Nested tenants

• US 10,747,578 B2
• Filed: 04/27/2018
• Issued: 08/18/2020
• Est. Priority Date: 04/27/2018
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Van Hoof, Hubert, Vandenbrouck, Gregory Christopher John, Zhou, Yurui, Petralli, Andres Carlo, Brennan, David John
• Primary Examiner(s): Keller, Michael A
• Assistant Examiner(s): Duong, Thao D
• Application Number:
  US15/964,736
• Publication Number:
  US 20190332437A1
• Time in Patent Office: 844 Days
• CPC Class Codes: G06F 16/9024 Graphs; Linked lists G06F16/9027 takes precedence
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 9/5027 the resource being a machine, e.g. CPUs, Servers, Terminals
• CPC Class Codes: G06F 9/5061 Partitioning or combining of resources
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/5061 characterised by the interaction between service providers and their network customers, e.g. customer relationship management

Abstract

Isolating resources between sub-entities. A method includes receiving data from a particular connected device. A memory storing a hierarchical graph that defines a topology for an entity is accessed. Branches or leaves in the graph include a node that represents a connected device, such as a sensor, controller, or computing system. Each connected device is configured to provide data or receive control signals. Each of the branches or leaves can be indicated as belonging to a particular sub-entity. A particular branch from the hierarchical graph having the particular connected device is identified using the graph. A sub-entity to which the particular branch belongs is identified. The method identifies that the particular sub-entity should be isolated from other sub entities. The data from the particular connected device is provided to a set of resources specifically allocated for the particular sub-entity.

Claims

1. A computing system comprising:

a memory storing a hierarchical graph that defines a topology for an entity, the hierarchical graph comprising a top node for the entity and a plurality of branches or leaves coupled, through 0 or more intermediate nodes, to the top node of the entity, each of the branches or leaves in the plurality of branches or leaves comprising a node that identifies a connected device, wherein each connected device is configured to provide data or receive control signals, and where each of the branches or leaves is associated in memory with a different customer of the entity and each of the branches or leaves includes a collection of nodes identifying one or more connected devices of the associated customer;

a service, wherein the service is configured to;

be coupled to one or more sets of resources, wherein each of the sets of resources can be accessed by the service in isolation from each other set of resources;

receive data from a particular connected device identified by a first node in the hierarchical graph;

identify a particular branch or leaf from the hierarchical graph that includes the first node identifying the particular connected device;

use the hierarchical graph to identify a customer associated with the particular branch or leaf including the first node;

access a stored data structure to determine that data for the particular customer should be isolated from other customers of the entity associated with other branches or leaves of the hierarchical graph; and

provide the data from the particular connected device to a set of resources specifically allocated for the customer associated with the identified branch or leaf without providing the data to other customers of the entity associated with other branches or leaves correlated with different sets of resources.

2. The computing system of claim 1, wherein the top node represents a cloud tenant on the service.

3. The computing system of claim 1, wherein one or more branches or leaves represent divisions of an organization.

4. The computing system of claim 1, wherein one or more branches or leaves represent locations of an organization.

5. The computing system of claim 1, wherein different sets of resources for different branches or leaves are configured to comply with resource centric requirements specific to locations of the customer associated with each of the different branches or leaves.

6. The computing system of claim 1, wherein one or more branches or leaves represent floors of a building.

7. The computing system of claim 1, wherein one or more branches or leaves represent areas of floors of a building.

8. A method of isolating resources between sub-entities, the method comprising:

receiving data from a particular connected device;

accessing a memory storing a hierarchical graph that defines a topology for an entity, the hierarchical graph comprising a top node for the entity and a plurality of branches or leaves coupled, through 0 or more intermediate nodes, to the top node of the entity, each of the branches or leaves in the plurality of branches or leaves being associated in memory with a different customer of the entity and including a node that identifies a connected device, wherein each connected device is configured to provide data or receive control signals;

using the graph, identifying a particular branch or leaf from the hierarchical graph having the particular connected device and a customer associated with the particular branch or leaf;

access a stored data structure to determine that data of the particular customer should be isolated from other customers of the entity associated with other branches or leaves of the hierarchical graph; and

providing the data from the particular connected device to a set of resources specifically allocated for the particular customer associated with the particular branch or leaf without providing the data to other customers of the entity associated with other branches or leaves correlated with different sets of resources.

9. The method of claim 8, wherein the top node represents a cloud tenant on the service, and one or more of the branches or leaves represent customers of the cloud tenant.

10. The method of claim 8, wherein one or more branches or leaves represent divisions of an organization.

11. The method of claim 8, wherein one or more branches or leaves represent locations of an organization.

12. The method of claim 8, wherein different sets of resources for different branches or leaves are configured to comply with resource centric requirements specific to locations of the customer associated with each of the different branches or leaves.

13. The method of claim 8, wherein one or more branches or leaves represent floors of a building.

14. The method of claim 8, wherein one or more branches or leaves represent areas of floors of a building.

15. A computing system comprising:

one or more processors; and

one or more computer-readable media having stored thereon instructions that are executable by the one or more processors to configure the computer system to isolate resources between customers of an entity, including instructions that are executable to configure the computer system to perform at least the following;

receive data from a particular connected device;

access a memory storing a hierarchical graph that defines a topology for the entity, the hierarchical graph comprising a top node for the entity and a plurality of branches or leaves coupled, through 0 or more intermediate nodes, to the top node of the entity, each of the branches or leaves in the plurality of branches or leaves being associated in memory with a different one of the customers of the entity and including a collection of nodes identifying one or more connected devices of the associated customer, wherein each connected device is configured to provide data or receive control signals;

using the graph, identify a particular branch from the hierarchical graph having the particular connected device and a particular customer associated with the particular branch;

access a stored data structure to determine that data for the particular customer should be isolated from other customers associated with other branches of the hierarchical graph; and

provide the data from the particular connected device to a set of resources specifically allocated for the particular customer without providing the data to other customers of the entity associated with other branches or leaves correlated with different sets of resources.

16. The computing system of claim 15, wherein the top node represents a cloud tenant on the service, and one or more of the branches or leaves represent customers of the cloud tenant.

17. The computing system of claim 15, wherein one or more branches or leaves represent divisions of an organization.

18. The computing system of claim 15, wherein one or more branches or leaves represent locations of an organization.

19. The computing system of claim 18, wherein different sets of resources for different branches or leaves are configured to comply with resource centric requirements.

20. The computing system of claim 15, wherein one or more branches or leaves represent floors of a building.