Resource sharing in cloud computing

• US 10,560,458 B2
• Filed: 07/06/2017
• Issued: 02/11/2020
• Est. Priority Date: 07/06/2017
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP SE
• Inventors: Drabant, Bernhard
• Primary Examiner(s): Rashid, Harunur
• Application Number:
  US15/643,362
• Publication Number:
  US 20190014120A1
• Time in Patent Office: 950 Days
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 9/4451 User profiles; Roaming
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/5072 Grid computing
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

In one respect, there is provided a system a data processor and a memory. The system can be configured to receive, from a first user associated with a first tenant, a request to access a resource associated with a second tenant. The first tenant and the second tenant can be tenants of a multi-tenant cloud-computing platform. The resource can be accessible via the multi-tenant cloud-computing platform. The first user can be authorized to access the resource associated with the second tenant based on a sharing relationship that allows the first user to access the resource. In response to determining that the first user is authorized to access the resource associated with the second tenant, access to the resource can be provided to the first user. Related methods and articles of manufacture, including computer program products, are also provided.

Claims

1. A system, comprising:

at least one data processor; and

at least one memory storing instructions which, when executed by the at least one data processor, result in operations comprising;

receiving, from a first user associated with a first tenant, a request to access a first resource associated with a second tenant, the first tenant and the second tenant being tenants of a multi-tenant cloud-computing platform, the first tenant comprising a first plurality of users including the first user, the second tenant comprising a second plurality of users, and the first resource associated with the second tenant being accessible via the multi-tenant cloud-computing platform;

determining that the first user associated with the first tenant is authorized to access the first resource associated with the second tenant based at least on a sharing relationship between the first tenant and a second user of the second plurality of users comprising the second tenant, a scope of the sharing relationship corresponding to a privilege associated with the second user, the scope of the sharing relationship including the first resource based at least on the first resource being within the privilege of the second user, and the scope of the sharing relationship further excluding a second resource associated with the second tenant based at least on the second resource exceeding the privilege associated with the second user such that applying the sharing relationship prevents the first user from accessing the second resource associated with the second tenant; and

in response to the determination that the first user is authorized to access the first resource associated with the second tenant, providing, to the first user, access to the first resource associated with the second tenant.

2. The system of claim 1, wherein the determination is based on an authorization table, the authorization table having an entry corresponding to the sharing relationship.

3. The system of claim 2, wherein the sharing relationship is formed based on a publication of the sharing relationship and a subscription to the published sharing relationship.

4. The system of claim 2, wherein the sharing relationship is formed based on a publication of the sharing relationship, an application to the published sharing relationship, and an approval of the application to the published sharing relationship.

5. The system of claim 2, wherein the sharing relationship is formed based on an explicit invitation to access the first resource associated with the second tenant.

6. The system of claim 2, further comprising:

in response to a formation of the sharing relationship, inserting, into the authorization table, the entry corresponding to the sharing relationship.

7. The system of claim 2, further comprising:

in response to a request to modify the scope of the sharing relationship, modify the entry corresponding to the sharing relationship, the entry being modified by at least adding and/or removing the first resource as being accessible based on the sharing relationship.

8. The system of claim 1, wherein the sharing relationship allows the first plurality of users associated with the first tenant to access the first resource associated with the second tenant, and wherein the first plurality of users is designated by the first tenant.

9. The system of claim 1, wherein the sharing relationship allows specifically the first user but not a second user of the first plurality of users comprising the first tenant to access the first resource associated with the second tenant.

19. The system of claim 1, further comprising:

in response to the first user requesting to access the second resource associated with the second tenant, applying the sharing relationship to at least prevent the first user from accessing the second resource associated with the second tenant.

10. A computer-implemented method, comprising:

receiving, from a first user associated with a first tenant, a request to access a first resource associated with a second tenant, the first tenant and the second tenant being tenants of a multi-tenant cloud-computing platform, the first tenant comprising a first plurality of users including the first user, the second tenant comprising a second plurality of users, and the first resource associated with the second tenant being accessible via the multi-tenant cloud-computing platform;

determining that the first user associated with the first tenant is authorized to access the first resource associated with the second tenant based at least on a sharing relationship between the first tenant and a second user of the second plurality of users comprising the second tenant, a scope of the sharing relationship corresponding to a privilege associated with the second user, the scope of the sharing relationship including the first resource based at least on the first resource being within the privilege of the second user, and the scope of the sharing relationship further excluding a second resource associated with the second tenant based at least on the second resource exceeding the privilege associated with the second user such that applying the sharing relationship prevents the first user from accessing the second resource associated with the second tenant; and

in response to the determination that the first user is authorized to access the first resource associated with the second tenant, providing, to the first user, access to the first resource associated with the second tenant.

11. The method of claim 10, wherein the determination is based on an authorization table, the authorization table having an entry corresponding to the sharing relationship.

12. The method of claim 11, wherein the sharing relationship is formed based on a publication of the sharing relationship and a subscription to the published sharing relationship.

13. The method of claim 11, wherein the sharing relationship is formed based on a publication of the sharing relationship, an application to the published sharing relationship, and an approval of the application to the published sharing relationship.

14. The method of claim 11, wherein the sharing relationship is formed based on an explicit invitation to access the first resource associated with the second tenant.

15. The method of claim 11, further comprising:

in response to a formation of the sharing relationship, inserting, into the authorization table, the entry corresponding to the sharing relationship.

16. The method of claim 11, further comprising:

in response to a request to modify the scope of the sharing relationship, modify the entry corresponding to the sharing relationship, the entry being modified by at least adding and/or removing the first resource as being accessible based on the sharing relationship.

17. The method of claim 10, wherein the sharing relationship allows specifically the first user but not a second user of the first plurality of users comprising the first tenant to access the first resource associated with the second tenant.

18. A non-transitory computer-readable storage medium including program code, which when executed by at least one data processor, cause operations comprising:

receiving, from a first user associated with a first tenant, a request to access a first resource associated with a second tenant, the first tenant and the second tenant being tenants of a multi-tenant cloud-computing platform, the first tenant comprising a first plurality of users including the first user, the second tenant comprising a second plurality of users, and the first resource associated with the second tenant being accessible via the multi-tenant cloud-computing platform;

determining that the first user associated with the first tenant is authorized to access the first resource associated with the second tenant based at least on a sharing relationship between the first tenant and a second user of the second plurality of users comprising the second tenant, a scope of the sharing relationship corresponding to a privilege associated with the second user, the scope of the sharing relationship including the first resource based at least on the first resource being within the privilege of the second user, and the scope of the sharing relationship further excluding a second resource associated with the second tenant based at least on the second resource exceeding the privilege associated with the second user such that applying the sharing relationship prevents the first user from accessing the second resource associated with the second tenant; and

in response to the determination that the first user is authorized to access the first resource associated with the second tenant, providing, to the first user, access to the first resource associated with the second tenant.