CACHING FRAMEWORK FOR A MULTI-TENANT IDENTITY AND DATA SECURITY MANAGEMENT CLOUD SERVICE

• US 20180041491A1
• Filed: 07/27/2017
• Published: 02/08/2018
• Est. Priority Date: 08/05/2016
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: GUPTA, Lokesh, PITRE, Ashutosh
• Granted Patent: US 10,735,394 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 9/50 Allocation of resources, e.g. of the central processing unit [CPU]
• CPC Class Codes: G06F 9/547 Remote procedure calls [RPC]; Web services
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 69/18 Multiprotocol handlers, e.g. single devices capable of handling multiple protocols

Abstract

A system provides cloud-based identity and access management. The system receives a request from a client for a resource, authenticates the request, and accesses a microservice based on the request. The system determines, by the microservice, whether the resource is cached in a near cache or in a remote cache, retrieves the resource from the near cache or from the remote cache when the resource is cached, and calls an administration microservice to obtain the resource when the resource is not cached. The system then provides the resource to the client.

Claims

1. A non-transitory computer readable medium having instructions stored thereon that, when executed by a processor, cause the processor to provide cloud-based identity and access management, the providing comprising:

receiving a request from a client for a resource;

authenticating the request;

accessing a microservice based on the request;

determining, by the microservice, whether the resource is cached in a near cache or in a remote cache;

retrieving the resource from the near cache or from the remote cache when the resource is cached;

calling an administration microservice to obtain the resource when the resource is not cached; and

providing the resource to the client.

2. The computer readable medium of claim 1, wherein the request comprises a Hypertext Transfer Protocol (HTTP) request, wherein the client comprises a Representational State Transfer (REST) client, wherein the administration microservice comprises a System for Cross-domain Identity Management (SCIM) microservice, wherein the providing comprises sending a JavaScript Object Notation (JSON) response payload.

3. The computer readable medium of claim 1, wherein the microservice is stateless, wherein the remote cache comprises a distributed data grid, wherein the remote cache and the microservice are configured to scale independently of one another.

4. The computer readable medium of claim 1, wherein the near cache is implemented in a virtual machine that implements the microservice.

5. The computer readable medium of claim 4, wherein the microservice obtains the resource by calling a remote Application Programming Interface (API) proxy implemented in the virtual machine that implements the microservice.

6. The computer readable medium of claim 5, wherein the remote API proxy determines whether the resource is cachable or not, and when the resource is cachable, whether the resource is configured to be cached in the near cache or in the remote cache.

7. The computer readable medium of claim 6, wherein the remote API proxy looks for the resource in the near cache when the resource is cachable and configured to be cached in the near cache, wherein the remote API proxy looks for the resource in the remote cache when the resource is cachable and configured to be cached in the remote cache.

8. The computer readable medium of claim 7, wherein the remote API proxy calls the administration microservice to obtain the resource if the resource is not cachable or if the resource is cachable but is not cached in the near cache or in the remote cache.

9. The computer readable medium of claim 1, wherein the resource is configured to be cached in the near cache when the resource is not a tenant specific resource.

10. The computer readable medium of claim 1, wherein a file stored at a global database indicates whether the resource is cachable, and if cachable, whether the resource is configured to be cached in the remote cache or in the near cache.

11. The computer readable medium of claim 1, wherein the resource is configured to be cached in the remote cache when the resource is a tenant specific resource.

12. The computer readable medium of claim 1, wherein the remote cache implements a different namespace for each tenant that uses the microservice.

13. A method of providing cloud-based identity and access management, comprising:

receiving a request from a client for a resource;

authenticating the request;

accessing a microservice based on the request;

determining, by the microservice, whether the resource is cached in a near cache or in a remote cache;

retrieving the resource from the near cache or from the remote cache when the resource is cached;

calling an administration microservice to obtain the resource when the resource is not cached; and

providing the resource to the client.

14. The method of claim 13, wherein the request comprises a Hypertext Transfer Protocol (HTTP) request, wherein the client comprises a Representational State Transfer (REST) client, wherein the administration microservice comprises a System for Cross-domain Identity Management (SCIM) microservice, wherein the providing comprises sending a JavaScript Object Notation (JSON) response payload.

15. The method of claim 13, wherein the microservice is stateless, wherein the remote cache comprises a distributed data grid, wherein the remote cache and the microservice are configured to scale independently of one another.

16. The method of claim 13, wherein the near cache is implemented in a virtual machine that implements the microservice.

17. The method of claim 16, wherein the microservice obtains the resource by calling a remote Application Programming Interface (API) proxy implemented in the virtual machine that implements the microservice.

18. The method of claim 17, wherein the remote API proxy determines whether the resource is cachable or not, and when the resource is cachable, whether the resource is configured to be cached in the near cache or in the remote cache.

19. The method of claim 18, wherein the remote API proxy looks for the resource in the near cache when the resource is cachable and configured to be cached in the near cache, wherein the remote API proxy looks for the resource in the remote cache when the resource is cachable and configured to be cached in the remote cache.

20. A system comprising:

a processor; and

a non-transitory computer readable medium having instructions stored thereon that, when executed by the processor, cause the processor to provide cloud-based identity and access management, the providing comprising;

receiving a request from a client for a resource;

authenticating the request;

accessing a microservice based on the request;

determining, by the microservice, whether the resource is cached in a near cache or in a remote cache;

retrieving the resource from the near cache or from the remote cache when the resource is cached;

calling an administration microservice to obtain the resource when the resource is not cached; and

providing the resource to the client.