SECURE MACHINE ENROLLMENT IN MULTI-TENANT SUBSCRIPTION ENVIRONMENT

• US 20130111558A1
• Filed: 10/31/2011
• Published: 05/02/2013
• Est. Priority Date: 10/31/2011
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Chen, Jiazhen, Chavez, Anthony S., Sangubhatla, Murali Krishna, Rangegowda, Dharshan, Brown, Morgan Asher
• Granted Patent: US 8,819,801 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

In a multi-tenant environment, machines across the Internet, belonging to a particular subscription are securely enrolled with the tenant'"'"'s subscription. Authentication of the machines is delegated to each of the tenant'"'"'s own on-premise authentication mechanism The trust relationship with the tenant'"'"'s authentication service is used to validate the security token presented by the machine being authenticated. Once authenticated, the machine has authorization (e.g. SSL machine cert for identity, security token, etc.,) to access the subscription. Each tenant within the multi-tenant environment can provide its own level of authentication. The machine presents the security token to the multi-tenant environment for requests for resources (e.g. services/content) from a user. When a request is received from a machine to access a resource, the multi-tenant environment determines from the issued token whether or not the machine is authorized to access the requested resources.

Claims

1. A method for securely enrolling a machine in a multi-tenant environment, comprising:

receiving a request from a machine to access a resource of a tenant in a multi-tenant environment that includes a token;

retrieving a trust relationship established with the tenant;

determining when the token is valid;

determining when the machine is authorized by the tenant to access the resource of the tenant using the token and the trust relationship; and

authorizing access to the resource when the machine is determined to be authenticated by the tenant.

2. The method of claim 1, wherein determining when the token is valid comprises determining when the token was issued to the machine from the tenant.

3. The method of claim 1, further comprising requesting the tenant that is associated with the resource to attempt to authenticate the machine when it is determined to authenticate the machine.

4. The method of claim 1, further comprising establishing a trust relationship between the multi-tenant environment and each of the tenants of the multi-tenant environment.

5. The method of claim 4, wherein the trust relationship uses at least one of:

Public Key Infrastructure (PKI) and Security Token Service (STS).

6. The method of claim 4, wherein each of the tenants provides to the multi-tenant environment at least one issuer of certificates that is authorized to authenticate machines of the tenant.

7. The method of claim 1, wherein the multi-tenant environment is a cloud based service that provides resources to different tenants at different network locations wherein data that is associated with each of the different tenants is protected from access by the other tenants.

8. The method of claim 1, wherein each tenant specifies its authentication procedures that employ different authentication protocols.

9. The method of claim 1, further comprising receiving login information from a user of the machine at the multi-tenant environment and associating the user with a tenant of the multi-tenant environment.

10. A computer-readable medium having computer-executable instructions for securely enrolling a machine in a multi-tenant environment, comprising:

receiving a request at a multi-tenant cloud based service from a machine to access a resource of a tenant in a multi-tenant environment;

determining when the machine is authorized by the tenant to access the resource of the tenant by determining when a token is issued to the machine from the tenant that authorizes the machine to access the resource and verifying a root certificate issued by a certification authority associated with the tenant; and

authorizing access to the resource when the machine is determined to be authenticated by the tenant.

11. The computer-readable medium of claim 10, further comprising requesting the tenant that is associated with the resource to attempt to authenticate the machine when it is determined to authenticate the machine.

12. The computer-readable medium of claim 10, further comprising establishing a trust relationship between the multi-tenant environment and each of the tenants of the multi-tenant environment using authentication protocols defined by each of the tenants.

13. The computer-readable medium of claim 12, wherein the trust relationship uses at least one of:

Public Key Infrastructure (PKI) and Security Token Service (STS).

14. The computer-readable medium of claim 12, wherein each of the tenants provides to the multi-tenant environment at least one issuer of certificates that is authorized to authenticate machines of the tenant.

15. The computer-readable medium of claim 10, wherein each tenant specifies its own level of authentication procedures defining when to allow access to the resource.

16. The computer-readable medium of claim 10, further comprising receiving login information from a user of the machine at the multi-tenant environment and associating the user with a tenant of the multi-tenant environment.

17. A system for securely enrolling a machine in a multi-tenant environment, comprising:

a network connection that is coupled to tenants of the multi-tenant environment;

a processor and a computer-readable medium;

an operating environment stored on the computer-readable medium and executing on the processor; and

an authentication manager operating under the control of the operating environment and operative to;

receive a request from a machine external to the multi-tenant environment to access a resource of a tenant;

determine when the machine is authorized by the tenant to access the resource of the tenant by determining when a token is issued to the machine from the tenant that authorizes the machine to access the resource; and

authorize access to the resource when the machine is determined to be authenticated by the tenant.

18. The system of claim 17, further comprising requesting the tenant that is associated with the resource to attempt to authenticate the machine when it is determined to authenticate the machine.

19. The system of claim 17, further comprising establishing a trust relationship between the multi-tenant environment and each of the tenants of the multi-tenant environment using authentication protocols defined by each of the tenants, wherein the trust relationship uses at least one of:

Public Key Infrastructure (PKI) and Security Token Service (STS).

20. The system of claim 17, wherein each tenant specifies its own level of authentication procedures defining when to allow access to the resource.