key pair, and wherein in order to determine whether the user is entitled to access data associated with the second tenant, the client device is required to have a second private key of the second key pair to decrypt the second encrypted block.

6. The method of claim 1 , wherein the authorization token is generated using a security assertion markup language (SAML).

7. The method of claim 2 , wherein the first encrypted block is represented by a first encrypted SAML assertion, and wherein the second encrypted block is represented by a second encrypted SAML assertion.

8. A non-transitory machine-readable medium having instructions stored therein, which when executed by a processor, cause the processor to perform operations for authenticating and authorizing users in a multi-tenant storage system, the operations comprising:
in response to a request received from a client device for authenticating and authorizing a user, authenticating the user based on user credentials extracted from the request;
upon having successfully authenticated the user, identifying a plurality of tenants that is represented by a tenant hierarchical tree having at least one of the tenants being a child tenant of a parent tenant, one or more roles of each of the tenants, and one or more privileges of each of the roles of each of the tenants associated with the user, wherein the one or more privileges include a privilege to access one or more data files and a privilege to realign the tenant hierarchical tree, each of the one or more data files having one or more data segments stored in a deduplicated manner;
generating an authorization token having information identifying the plurality of tenants, their respective one or more roles of the user, and their one or more privileges of each of the roles of each of the tenants, wherein one or more portions of the information of each of the tenants, its respective roles, and its respective privileges are encrypted with one or more specific keys corresponding to each of the tenants, wherein each portion of the information is encrypted with a specific key that is associated with a specific tenant of the user; and
transmitting the authorization token containing the encrypted tenants, the roles, and the privileges of the user to the client device to allow the client device to determine whether the user is allowed to access a requested resource based on the one or more portions of the information of the authorization token.

9. The medium of claim 8 , further comprising:
determining a first set of one or more roles of the user associated with a first of the plurality of tenants and a first set of one or more privileges associated with the first set of roles;
determining a second set of one or more roles of the user associated with a second of the plurality of tenants and a second set of one or more privileges associated with the second set of roles;
encrypting information representing the first set of roles and the first set of privileges into a first encrypted block using a first key that is associated with the first tenant;
encrypting information representing the second set of roles and the second set of privileges into a second encrypted block using a second key that is associated with the second tenant; and
encapsulating the first encrypted block and the second encrypted block in the authorization token.

10. The medium of claim 9 , further comprising:
performing a first lookup operation in a key database based on a first tenant identifier identifying the first tenant to retrieve the first key; and
performing a second lookup operation in the key database based on a second tenant identifier identifying the second tenant to retrieve the second key.

11. The medium of claim 9 , wherein the first key is a first public key of a first key pair, and wherein in order to determine whether the user is entitled to access data associated with the first tenant, the client device is required to have a first private key of the first key pair to decrypt the first encrypted block.

12. The medium of claim 11 , wherein the second key is a second public key of a second key pair, and wherein in order to determine whether the user is entitled to access data associated with the second t

Assignees

• Emc Corp
• Emc Ip Holding Co Llc

Inventors

• Drozd Michal J
• Shtop Aliaksandr
• Fischer Ilia
• Morozov Vitaly
• Roche michael g

Classifications

• H04L63/0807 Primary

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L63/0435

  wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06) · CPC title

• H04L63/0815

  providing single-sign-on or federations · CPC title

• H04L63/102 Primary

  Entity profiles · CPC title