TWI696932B - System for providing multi-authentication management in a multi-tenant environment and method thereof - Google Patents

Abstract

A system for providing multi-authentication management in a multi-tenant environment and a method thereof are disclosed, including: seting up different authentication terminals for each domain, so that a user can be guided to the authentication terminal of a corresponding domain to perform identity authentication through the authentication management device before entering the corresponding domain.

Description

Multi-tenant management system and method

The invention relates to a cloud system, in particular to a cloud system and method for multi-tenant management.

In the private cloud business model of the cloud computing system, users will need to have different authentication mechanism structures. In the public cloud business model of the cloud computing system, the tenant's account needs to provide necessary confidential information due to the cost calculation. Therefore, there must also be a specific tenant account authentication mechanism.

However, the traditional system backend can only use a single authentication source method to authenticate the identity of the system user. This method cannot easily isolate and use different authentication mechanisms.

Therefore, how to provide a general mechanism to enable private or public cloud computing systems to be subsequently connected to different authentication mechanisms is the technical problem to be solved by the present invention.

In order to overcome the shortcomings of the conventional technology, the present invention provides a multi-tenant management system, which includes: plural field, providing logical services; plural recognition The certificate terminal provides an authentication mechanism to enter each field, wherein each authentication terminal corresponds to a different field, and each authentication terminal has a different authentication mechanism; and the authentication management device includes: an authentication association module The group receives the input data of the user, finds the associated authentication terminal based on the input data, and sends the input data to the associated authentication terminal for authentication; and the domain pass module transmits a domain pass For users who are authenticated by the associated authentication terminal, the domain pass permits the user to enter the domain corresponding to the associated authentication terminal.

In one embodiment, the system further includes: an adapter that is connected between the authentication management device and each authentication terminal to transmit the input data to the associated authentication terminal for authentication, wherein, when When the authentication is passed, the authentication related module is notified of the successful authentication.

In an embodiment, the input data includes the field, and the authentication management device further includes: an authentication setting database that stores authentication setting data. The authentication setting data includes the field and the authentication terminal corresponding to the field. The authentication association module finds the certificate setting data associated with the field of the input data, so that the authentication terminal referred to in the associated certificate setting data is the associated authentication terminal.

In one embodiment, the user includes a general user who has the right to use the field or a tenant who has the right to manage the field.

In an embodiment, the system further includes: a public tenant area, which is a relay terminal before each tenant in the field enters the field to which it belongs; a tenant authentication terminal, which provides each tenant in the field to enter the public tenant area Authentication mechanism; and the authentication management device further includes: a regional access module, which transmits An area pass to the tenant who is authenticated by the tenant authentication terminal, where the area pass permits the tenant to enter the public tenant area or provides the tenant to obtain a pass to the area pass module to enter the area of the area to which the tenant belongs A pass, wherein, when receiving the input data of the user, the authentication-related module further includes determining that the user who inputs the input data is the general user or the tenant, and when the user who inputs the input data is the general user At the time, find the associated authentication terminal based on the input data, so as to send the input data to the associated authentication terminal for the authentication mechanism, and when the user who inputs the input data is the tenant, the input The data is sent to the tenant authentication terminal for the authentication mechanism.

The present invention also provides a multi-tenant management method, which includes the following steps: (1) receiving user input data; (2) finding the authentication terminal associated with the input data; (3) the input data Send to the associated authentication terminal for authentication; (4) After the input data passes the authentication of the associated authentication terminal, send a domain pass to the user who passed the authentication of the associated authentication terminal; and (5) The user is allowed to enter the field corresponding to the field pass according to the field pass.

In an embodiment, the input data includes the field, and the step (2) is to find the authentication setting data associated with the field of the input data from the authentication setting data, so that the associated authentication setting The authentication terminal referred to in the data is the associated authentication terminal.

In one embodiment, the step (1) further includes the following steps when receiving the user's input data: (1-1) judging whether there is a public tenant area, if not, starting from the step (2) carried out.

In an embodiment, the user includes a general user who has the right to use the field or a tenant who has the right to manage the field, and when it is determined that there is the public tenant area, the following steps are performed: (1- 2) Determine whether the user is a tenant, if not, then start from step (2), if yes, send the input data to the tenant authentication terminal for authentication; (1-3) When the input data passes the tenant After the authentication of the authentication terminal, an area pass is sent to the tenant who has passed the authentication of the tenant authentication end; (1-4) the tenant is exchanged for the area pass to enter the area of the field to which the tenant belongs; and (1 -5) Make the tenant enter the field to which the tenant belongs based on the field pass.

In one embodiment, the step (1-4) further includes, before exchanging the domain pass obtained to enter the domain to which the tenant belongs, allowing the tenant to enter a public tenant area based on the area pass.

It can be known from the above that the present invention provides authentication terminals with different users in various fields through the setting of authentication setting data, which can integrate multiple authentication methods existing in enterprises, thereby solving the problem of authentication of users of traditional system platforms. The old technical architecture that can interface and trust a single authentication terminal.

Therefore, the present invention has the following technical advantages:

1. Under the same system, tenants and users in different domains use different authentication sources, and after providing centralized tenants with the same authentication source, the tenant can automatically control users and users of another authentication source within the logical scope of their exclusive domain. Permission for resources in this exclusive domain.

2. Each tenant has its own logical scope of exclusive domain, and has independent authority policy in the exclusive domain, and adjustments will not affect other domains.

1‧‧‧ user

2‧‧‧ certification management device

3‧‧‧Adapter

4‧‧‧Certificate

5‧‧‧ Domain

6‧‧‧ Tenant authentication terminal

7‧‧‧Public tenant area

21‧‧‧ Authentication Setting Database

22‧‧‧Certification related module

23‧‧‧Access module

24‧‧‧ Regional Access Module

51‧‧‧ tenant

52‧‧‧Authorization Management Module

53‧‧‧ Authority Policy

54‧‧‧General users

55‧‧‧Resources

S61~S65,S71~S76‧‧‧Step

Figure 1 is a schematic diagram of the first embodiment of the multi-tenant management system of the present invention; Figure 2 is a schematic diagram of the first embodiment of the authentication management device of the present invention; Figure 3 is a schematic diagram of the field of the present invention; 4 is a schematic diagram of a second embodiment of the multi-tenant management system of the present invention; FIG. 5 is a schematic diagram of the second embodiment of the authentication management device of the present invention; FIG. 6 is a method of multi-tenant management of the present invention Step flowchart of the first embodiment; and FIG. 7 is a step flowchart of the second embodiment of the multi-tenant management method of the present invention.

The following describes the implementation of the present invention by specific specific examples. Those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification.

It should be noted that the structure, proportion, size, etc. shown in the drawings of this specification are only used to match the contents disclosed in the specification, for those who are familiar with this skill to understand and read, not to limit the implementation of the present invention The limited conditions, so it does not have the technical significance, any modification of the structure, the change of the proportional relationship or the adjustment of the size, does not affect the power of the invention Both the effectiveness and the objectives that can be achieved should still fall within the scope of the technical content disclosed by the present invention.

Please refer to FIG. 1, which is a schematic diagram of the first embodiment of the multi-tenant management system of the present invention. The system includes plural users 1, an authentication management device 2, an adapter 3, plural authentication terminals 4, and plural fields 5.

The plural users 1 input an input data to the authentication management device 2 through a mobile device or a computer.

In one embodiment, the plural users 1 include general users who have the right to use the field and tenants who have the right to manage the field.

In an embodiment, the input data includes a web address, field 5, and account/password, but not limited to this.

The adapter 3 is interposed between the authentication management device 2 and each authentication terminal 4 to perform data transmission between the authentication management device 2 and each authentication terminal 4.

The complex field 5 provides logic services. In an embodiment, the logical service may be a logical service of a website, but not limited thereto.

The plural authentication terminals 4 respectively provide an authentication mechanism for entering each field 5, wherein each authentication terminal 4 corresponds to a different field 5, and each authentication terminal 4 has a different authentication mechanism.

The authentication management device 2 receives each input data of the user 1 and transmits the input data to the authentication terminal 4 associated with the input data through the adapter 3 for authentication, wherein, when the input data passes the associated When the authentication terminal 4 authenticates, the associated authentication terminal 4 notifies the authentication management device 2 of the successful authentication message via the adapter 3, so that the authentication management device 2 According to the successful authentication message, the user 1 who inputs the input data is allowed to enter the field 5 corresponding to the associated authentication terminal 4.

Please refer to FIG. 2, which is a schematic diagram of the first embodiment of the authentication management device 2 of the present invention. The authentication management device 2 includes an authentication setting database 21, an authentication related module 22, and a domain pass module 23.

The authentication setting database 21 stores authentication setting data, where the authentication setting data includes the field 5 and the authentication terminal 4 corresponding to the field 5.

The authentication association module 22 receives the input data of each user 1 and reads the authentication setting data from the authentication setting database 21, so that the field 5 in the authentication setting data is the same as the field 5 of the input data. The authentication setting data is the associated certificate setting data, so that the authentication terminal 4 referred to in the associated certificate setting data is the associated authentication terminal 4, so that the input data is transmitted to the The associated authentication terminal 4 performs authentication.

The domain pass module 23 transmits a domain pass to the user 1 who is authenticated by the associated authentication terminal 4, wherein the domain pass allows the user 1 to enter the domain corresponding to the associated authentication terminal.

In an embodiment, when the input data passes the authentication of the associated authentication terminal 4, the associated authentication terminal 4 transmits the authentication-passed message to the authentication associated module 22 through the adapter 3, so that the authentication associated module 22 The control domain pass module 23 transmits a domain pass to the user 1 authenticated by the associated authentication terminal, but not limited to this.

Please refer to FIG. 3, which is a schematic diagram of Field 5 of the present invention. Domain 5 includes tenant 51, authorization management module 52, plural authority policy 53, plural general users 54 and plural resources 55, wherein when user 1 enters domain 5 according to the pass of the domain, user 1 is based on the input data The account division in is the tenant 51 or the general user 54. Among them, the tenant 51 is an administrator who has the authority to manage the domain 5, and the general user 54 is a general user who cannot manage the authority of the domain 5.

The authorization management module 52 provides the tenant 51 to change, remove, or use the plural authority policy 53 and provides the tenant 51 to assign the plural authority policy 53 to the general user 54 for use.

The plural permission policy 53 is to provide the tenant 51 or the general user 54 with the right to use the domain 5, and to provide the tenant 51 or the general user 54 with the right to access the resource 55.

The plural resource 5 includes any resource used for the logical service.

When the general user 54 or the tenant 51 in the field 5 receives the input data of the user 1 when the authentication association module 22 receives the input data of the user 1, the user 1 inputting the input data is determined to be the general user 54 or The tenant 51.

In an embodiment, the authentication management device 2 further includes providing user 1 to apply to become a general user 54 of the existing domain 5 in the system, or providing user 1 to apply to establish domain 5 and become a tenant 51 of domain 5, wherein each domain 52 The corresponding authentication setting data of the authentication terminal 4 and the authentication setting database 21 is set when the tenant 51 applies to the authentication management device 2 to establish a domain, but it is not limited to this.

Please refer to FIG. 4 for a schematic diagram of a second embodiment of the multi-tenant management system of the present invention. The difference between this embodiment and the first embodiment is the tenant authentication terminal 6 and the public tenant area 7, so the following will explain the differences, but not Repeat the same points.

The public tenant area 7 is a relay end before the tenants in each area 5 enter the area 5 to which they belong. The public tenant area 7 also provides this logical service.

The tenant authentication terminal 6 provides an authentication mechanism for tenants in various fields 5 to enter the public tenant area 7.

Please refer to FIG. 5, which is a schematic diagram of a second embodiment of the authentication management device 2 of the present invention. The difference between this embodiment and the first embodiment lies in the area passage module 24, so the differences will be described below, and the similarities will not be repeated.

The area pass module 24 transmits an area pass to the tenant 51 who has been authenticated by the tenant authentication terminal 6. The area pass permits the tenant 51 to enter the public tenant area 7 or provides the tenant 51 to the domain pass module 23 to obtain the entry The domain pass of the domain 5 to which the tenant 51 belongs.

When the authentication association module 22 receives the input data of the user 1, the user 1 inputting the input data is determined to be the general user 54 or the tenant 51 according to the account number in the input data. When the user inputting the input data 1 is the general user 54, finds the associated authentication terminal 4 according to the input data, so that the input data is transmitted to the associated authentication terminal 4 through the adapter 3 for the authentication mechanism, and when the input is input When the user 1 of the data is the tenant 51, the input data is transmitted to the tenant authentication terminal 6 through the adapter 3 to perform the authentication mechanism.

Please refer to FIG. 6, which is a flowchart of steps of the first embodiment of the multi-tenant management method of the present invention. The method includes the following execution steps.

In step S61, the user's input data is received, where The certificate association module 22 receives the input data of the user 1.

In step S62, the associated authentication terminal 4 is found according to the input data, wherein the authentication related module 22 is caused to find the certificate setting data associated with the field 5 of the input data from the authentication setting database 21, to Let the authentication terminal 4 referred to in the associated certificate setting data be the associated authentication terminal 4.

In step S63, the input data is transmitted to the associated authentication terminal for authentication, wherein the authentication association module 22 is caused to transmit the input data to the authentication terminal 4 associated with the input data through the adapter 3 Certification.

In step S64, after the input data passes the authentication of the associated authentication terminal 4, a domain pass is sent to the user 1 authenticated by the associated authentication terminal 4, wherein the domain pass module 23 transmits the domain The pass is to the user 1 who is authenticated by the associated authentication terminal 4.

In step S65, the user 1 is allowed to enter the field 5 corresponding to the field pass according to the field pass, and the user 1 obtains the permission policy 53 under the corresponding field 5 to make the user 1 operate according to the permission policy 53 Various functions or resources 55 of the domain 5.

Please refer to FIG. 7, which is a flow chart of the steps of the second embodiment of the multi-tenant management method of the present invention. The method includes the following execution steps.

In step S71, the input data of the user 1 is received, wherein the authentication association module 22 in the multi-tenant management system is caused to receive the input data of each user 1.

In step S72, it is determined whether there is a public tenant area 7, if not, Then it is executed from this step S62, and if it is, then the following step S73 is performed.

In one embodiment, the step S72 causes the authentication association module 22 to determine whether there is a public tenant area in the multi-tenant management system.

In step S73, it is determined whether the user 1 is a tenant. If not, the process starts from step S62. If yes, the input data is sent to the tenant authentication terminal 6 for authentication.

In one embodiment, the step S73 causes the authentication association module 22 to determine that the user 1 who inputs the input data is a general user 54 or a tenant 51 according to the account number in the input data, and when the user 1 who inputs the input data When it is the tenant 51, the input data is transmitted to the tenant authentication terminal 6 through the adapter 3 to perform the authentication mechanism.

In step S74, after the input data passes the authentication of the tenant authentication terminal 6, an area pass is sent to the tenant 51 that has passed the authentication of the tenant authentication terminal 6.

In an embodiment, after the input data passes the authentication of the tenant authentication terminal 6, the tenant authentication terminal 6 transmits a message of successful authentication to the authentication association module 22. At this time, the authentication association module 22 controls the area pass module 24 to transmit An area pass is given to the tenant 51 who is authenticated by the tenant authentication terminal 6.

In step S75, the tenant 51 is exchanged for the area pass obtained to enter the domain of the area to which the tenant belongs, wherein the tenant 51 is exchanged for the area pass module 23 with the area pass to enter the area 5 of the tenant 51 Domain Pass.

In an embodiment, in step S75, before the tenant 51 obtains the area pass in exchange for the area pass to enter the area pass of the area 5 to which the tenant belongs, This includes making the tenant 51 enter the public tenant area 7 based on the area pass, where the tenant 51 can exchange the area pass with the area pass module 23 to obtain the area pass to enter the area 5 of the tenant 51 at any time when the tenant 51 is in the public tenant area 7.

In step S76, the tenant 51 is allowed to enter the domain 5 to which the tenant 51 belongs according to the domain pass, so that the tenant 51 is based on the authorization management module 52 and the authority policy 53 to the various functions, resources 55 and general users 54 in the domain 5 to which it belongs .

The first embodiment of the above multi-tenant management system and method of the present invention is a multi-tenant authentication and authorization management architecture of a private cloud computing system, and the second embodiment of the multi-tenant management system and method of the present invention is a public cloud The multi-tenant authentication and authorization management architecture of the computing system. In this second embodiment, the tenant authentication terminal 6 through the tenant authentication terminal 6 and the common tenant area user 7 gathers tenants 51 in various fields 5 to use the same tenant authentication terminal 6 from the same authentication source, thereby enabling tenants in various fields 5 51 can use the public cloud operator's authentication source (that is, tenant authentication terminal 6) to verify its identity.

In an embodiment, each module in the first and second embodiments of the multi-tenant management system and method of the present invention (such as the authentication management device 2 and the module in the field 5) is an application program, and the present invention The multi-tenant management system of the first and second embodiments is a cloud server, wherein the storage device of the cloud server stores the application programs of each module for the processor of the cloud server to execute each The application in the module, but not limited to this.

As can be seen from the above, the present invention provides authentication terminals with different users in various fields through the setting of authentication setting data, which can integrate enterprises The existing multiple authentication methods can solve the problem of the old technical architecture that the authentication of users of traditional system platforms can only interface and trust a single authentication terminal.

The above embodiments are used to exemplify the principles and effects of the present invention, rather than to limit the present invention. Anyone who is familiar with this skill can modify the above embodiments without violating the spirit and scope of the present invention. Therefore, the scope of protection of the rights of the present invention should be as listed in the scope of patent application mentioned later.

1‧‧‧ user

2‧‧‧ certification management device

3‧‧‧Adapter

4‧‧‧Certificate

5‧‧‧ Domain

Claims (7)

A multi-tenant management system includes: multiple domains, which provide dedicated logical services for each domain, and the logical services are logical services for websites; public tenant areas, which are for each tenant in this domain before entering the domain to which they belong Relay terminal; plural authentication terminals provide authentication mechanisms to enter each field respectively, wherein each authentication terminal corresponds to different fields, and each authentication terminal has a different authentication mechanism; tenant authentication terminal provides each The authentication mechanism for tenants in the field to enter the public tenant area; and the authentication management device, including: an authentication association module, which receives user input data, and finds the associated authentication terminal or tenant authentication based on the input data Terminal to send the input data to the associated authentication terminal or the tenant authentication terminal for authentication, where the user includes a general user with the right to use the field or a tenant with the management right to the field; domain pass mode Group, is to pass a domain pass to the general user who is authenticated by the associated authentication terminal, wherein the domain pass allows the general user to enter the domain corresponding to the associated authentication terminal; and the regional pass module, Pass an area pass to the tenant who is authenticated by the tenant authentication terminal, where the area passes The permit system allows the tenant to enter the public tenant area or provide the tenant with the domain pass module to obtain a domain pass to enter the domain to which the tenant belongs; wherein, the authentication association module is more effective when receiving the user's input data It includes determining that the user who inputs the input data is the general user or the tenant. When the user who inputs the input data is the general user, find the associated authentication terminal according to the input data, so that the input data The authentication mechanism is sent to the associated authentication terminal, and when the user who inputs the input data is the tenant, the input data is transmitted to the tenant authentication terminal for the authentication mechanism. As in the system described in item 1 of the patent application scope, the system further includes: an adapter that is connected between the authentication management device and each authentication terminal to transmit the input data to the associated authentication terminal Perform authentication, wherein, when the authentication is passed, the authentication-related module is notified of successful authentication. The system as described in item 1 of the patent application scope, wherein the input data includes the field, and the authentication management device further includes: an authentication setting database that stores authentication setting data, and the authentication setting data includes the field and the field The corresponding authentication terminal for the authentication related module to find the certificate setting data associated with the field of the input data, so that the authentication terminal referred to in the associated certificate setting data is the The associated authentication terminal. A multi-tenant management method includes the following steps: (1) Receive user input data; (2) Determine whether there is a public tenant area, if not, start from step (3); (3) Find the associated authentication terminal based on the input data; (4) Send the input data to the association The authentication terminal of the authentication; (5) After the input data passes the authentication of the associated authentication terminal, send a domain pass to the user who passed the authentication of the associated authentication terminal; and (6) Make the user Enter the field corresponding to the pass in this field based on the pass in this field. The method as described in item 4 of the patent application scope, wherein the input data includes the field, and the step (3) is to find the authentication setting data associated with the field of the input data from the authentication setting data, to Let the authentication terminal referred to in the associated authentication setting data be the associated authentication terminal. The method as described in item 4 of the patent application scope, where the user includes a general user who has the right to use the field or a tenant who has the right to manage the field, and when it is determined that there is the public tenant area, then Perform the following steps: (2-1) determine whether the user is a tenant, if not, start from step (3), if yes, then send the input data to the tenant authentication terminal for authentication; (2-2 ) After the input data passes the authentication of the tenant authentication terminal, send an area pass to the tenant who has passed the authentication of the tenant authentication terminal (2-3) order the tenant to obtain the area pass in exchange for the area pass to enter the area to which the tenant belongs; and (2-4) order the tenant to enter the area to which the tenant belongs based on the area pass. The method as described in item 6 of the patent application scope, wherein the step (2-3) further includes making the tenant enter a public tenant area based on the area pass before redeeming the area pass to enter the area to which the tenant belongs .

Images