US 12,254,106 B2
Client isolation with native cloud features
Mohammed Rupawalla, Katy, TX (US); and Hrvoje Markovic, Houston, TX (US)
Assigned to SCHLUMBERGER TECHNOLOGY CORPORATION, Sugar Land, TX (US)
Appl. No. 17/594,913
Filed by Schlumberger Technology Corporation, Sugar Land, TX (US)
PCT Filed May 9, 2019, PCT No. PCT/US2019/031424
§ 371(c)(1), (2) Date Nov. 3, 2021,
PCT Pub. No. WO2020/226648, PCT Pub. Date Nov. 12, 2020.
Prior Publication US 2022/0222363 A1, Jul. 14, 2022
Int. Cl. H04L 29/06 (2006.01); G06F 9/455 (2018.01); G06F 21/31 (2013.01); G06F 21/60 (2013.01); G06F 21/62 (2013.01)
CPC G06F 21/6218 (2013.01) [G06F 9/45558 (2013.01); G06F 21/31 (2013.01); G06F 21/606 (2013.01)] 17 Claims
OG exemplary drawing
 
1. A method comprising:
receiving a primary request that includes a primary identity and is for a service that is provided by a services provider, wherein the service is within a service container group hosted by a cloud provider;
generating a shadow request from the primary request, wherein the shadow request includes a shadow identity that is created when the primary identity is created and is linked to the primary identity from the primary request;
authorizing the shadow request by verifying that the shadow identity has access to the service;
generating a tenant token for the shadow identity in response to authorizing the shadow request;
obtaining an access token using native authorization of the cloud provider in exchange for the tenant token, wherein the access token is a data store access token and provides the shadow identity with access to a tenant data repository of a tenant container group of a set of tenant container groups hosted by the cloud provider;
sending a data access request with the data store access token to a data access service that verifies authorization for access to a tenant data store of the tenant data repository;
accessing tenant data from the tenant data repository using the access token;
obtaining a shadow response that is generated for the shadow identity and includes processed tenant data generated by processing the tenant data from the tenant data repository with the service; and
sending a primary response that is for the primary identity and is generated from the shadow response, wherein generating the primary response removes references to the shadow identity by replacing the shadow identity with the primary identity linked to the shadow identity.