TASK SEGREGATION IN A MULTI-TENANT IDENTITY AND DATA SECURITY MANAGEMENT CLOUD SERVICE

• US 20170331813A1
• Filed: 03/06/2017
• Published: 11/16/2017
• Est. Priority Date: 05/11/2016
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: LANDER, Vadim, CARRU, Damien, COLE, Gary P., SONDHI, Ajay, WILSON, Gregg
• Granted Patent: US 9,838,377 B1
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

A system provides cloud-based identity and access management. The system receives a request to perform an identity management service, and accesses a microservice based on the identity management service. The system determines one or more real-time tasks and one or more near-real-time tasks that are required to be executed to complete the identity management task. The system synchronously executes the one or more real-time tasks by the microservice, and sends the one or more near-real-time tasks to a queue to be asynchronously executed.

Claims

1. A non-transitory computer readable medium having instructions stored thereon that, when executed by a processor, cause the processor to provide cloud-based identity and access management, the providing comprising:

receiving a request to perform an identity management service;

accessing a microservice based on the identity management service;

determining one or more real-time tasks and one or more near-real-time tasks that are required to be executed to complete the identity management service;

synchronously executing the one or more real-time tasks by the microservice; and

sending the one or more near-real-time tasks to a queue to be asynchronously executed.

2. The computer readable medium of claim 1, wherein the identity management service is requested to allow a user to proceed with accessing a resource.

3. The computer readable medium of claim 2, wherein the user is allowed to proceed with accessing the resource when the one or more real-time tasks are completed and before the one or more near-real-time tasks are completed.

4. The computer readable medium of claim 3, wherein the identity management service includes authenticating the user, wherein the one or more real-time tasks include validating credentials of the user and starting a corresponding session.

5. The computer readable medium of claim 4, wherein the one or more near-real-time tasks include at least one of auditing or notifications.

6. The computer readable medium of claim 1, wherein the queue is a message queue that implements a highly scalable asynchronous event management system with guaranteed delivery and processing.

7. The computer readable medium of claim 1, wherein the identity management service comprises a login service, a single sign on (SSO) service, a federation service, a token service, a directory service, a provisioning service, or a role-based access control (RBAC) service.

8. The computer readable medium of claim 1, wherein the microservice is stateless, wherein the microservice performs the identity management service based on tenant data stored in a database, wherein the database and the microservice are configured to scale independently of one another.

9. The computer readable medium of claim 8, wherein the database comprises a distributed data grid.

16. The method of claim 1, wherein the identity management service comprises a login service, a single sign on (SSO) service, a federation service, a token service, a directory service, a provisioning service, or a role-based access control (RBAC) service.

17. The method of claim 1, wherein the microservice is stateless, wherein the microservice performs the identity management service based on tenant data stored in a database, wherein the database and the microservice are configured to scale independently of one another.

18. The method of claim 17, wherein the database comprises a distributed data grid.

10. A method of cloud-based identity and access management, comprising:

receiving a request to perform an identity management service;

accessing a microservice based on the identity management service;

determining one or more real-time tasks and one or more near-real-time tasks that are required to be executed to complete the identity management service;

synchronously executing the one or more real-time tasks by the microservice; and

sending the one or more near-real-time tasks to a queue to be asynchronously executed.

11. The method of claim 10, wherein the identity management service is requested to allow a user to proceed with accessing a resource.

12. The method of claim 11, wherein the user is allowed to proceed with accessing the resource when the one or more real-time tasks are completed and before the one or more near-real-time tasks are completed.

13. The method of claim 12, wherein the identity management service includes authenticating the user, wherein the one or more real-time tasks include validating credentials of the user and starting a corresponding session.

14. The method of claim 13, wherein the one or more near-real-time task include at least one of auditing or notifications.

15. The method of claim 10, wherein the queue is a message queue that implements a highly scalable asynchronous event management system with guaranteed delivery and processing.

19. A system for providing cloud-based identity and access management, the system comprising:

a receiving module that receives a request to perform an identity management service;

an accessing module that accesses a microservice based on the identity management service;

a determining module that determines one or more real-time tasks and one or more near-real-time tasks that are required to be executed to complete the identity management task;

a synchronously executing module that synchronously executes the one or more real-time tasks by the microservice; and

a sending module that sends the one or more near-real-time tasks to a queue to be asynchronously executed.

20. The system of claim 19, wherein the identity management service is requested to allow a user to proceed with accessing a resource.