US 12,476,960 B2
End-to-end context isolation across microservices in a multi-tenant distributed cloud infrastructure
Suyin Liu, Suzhou (CN); Jie Liu, Bellevue, WA (US); Na Li, Bellevue, WA (US); Yizhong Wu, Shanghai (CN); Chuanbo Zhang, Suzhou (CN); Xiangyi Deng, Suzhou (CN); Yiteng Yu, Shanghai (CN); Yu Zhang, Suzhou (CN); Yu Xia, Suzhou (CN); and Jonathan Shi, Redmond, WA (US)
Assigned to Microsoft Technology Licensing, LLC, Redmond, WA (US)
Filed by Microsoft Technology Licensing, LLC, Redmond, WA (US)
Filed on Jun. 12, 2023, as Appl. No. 18/208,686.
Prior Publication US 2024/0414148 A1, Dec. 12, 2024
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/083 (2013.01) 20 Claims
OG exemplary drawing
 
1. A computer-implemented method for providing end-to-end context isolation across microservices in a multi-tenant distributed cloud system comprising:
calling, by a first microservice, a first shared library instance in response to the first microservice receiving an external request from an external source, the external request having a security token that embeds context information associated with an entity;
utilizing a first context initializer implemented by the first shared library instance to verify the security token and extract the context information from the security token;
storing the context information in a first context holder that is implemented by the first shared library instance and accessible to the first microservice;
providing, to a second microservice, an internal request generated by a context deliverer implemented by the first shared library instance that embeds the context information obtained from the first context holder with a new security token;
in response to receiving the internal request, calling a second shared library instance by the second microservice to extract the context information from the new security token and store the context information in a second context holder implemented by the second shared library instance, wherein the second context holder is separate from the first context holder;
determining, by a context enforcer implemented by the second shared library instance, compatibility of stored context information stored in a multi-tenant data store identified based on the context information from the second context holder; and
based on the context information from the second context holder being compatible with the stored context information, performing, by the second microservice, an operation indicated in the context information with the stored context information stored in the multi-tenant data store.