Task segregation in a multi-tenant identity and data security management cloud service

• US 9,838,377 B1
• Filed: 03/06/2017
• Issued: 12/05/2017
• Est. Priority Date: 05/11/2016
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Lander, Vadim, Carru, Damien, Cole, Gary P., Sondhi, Ajay, Wilson, Gregg
• Primary Examiner(s): Le, Chau
• Application Number:
  US15/450,550
• Publication Number:
  US 20170331813A1
• Time in Patent Office: 274 Days
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

A system provides cloud-based identity and access management. The system receives a request to perform an identity management service, and accesses a microservice based on the identity management service. The system determines one or more real-time tasks and one or more near-real-time tasks that are required to be executed to complete the identity management task. The system synchronously executes the one or more real-time tasks by the microservice, and sends the one or more near-real-time tasks to a queue to be asynchronously executed.

Claims

1. A non-transitory computer readable medium having instructions stored thereon that, when executed by a processor, cause the processor to provide cloud-based identity and access management, the provide comprising:

receiving a request to perform an identity management service comprising a login service, wherein responding to the request comprises a plurality of tasks;

accessing a microservice via an application programming interface (API) unique to the microservice and based on the identity management service;

determining one or more real-time tasks of the plurality of tasks and one or more near-real-time tasks of the plurality of tasks that are required to be executed to complete the identity management service;

synchronously executing the one or more real-time tasks by the microservice to allow a user to initiate the login service; and

sending the one or more near-real-time tasks to a queue to be asynchronously executed after the user has initiated the login service.

2. The computer readable medium of claim 1, wherein the identity management service is requested to allow a user to proceed with accessing a resource.

3. The computer readable medium of claim 2, wherein the user is allowed to proceed with accessing the resource when the one or more real-time tasks are completed and before the one or more near-real-time tasks are completed.

4. The computer readable medium of claim 3, wherein the identity management service includes authenticating the user, wherein the one or more real-time tasks include validating credentials of the user and starting a corresponding session.

5. The computer readable medium of claim 4, wherein the one or more near-real-time tasks include at least one of auditing or notifications.

6. The computer readable medium of claim 1, wherein the queue is a message queue that implements a highly scalable asynchronous event management system with guaranteed delivery and processing.

7. The computer readable medium of claim 1, wherein the identity management service comprises, a single sign on (SSO) service, a federation service, a token service, a directory service, a provisioning service, or a role-based access control (RBAC) service.

8. The computer readable medium of claim 1, wherein the microservice is stateless, wherein the microservice performs the identity management service based on tenant data stored in a database, wherein the database and the microservice are configured to scale independently of one another.

9. The computer readable medium of claim 8, wherein the database comprises a distributed data grid.

10. A method of cloud-based identity and access management, comprising:

receiving a request to perform an identity management service comprising a login service, wherein responding to the request comprises a plurality of tasks;

accessing a microservice via an application programming interface (API) unique to the microservice and based on the identity management service;

determining one or more real-time tasks of the plurality of tasks and one or more near-real-time tasks of the plurality of tasks that are required to be executed to complete the identity management service;

synchronously executing the one or more real-time tasks by the microservice to allow a user to initiate the login service; and

sending the one or more near-real-time tasks to a queue to be asynchronously executed after the user has initiated the login service.

11. The method of claim 10, wherein the identity management service is requested to allow a user to proceed with accessing a resource.

12. The method of claim 11, wherein the user is allowed to proceed with accessing the resource when the one or more real-time tasks are completed and before the one or more near-real-time tasks are completed.

13. The method of claim 12, wherein the identity management service includes authenticating the user, wherein the one or more real-time tasks include validating credentials of the user and starting a corresponding session.

14. The method of claim 13, wherein the one or more near-real-time task include at least one of auditing or notifications.

15. The method of claim 10, wherein the queue is a message queue that implements a highly scalable asynchronous event management system with guaranteed delivery and processing.

16. The method of claim 10, wherein the identity management service comprises, a single sign on (SSO) service, a federation service, a token service, a directory service, a provisioning service, or a role-based access control (RBAC) service.

17. The method of claim 10, wherein the microservice is stateless, wherein the microservice performs the identity management service based on tenant data stored in a database, wherein the database and the microservice are configured to scale independently of one another.

18. The method of claim 17, wherein the database comprises a distributed data grid.

19. A system for providing cloud-based identity and access management, the system comprising:

a processor coupled to a storage device comprising instructions, wherein the processor executed the instructions to implement modules comprising;

a receiving module that receives a request to perform an identity management service comprising a login service, wherein responding to the request comprises a plurality of tasks;

an accessing module that accesses a microservice via an application programming interface (API) unique to the microservice and based on the identity management service;

a determining module that determines one or more real-time tasks of the plurality of tasks and one or more near-real-time tasks of the plurality of tasks that are required to be executed to complete the identity management service;

a synchronously executing module that synchronously executes the one or more real-time tasks by the microservice to allow a user to initiate the login service; and

a sending module that sends the one or more near-real-time tasks to a queue to be asynchronously executed after the user has initiated the login service.

20. The system of claim 19, wherein the identity management service is requested to allow a user to proceed with accessing a resource.