Secure machine enrollment in multi-tenant subscription environment

#Many Internet services attempt to prevent unauthorized users from accessing resources provided by the service. For example, a service may issue a link to an authorized user to access content at the service. A service may also require a user to provide authentication credentials to access resources provided by the service. Anyone who obtains access to the link or to the user's authentication credentials, however, can access the resources.

#This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter.

#In a multi-tenant environment, machines across the Internet, belonging to a particular subscription are securely enrolled with the tenant's subscription. Authentication of the machines is delegated to each of the tenants own on-premise authentication mechanism (e.g. Public Key Infrastructure “PKI”, Security Token Service “STS”, Kerberos, . . . ). The trust relationship with the tenant's authentication service (PKI root certificate/issuer, certificate trust, . . . ) is used to validate the token presented by the machine attempting to be authenticated. Once authenticated, the machine has authorization (e.g. SSL machine cert for identity, token, . . . ) to access the subscription. Each tenant within the multi-tenant environment can provide its own level of authentication. A trust relationship (e.g. Public Key Infrastructure “PKI”, Security Token Service “STS”, . . . ) is established between each of the tenants and the multi-tenant environment. The machine presents the token to the multi-tenant environment for requests for resources (e.g. services/content). When a request is received from a machine to access a resource, the multi-tenant environment determines from the issued token whether or not the machine is authorized to access the requested resources.

#FIG. 1 illustrates an exemplary computing device;

#FIG. 2 illustrates an exemplary system for a securely enrolling machines with a multi-tenant environment;

#FIG. 3 shows a process for authenticating a machine requesting a resource from a multi-tenant environment; and

#Referring now to the drawings, in which like numerals represent like elements, various embodiments will be described. In particular, FIG. 1 and the corresponding discussion are intended to provide a brief, general description of a suitable computing environment in which embodiments may be implemented.

#Generally, program modules include routines, programs, components, data structures, and other types of structures that perform particular tasks or implement particular abstract data types. Other computer system configurations may also be used, including hand-held devices, multiprocessor systems, microprocessor-based or programmable consumer electronics, minicomputers, mainframe computers, and the like. Distributed computing environments may also be used where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote memory storage devices.

#Referring now to FIG. 1, an illustrative computer architecture for a computer 100 utilized in the various embodiments will be described. The computer architecture shown in FIG. 1 may be configured as a server computing device, a desktop computing device, a mobile computing device (e.g. smartphone, notebook, tablet . . . ) and includes a central processing unit 5 (“CPU”), a system memory 7, including a random access memory 9 (“RAM”) and a read-only memory (“ROM”) 10, and a system bus 12 that couples the memory to the central processing unit (“CPU”) 5.