# US 10,320,572 B2 · Scope-based certificate deployment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,320,572 B2 - Document ID: US10320572B2 - Status: Granted - Kind: B2 - Application number: 15/369,297 - Filed: 2016-12-05 - Published: 2018-02-08 - Granted: 2019-06-11 - Earliest claimed: 2016-08-04 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing LLC - Inventors: Mangalam Rathinasabapathy; Patrick Simek; Xinghuo Zeng; Harpreet Miglani; Roshane Silva - Web page: https://patentgrep.com/patent/US10320572B2 ## CPC - H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]} - H04L 9/006: {involving public key infrastructure [PKI] trust models (network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 9/14: using a plurality of keys or algorithms - H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy - H04L 9/3247: {involving digital signatures} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 9/3265: {using certificate chains, trees or paths; Hierarchical trust model} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The techniques described herein facilitate scope-based certificate deployment for secure dedicated tenant access in multi-tenant, cloud-based content and collaboration environments. In some embodiments, a method is described that includes receiving an incoming authentication request from an access system, wherein the authentication request includes metadata, extracting the metadata from the authentication request, and processing the metadata to identify a tenant corresponding to the request. A tenant-specific certificate associated with the tenant is then accessed and provided to the access system for validation by a third-party certificate authority. ## Claims ### Claim 1 A method of operating a front-end access server to facilitate scope-based certificate deployment in a multi-tenant cloud-based content service, the method comprising: receiving a request for authentication including metadata from an access system; extracting the metadata from the authentication request; processing the metadata to identify a tenant associated with the request for authentication; accessing a tenant-specific certificate associated with the tenant; accessing a set of global certificates shared among tenants in the multi-tenant cloud-based content service; and responsive to the request for authentication, providing to the access system, the tenant-specific certificate for validation by a third-party certificate authority and one or more of the set of global certificates for accessing one or more corresponding back-end services, wherein the tenant-specific certificate is provided to the front-end access server and scoped prior to receiving the request for authentication. ### Claim 2 (depends on 1) The method of claim 1, wherein the tenant-specific certificate comprises one or more of a Secure Socket Layer (SSL) certificate, an email encryption certificate, or a code signing certificate. ### Claim 3 (depends on 1) The method of claim 1, wherein the tenant-specific certificate comprises a certificate issued to the tenant by the third-party certificate authority. ### Claim 4 (depends on 3) The method of claim 3, further comprising: receiving the tenant-specific certificate from a dedicated tenant system; providing the tenant-specific certificate to the multi-tenant cloud-based content service; receiving an indication of machines on which tenant data is or will be stored; and deploying the tenant-specific certificates to the machines. ### Claim 5 (depends on 4) The method of claim 4, further comprising deploying global certificates to the machines. ### Claim 6 (depends on 1) The method of claim 1, further comprising: receiving a request from the access system, wherein fulfilling the request requires accessing a back-end service; identifying a shared certificate corresponding to the back-end service; and authenticating with the back-end service using the shared certificate. ### Claim 7 (depends on 1) The method of claim 1, further comprising authenticating a server using the tenant-specific certificate. ### Claim 8 (depends on 1) The method of claim 1, further comprising: receiving, by an Application Program Interface (API), a request to change a type of a first certificate from a global certificate to a scope-based certificate. ### Claim 9 (depends on 8) The method of claim 8, further comprising: responsive to receiving the request to change the type of the first certificate, identifying machines on which the first certificate is deployed; and reimaging the machines on which the first certificate is deployed. ### Claim 10 A computer readable storage medium having program instructions stored thereon which, when executed by one or more processors, cause the one or more processors to: trigger an interrupt responsive to receiving a request for authentication from an access system, wherein the authentication request includes metadata; extract the metadata from the authentication request; process the metadata to identify a tenant associated with the request; and access a tenant-specific certificate associated with the tenant and a set of global certificates shared among tenants in a multi-tenant cloud-based content service. ### Claim 11 (depends on 10) The computer readable storage medium of claim 10, wherein the instructions, when executed by the one or more processors, further cause the one or more processors to: provide the tenant-specific certificate to the access system for validation by a third-party certificate authority. ### Claim 12 (depends on 10) The computer readable storage medium of claim 10, wherein the tenant-specific certificate comprises one or more of a Secure Socket Layer (SSL) certificate, an email encryption certificate, or a code signing certificate. ### Claim 13 (depends on 10) The computer readable storage medium of claim 10, wherein the tenant-specific certificate comprises a certificate issued to the tenant by the third-party certificate authority. ### Claim 14 (depends on 13) The computer readable storage medium of claim 13, wherein the instructions, when executed by the one or more processors, further cause the one or more processors to: receive the tenant-specific certificate from a dedicated tenant system; provide the tenant-specific certificate to the multi-tenant cloud-based content service; receive an indication of machines on which tenant data is or will be stored; and deploy the tenant-specific certificates to the machines. ### Claim 15 (depends on 14) The computer readable storage medium of claim 14, wherein the instructions, when executed by the one or more processors, further cause the one or more processors to deploy global certificates to the machines. ### Claim 16 (depends on 14) The computer readable storage medium of claim 14, wherein the instructions, when executed by the one or more processors, further cause the one or more processors to receive a request from the access system, wherein fulfilling the request requires accessing a back-end service; identify a shared certificate corresponding to the back-end service; and authenticate with the back-end service using the shared certificate. ### Claim 17 (depends on 14) The computer readable storage medium of claim 14, wherein the instructions, when executed by the one or more processors, further cause the one or more processors to: responsive to receiving, a request to change a type of a first certificate from a global certificate to a scope-based certificate, modify the type of the first certificate, identify machines on which the first certificate is deployed; and reimage the machines on which the first certificate is deployed. ### Claim 18 A method of operating a front-end access server to facilitate scope-based certificate deployment in a multi-tenant cloud-based content service, the method comprising: receiving a request for authentication from an access system, wherein the request includes metadata; extracting the metadata from the request; processing the metadata to identify a scope-based certificate corresponding to the request, wherein the scope-based certificate has a scope within the multi-tenant cloud-based content service; accessing the scope-based certificate and a set of global certificates shared among tenants in the multi-tenant cloud-based content service; and responsive to receiving the request for authentication, providing to the access system, the scope-based certificate for validation by a third-party certificate authority and one or more of the set of global certificates, wherein the set of global certificates are provided for accessing a set of back-end services. ### Claim 19 (depends on 18) The method of claim 18, wherein the scope of the scope-based certificate comprises one or more of a particular region or content farm. ### Claim 20 (depends on 18) The method of claim 18, wherein the certificate comprises one or more of a Secure Socket Layer (SSL) certificate, an email encryption certificate, or a code signing certificate.