# US 12,603,888 B2 · Layered authentication method for managing access to cloud resources > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,603,888 B2 - Document ID: US12603888B2 - Status: Granted - Kind: B2 - Application number: 17/568,290 - Filed: 2022-01-04 - Published: 2023-07-06 - Granted: 2026-04-14 - Earliest claimed: 2022-01-04 - Assignees: Dell Products L.P. - Applicants: Dell Products L.P. - Inventors: Michael G. Varteresian; Muzhar S. Khokhar - Web page: https://patentgrep.com/patent/US12603888B2 ## CPC - H04L 63/102: {Entity profiles} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 2463/082: applying multi-factor authentication - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A disclosed method for managing access to cloud infrastructure include responding to receiving a user request to access a cloud resource, such as a cluster associated with a hyper-converged infrastructure appliance, associated with an entity by performing a layered authentication of the user. The layered authentication includes determining first layer privileges based on first user credentials associated with a first authentication module and determining second layer privileges based on second user credentials associated with a second authentication module. The request is granted or denied based on a combination of the user's first and second layer privileges. The first authentication module may be associated with a first authentication domain such as an authentication domain of a cloud service provider or an OEM of cloud infrastructure resources. The second authentication module may comprise an authentication module maintained by the entity associated with the resource targeted by the user request. ## Claims ### Claim 1 A method for managing access to cloud infrastructure, the method comprising: responsive to receiving a request to access a cloud infrastructure resource provisioned by a cloud service provider and allocated, by the cloud service provider, to an entity, performing a layered authentication of a user associated with the request, wherein the layered authentication includes: determining first layer privileges of the user based on first user credentials associated with a first authentication interface, wherein the first authentication interface comprises an authentication interface of the cloud service provider; determining second layer privileges for the user based on second user credentials associated with a second authentication interface, wherein the second authentication interface comprises an authentication interface of the entity; wherein the first and second layer privileges include one or more privileges common to both the first and the second layer privileges and one or more privileges unique to the second layer of privileges; and determining whether to grant the request based, at least in part, on a combination of the first layer privileges and the second layer privileges; wherein the first layer privileges determine whether the cloud service provider permits the user to view the cloud infrastructure resource, the second layer privileges determine actions the entity permits the user to perform on the cloud infrastructure resource, and the actions include updating the cloud infrastructure resource; wherein the first credentials and the second credentials are independent and distinct. ### Claim 2 (depends on 1) The method of claim 1, wherein the cloud infrastructure resource includes a multi-node cluster provisioned by a hyper-converged infrastructure appliance. ### Claim 3 (depends on 1) The method of claim 1, wherein the user request contains only one of the first credentials and the second credentials. ### Claim 4 (depends on 1) The method of claim 1, wherein determining whether to grant the request includes denying the request unless the cloud service provider and the entity both permit the user to view the cloud infrastructure resource. ### Claim 5 An information handling system, comprising: a central processing unit; and a memory including process executable instructions that, when executed by the central processing unit, cause the system to perform operations for managing access to cloud infrastructure, the operations comprising: responsive to receiving a request to access a cloud infrastructure resource provisioned by a cloud service provider and allocated, by the cloud service provider, to an entity, performing a layered authentication of a user associated with the request, wherein the layered authentication includes: determining first layer privileges of the user based on first user credentials associated with a first authentication interface, wherein the first authentication interface comprises an authentication interface of the cloud service provider; determining second layer privileges for the user based on second user credentials associated with a second authentication interface, wherein the second authentication interface comprises an authentication interface of the entity; wherein the first and second layer privileges include one or more privileges common to both the first and the second layer privileges and one or more privileges unique to of the second layer of privileges; and determining whether to grant the request based, at least in part, on a combination of the first layer privileges and the second layer privileges; wherein the first layer privileges determine whether the cloud service provider permits the user to view the cloud infrastructure resource, the second layer privileges determine actions the entity permits the user to perform on the cloud infrastructure resource, and the actions include performing a pre-update health check of the cloud infrastructure resource; wherein the first credentials and the second credentials are independent and distinct. ### Claim 6 (depends on 5) The information handling system of claim 5, wherein the cloud infrastructure resource includes a multi-node cluster provisioned by a hyper-converged infrastructure appliance. ### Claim 7 (depends on 5) The information handling system of claim 5, wherein the user request contains only one of the first credentials and the second credentials. ### Claim 8 (depends on 5) The information handling system of claim 5, wherein determining whether to grant the request includes denying the request unless the cloud service provider and the entity both permit the user to view the cloud infrastructure resource.