Multi cloud policy enactment via organizations to cloud-provider partnerships

• US 9,961,114 B2
• Filed: 02/10/2017
• Issued: 05/01/2018
• Est. Priority Date: 08/26/2014
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Srikanth, Ranganathan, Armour, David James, Sanghvi, Ashvinkumar J., Winter, Jeremy, Ballard, John David, Need, Dwayne Richard, Parthasarathy, Srivatsan
• Primary Examiner(s): To, Baotran N
• Application Number:
  US15/430,303
• Publication Number:
  US 20170155685A1
• Time in Patent Office: 445 Days
• Field of Search: 726 1
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

A method includes acts for establishing a subscription for an entity. The method includes receiving, at a cloud service provider, a request from an entity to establish a subscription. The request includes credentials for the entity that are not proper credentials for an organization associated with the entity that the entity should use to access services for the organization. The method further includes performing a corrective action based on detecting one or more factors to determine that the entity is associated with the organization. The method further includes providing services based on the corrective action.

Claims

1. In a cloud provider service environment, a method of controlling services provided to an entity based on the entity being associated with a particular organization, the method comprising:

at a cloud service provider receiving, from the entity, a request for services provided by the cloud service provider, the request including a first set of credentials;

identifying that the entity is associated with the particular organization by determining at least one or more of;

a network identifier associated with the entity;

a billing identifier associated with the entity;

or

a physical location associated with the entity;

identifying that the first set of credentials does not match a second set of credentials that are associated with the particular organization at the cloud service provider;

based on the entity being associated with the particular organization, and even though the first set of credentials do not match the second set of credentials, querying a management service regarding policies for the particular organization that apply to the entity; and

applying the policies to the entity while providing the entity with the services.

2. The method of claim 1, wherein the management service is a third party service.

3. The method of claim 1, wherein the management service is part of the organization.

4. The method of claim 1, wherein the applying the policies includes prompting the entity for credentials.

5. The method of claim 1, wherein the applying the policies includes:

enforcing policies that are associated with the organization on a subscription that is created by the entity without using proper credentials.

6. The method of claim 1, wherein the policies are quantity and quality of service.

7. The method of claim 1, wherein the policies are configuration policies.

8. The method of claim 1, wherein the policies include access to shared enablers.

18. The method of claim 1, wherein identifying that the entity is associated with the particular organization includes receiving a network identifier in the form of one or more of a domain name associated with the entity or an IP address associated with the entity.

19. The method of claim 1, wherein identifying that the entity is associated with the particular organization includes receiving a billing identifier in the form of either or both of a billing address or a payment instrument that is already associated with the organization at the cloud service provider.

20. The method of claim 1, wherein identifying that the entity is associated with the particular organization includes receiving a physical location identifier in the form of a telephone number that is already associated with the organization at the cloud service provider.

9. A cloud provider system, wherein the cloud provider system comprises:

one or more processors; and

one or more computer readable hardware storage device, wherein the one or more computer readable hardware storage device comprises stored computer executable instructions that are executable by at least one of the one or more processors to cause at least one of the one or more processors to control services provided to an entity based on the entity being associated with a particular organization by at least implementing the following;

at the cloud system, receiving a request from the entity for services provided by the cloud service provider, the request including a first set of credentials;

identifying that the entity is associated with the particular organization by determining at least one or more of;

a network identifier associated with the entity;

a billing identifier associated with the entity;

or

a physical location associated with the entity;

identifying that the first set of credentials does not match a second set of credentials that are associated with the particular organization at the cloud service provider;

based on the entity being associated with the particular organization, and even though the first set of credentials do not match the second set of credentials, querying a management service regarding policies for the particular organization that apply to the entity; and

applying the policies to the entity while providing the entity with the services.

10. The cloud provider system of claim 9, wherein the management service is a third party service.

11. The cloud provider system of claim 9, wherein the management service is part of the organization.

12. The cloud provider system of claim 9, wherein the applying the policies includes prompting the entity for credentials.

17. The cloud provider system of claim 9, wherein the applying the policies includes enforcing policies that are associated with the organization on a subscription that is created by the entity without using proper credentials and wherein the policies include at least one or more of:

quantity and quality of service;

configuration policies;

or

access to shared enablers.

13. A computer program product comprising one or more computer readable hardware storage devices having stored thereon computer-executable instructions that are executable by one or more processors of a computing system comprising a cloud service provider to cause the computing system to control services provided by the cloud service provider to an entity based on the entity being associated with a particular organization and by at least implementing the following:

at the cloud system, receiving a request from the entity for services provided by the cloud service provider, the request including a first set of credentials;

identifying that the entity is associated with the particular organization by determining at least one or more of;

a network identifier associated with the entity;

a billing identifier associated with the entity;

or

a physical location associated with the entity;

identifying that the first set of credentials does not match a second set of credentials that are associated with the particular organization at the cloud service provider;

based on the entity being associated with the particular organization, and even though the first set of credentials do not match the second set of credentials, querying a management service regarding policies for the particular organization that apply to the entity; and

applying the policies to the entity while providing the entity with the services.

14. The computer program product of claim 13, wherein the management service is a third party service.

15. The computer program product of claim 13, wherein the management service is part of the organization.

16. The computer program product of claim 13, wherein the applying the policies includes enforcing policies that are associated with the organization on a subscription that is created by the entity without using proper credentials and wherein the policies include at least one or more of:

quantity and quality of service;

configuration policies;

or

access to shared enablers.