Granted Patent B1

US 11,632,360 · App. 16/434,964 · Granted Apr 18, 2023

Inventors: Yu Tan (Sammamish, WA); Shiva Ankam (Sammamish, WA)

Assignee: Pure Storage, Inc.

H04L63/08G06F3/0622G06F3/0637H04L67/1097

Abstract

Claims (54)

1. A method comprising:

authorizing a user to access a cloud storage platform implemented in a cloud computing domain;

transmitting, to the user upon authorizing the user to access the cloud storage platform, information associated with a set of storage devices for which the user is registered, the set of storage devices included in a plurality of storage devices in a computing system domain that is separate and remote from the cloud computing domain, wherein the information includes a fleet view of the set of storage devices;

receiving, from the user, a request to access, through the cloud storage platform, an application executing on a storage device, the storage device included in the plurality of storage devices, wherein the request to access, through the cloud storage platform, the application executing on the storage device is received based at least in part on a selection of one storage device in the set of storage devices included in the fleet view;

obtaining, at the cloud storage platform and from a cloud identity provider that is implemented in the cloud computing environment and maintains a directory of users authorized to access the cloud storage platform and a correlation of the users to storage devices in the plurality of storage devices in the computing system domain, an access token in response to receiving the request from the user, the access token including user identity information for the user, storage device identity information for the storage device, and cloud identity information indicating the cloud identity provider from which the access token is obtained; and

transmitting the access token from the cloud storage platform to the storage device without the access token going through the user device, the access token configured for use by the storage device to validate the user, based on the user identity information, the storage device identity information, and the cloud identity information in the access token, and grant the user access, through the cloud storage platform, to the application executing on the storage device, wherein the validation includes determining that the user identity information in the access token corresponds to a user identity maintained in a directory operating in the computing system domain.

2. The method of claim 1 , wherein the obtaining the access token in response to the request comprises:

transmitting, to an identity authorization endpoint associated with the cloud identity provider, an access token request upon receiving, from the user, the request to access the application executing on the storage device, the access token request including the user identity information for the user and the storage device identity information for the storage device; and

receiving, at the cloud storage platform, the access token from the identity authorization endpoint.

3. The method of claim 1 , wherein the authorizing the user to access the cloud storage platform comprises:

authenticating, based on user credentials received from the user, the user for a login to the cloud storage platform.

4. The method of claim 3 , wherein:

an additional authorization is used to grant the user access to the application executing on the storage device; and

the access token facilitates the additional authorization without prompting the user to provide user credentials to access the application executing on the storage device.

5. The method of claim 1 , wherein:

the authorizing the user to access the cloud storage platform comprises authorizing the user to access the cloud storage platform based on an identity authorization received from an identity authentication endpoint that is in the computing system domain.

6. The method of claim 1 , wherein the access token facilitates bypassing a login screen of the storage device without the login screen being presented to request credentials.

7. The method of claim 1 , wherein the directory operating in the computing system domain is further used to validate an additional user indicated by a request to access the storage device from a user device located in the computing system domain.

8. The method of claim 1 , wherein the storage device is opted into and configured to provide remote access through the cloud storage platform.

9. The method of claim 8 , wherein the storage device is configured with a computing instance used to bypass a login screen such that the storage device does not prompt for user credentials when the access token is received from the cloud storage platform.

10. The method of claim 8 , wherein the storage device is configured to:

periodically request and receive configuration information from the cloud identity provider; and

use the configuration information received from the cloud identity provider to validate the access token.

11. The method of claim 1 , further comprising:

logging operations of the cloud storage platform, wherein operations associated with access tokens are identified and not logged.

12. A system comprising:

a memory storing instructions;

a processor communicatively coupled to the memory and configured to execute the instructions to:

authorize a user to access a cloud storage platform implemented in a cloud computing domain;

transmit, to the user upon authorizing the user to access the cloud storage platform, information associated with a set of storage devices for which the user is registered, the set of storage devices included in a plurality of storage devices in a computing system domain that is separate and remote from the cloud computing domain, wherein the information includes a fleet view of the set of storage devices;

receive, from the user, a request to access, through the cloud storage platform, an application executing on a storage device, the storage device included in the plurality of storage devices, wherein the request to access, through the cloud storage platform, the application executing on the storage device is received based at least in part on a selection of one storage device in the set of storage devices included in the fleet view;

obtain, at the cloud storage platform and from a cloud identity provider that is implemented in the cloud computing environment and maintains a directory of users authorized to access the cloud storage platform and a correlation of the users to storage devices in the plurality of storage devices in the computing system domain, an access token in response to receiving the request from the user, the access token including user identity information for the user, storage device identity information for the storage device, and cloud identity information indicating the cloud identity provider from which the access token is obtained; and

transmit the access token from the cloud storage platform to the storage device without the access token going through the user device, the access token configured for use by the storage device to validate the user, based on the user identity information, the storage device identity information, and the cloud identity information in the access token, and grant the user access, through the cloud storage platform, to the application executing on the storage device, wherein the validation includes determining that the user identity information in the access token corresponds to a user identity maintained in a directory operating in the computing system domain.

13. The system of claim 12 , wherein the processor is configured to execute the instructions to obtain the access token in response to the request by:

transmitting, to an identity authorization endpoint associated with the cloud identity provider, an access token request upon receiving, from the user, the request to access the application executing on the storage device, the access token request including the user identity information for the user and the storage device identity information for the storage device; and

receiving, at the cloud storage platform, the access token from the identity authorization endpoint.

14. The system of claim 12 , wherein:

an additional authorization is used to grant the user access to the application executing on the storage device; and

the access token facilitates the additional authorization without the user being prompted to provide user credentials to access the application executing on the storage device.

15. The system of claim 12 , wherein the processor is configured to execute the instructions to authorize the user to access the cloud storage platform by:

authorizing the user to access the cloud storage platform based on an identity authorization received from an identity authentication endpoint in the cloud computing domain.

16. A computer program product disposed upon a non-transitory computer-readable storage medium, the computer program product comprising computer program instructions that, when executed, cause a computer to carry out the steps of:

authorizing a user to access a cloud storage platform implemented in a cloud computing domain;

transmitting, to the user upon authorizing the user to access the cloud storage platform, information associated with a set of storage devices for which the user is registered, the set of storage devices included in a plurality of storage devices in a computing system domain that is separate and remote from the cloud computing domain, wherein the information includes a fleet view of the set of storage devices;

receiving, from the user, a request to access, through the cloud storage platform, an application executing on a storage device, the storage device included in the plurality of storage devices, wherein the request to access, through the cloud storage platform, the application executing on the storage device is received based at least in part on a selection of one storage device in the set of storage devices included in the fleet view;

obtaining, at the cloud storage platform and from a cloud identity provider that is implemented in the cloud computing environment and maintains a directory of users authorized to access the cloud storage platform and a correlation of the users to storage devices in the plurality of storage devices in the computing system domain, an access token in response to receiving the request from the user, the access token including user identity information for the user, storage device identity information for the storage device, and cloud identity information indicating the cloud identity provider from which the access token is obtained; and

transmitting the access token from the cloud storage platform to the storage device without the access token going through the user device, the access token configured for use by the storage device to validate the user, based on the user identity information, the storage device identity information, and the cloud identity information in the access token, and grant the user access, through the cloud storage platform, to the application executing on the storage device, wherein the validation includes determining that the user identity information in the access token corresponds to a user identity maintained in a directory operating in the computing system domain.

17. The computer program product of claim 16 , wherein the computer program instructions, when executed, cause the computer to carry out the step of obtaining the access token in response to the request by:

transmitting, to an identity authorization endpoint associated with the cloud identity provider, an access token request upon receiving, from the user, the request to access the application executing on the storage device, the access token request including the user identity information for the user and the storage device identity information for the storage device; and

receiving, at the cloud storage platform, the access token from the identity authorization endpoint.

18. The computer program product of claim 16 , wherein the computer program instructions, when executed, cause the computer to carry out the step of authorizing the user to access the cloud storage platform by:

authenticating, based on user credentials received from the user, the user for a login to the cloud storage platform,

wherein an additional authorization is used to grant the user access to the application executing on the storage device, and

wherein the access token facilitates the additional authorization without prompting the user to provide user credentials to access the application executing to the storage device.

Assignments (3)

Cited By (11)

US 12,216,763 US 12,273,347 US 12,332,644 US 12,367,320 US 12,388,806 US 12,400,029 US 12,406,663 US 12,437,097 US 12,513,152 US 12,561,193 US 12,627,651