Abstract: Systems, methods, and software technology for managing keys used to encrypt data at-rest and decrypt the data when serving requests for the data. In an implementation, a data service receives a request for data that has been encrypted at rest using a data key, wherein the data key has been encrypted using a policy key, and wherein the policy key has been encrypted using a root key. When the root key is unavailable, the data service requests a key service to decrypt the policy key using an alternative root key. When the data service receives the policy key in an unencrypted state from the key service, it decrypts the data key using the policy key and decrypts the data using the data key.

Abstract: The present invention extends to methods, systems, and computer program products for implementing a tenant provisioning system in a multi-tenancy architecture using a single provisioning master in the architecture, and a data center provisioner in each data center in the architecture. The provisioning master receives user requests to provision a tenant of a service and routes such requests to an appropriate data center provisioner. Each service in the multi-tenancy architecture implements a common interface by which the corresponding data center provisioner can obtain a common indication of load from each different service deployed in the data center thus facilitating the selection of a scale unit on which a tenant is provisioned. The common interface also enables a service to dynamically register (i.e. without redeploying the tenant provisioning system) with the provisioning master as a multi-tenancy service by registering an endpoint address with the provisioning master.

Abstract: The present invention extends to methods, systems, and computer program products for implementing a tenant provisioning system in a multi-tenancy architecture using a single provisioning master in the architecture, and a data center provisioner in each data center in the architecture. The provisioning master receives user requests to provision a tenant of a service and routes such requests to an appropriate data center provisioner. Each service in the multi-tenancy architecture implements a common interface by which the corresponding data center provisioner can obtain a common indication of load from each different service deployed in the data center thus facilitating the selection of a scale unit on which a tenant is provisioned. The common interface also enables a service to dynamically register (i.e. without redeploying the tenant provisioning system) with the provisioning master as a multi-tenancy service by registering an endpoint address with the provisioning master.

Abstract: A highly available central controller to store and enforce valid state transitions of distributed components is provided for centrally controlling access to a service. Central control is provided by a database with an API according to a set of stored procedures, which provides a virtual view to requesters that seek to read or manipulate service entities.

Abstract: The disclosure relates to a service allocation system in which servers advertise services they offer to the system and clients ask for services to consume. Both the clients and the servers interact with the allocation system using database calls to at least one of a plurality of databases. Servers that provide services update the current status of a service periodically. High-availability and load-balancing of the services can be achieved. The allocation system can be used for a single type of service or multiple different types of services.

Abstract: A highly available central controller to store and enforce valid state transitions of distributed components is provided for centrally controlling access to a service. Central control is provided by a database with an API according to a set of stored procedures, which provides a virtual view to requesters that seek to read or manipulate service entities.