Client identification for enforcing computer resource quotas
View Patent ↗A system, method, and apparatus are provided for identifying clients or consumers of one or more controlled resources within a computing environment (e.g., a data center, a computing cluster). The resources may be controlled via the enforcement of quotas, wherein different clients have different quotas for the controlled resource(s). A client associated with a given call to a resource is identified using a tuple formed from identifiers of multiple services in the call stack, such as a first service (e.g., a front-end or user-facing service) and an immediate service (e.g., a final service in the stack prior to receipt of the call at a gateway, broker, or other entity that manages access to the controlled resources).
1. A method of enforcing quotas on a computing resource, the method comprising:
receiving, at a gateway controlling access to one or more resources, a call addressed to a first resource using identities of multiple services that processed the call prior to the gateway to identify a client associated with the call, including a first service and an immediate service; and
applying a quota associated with the first resource and the client to determine whether to forward the call to the first resource;
wherein the first service is an initial service that processes the call within a computing environment comprising the one or more resources; and
wherein the immediate service is a final service that processes the call within the computing environment, prior to receipt of the call by the gateway.
2. The method of claim 1 , wherein applying the quota comprises:
determining whether the client has exceeded the quota; and
when the client has not exceeded the quota, forwarding the call to the first resource.
3. The method of claim 2 , wherein applying the quota further comprises:
updating a measure of the client's use of the first resource.
4. The method of claim 1 , wherein:
the first service is a user-facing service.
5. The method of claim 1 , wherein at least one additional service within the computing environment processes the call between the first service and the immediate service.
6. The method of claim 1 , wherein the one or more resources include a database storing a graph of a social network.
7. An apparatus for enforcing quotas on a computing resource, the apparatus comprising:
at least one processor; and
memory storing instructions that, when executed by the at least one processor, cause the apparatus to:
receive, at a gateway controlling access to one or more resources, a call addressed to a first resource;
use identities of multiple services that processed the call prior to the gateway to identify a client associated with the call, including a first service and an immediate service; and
apply a quota associated with the first resource and the client to determine whether to forward the call to the first resource;
wherein the first service is an initial service that processes the call within a computing environment comprising the one or more resources; and
wherein the immediate service is a final service that processes the call within the computing environment, prior to receipt of the call by the gateway.
8. The apparatus of claim 7 , wherein applying the quota comprises:
determining whether the client has exceeded the quota; and
when the client has not exceeded the quota:
forwarding the call to the first resource; and
updating a measure of the client's use of the first resource.
9. The apparatus of claim 7 , wherein:
the first service is a user-facing service.
10. The apparatus of claim 7 , wherein at least one additional service within the computing environment processes the call between the first service and the immediate service.
11. A system for enforcing quotas on a computing resource, the system comprising:
a gateway module comprising a non-transitory computer readable medium storing instructions that, when executed, cause the system to receive, at a gateway controlling access to one or more resources, a call addressed to a first resource;
a client identification module comprising a non-transitory computer readable medium storing instructions that, when executed, cause the system to use identities of multiple services that processed the call prior to the gateway to identify a client associated with the call, including a first service and an immediate service; and
a quota module comprising a non-transitory computer readable medium storing instructions that, when executed, cause the system to apply a quota associated with the first resource and the client to determine whether to forward the call to the first resource;
wherein the first service is an initial service that processes the call within a computing environment comprising the one or more resources; and
wherein the immediate service is a final service that processes the call within the computing environment, prior to receipt of the call by the gateway.
12. The system of claim 11 , wherein applying the quota comprises:
determining whether the client has exceeded the quota; and
when the client has not exceeded the quota:
forwarding the call to the first resource; and
updating a measure of the client's use of the first resource.
13. The system of claim 11 , wherein:
the first service is a user-facing service.
14. The system of claim 11 , wherein at least one additional service within the computing environment processes the call between the first service and the immediate service.
15. The method of claim 1 , wherein at least one of the first service and the immediate service is not a general service.
16. The method of claim 1 , wherein the first service is a service internal to the computing environment.
17. The apparatus of claim 7 , wherein at least one of the first service and the immediate service is not a general service.
18. The apparatus of claim 7 , wherein the first service is a service internal to the computing environment.
19. The system of claim 11 , wherein at least one of the first service and the immediate service is not a general service.
20. The system of claim 11 , wherein the first service is a service internal to the computing environment.