Flexible scalable application authorization for cloud computing environments

• US 8,418,222 B2
• Filed: 09/30/2008
• Issued: 04/09/2013
• Est. Priority Date: 03/05/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Gbadegesin, Abolade, Batoukov, Roman, Reed, David R.
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Getachew, Abiy
• Application Number:
  US12/241,710
• Publication Number:
  US 20090228967A1
• Time in Patent Office: 1,652 Days
• Field of Search: 709/255, 709/229
• US Class Current: 726/1
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

A representational state transfer-based model for a computing environment uses models resources with links between them. Security principals are resources which can be independently authenticated. Each resource may be associated with an authorization policy that determines level of access, protocol supported. Successfully presenting security credentials at a security principal allows use of an instance of the security principal (i.e. application) as well as generation of an authentication token that can be presented across the computing environment to resources subscribing to the same authorization policy. As security principals with different security policies are authenticated, the appropriate tokens may be combined to allow broader access without undue re-authentication for resources subscribing to the same security policy. Authorization requirements (policies) may be attached to links to resources so that an application instance can dynamically discover authentication rules for that resource by inspecting the link.

Claims

1. One or more computer-readable media, not comprising a propagated signal, containing programmed instructions which, when executed by one or more processors disposed in an electronic device, perform a method of authorizing use of a resource in a cloud computing environment comprising:

associating at least one security policy with the resource;

receiving a request from a security principal to access the resource, the request including a security credential of the security principal;

comparing the security credential to the at least one security policy associated with the resource;

generating an authorization token when the security credential satisfies the at least one security policy; and

attaching security policy-related information to a resource link used to traverse to the resource to annotate the resource link such that the security policy-related information annotating the resource link is able to be inspected to determine the security policy associated with the resource, the security policy-related information corresponding to the at least one security policy.

2. The one or more computer-readable media of claim 1, wherein the security policy-related information is an authorization token link identifying a second resource from which the authorization token is retrievable.

3. The one or more computer-readable media of claim 1, further comprising:

forwarding the authorization token from an instance of the resource to a third resource.

4. The one or more computer-readable media of claim 1, further comprising:

inspecting the resource link for the security policy-related information to determine a security requirement of the resource.

5. The one or more computer-readable media of claim 1, wherein the at least one security policy specifies a credential requirement for use of the resource.

6. The one or more computer-readable media of claim 1, wherein at least one security policy specifies a credential requirement for access to the resource.

7. The one or more computer-readable media of claim 1, wherein the at least one security policy specifies a cryptographic policy.

8. The one or more computer-readable media of claim 1, wherein the at least one security policy comprises a first security policy associated with a first entity associated with the resource and a second security policy associated with a second entity associated with the resource.

9. The one or more computer-readable media of claim 1, wherein receiving the request for access to the resource comprises receiving the request for access to the resource at an authentication engine.

10. The one or more computer-readable media of claim 9, wherein generating the authorization token comprises generating the authorization token at the authentication engine.

11. The one or more computer-readable media of claim 1, further comprising:

developing a set of standard policies that may be associated with the resource.

12. The one or more computer-readable media of claim 1, wherein generating the authorization token when the security credential satisfies the at least one security policy comprises:

generating a separate authentication token for each security policy successfully authenticated.

13. A computing environment comprising:

a computing cloud including a plurality of resources accessible via links;

at least one client entity coupled to the computing cloud of computing resources that requests access to a resource of the plurality of resources;

an authentication engine that evaluates a security policy associated with the resource of the plurality of resources and generates an authorization token when a client entity security data satisfies the security policy for the resource, wherein an authorization token link is attached to each link used to access the resource;

a policy repository in the computing cloud for storing one or more of the security policies related to authentication and authorization of the resource; and

a token repository in the computing cloud for storing the authorization token generated by the authentication engine.

14. The computing environment of claim 13, wherein the security policy defines a security protocol supported by the resource.

15. The computing environment of claim 13, wherein the security policy defines a credential that must be presented by the at least one client entity.

16. The computing environment of claim 13, wherein access to the resource comprises one of use of an application and access to a control of the application.

17. The computing environment of claim 13, wherein a plurality of authorization token links are attached to each link used to access the resource.

18. A method, operating as one or more processes or sub-processes programmed for execution on a computing platform, of accessing a resource in a cloud computing environment, the method comprising:

receiving, in a first of the one or more processes or sub-processes, a request from a security principal requesting access to the resource, the request including a security credential;

presenting, in a second of the one or more processes or sub-processes, the security credential to an authentication engine;

issuing, in a third of the one or more processes or sub-processes, a first authorization token granting access to the resource;

issuing, in a fourth of the one or more processes or sub-processes, a second authorization token related to the resource;

storing, in a fifth of the one or more processes or sub-processes, the first and second authorization tokens in a token repository; and

attaching, in a sixth of the one or more processes or sub-processes, an authorization token link that points to the token repository to a link pointing to the resource.

19. The method of claim 18, wherein issuing the second authorization token comprises issuing the second authorization token granting additional rights to an instance of the resource associated with the request.

20. The method of claim 18, wherein issuing the second authorization token comprises issuing the second authorization token granting additional privileges to security principal related to access to the resource.