Secure cross-tenancy federation in software-as-a-service system
First Claim
1. A method of operating a computer system hosting a service application and multiple tenant subsystems having respective resources, the computer system including an access control subsystem capable of mutually isolating the tenant subsystems to prevent a given tenant from accessing the resources of another tenant, comprising:
- establishing a federated relationship between a first tenant subsystem and a user account on a second tenant subsystem, the federated relationship including visibility controls in the first tenant subsystem identifying the user account and specifying resources of the first tenant subsystem that are accessible to an authorized user of the user account in the second tenant subsystem;
performing a user authentication in the first tenant subsystem when a user of the second tenant subsystem accesses the resources, the user authentication including requesting and receiving from the second tenant subsystem a security assertion that the user has been authenticated by the second tenant subsystem as the authorized user of the user account; and
wherein each tenant subsystem includes a respective tenant identity store containing authentication information for user accounts of the respective tenant.
9 Assignments
0 Petitions
Accused Products
Abstract
In a software-as-a-service system, a federated relationship is established between a first tenant subsystem (host) and a user account on a second tenant subsystem (guest), the federated relationship including visibility controls in the host specifying resources made accessible to an authorized user of the user account. When a guest user accesses the host, an authentication is performed that includes requesting and receiving from the guest a security assertion that the user has been authenticated by the guest as the authorized user. Each tenant subsystem includes mechanisms for authenticating its own users for access control; the cross-tenancy authentication extends this operation to make and accept authentication assertions from other tenants. A second risk-based authentication may be performed for additional confidence, typically based on comparing circumstances for the present access to circumstances for past accesses.
-
Citations
22 Claims
-
1. A method of operating a computer system hosting a service application and multiple tenant subsystems having respective resources, the computer system including an access control subsystem capable of mutually isolating the tenant subsystems to prevent a given tenant from accessing the resources of another tenant, comprising:
-
establishing a federated relationship between a first tenant subsystem and a user account on a second tenant subsystem, the federated relationship including visibility controls in the first tenant subsystem identifying the user account and specifying resources of the first tenant subsystem that are accessible to an authorized user of the user account in the second tenant subsystem; performing a user authentication in the first tenant subsystem when a user of the second tenant subsystem accesses the resources, the user authentication including requesting and receiving from the second tenant subsystem a security assertion that the user has been authenticated by the second tenant subsystem as the authorized user of the user account; and wherein each tenant subsystem includes a respective tenant identity store containing authentication information for user accounts of the respective tenant. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10)
-
-
11. A computer system, comprising:
-
one or more processors; memory; input/output circuitry for coupling the computer system to local storage and to a network via which users access the computer system; and one or more high-speed data buses interconnecting the processors, memory and input/output circuitry for data transfer there between, the memory storing computer instructions and data of a service application, multiple tenant subsystems having respective resources in the local storage, wherein each tenant subsystem includes a respective tenant identity store containing authentication information for user accounts of the respective tenant, and an access control subsystem capable of mutually isolating the tenant subsystems to prevent a given tenant from accessing the resources of another tenant, the instructions being executable by the processors to cause the computer system to perform a method including; establishing a federated relationship between a first tenant subsystem and a user account on a second tenant subsystem, the federated relationship including visibility controls in the first tenant subsystem identifying the user account and specifying resources of the first tenant subsystem that are accessible to an authorized user of the user account in the second tenant subsystem; and performing a user authentication in the first tenant subsystem when a user of the second tenant subsystem accesses the resources, the user authentication including requesting and receiving from the second tenant subsystem a security assertion that the user has been authenticated by the second tenant subsystem as the authorized user of the user account. - View Dependent Claims (12, 13, 14, 15, 16, 17, 18)
-
-
19. A non-transitory computer-readable medium storing computer program instructions, the instructions being executable by a computer system to cause the computer system to host a service application, multiple tenant subsystems having respective resources, and an access control subsystem capable of mutually isolating the tenant subsystems to prevent a given tenant from accessing the resources of another tenant, the instructions further causing the computer system to perform a method including:
-
establishing a federated relationship between a first tenant subsystem and a user account on a second tenant subsystem, the federated relationship including visibility controls in the first tenant subsystem identifying the user account and specifying resources of the first tenant subsystem that are accessible to an authorized user of the user account in the second tenant subsystem; performing a user authentication in the first tenant subsystem when a user of the second tenant subsystem accesses the resources, the user authentication including requesting and receiving from the second tenant subsystem a security assertion that the user has been authenticated by the second tenant subsystem as the authorized user of the user account; and wherein each tenant subsystem includes a respective tenant identity store containing authentication information for user accounts of the respective tenant. - View Dependent Claims (20, 21, 22)
-
Specification