U.S. patent application number 14/750852 was filed with the patent office on 2016-12-08 for trusted public infrastructure grid cloud.
The applicant listed for this patent is CA, Inc.. Invention is credited to Nir Barak, Yaacov Bezalel, Eitan Hadar, Amir Jerbi, Michael Kletskin.
Application Number | 20160359911 14/750852 |
Document ID | / |
Family ID | 49478558 |
Filed Date | 2016-12-08 |
United States Patent
Application |
20160359911 |
Kind Code |
A1 |
Hadar; Eitan ; et
al. |
December 8, 2016 |
TRUSTED PUBLIC INFRASTRUCTURE GRID CLOUD
Abstract
Systems and methods of implementing a secured cloud environment
allow for design and instantiation of a security policy at the
infrastructure level. An example system may comprise a first module
to facilitate selecting at least two cloud computing component
templates from a cloud computing component catalog. The system may
comprise a second module to facilitate defining a connection
between the at least two selected cloud computing component
templates. The system may comprise a third module to facilitate
assigning a security level and a policy to at least one of the at
least two selected cloud computing component templates. The system
may comprise a fourth module to facilitate building a cloud
computing component blueprint.
Inventors: |
Hadar; Eitan; (Nesher,
IL) ; Kletskin; Michael; (Matan, IL) ; Barak;
Nir; (Karmi Yosef, IL) ; Jerbi; Amir;
(Givatayim, IL) ; Bezalel; Yaacov; (Holon,
IL) |
|
Applicant: |
Name |
City |
State |
Country |
Type |
CA, Inc. |
New York |
NY |
US |
|
|
Family ID: |
49478558 |
Appl. No.: |
14/750852 |
Filed: |
June 25, 2015 |
Related U.S. Patent Documents
|
|
|
|
|
|
Application
Number |
Filing Date |
Patent Number |
|
|
13459593 |
Apr 30, 2012 |
|
|
|
14750852 |
|
|
|
|
Current U.S.
Class: |
1/1 |
Current CPC
Class: |
H04L 63/20 20130101;
G06F 21/6218 20130101; H04L 63/10 20130101; G06F 2221/2113
20130101; H04L 67/10 20130101 |
International
Class: |
H04L 29/06 20060101
H04L029/06 |
Claims
1. A system comprising: a processor; a computer readable storage
medium having computer readable instructions, the instructions
executable by the processor to cause the system to: select a first
security policy for a first cloud computing component, wherein the
first security policy indicates a plurality of security
requirements; deploy the first cloud computing component along with
an agent to monitor whether the first cloud computing component
complies with the plurality of security requirements; receive first
security compliance information from the agent; and in response to
a determination that the first security compliance information
indicates that the deployed first cloud computing component does
not comply with a first security requirement of the plurality of
security requirements, indicate that the first cloud computing
component does not comply with the first security policy; and
modify the deployed first cloud computing component to comply with
the first security requirement; receive second security compliance
information from the agent; and in response to a determination that
the second security compliance information indicates that the
deployed first cloud computing component complies with the
plurality of security requirements, indicate that the first cloud
computing component complies with the first security policy.
2. (canceled)
3. The system of claim 1, wherein the computer readable storage
medium further has instructions executable by the processor to
cause the system to: select a cloud computing component template
from a cloud computing component template catalog, wherein the
cloud computing component template corresponds to the first cloud
computing component; wherein the instructions executable by the
processor to cause the system to modify the deployed first cloud
computing component to comply with the first security requirement
comprise instructions executable by the processor to cause the
system to modify the cloud computing component template and
redeploy the first cloud computing component in accordance with the
modified cloud computing component template.
4. The system of claim 1, wherein the computer readable storage
medium further has instructions executable by the processor to
cause the system to create a cloud computing application blueprint,
wherein the blueprint comprises information regarding the first
security policy and a deployment process for the first cloud
computing component, wherein the instructions executable by the
processor to cause the system to deploy the first cloud computing
component comprise instructions executable by the processor to
cause the system to deploy the first cloud computing component in
accordance with the blueprint.
5. (canceled)
6. The system of claim 1, wherein the computer readable storage
medium further has instructions executable by the processor to
cause the system to periodically retrieve security compliance
information from the agent.
7. (canceled)
8. A method comprising: selecting a first security policy for a
first cloud computing component, wherein the first security policy
indicates a plurality of security requirements; deploying the first
cloud computing component along with an agent to monitor whether
the first cloud computing component complies with the plurality of
security requirements; receiving first security compliance
information from the agent; in response to a determination that the
first security compliance information indicates that the deployed
first cloud computing component does not comply with a first
security requirement of the plurality of security requirements,
indicating that the first cloud computing component does not comply
with the first security policy; and modifying the deployed first
cloud computing component to comply with the first security
requirement; receiving second security compliance information from
the agent; and in response to a determination that the second
security compliance information indicates that the deployed first
cloud computing component complies with the plurality of security
requirements, indicating that the first cloud computing complies
with the first security policy.
9. (canceled)
10. The method of claim 8 further comprising: selecting a cloud
computing component template from a cloud computing component
template catalog, wherein the cloud computing component template
corresponds to the first cloud computing component; wherein
modifying the deployed first cloud computing component to comply
with the first security requirement comprise modifying the cloud
computing component template and redeploying the first cloud
computing component in accordance with the modified cloud computing
component template.
11. The method of claim 8 further comprising creating a cloud
computing application blueprint, wherein the blueprint comprises
information regarding the first security policy and a deployment
process for the first cloud computing component, wherein deploying
the first cloud computing component comprises deploying the first
cloud computing component in accordance with the blueprint.
12. (canceled)
13. The method of claim 8 further comprising periodically
retrieving security compliance information from the agent.
14. (canceled)
15. A non-transitory computer readable storage medium with
instructions stored thereon, the instructions to: select a first
security policy for a first cloud computing component, wherein the
first security policy indicates a plurality of security
requirements; deploy the first cloud computing component along with
an agent to monitor whether the first cloud computing component
complies with the plurality of security requirements; receive first
security compliance information from the agent; and in response to
a determination that the first security compliance information
indicates that the deployed first cloud computing component does
not comply with a first security requirement of the plurality of
security requirements, indicate that the first cloud computing
component does not comply with the first security policy; and
modify the deployed first cloud computing component to comply with
the first security requirement; receive second security compliance
information from the agent; and in response to a determination that
the second security compliance information indicates that the
deployed first cloud computing component complies with the
plurality of security requirements, indicate that the first cloud
computing component complies with the first security policy.
16. (canceled)
17. The non-transitory computer readable storage medium of claim 15
further comprising instructions to: select a cloud computing
component template from a cloud computing component template
catalog, wherein the cloud computing component template corresponds
to the first cloud computing component; wherein the instructions to
modify the deployed first cloud computing component to comply with
the first security requirement comprise instructions to modify the
cloud computing component template and redeploy the first cloud
computing component in accordance with the modified cloud computing
component template.
18. The non-transitory computer readable storage medium of claim 15
further comprising instructions to a cloud computing application
blueprint, wherein the blueprint comprises information regarding
the first security policy and a deployment process for the first
cloud computing component, wherein the instructions to deploy the
first cloud computing component comprise instructions to deploy the
first cloud computing component in accordance with the
blueprint.
19. (canceled)
20. (canceled)
21. The system of claim 1, wherein the computer readable storage
medium further has instructions executable by the processor to
cause the system to: determine that a second security requirement
of the plurality of security requirements indicates that data of
the first cloud computing component should be password protected;
deploy a second cloud computing component, wherein the second cloud
computing component receives data from the first cloud computing
component and is monitored by the agent; receive third security
compliance information from the agent; and in response to a
determination that the third security compliance information
indicates that the deployed second cloud computing component does
not comply with the second security requirement, modify the
deployed second cloud computing component to provide password
protection for data received from the first cloud computing
component.
22. The system of claim 1, wherein the computer readable storage
medium further has instructions executable by the processor to
cause the system to: determine whether the deployed first cloud
computing component complies with each of the plurality of security
requirements based, at least in part, on actual use of the deployed
first cloud computing component and planned use of the deployed
first cloud computing component, wherein the actual use and the
planned use is indicated in the first security compliance
information; and generate a compliance report based, at least in
part, on the determination of whether the deployed first cloud
computing component compiles with each of the plurality of security
requirements, wherein the compliance report indicates a compliance
status of the deployed first cloud computing component.
23. The system of claim 1, wherein the computer readable storage
medium further has instructions executable by the processor to
cause the system to: determine that the first security compliance
information comprises an indication of a security event, wherein
the security event was an attempt to violate security of the first
cloud computing component; and in response to the indication of the
security event, update the first cloud computing component with a
second security policy, wherein the second security policy imposes
greater security than the first security policy.
24. The method of claim 8 further comprising: determining that a
second security requirement of the plurality of security
requirements indicates that data of the first cloud computing
component should be password protected; deploying a second cloud
computing component, wherein the second cloud computing component
receives data from the first cloud computing component and is
monitored by the agent; receiving third security compliance
information from the agent; and in response to a determination that
the third security compliance information indicates that the
deployed second cloud computing component does not comply with the
second security requirement, modifying the deployed second cloud
computing component to provide password protection for data
received from the first cloud computing component.
25. The method of claim 8 further comprising: determining whether
the deployed first cloud computing component complies with each of
the plurality of security requirements based, at least in part, on
actual use of the deployed first cloud computing component and
planned use of the deployed first cloud computing component,
wherein the actual use and the planned use is indicated in the
first security compliance information; and generating a compliance
report based, at least in part, on the determination of whether the
deployed first cloud computing component compiles with each of the
plurality of security requirements, wherein the compliance report
indicates a compliance status of the deployed first cloud computing
component.
26. The method of claim 8 further comprising: determining that the
first security compliance information comprises an indication of a
security event, wherein the security event was an attempt to
violate security of the first cloud computing component; and in
response to the indication of the security event, updating the
first cloud computing component with a second security policy,
wherein the second security policy imposes greater security than
the first security policy.
27. The non-transitory computer readable storage medium of claim 15
further comprising instructions to: determine that a second
security requirement of the plurality of security requirements
indicates that data of the first cloud computing component should
be password protected; deploy a second cloud computing component,
wherein the second cloud computing component receives data from the
first cloud computing component and is monitored by the agent;
receive third security compliance information from the agent; and
in response to a determination that the third security compliance
information indicates that the deployed second cloud computing
component does not comply with the second security requirement,
modify the deployed second cloud computing component to provide
password protection for data received from the first cloud
computing component.
28. The non-transitory computer readable storage medium of claim 15
further comprising instructions to: determine whether the deployed
first cloud computing component complies with each of the plurality
of security requirements based, at least in part, on actual use of
the deployed first cloud computing component and planned use of the
deployed first cloud computing component, wherein the actual use
and the planned use is indicated in the first security compliance
information; and generate a compliance report based, at least in
part, on the determination of whether the deployed first cloud
computing component compiles with each of the plurality of security
requirements, wherein the compliance report indicates a compliance
status of the deployed first cloud computing component.
29. The non-transitory computer readable storage medium of claim 15
further comprising instructions to: determine that the first
security compliance information comprises an indication of a
security event, wherein the security event was an attempt to
violate security of the first cloud computing component; and in
response to the indication of the security event, update the first
cloud computing component with a second security policy, wherein
the second security policy imposes greater security than the first
security policy.
Description
RELATED APPLICATION
[0001] This application is a Divisional application of and is
related and claims priority to U.S. patent application Ser. No.
13/459,593 filed on Apr. 30, 2012, entitled "TRUSTED PUBLIC
INFRASTRUCTURE GRID CLOUD", the entirety of which is incorporated
herein by reference.
BACKGROUND
[0002] Prior attempts to build cloud grids focus on rapid service
enablement, accurate billing, and quality of service. The prior
solutions attempt to provide easier ways to design a requested
information technology (IT) system, and focus on automation and
optimization of the location of the corresponding manager grid.
There exists no known prior cloud grid system with a complete
security system built into it at the infrastructure level.
BRIEF SUMMARY
[0003] Methods and systems help secure a grid cloud by adding
security policy instantiation at an infrastructure design stage,
among other measures. The infrastructure designed may create a
compliance report to demonstrate that the designed infrastructure
satisfies a security policy. Access and network separations
according to application tiers of a tenant (e.g. user) may be
realized. The methods and systems may be used to merge security and
infrastructure design to increase trust and security in cloud
systems.
[0004] In further embodiments, systems may provide transparency
which may include compliance reports on actual usage and access to
cloud computing components. Trust between consumers of cloud grid
systems and providers may be proven, and based on more than just
reputation. In an example embodiment users are segmented to have
different access privileges through the use of security policies.
Segmentation may also be provided at the application level of a
particular user. All segmentation may be within the same grid and
may increase efficiency of the cloud grid.
[0005] In an example, a designer of a cloud grid selects a cloud
grid component and a security policy, including a security level,
to be assigned to the component. The security policy choice can be
made based on business, architecture, or any other segmentation
reason. Cloud grid infrastructure, security, and a security agent
may be installed automatically. If an entity (e.g. a person or a
balancing system) is attempting to move a cloud grid component, a
security policy at the new location of the component can be
analyzed and the security policy at the new location can be altered
to ensure that proper security for the moved component is
maintained.
[0006] In an example embodiment a trusted public infrastructure
cloud grid may include a system comprising a first module to
facilitate selecting at least two cloud computing component
templates from a cloud computing component catalog. The system may
further comprise a second module to facilitate defining a
connection between the at least two selected cloud computing
component templates. The system may further comprise a third module
to facilitate assigning a security level and a policy to at least
one of the at least two selected cloud computing component
templates. The system may further comprise a fourth module to
facilitate building a cloud computing component blueprint for the
connected cloud computing components, wherein the cloud computing
component blueprint includes information regarding the security
level and policy assigned to the corresponding cloud computing
component template, and the cloud computing component blueprint
including information regarding the defined connection. The system
may further comprise a fifth module to facilitate coupling cloud
computing components corresponding to the cloud computing component
blueprint to a control server.
[0007] In an example embodiment a trusted public infrastructure
cloud grid may include a system comprising a secured cloud system
design studio, an application manager, and a control server. A
secured cloud system design studio may comprise a policy builder
that facilitates design of a security policy for a cloud computing
component to comply with, a policy importer that facilitates the
import of a security policy for a cloud computing component to
comply with, and a design studio that facilitates designing secured
and non-secured cloud computing components to be deployed in a
cloud environment. The design of a secured cloud computing
component may include instantiating a security policy that a cloud
computing component must comply with, and instantiating a security
agent that monitors compliance with the security policy. A security
agent ("agent") may send compliance data to a control server, and a
cloud computing component catalog. A cloud computing component
catalog may include cloud computing component templates that a
design studio can use to help facilitate the design of cloud
computing components. A cloud computing component template may
include a template for a secured cloud computing component. An
application manager may comprise a grid deployer that deploys a
designed cloud computing component, and a compliance reports module
that creates compliance reports. A compliance report may identify
compliance status of a deployed, secured cloud computing component.
Compliance reports may be created as a function of an instantiated
security policy and compliance data. A control server may comprise
a policy distributor, wherein the policy distributor receives
information regarding changes in an instantiated security policy to
be implemented on a cloud computing component and the policy
distributor updates the security policy accordingly. A trusted
public infrastructure cloud grid may comprise a virtualization
environment including a deployed, secured cloud computing
component. A deployed, secured cloud computing component may
include a security agent that maintains and enforces a security
policy to be followed by a deployed, secured cloud computing
component. An agent may send cloud computing component compliance
information to a control server.
[0008] According to an example embodiment a method of creating a
trusted public infrastructure cloud grid may comprise selecting at
least two cloud computing component templates from a cloud
computing component catalog, defining connections between the at
least two selected cloud computing component templates, assigning a
security level and a policy to at least one of the at least two
selected cloud computing component templates, building a cloud
computing component blueprint for each selected cloud computing
components, and coupling relevant cloud computing components that
have a corresponding cloud computing component blueprint to a
control server. A cloud computing component blueprint may include
information regarding a security level and policy assigned to a
corresponding cloud computing component. A cloud computing
component blueprint may include information regarding defined
connections corresponding to a cloud computing component.
BRIEF DESCRIPTION OF THE DRAWINGS
[0009] Aspects of the present disclosure are illustrated by way of
example and are not limited by the accompanying figures with like
references indicating like elements.
[0010] FIG. 1 is a block diagram of a system capable of
facilitating the design of secure cloud systems according to an
example embodiment.
[0011] FIG. 2 is a flow diagram of a method of creating a virtual
computing environment according to an example embodiment.
[0012] FIG. 3 is a flow diagram of a method of deploying a virtual
computing environment according to an example embodiment.
[0013] FIG. 4 is a flow diagram of a method of updating a virtual
computing environment according to an example embodiment.
[0014] FIG. 5 is a flow diagram of a method of generating
compliance reports according to an example embodiment.
[0015] FIG. 6 is a block diagram of a computer system to implement
methods according to an example embodiment.
DETAILED DESCRIPTION
[0016] As will be appreciated by one skilled in the art, aspects of
the present disclosure may be illustrated and described herein in
any of a number of patentable classes or context including any new
and useful process, machine, manufacture, or composition of matter,
or any new and useful improvement thereof. Accordingly, aspects of
the present disclosure may be implemented entirely hardware,
entirely software (including firmware, resident software,
micro-code, etc.) or combining software and hardware implementation
that may all generally be referred to herein as a "circuit,"
"module," "component," or "system." Furthermore, aspects of the
present disclosure may take the form of a computer program product
embodied in one or more computer readable media having computer
readable program code embodied thereon.
[0017] Any combination of one or more computer readable media may
be utilized. The computer readable media may be a computer readable
signal medium or a computer readable storage medium. A computer
readable storage medium may be, for example, but not limited to, an
electronic, magnetic, optical, electromagnetic, or semiconductor
system, apparatus, or device, or any suitable combination of the
foregoing. More specific examples (a non-exhaustive list) of the
computer readable storage medium would include the following: a
portable computer diskette, a hard disk, a random access memory
(RAM), a read-only memory (ROM), an erasable programmable read-only
memory (EPROM or Flash memory), an appropriate optical fiber with a
repeater, a portable compact disc read-only memory (CD-ROM), an
optical storage device, a magnetic storage device, or any suitable
combination of the foregoing. In the context of this document, a
computer readable storage medium may be any tangible medium that
can contain, or store a program for use by or in connection with an
instruction execution system, apparatus, or device.
[0018] A computer readable signal medium may include a propagated
data signal with computer readable program code embodied therein,
for example, in baseband or as part of a carrier wave. Such a
propagated signal may take any of a variety of forms, including,
but not limited to, electro-magnetic, optical, or any suitable
combination thereof. A computer readable signal medium may be any
computer readable medium that is not a computer readable storage
medium and that can communicate, propagate, or transport a program
for use by or in connection with an instruction execution system,
apparatus, or device. Program code embodied on a computer readable
signal medium may be transmitted using any appropriate medium,
including but not limited to wireless, wireline, optical fiber
cable, RF, etc., or any suitable combination of the foregoing.
[0019] Computer program code for carrying out operations for
aspects of the present disclosure may be written in any combination
of one or more programming languages, including an object oriented
programming language such as Java, Scala, Smalltalk, Eiffel, JADE,
Emerald, C++, C#, VB.NET, Python or the like, conventional
procedural programming languages, such as the "C" programming
language, Visual Basic, Fortran 2003, Perl, COBOL 2002, PHP, ABAP,
dynamic programming languages such as Python, Ruby and Groovy, or
other programming languages. The program code may execute entirely
on the user's computer, partly on the user's computer, as a
stand-alone software package, partly on the user's computer and
partly on a remote computer or entirely on the remote computer or
server. In the latter scenario, the remote computer may be
connected to the user's computer through any type of network,
including a local area network (LAN) or a wide area network (WAN),
or the connection may be made to an external computer (for example,
through the Internet using an Internet Service Provider) or in a
cloud computing environment or offered as a service such as a
Software as a Service (SaaS).
[0020] Aspects of the present disclosure are described herein with
reference to flowchart illustrations and/or block diagrams of
methods, apparatuses (systems) and computer program products
according to embodiments of the disclosure. It will be understood
that each block of the flowchart illustrations and/or block
diagrams, and combinations of blocks in the flowchart illustrations
and/or block diagrams, can be implemented by computer program
instructions. These computer program instructions may be provided
to a processor of a general purpose computer, special purpose
computer, or other programmable data processing apparatus to
produce a machine, such that the instructions, which execute via
the processor of the computer or other programmable instruction
execution apparatus, create a mechanism for implementing the
functions/acts specified in the flowchart and/or block diagram
block or blocks.
[0021] These computer program instructions may also be stored in a
computer readable medium that when executed can direct a computer,
other programmable data processing apparatus, or other devices to
function in a particular manner, such that the instructions when
stored in the computer readable medium produce an article of
manufacture including instructions which when executed, cause a
computer to implement the function/act specified in the flowchart
and/or block diagram block or blocks. The computer program
instructions may also be loaded onto a computer, other programmable
instruction execution apparatus, or other devices to cause a series
of operational steps to be performed on the computer, other
programmable apparatuses or other devices to produce a computer
implemented process such that the instructions which execute on the
computer or other programmable apparatus provide processes for
implementing the functions/acts specified in the flowchart and/or
block diagram block or blocks.
[0022] FIG. 1 depicts a system 100 used to design an at least
partially secure cloud computing system. System 100 may include a
public infrastructure 102 and a virtualization environment 108.
Public infrastructure 102 may include a designer 104, a control
server 108, and an application manager 106. Designer 104 may
include a design studio 112, a policy importer 114, a policy
builder 116, a blueprints module 120, a cloud computing component
catalog 118, a secured templates module 122, and a non-secured
templates module 124. Application manager 106 may include a grid
deployer 126, a deployment tracker 128, and a compliance reports
module 130. Control server 108 may include a policy distributor 134
and a compliance analyzer 132. Virtualization environment 108 may
include a non-secured cloud computing component module 138 and a
secured cloud computing component module 136. Secured cloud
computing component module 136 may include an agent 140.
[0023] Design studio 112 may be coupled to policy importer 114,
policy builder 116, cloud computing component catalog 118, and
blueprints module 120 to help facilitate the design of cloud
computing components. Design studio 112 allows a user to model both
secured and non-secured virtual applications. Virtual applications
are designs of cloud grids including a virtual machine, secured or
non-secured, and/or other cloud computing components. As used
herein, a cloud computing component can be a virtual machine or any
other hardware or software related to implementing a cloud grid. A
user may interact with design studio 112 through a user interface.
The user interface may allow a user to interact through a display
and a user input device including but not limited to a keyboard,
touchpad, and mouse. The user interface may allow for the drag and
drop of virtual computing instruments that represent cloud
computing components. Design studio 112 may allow a user to assign
security attributes and policies to cloud computing components.
Design studio 112 may allow a user to assign policies to cloud
computing components. A policy assigned to a specific cloud
computing component may be retrieved from policy importer 114. A
policy assigned to a specific cloud computing component may be
designed using policy builder 116. Design studio 112 may provide an
environment to facilitate the selection of cloud computing
component templates, selection of virtual datacenter resources, and
assignment of security policies to the cloud computing component
templates. The security policies may include security attributes to
be assigned to a cloud computing component.
[0024] As used herein a "security attribute" is a label that may be
assigned to a cloud computing component. The security attribute may
control which security policies are assigned to a cloud computing
component. For example, a security attributes may include "public,"
"secret," "isolated," or "top secret," among others. A "security
policy" (or "policy") associated with security attribute secret or
top secret may be "deny access to network unless username,
password, and IP address are verified." As used herein "security
level" is a numeric representation corresponding to a specific
security attribute. A security level may be any number within any
range of numbers that allows for a sufficient number of security
attributes, and combinations of security attributes, to be defined.
A security level may define how secure a cloud computing component
is. A security level may correspond to a single security attribute
or a combination of security attributes. In an example a bigger
security level number corresponds to a cloud computing component
that is to be subject to more stringent security requirements. A
cloud computing component may include more than one security
attribute.
[0025] Policy builder 116 may be used to design a security policy
for a cloud computing component that may be deployed in
virtualization environment 108. A security policy may become a part
of a secured template when building a cloud grid using design
studio 112. Adding a security policy to secure a template may be
done manually where a user may define a security policy that a
specific cloud computing component template should have. Adding a
security policy to a template may be done automatically where a
user specifies a security level to be attained and a corresponding
security policy is added to the template. A secured template is a
cloud computing component template that has been assigned a
security policy, a security attribute, and/or a security level. A
non-secured template is a cloud computing component template that
has not been assigned a security policy, security attribute, or
security level. Policy builder 116 may facilitate the design of a
security policy for a cloud computing component to comply with.
[0026] Policy importer 114 is a module that may facilitate an
import of a security policy from an external storage device, such
as a database. The imported security policy may be added to a cloud
computing component template. Policy importer 114 and/or policy
builder 116 may store a list of available policies that may be
added to cloud computing components. The list stored by policy
importer 114 and/or policy builder 116 may be a complete list of
all the available security policies that may be added to cloud
computing component templates. Policy importer 114 may facilitate
the import of a security policy for a cloud computing component to
comply with.
[0027] Templates corresponding to cloud computing components may be
stored in cloud computing component catalog 118. Secured cloud
computing component templates may be stored in secured templates
module 122. Non-secured cloud computing component templates may be
stored in non-secured templates module 124. Cloud computing
component catalog 118 may include cloud computing component catalog
templates which design studio 112 may use to help facilitate the
design of cloud computing components to be deployed.
[0028] Blueprints module 120 may store cloud computing component
application blueprints created using, in part, design studio 112.
Blueprints module 120 may be coupled to application manager 106.
Blueprints module 120 may be coupled to grid deployer 126 to
facilitate the transfer of data required to deploy an application.
Blueprints module 120 may be coupled to deployment tracker 128 so
that the location of a deployed application can be tracked.
Blueprints stored in blueprints module 120 may be deployment
descriptors that can be used by grid deployer 126 to aid in
deploying a cloud computing component application. In an example
embodiment a deployment descriptor is an extensible markup language
(XML) file which contains information including how to deploy a
cloud computing component, what security attributes, security
policies, and security levels the cloud computing component should
have, and how the cloud computing component should be configured
and/or connections between them.
[0029] As used herein a "template" is a definition of a specific
cloud computing component. As used herein a "blueprint" is a
combination of any number of definitions of cloud computing
components, policies, security attributes, security levels, and
connections between them.
[0030] Grid deployer 126 is a part of application manager 106. Grid
deployer 126 may be coupled to virtualization environment 108 to
facilitate the deployment of cloud computing components. Grid
deployer 126 may be coupled to deployment tracker 128 to allow for
storage of data corresponding to deployed cloud computing
components. Grid deployer 126 may use blueprints from blueprints
module 120 to deploy a cloud computing component in virtualization
environment 108. Grid deployer 126 may deploy a cloud computing
component when the virtual environment properties of the cloud
computing component are sufficiently defined. Grid deployer 126 may
be coupled to blueprints module 120 so that data relevant to
deploying an application may be communicated to grid deployer 126.
Grid deployer 126 may deploy designed cloud computing components as
a function of the data contained in relevant cloud computing
component blueprints. Designed cloud computing components may be
included in a cloud computing component application which includes
a corresponding cloud computing component application blueprint.
Grid deployer 126 may request additional information including host
name, network settings, or administrator password, etc., before
deploying a cloud computing component. Information requested by
grid deployer 126 may be dependent on the attributes of the
environment in which the cloud computing component is to be
deployed. These attributes are called "virtual environment
properties" herein.
[0031] Deployment tracker 128 may store previously completed cloud
computing component application deployments. Deployment tracker 128
may be coupled to control server 108. Deployment tracker 128 may be
coupled to policy distributor 134 to facilitate retention of what
the current security attributes, security policies, and security
level has been assigned to a cloud computing component, if any.
Deployment tracker 128 may be coupled to compliance reports module
130 to help facilitate the transfer of data relevant to creating
compliance reports. If a security policy has been modified, or the
meaning of a security level has been updated, and there are cloud
computing components with a corresponding security policy stored in
deployment tracker 128, then deployment tracker 128 may send a
notice to policy distributor 134. Policy distributor 134 may then
update the cloud computing component with a new security
policy.
[0032] Compliance reports module 130 may create and store
compliance reports. Compliance reports may provide compliance
status of a deployed cloud computing component. Compliance reports
stored in compliance reports module 130 may provide the security
status of a deployed cloud computing component. Compliance reports
may be created as a function of the assigned security policy and
compliance data. Compliance reports may provide an indication as to
whether a deployed cloud computing component is up to date with the
corresponding security policy defined for the cloud computing
component. Compliance reports module 130 may be coupled to control
server 108. Compliance reports module 130 may be coupled to
compliance analyzer 132 to facilitate the creation of compliance
reports. Compliance reports module 130 may be coupled to policy
distributor 134 to facilitate communication of data relevant to
creating compliance reports.
[0033] In an example, compliance status may include different
levels of compliance including "compliant," "deviations exist," and
"no compliance." Compliance status may be determined by comparing
how a deployed cloud computing component should have been
configured (e.g. by using a blueprint) and comparing that to the
actual configuration of the deployed cloud computing component.
[0034] Compliance analyzer 132 may be a part of control server 108.
Compliance analyzer 132 may be coupled to virtualization
environment 108. Compliance analyzer 132 may be coupled to secured
cloud computing component module 136 to facilitate the transfer of
data relevant to creating compliance reports. Compliance analyzer
132 may be coupled to agent 140 for at least the same reason.
Compliance analyzer 132 may collect compliance information from
secured cloud computing component module 136. Information collected
by compliance analyzer 132 may be sent from agent 140. Information
collected by compliance analyzer 132 may be information relevant to
compliance reports created by compliance reports module 130.
Compliance information may correspond to a security related event
that occurred in virtualization environment 108. The security
related event may be a user attempting to access a cloud computing
component that the user does not have authorization to access. The
security related event may be any activity that attempts to violate
the security policy corresponding to a cloud computing
component.
[0035] Policy distributor 134 may be a part of control server 108.
Policy distributor 134 may be coupled to virtualization environment
108 to facilitate the communication of data relevant to
implementing and/or updating a security policy on a cloud computing
component. Policy distributor 134 may be coupled to secured cloud
computing component module 136 to facilitate communication of a
security policy that a cloud computing component must comply with.
Policy distributor 134 may be coupled to agent 140 for at least the
same reason. Policy distributor 134 may be responsible for
deploying security policies to the relevant secured cloud computing
components. The security policy distributed by policy distributor
134 may be created using policy builder 116 or retrieved using
policy importer 114. The security policy distributed by policy
distributor 134 may be received from deployment tracker 128.
Deployment tracker 128 may determine that a security policy on a
deployed cloud computing component may be updated and alert policy
distributor 134 as to which cloud computing component may be
updated and how the cloud computing component should be updated.
Policy distributor 134 may update a security policy on a deployed
cloud computing component when an authorized user makes a request
to update a security policy on the deployed cloud computing
component. An authorized user may be anyone who has been given
clearance to update or modify a security level of a deployed cloud
computing component. An authorized user may also be anyone who is
allowed to modify a blueprint (e.g. a security officer) or anyone
who has been given access to change attributes on a specific
deployment environment (e.g. an operator), among others.
Definitions of who is allowed to be an authorized user may be
managed on a given system through the use of user management tasks.
Policy distributor 134 may collect compliance information from
secured cloud computing component module 136. The information
collected from secured cloud computing component module 136 may
correspond to the current compliance status of the particular cloud
computing component. The information collected from secured cloud
computing component module 136 may correspond to deviations from a
security policy that may exist, or existed at some time, on a
deployed cloud computing component. Deployed cloud computing
components include all machines or components deployed in
virtualization environment 108. Cloud computing components
contained in virtualization environment 108 may include non-secured
cloud computing components, secured cloud computing components, and
other cloud computing components including network routers, storage
devices, firewalls, and load balancers.
[0036] Virtualization environment 108 may include a secured cloud
computing component module 136 and non-secured cloud computing
component module 138. Secured cloud computing component module 136
may include a deployed cloud computing component that has been
assigned a security policy. The security policy may be assigned
using design studio 112. Non-secured cloud computing component
module 138 may include deployed cloud computing components that
have not been assigned a security policy. Secured cloud computing
component module 136 may contain agent 140. Agent 140 may deploy,
maintain, and/or enforce a security policy locally. Agent 140 may
be coupled to control server 108 to facilitate communication of
data relevant to compliance with a security policy. Each deployed
secured cloud computing component may include an agent. Any number
of agents may be used to deploy, maintain, and/or enforce a
security policy locally on a secured cloud computing component.
Agent 140 may send compliance information to control server 108.
The compliance information may be relevant to cloud computing
component compliance with a security policy. The compliance
information may be relevant to compliance reports created by
compliance reports module 130.
[0037] FIG. 2 is a flow diagram of a method of creating a secured
cloud grid according to an example embodiment. The method 200
begins at 202 with a user selecting cloud computing components
(e.g. secured and non-secured cloud computing components). The
selection may be facilitated by cloud computing component catalog
118. At 204, the user creates connections between the cloud
computing components chosen. The connected cloud computing
components may become part of a cloud computing component
application.
[0038] As used herein a "cloud computing application" is a set of
virtual machines and other cloud computing components which provide
some kind of service. For example, a "web application" is composed
of virtual machines (e.g. an Oracle machine, a web server machine)
and other cloud computing components (e.g. router, firewall and
storage). In an example a user design of a web application includes
dragging and dropping virtual machines and other cloud computing
components and specifying the connections between them.
[0039] At 206, the user may choose to import security policies from
a database of pre-selected security policies. This may be
accomplished using policy importer 114. The imported security
policies may be received from customers of the user. Alternatively,
the user may choose to build their own security policies for a
given cloud computing component using policy builder 116. At 208
the user may assign a security level and a policy to cloud
computing components that need to be secured. At 210 the user
connects secured cloud computing components to a control server. At
212 a cloud computing component application blueprint is created.
The cloud computing component application blueprint may be created
automatically by design studio 112 or manually through use of
design studio 114. The cloud computing component application
blueprint may be stored in blueprints module 120.
[0040] FIG. 3 is a flow diagram of deploying a cloud computing
component according to an example embodiment. Method 300 begins
with a user choosing a cloud computing component application, at
302. The cloud computing component application may be chosen from
blueprints module 120. At 304 deployment properties are specified.
The deployment properties may be specified automatically by design
studio 112 or manually by a user using design studio 112. At 306
the cloud computing component application is deployed in
virtualization environment 108.
[0041] FIG. 4 is a flow diagram of updating a security policy or
other part of a cloud computing component blueprint according to an
example embodiment. Method 400 begins at 402 with a cloud computing
component application blueprint being modified with a new cloud
computing component version, a modified security policy, or both.
At 404 a new cloud computing component application blueprint is
generated. The new cloud computing component application blueprint
reflects the new cloud computing component version or security
policy that is to be implemented. At 406, the location of the cloud
computing component application to be updated is identified. The
location may be identified by deployment tracker 128. Item 408 is
optional. At 408, the cloud computing component application to be
updated with new cloud computing component application parameters
is updated. The updating may be accomplished using grid deployer
126. The new cloud computing component parameters reflect the new
cloud computing component version or modified security policy to be
implemented in the cloud computing component application. Item 410
is optional. At 410, security policies on cloud computing
components are updated. The updating may be accomplished using
policy distributor 134. Updating may include updating the security
level corresponding to the cloud computing component.
[0042] FIG. 5 is a flow diagram of creating compliance reports.
Method 500 begins at 502 with collecting audit information and
reporting the audit information from secured cloud computing
components. The collecting may be accomplished using compliance
analyzer 132. The audit information may be relevant to security
policy compliance. The audit information may regard attempts to
violate a security policy. At 504, compliance reports are
generated. A compliance report may be based on actual and/or
planned use of a relevant cloud computing component. Compliance
reports may be generated using compliance reports module 130.
[0043] An example method of designing, updating, and generating a
compliance report for a virtual cloud environment includes
selecting at least two cloud computing component templates from
cloud computing component catalog 118. A user may choose to select
secured and/or non-secured cloud computing components. After the
cloud computing components have been selected, connections between
the at least two selected cloud computing component templates may
be defined. Security levels and policies may be assigned to the
selected cloud computing component templates. The security levels
and policies may be imported using policy importer 114 or built
using policy builder 116. A cloud computing component blueprint may
be defined for selected cloud computing components. The cloud
computing component blueprint may include information regarding
security levels and policies assigned to the corresponding cloud
computing component. The cloud computing component blueprint may
also include information regarding the defined connections
corresponding to the cloud computing component. Relevant cloud
computing components with a corresponding cloud computing component
blueprint may then be communicated to control server 108.
[0044] Security levels and policies assigned to the selected cloud
computing components may be updated. Updating may include
generating a modified cloud computing component blueprint, the
cloud computing component blueprint altered in accord with a
blueprint update corresponding to a modified security policy, or
new cloud computing component version, to create the modified cloud
computing component blueprint. Updating may include identifying
where the cloud computing component to be updated is deployed.
Identifying where a cloud computing component has been deployed may
be accomplished using deployment tracker 128. A cloud computing
component may be updated according to the altered cloud computing
component blueprint. Updating the cloud computing component may be
accomplished using policy distributor 134 or grid deployer 126.
Audit and reporting information regarding secured cloud computing
component compliance with security policies may be collected, and
compliance reports generated as a function of actual and/or planned
use of the secured cloud computing components and the security
levels and policies assigned to the cloud computing component
templates.
[0045] In an example embodiment a compliance report may include a
list of applications and the corresponding compliance status of the
applications in the list. In an example embodiment a user can use
filters to help review compliance reports. For example a user can
use a filter to view only those applications which have an
outstanding security deviation. In another example a user can use a
filter to view only those applications which have a specific
security attribute. In an example embodiment a compliance report
may show what security is missing on a specific cloud computing
component that is creating a security deviation. It should be
appreciated by one of ordinary skill in the art that many other
types of filters may be used to help review security policy
compliance of cloud computing components.
[0046] FIG. 6 is a block diagram of a computer system to implement
methods according to an example embodiment. In the embodiment shown
in FIG. 6, a hardware and operating environment is provided that is
applicable to any of the servers and/or remote clients shown in the
other Figures.
[0047] As shown in FIG. 6, one embodiment of the hardware and
operating environment includes a general purpose computing device
in the form of a computer 600 (e.g., a personal computer,
workstation, or server), including one or more processing units
621, a system memory 622, and a system bus 623 that operatively
couples various system components including the system memory 622
to the processing unit 621. There may be only one or there may be
more than one processing unit 621, such that the processor of
computer 600 comprises a single central-processing unit (CPU), or a
plurality of processing units, commonly referred to as a
multiprocessor or parallel-processor environment. In various
embodiments, computer 600 is a conventional computer, a distributed
computer, or any other type of computer.
[0048] The system bus 623 can be any of several types of bus
structures including a memory bus or memory controller, a
peripheral bus, and a local bus using any of a variety of bus
architectures. The system memory can also be referred to as simply
the memory, and, in some embodiments, includes read-only memory
(ROM) 624 and random-access memory (RAM) 625. A basic input/output
system (BIOS) program 626, containing the basic routines that help
to transfer information between elements within the computer 600,
such as during start-up, may be stored in ROM 624. The computer 600
further includes a hard disk drive 627 for reading from and writing
to a hard disk, not shown, a magnetic disk drive 628 for reading
from or writing to a removable magnetic disk 629, and an optical
disk drive 630 for reading from or writing to a removable optical
disk 631 such as a CD ROM or other optical media.
[0049] The hard disk drive 627, magnetic disk drive 628, and
optical disk drive 630 couple with a hard disk drive interface 632,
a magnetic disk drive interface 633, and an optical disk drive
interface 634, respectively. The drives and their associated
computer-readable media provide non volatile storage of
computer-readable instructions, data structures, program modules
and other data for the computer 600. It should be appreciated by
those skilled in the art that any type of computer-readable media
which can store data that is accessible by a computer, such as
magnetic cassettes, flash memory cards, digital video disks,
Bernoulli cartridges, random access memories (RAMs), read only
memories (ROMs), redundant arrays of independent disks (e.g., RAID
storage devices) and the like, can be used in the exemplary
operating environment.
[0050] A plurality of program modules can be stored on the hard
disk, magnetic disk 629, optical disk 631, ROM 624, or RAM 625,
including an operating system 635, one or more application programs
636, other program modules 637, and program data 638. Programming
for implementing one or more processes or method described herein
may be resident on any one or number of these computer-readable
media.
[0051] A user may enter commands and information into computer 600
through input devices such as a keyboard 640 and pointing device
642. Other input devices (not shown) can include a microphone,
joystick, game pad, satellite dish, scanner, or the like. These
other input devices are often connected to the processing unit 621
through a serial port interface 646 that is coupled to the system
bus 623, but can be connected by other interfaces, such as a
parallel port, game port, or a universal serial bus (USB). A
monitor 647 or other type of display device can also be connected
to the system bus 623 via an interface, such as a video adapter
648. The monitor 647 can display a graphical user interface for the
user. In addition to the monitor 647, computers typically include
other peripheral output devices (not shown), such as speakers and
printers.
[0052] The computer 600 may operate in a networked environment
using logical connections to one or more remote computers or
servers, such as remote computer 649. These logical connections are
achieved by a communication device coupled to or a part of the
computer 600; the invention is not limited to a particular type of
communications device. The remote computer 649 can be another
computer, a server, a router, a network PC, a client, a peer device
or other common network node, and typically includes many or all of
the elements described above I/O relative to the computer 600,
although only a memory storage device 650 has been illustrated. The
logical connections depicted in FIG. 6 include a local area network
(LAN) 651 and/or a wide area network (WAN) 652. Such networking
environments are commonplace in office networks, enterprise-wide
computer networks, intranets and the internet, which are all types
of networks.
[0053] When used in a LAN-networking environment, the computer 600
is connected to the LAN 651 through a network interface or adapter
653, which is one type of communications device. In some
embodiments, when used in a WAN-networking environment, the
computer 600 typically includes a modem 654 (another type of
communications device) or any other type of communications device,
e.g., a wireless transceiver, for establishing communications over
the wide-area network 652, such as the internet. The modem 654,
which may be internal or external, is connected to the system bus
623 via the serial port interface 646. In a networked environment,
program modules depicted relative to the computer 600 can be stored
in the remote memory storage device 650 of remote computer, or
server 649. It is appreciated that the network connections shown
are exemplary and other means of, and communications devices for,
establishing a communications link between the computers may be
used including hybrid fiber-coax connections, T1-T3 lines, DSL's,
OC-3 and/or OC-12, TCP/IP, microwave, wireless application policy,
and any other electronic media through any suitable switches,
routers, outlets and power lines, as the same are known and
understood by one of ordinary skill in the art.
[0054] The flowchart and block diagrams in the Figures illustrate
the architecture, functionality, and operation of possible
implementations of systems, methods and computer program products
according to various aspects of the present disclosure. In this
regard, each block in the flowchart or block diagrams may represent
a module, segment, or portion of code, which comprises one or more
executable instructions for implementing the specified logical
function(s). It should also be noted that, in some alternative
implementations, the functions noted in the block may occur out of
the order noted in the figures. For example, two blocks shown in
succession may, in fact, be executed substantially concurrently, or
the blocks may sometimes be executed in the reverse order,
depending upon the functionality involved. It will also be noted
that each block of the block diagrams and/or flowchart
illustration, and combinations of blocks in the block diagrams
and/or flowchart illustration, can be implemented by special
purpose hardware-based systems that perform the specified functions
or acts, or combinations of special purpose hardware and computer
instructions.
[0055] The terminology used herein is for the purpose of describing
particular aspects only and is not intended to be limiting of the
disclosure. As used herein, the singular forms "a", "an" and "the"
are intended to include the plural forms as well, unless the
context clearly indicates otherwise. It will be further understood
that the terms "comprises" and/or "comprising," when used in this
specification, specify the presence of stated features, integers,
steps, operations, elements, and/or components, but do not preclude
the presence or addition of one or more other features, integers,
steps, operations, elements, components, and/or groups thereof.
[0056] The corresponding structures, materials, acts, and
equivalents of any means or step plus function elements in the
claims below are intended to include any disclosed structure,
material, or act for performing the function in combination with
other claimed elements as specifically claimed. The description of
the present disclosure has been presented for purposes of
illustration and description, but is not intended to be exhaustive
or limited to the disclosure in the form disclosed. Many
modifications and variations will be apparent to those of ordinary
skill in the art without departing from the scope and spirit of the
disclosure. The aspects of the disclosure herein were chosen and
described in order to best explain the principles of the disclosure
and the practical application, and to enable others of ordinary
skill in the art to understand the disclosure with various
modifications as are suited to the particular use contemplated.
* * * * *