CLOUD SERVICES LAYER

• US 20120102539A1
• Filed: 10/20/2010
• Published: 04/26/2012
• Est. Priority Date: 10/20/2010
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Inventors: McKee, Martin W., Robb, Terence, Harris, Roger Dale, Lacey, William Martin
• Granted Patent: US 8,516,249 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6272 by registering files or documents with a third party
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A method including receiving a service registration request to register a service with a multi-tenant, multi-service cloud network from a user; registering object types that pertain to the service, wherein the object types include at least one service object type that is not an object type offered by the cloud network to the user; and registering objects based on the object types, wherein the objects include at least one object associated with the at least one service object type.

Claims

1. A method comprising:

receiving a service registration request to register a service with a multi-tenant, multi-service cloud network from a user;

registering object types that pertain to the service, wherein the object types include at least one service object type that is not an object type offered by the cloud network to the user; and

registering objects based on the object types, wherein the objects include at least one object associated with the at least one service object type.

2. The method of claim 1, wherein the object types include a service object type that is offered by the cloud network to the user.

3. The method of claim 1, wherein the object types include a policy object type, a role object type, a permission object type, and a privilege object type, and the method further comprising:

registering policy objects, role objects, permission objects, and privilege objects that pertain to the object types.

4. The method of claim 3, wherein the object types include a user object type, a group object type, and an organization object type, and the method further comprising:

registering user objects, group objects, and organization objects that pertain to the object types; and

linking the privilege objects with other registered objects.

5. The method of claim 1, wherein the object types include an organization object type, and the method further comprising:

registering a root organization object, wherein the root organization object includes a root organization identifier; and

registering at least one child organization object, wherein the at least one child organization object includes an at least one organization identifier that identifies the at least one child organization object and an at least one parent identifier that identifies a parent organization object of the at least one child organization object.

6. The method of claim 1, wherein the object type includes a user object type, and the method further comprising:

registering user objects that each include an object identifier that identifies a user object and an organization identifier that identifies an organization object that the user object belongs;

registering privilege objects; and

allowing the user objects to inherit the privilege objects directly or indirectly through an organization membership associated with the user objects.

7. The method of claim 1, further comprising:

performing a permission check when a user requests to perform an action with respect to a registered service, wherein the permission check includes;

determining whether a privilege exists for the user requesting to perform the action; and

assigning a default privilege to the user requesting to perform the action when a privilege does not exist for the user requesting to perform the action.

8. The method of claim 7, further comprising:

assigning a higher priority to a privilege relative to another privilege when the privilege is determined to be more directly linked to the user requesting to perform the action than the other privilege;

selecting the privilege having the higher priority relative to the other privilege having a lower priority; and

determining whether to grant or deny the action based on the selected privilege.

9. The method of claim 1, wherein the service includes one of an end service, a management service, or a function associated with the service.

10. The method of claim 1, further comprising:

registering a service object that includes a service identifier that identifies the service and an organization identifier that identifies an organization to which the service object belongs.

11. A cloud services layer comprising one or more devices having logic configured to:

receive a service registration request to register a service with a cloud network from a user;

register object types that pertain to the service, wherein the object types include at least one service object type that is not an object type offered by the cloud network;

register objects based on the object types, wherein the objects include at least one object associated with the at least one service object type; and

grant or deny use of the service or a function associated with the service based on the objects.

12. The cloud services layer of claim 11, wherein the object types include a policy object type, a role object type, a permission object type, and a privilege object type, and the objects include a policy object, a role object, an permission object, and a privilege object.

13. The cloud services layer of claim 11, wherein the object types include a service object type that is offered by the cloud network to the user.

14. The cloud services layer of claim 11, wherein the object types include a user object type, a group object type, and an organization object type, and the objects include a user object, a group object, and an organization object.

15. The cloud services layer of claim 14, wherein the logic is further configured to:

allow the user object to inherit a privilege object directly or indirectly through a group membership or an organization membership associated with the user object.

16. The cloud services layer of claim 11, wherein the logic is further configured to:

perform a permission check when a user requests to access or use a registered service, wherein the permission check includes;

determine whether a privilege exists for the user requesting to perform the action;

assign a default privilege to the user requesting to perform the action when a privilege does not exist; and

grant or deny the access to or the use of the registered service based on the default privilege.

17. The cloud services layer of claim 16, wherein the logic is further configured to:

assign a higher priority to a privilege relative to another privilege when the privilege is determined to be more directly linked to the user requesting to access or use the registered service;

select the privilege having the higher priority relative to the other privilege having a lower priority; and

determine whether to grant or deny the access or the use of the registered service based on the selected privilege.

18. The cloud services layer of claim 11, wherein the objects include a privilege object that associates at least one of a policy object with a user object, a policy object with a group object, or a policy object with an organization object, and the logic is further configured to:

deny or grant permission to a user to access or use a registered service based on the privilege object.

19. The cloud services layer of claim 11, wherein the logic is further configured to:

register links between an organization object and at least one of a user object, a group object, or a service object; and

register links between a service object and at least one of a permission object, a role object, or a policy object.

20. A computer-readable medium storing instructions executable by at least one processor, the computer-readable medium storing instructions for:

receiving a service registration request to register a service with a multi-tenant, multi-service cloud network a user;

registering object types that pertain to the service, wherein the object types include at least one service object type that is not an object type offered by the cloud network to the user;

registering objects based on the object types, wherein the objects include at least one object associated with the at least one service object type; and

granting or denying use of the service or a function associated with the service based on the objects.