Multi-tenant Identity Cloud Service Microservices Architecture
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current identity management systems in cloud environments face challenges in providing secure, unified access management across diverse devices and user types, including employees, customers, and partners, while ensuring consistency in security across on-premise and cloud environments to prevent unauthorized access and breaches.
Innovation Solution
A microservices-based architecture for Identity Cloud Service (IDCS) that implements a stateless middle tier to provide multi-tenant identity and access management, using a task execution framework and token-based security to enforce access controls, ensuring secure access from various devices and user types, and integrating with existing applications for seamless user experience.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a cloud-based identity management system is implemented to provide unified access across diverse devices and user types, then accessibility and ease of operation are improved, but security risks from unauthorized access and account hijacking increase
Solution Approach 1:
The patent segments the identity management system into multiple independent microservices (authentication service, authorization service, user profile service, etc.) that can be deployed and managed separately. Each microservice handles specific security functions, allowing fine-grained security controls while maintaining overall system accessibility. This segmentation enables the system to serve diverse user types (employees, customers, partners) through specialized service instances while enforcing security policies at each service boundary.
Solution Approach 2:
The patent introduces an identity broker as an intermediary component that mediates between external applications and the identity management system. The broker handles authentication requests, token validation, and security policy enforcement, acting as a security gateway that protects the core identity services from direct external access. This intermediary layer reduces security risks by centralizing security checks and preventing unauthorized direct access to sensitive identity data.
2Device complexity
If multi-tenant architecture is used to support multiple tenants in a single cloud service, then device complexity and deployment cost are reduced, but security isolation between tenants becomes more difficult to ensure
Solution Approach 1:
The patent implements logical segmentation of multi-tenant data and services using tenant-specific identifiers and context propagation. Each tenant's data is tagged with unique identifiers, and the system maintains separate security contexts for each tenant throughout the microservice architecture. This allows multiple tenants to share the same infrastructure while maintaining logical isolation, reducing deployment complexity compared to physical separation while preserving security boundaries through software-enforced tenant contexts.
Solution Approach 2:
The patent applies local quality by allowing different security policies, authentication methods, and authorization rules to be configured specifically for each tenant. Each tenant can have customized security requirements (e.g., MFA for employees, simpler authentication for customers) while sharing the same underlying platform. This per-tenant customization maintains security isolation through localized policy enforcement while benefiting from the efficiency of a shared multi-tenant infrastructure.
3Reliability
If stateless microservices are implemented in the middle tier, then system scalability and reliability are improved, but session management and user context tracking become more complex
Solution Approach 1:
The patent implements token-based authentication where user session information is copied into self-contained security tokens (e.g., JWT - JSON Web Tokens) that are issued to clients. These tokens contain all necessary authentication and authorization information, allowing stateless microservices to verify user identity without maintaining server-side session state. The token acts as a portable copy of session data that can be validated by any microservice independently, simplifying stateless architecture while managing user context through distributed token validation.
Solution Approach 2:
The patent introduces a centralized token issuance and validation service as an intermediary that handles session management complexities. This service issues authenticated tokens to clients and provides validation endpoints for microservices to verify token authenticity. By centralizing session management functions in this intermediary service, the system maintains stateless microservices while still providing robust session management through the mediating token validation mechanism.
4Ease of operation
If integration with existing applications is implemented to provide seamless user experience, then ease of operation is improved, but security vulnerabilities from legacy systems may be introduced
Solution Approach 1:
The patent employs the identity broker as an intermediary layer between legacy applications and the modern identity management system. The broker translates authentication and authorization requests from legacy systems into standardized protocols supported by the microservice architecture. This intermediary approach enables seamless integration with existing applications while protecting the core system from legacy security vulnerabilities by enforcing modern security policies at the broker boundary rather than requiring changes to legacy applications themselves.
Solution Approach 2:
The patent implements dynamic security policy enforcement that adapts to the specific application and user context. Security rules are not static but are dynamically evaluated based on the requesting application, user identity, resource being accessed, and current security conditions. This dynamic approach allows the system to provide seamless access to legacy applications while applying appropriate security controls specific to each integration scenario, rather than using a one-size-fits-all security model that would either block legitimate access or fail to protect vulnerable systems.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Tenant and service management for an Identity Cloud Service (IDCS) is provided. A request is received, from a Tenant Automation System (TAS) over a network, to create an IDCS service instance for a tenant. The IDCS service instance is created using a task execution framework that includes a task orchestrator and a plurality of synchronous tasks, the task orchestrator instantiating the tasks, controlling the tasks and generating a response to the request. A response, indicating that the IDCS service instance for the tenant has been created, is sent to the TAS over the network.