# US 11,122,053 B2 · Flexible rights management for cloud-based access to computing resources > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,122,053 B2 - Document ID: US11122053B2 - Status: Granted - Kind: B2 - Application number: 16/251,493 - Filed: 2019-01-18 - Published: 2020-07-23 - Granted: 2021-09-14 - Earliest claimed: 2019-01-18 - Assignees: VMware, Inc. - Applicants: Vmware, Inc. - Inventors: Jeff Moroski; Ron Passerini; John Kilroy - Web page: https://patentgrep.com/patent/US11122053B2 ## CPC - H04L 63/105: {Multiple levels of security} - G06F 9/5077: {Logical partitioning of resources; Management or configuration of virtualized resources (specific details on emulation or internal functioning of virtual machines G06F9/455)} - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 41/0806: for initial configuration or provisioning, e.g. plug-and-play - H04L 41/0895: Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements - H04L 41/22: comprising specially adapted graphical user interfaces [GUI] - H04L 41/40: using virtualisation of network functions or resources, e.g. SDN or NFV entities - H04L 63/0272: {Virtual private networks} - H04L 63/102: {Entity profiles} - H04L 63/104: {Grouping of entities} - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - H04L 41/0816: the condition being an adaptation, e.g. in response to network events - H04L 41/0897: by horizontal or vertical scaling of resources, or by migrating entities, e.g. virtual resources or entities - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An example method for assigning rights to utilize cloud resources associated with a service provider's computing hardware is provided. The example method can include defining a rights package including multiple rights pertaining to utilization of the cloud resources. The rights package can be assigned across multiple tenants of the service provider. The example method can also include defining a global role that includes potential rights, where the global role is assignable to individual tenant users of the tenant. The global roles can be made available to multiple tenants using the service provider. The method can further include provisioning filtered rights to utilize the cloud resources to a tenant user of the tenant, the tenant user being assigned the global role. The filtered rights can include rights present in both the potential rights defined for the global role and the rights defined for the rights package. ## Claims ### Claim 1 A method for assigning rights to utilize cloud resources associated with a service provider's computing hardware, comprising: defining a rights package comprising a plurality of rights pertaining to utilization of the cloud resources, wherein the rights package is assignable to a tenant of the service provider's computing hardware, the tenant including a plurality of tenant users; defining a first global role comprising a first plurality of potential rights, wherein the first global role is assignable to individual tenant users of the tenant and wherein the first plurality of potential rights includes at least one right that is not included in the rights package; assigning the first global role to a first individual tenant user of the tenant; and provisioning first filtered rights to utilize the cloud resources to the first individual tenant user of the tenant based on the tenant assigning the first global role to the first individual tenant user, wherein the filtered rights include rights present in both the first plurality of potential rights defined for the first global role and the plurality of rights defined for the rights package. ### Claim 2 (depends on 1) The method of claim 1, further comprising: defining a second global role comprising a second plurality of potential rights, wherein the second global role is assignable to individual tenant users of the tenant; assigning the second global role to a second individual tenant user of the tenant; and provisioning second filtered rights to utilize the cloud resources to the second individual tenant user of the tenant, the second filtered rights including rights present in both the second plurality of potential rights defined for the first global role and the plurality of rights defined for the rights package assigned to the tenant, wherein the first filtered rights include at least one right that is not included in the second filtered rights, and wherein the first and second filtered rights are provisioned based on the tenant assigning the first and second global roles to the first and second individual tenant users, respectively. ### Claim 3 (depends on 2) The method of claim 2, wherein when the rights package is assigned to a plurality of tenants, modifying the rights package by the service provider causes the assigned rights packages to automatically update for each of the plurality of tenants. ### Claim 4 (depends on 1) The method of claim 1, wherein the global role can be assigned to a plurality of individual tenant users, each of the plurality of individual tenant users being associated with a separate tenant using the service provider's computing hardware. ### Claim 5 (depends on 1) The method of claim 1, further comprising: defining a local role comprising a third plurality of potential rights, the local role being defined by the tenant and specific to the tenant; and provisioning custom rights to utilize the cloud resources to a second tenant user assigned to the local role, wherein the custom rights include rights present in both the third plurality of potential rights defined for the local role and the first plurality of rights defined for the rights package. ### Claim 6 (depends on 1) The method of claim 1, wherein the rights package reflects rights defined by a service contract between the service provider and the tenant. ### Claim 7 (depends on 1) The method of claim 1, wherein an individual tenant user is authorized to exercise a VPN right pertaining to configuring VPN access to the cloud resources based on both the global role assigned to the individual tenant user and the rights package assigned to the tenant associated with the individual tenant user including the VPN right. ### Claim 8 A non-transitory, computer-readable medium containing instructions that, when executed by a hardware-based processor, performs stages for assigning rights to utilize cloud resources associated with a service provider's computing hardware, the stages comprising: defining a rights package comprising a plurality of rights pertaining to utilization of the cloud resources, wherein the rights package is assignable to a tenant of the service provider's computing hardware, the tenant including a plurality of tenant users; defining a first global role comprising a first plurality of potential rights, wherein the first global role is assignable to individual tenant users of the tenant and wherein the first plurality of potential rights includes at least one right that is not included in the rights package; assigning the first global role to a first individual tenant user of the tenant; and provisioning first filtered rights to utilize the cloud resources to the first individual tenant user of the tenant based on the tenant assigning the first global role to the first individual tenant user, wherein the filtered rights include rights present in both the first plurality of potential rights defined for the first global role and the plurality of rights defined for the rights package. ### Claim 9 (depends on 8) The non-transitory, computer-readable medium of claim 8, the stages further comprising: defining a second global role comprising a second plurality of potential rights, wherein the second global role is assignable to individual tenant users of the tenant; assigning the second global role to a second individual tenant user of the tenant; and provisioning second filtered rights to utilize the cloud resources to the second individual tenant user of the tenant, the second filtered rights including rights present in both the second plurality of potential rights defined for the first global role and the plurality of rights defined for the rights package assigned to the tenant, wherein the first filtered rights include at least one right that is not included in the second filtered rights, and wherein the first and second filtered rights are provisioned based on the tenant assigning the first and second global roles to the first and second individual tenant users, respectively. ### Claim 10 (depends on 9) The non-transitory, computer-readable medium of claim 9, wherein when the rights package is assigned to a plurality of tenants, modifying the rights package by the service provider causes the assigned rights packages to automatically update for each of the plurality of tenants. ### Claim 11 (depends on 8) The non-transitory, computer-readable medium of claim 8, wherein the global role can be assigned to a plurality of individual tenant users, each of the plurality of individual tenant users being associated with a separate tenant using the service provider's computing hardware. ### Claim 12 (depends on 8) The non-transitory, computer-readable medium of claim 8, the stages further comprising: defining a local role comprising a third plurality of potential rights, the local role being defined by the tenant and specific to the tenant; and provisioning custom rights to utilize the cloud resources to a second tenant user assigned to the local role, wherein the custom rights include rights present in both the third plurality of potential rights defined for the local role and the first plurality of rights defined for the rights package. ### Claim 13 (depends on 8) The non-transitory, computer-readable medium of claim 8, wherein the rights package reflects rights defined by a service contract between the service provider and the tenant. ### Claim 14 (depends on 8) The non-transitory, computer-readable medium of claim 8, wherein an individual tenant user is authorized to exercise a VPN right pertaining to configuring VPN access to the cloud resources based on both the global role assigned to the individual tenant user and the rights package assigned to the tenant associated with the tenant user including the VPN right. ### Claim 15 A system for assigning rights to utilize cloud resources associated with a service provider's computing hardware, comprising: a memory storage including a non-transitory, computer-readable medium comprising instructions; and a computing device including a hardware-based processor that executes the instructions to carry out stages comprising: defining a rights package comprising a plurality of rights pertaining to utilization of the cloud resources, wherein the rights package is assignable to a tenant of the service provider's computing hardware, the tenant including a plurality of tenant users; defining a first global role comprising a first plurality of potential rights, wherein the first global role is assignable to individual tenant users of the tenant and wherein the first plurality of potential rights includes at least one right that is not included in the rights package; and assigning the first global role to a first individual tenant user of the tenant; and provisioning first filtered rights to utilize the cloud resources to the first individual tenant user of the tenant based on the tenant assigning the first global role to the first individual tenant user, wherein the filtered rights include rights present in both the first plurality of potential rights defined for the first global role and the plurality of rights defined for the rights package. ### Claim 16 (depends on 15) The system of claim 15, the stages further comprising: defining a second global role comprising a second plurality of potential rights, wherein the second global role is assignable to individual tenant users of the tenant; assigning the second global role to a second individual tenant user of the tenant; and provisioning second filtered rights to utilize the cloud resources to the second individual tenant user of the tenant, the second filtered rights including rights present in both the second plurality of potential rights defined for the first global role and the plurality of rights defined for the rights package assigned to the tenant, wherein the first filtered rights include at least one right that is not included in the second filtered rights, and wherein the first and second filtered rights are provisioned based on the tenant assigning the first and second global roles to the first and second individual tenant users, respectively. ### Claim 17 (depends on 16) The system of claim 16, wherein when the rights package is assigned to a plurality of tenants, modifying the rights package by the service provider causes the assigned rights packages to automatically update for each of the plurality of tenants. ### Claim 18 (depends on 15) The system of claim 15, wherein the global role can be assigned to a plurality of individual tenant users, each of the plurality of individual tenant users being associated with a separate tenant using the service provider's computing hardware. ### Claim 19 (depends on 15) The system of claim 15, the stages further comprising: defining a local role comprising a third plurality of potential rights, the local role being defined by the tenant and specific to the tenant; and provisioning custom rights to utilize the cloud resources to a second tenant user assigned to the local role, wherein the custom rights include rights present in both the third plurality of potential rights defined for the local role and the first plurality of rights defined for the rights package. ### Claim 20 (depends on 15) The system of claim 15, wherein an individual tenant user is authorized to exercise a VPN right pertaining to configuring VPN access to the cloud resources based on both the global role assigned to the individual tenant user and the rights package assigned to the tenant associated with the tenant user including the VPN right.