US20110072487A1 - System, Method, and Software for Providing Access Control Enforcement Capabilities in Cloud Computing Systems - Google Patents

System, Method, and Software for Providing Access Control Enforcement Capabilities in Cloud Computing Systems Download PDF

Info

Publication number
US20110072487A1
US20110072487A1 US12565474 US56547409A US20110072487A1 US 20110072487 A1 US20110072487 A1 US 20110072487A1 US 12565474 US12565474 US 12565474 US 56547409 A US56547409 A US 56547409A US 20110072487 A1 US20110072487 A1 US 20110072487A1
Authority
US
Grant status
Application
Patent type
Prior art keywords
cloud
system
computing
systems
hosts
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
US12565474
Inventor
Ethan Hadar
Nimrod Vax
Amir Jerbi
Michael Kletskin
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
CA Technologies Inc
Original Assignee
Computer Associates Think Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/10Network architectures or network communication protocols for network security for controlling access to network resources
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00Arrangements for program control, e.g. control units
    • G06F9/06Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46Multiprogramming arrangements
    • G06F9/50Allocation of resources, e.g. of the central processing unit [CPU]
    • G06F9/5061Partitioning or combining of resources
    • G06F9/5072Grid computing
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/20Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F2209/00Indexing scheme relating to G06F9/00
    • G06F2209/50Indexing scheme relating to G06F9/50
    • G06F2209/505Clust

Abstract

According to one embodiment, a system comprises one or more processors coupled to a memory. The one or more processors when executing logic encoded in the memory provide a topology manager. The topology manager is configured to maintain a security topology of a plurality of hosts. The security topology associates one or more virtual hosts policies with a plurality of virtual hosts in a cloud computing deployment. The topology manager is also configured to request a query for one or more hosts that are candidates to be enforced. A portability manager is configured to receive a request to deploy an access control agent on the one or more candidate hosts, determine an optimal agent to be deployed from a list of available agents, and deploy the optimal agent on the one or more candidate hosts.

Description

    TECHNICAL FIELD
  • [0001]
    The present invention relates generally to computer management, and more particularly to a system, method, and software for enforcing access control in cloud computing systems.
  • BACKGROUND
  • [0002]
    Cloud computing systems include computing resources. For example, cloud computing systems may include servers, network storage devices, and other information technology (IT) services. Cloud computing systems include proprietary interfaces to access their respective computing resources.
  • SUMMARY
  • [0003]
    According to one embodiment, a system comprises one or more processors coupled to a memory. The one or more processors when executing logic encoded in the memory provide a topology manager. The topology manager is configured to maintain a security topology of a plurality of hosts. The security topology associates one or more virtual hosts policies with a plurality of virtual hosts in a cloud computing deployment. The topology manager is also configured to request a query for one or more hosts that are candidates to be enforced. A portability manager is configured to receive a request to deploy an access control agent on the one or more candidate hosts, determine an optimal agent to be deployed from a list of available agents, and deploy the optimal agent on the one or more candidate hosts.
  • [0004]
    Certain embodiments of the present invention may provide one or more technical advantages. For example, a technical advantage of one embodiment may include the capability to prevent virtual machine sprawl. Another technical advantage of one embodiment may include the capability to protect the physical boundaries of virtual machines. Another technical advantage of one embodiment may include the capability to guard external management capabilities and prevent misuses of a cloud image by an unauthorized administrator. Another technical advantage of one embodiment may include the capability to accept and enforce customer security compliance needs on a cloud computing system.
  • [0005]
    While specific advantages have been enumerated above, various embodiments may include all, some, or none of the enumerated advantages. Additionally, other technical advantages may become readily apparent to one of ordinary skill in the art after review of the following figures, description, and claims.
  • BRIEF DESCRIPTION OF THE DRAWINGS
  • [0006]
    For a more complete understanding of the present invention and its features and advantages, reference is now made to the following description, taken in conjunction with the accompanying drawings, in which:
  • [0007]
    FIG. 1 illustrates an example system for providing access control enforcement capabilities in cloud computing systems, according to certain embodiments;
  • [0008]
    FIG. 2 illustrates an example external integration architecture and the cloud computing system architecture of FIG. 1, according to certain embodiments; and
  • [0009]
    FIG. 3 illustrates example details of the external integration architecture and cloud computing system architecture of FIGS. 1 and 2, according to certain embodiments.
  • DESCRIPTION OF EXAMPLE EMBODIMENTS
  • [0010]
    It should be understood at the outset that although example implementations of embodiments of the invention are illustrated below, the present invention may be implemented using any number of techniques, whether currently known or in existence. The present invention should in no way be limited to the example implementations, drawings, and techniques illustrated below. Additionally, the drawings are not necessarily drawn to scale.
  • [0011]
    FIG. 1 illustrates an example system 100 for providing access control enforcement capabilities in cloud computing systems according to some embodiments. System 100 may include one or more user systems 102 and one or more administrative systems 104, one or more server systems 106, one or more cloud computing systems 108 and 110, and a network 112. Although this particular implementation of system 100 is illustrated and primarily described, embodiments may include any suitable implementation of system 100 according to particular needs.
  • [0012]
    In general, system 100 is operable to integrate between IT Information Library (ITIL) software components (such as ITIL V3 and any future versions of ITIL in EITM) and cloud computing systems. In certain embodiments, system 100 includes a cloud computing system architecture for integrating cloud computing systems with ITIL software components. For example, an external integration architecture may include several ITIL software components. According to certain embodiments, adapters are created in a cloud computing system architecture that bridge the architectural layer that encapsulates and abstracts the cloud computing systems while still integrating with enterprise ITIL software components. Thus, certain embodiments provide a set of components for life cycle phases of ITIL service management, from strategy to design, transition, and operation. In certain embodiments, the cloud computing system architecture is mapped to the different layers of the cloud computing systems, thus serving IT workshops and workers that rent cloud computing resources and manage the cloud computing systems within their own IT organization in an abstract manner. In certain embodiments, the cloud computing system architecture may serve the cloud computing system providers that manage their cloud computing systems and provide ITIL integration points to their customers.
  • [0013]
    System 100 may include one or more user systems 102 and one or more administrative systems 104. “User system 102” and “user of user system 102” may be used interchangeably. A user of user system 102 may include, for example, a human user or a computer program or other suitable software module for automatically interacting with user system 102. Likewise, “administrative system 104” and “user of administrative system 104” may be used interchangeably. A user of administrative system 104 may include, for example, a human user or a computer program or other suitable software module for automatically interacting with administrative system 104.
  • [0014]
    Each user system 102 and administrative system 104 may include one or more computer systems at one or more locations. Each computer system may include any appropriate input devices (such as a keypad, touch screen, mouse, or other device that can accept information), output devices, mass storage media, or other suitable components for receiving, processing, storing, and communicating data. Both the input device and output device may include fixed or removable storage media such as a magnetic computer disk, CD-ROM, or other suitable media to both receive input from and provide output to a user of administrative system 104. Each computer system may include a personal computer, workstation, network computer, kiosk, wireless data port, personal data assistant (PDA), one or more processors within these or other devices, or any other suitable processing device. As an example, system 100 may include multiple distributed user systems 102 and/or administrative systems 104. User systems 102 and administrative systems 104 may be physically distributed, being in different locations geographically remote from each other and from the other components of system 100, or logically distributed, being at approximately the same location as other user systems 102 and administrative systems 104 and the other components of system 100. For simplicity, the one or more user systems 102 and administrative systems 104 of system 100 are referred to throughout this description primarily in the singular. Although user system 102 and administrative system 104 are illustrated and primarily described as being separate, it is understood that the computer systems and the functionality associated with user system 102 and administrative system 104 may be combined or separated in any suitable manner.
  • [0015]
    System 100 may include one or more server systems 106, referred to primarily in the singular throughout the remainder of this description. Server system 106 may include one or more electronic computing devices operable to receive, transmit, process, and store data associated with system 100. For example, server system 106 may include one or more general-purpose PCs, Macintoshes, workstations, Unix-based computers, server computers, one or more server pools, or any other suitable devices. In certain embodiments, server system 106 includes a web server. In short, server system 106 may include any suitable combination of software, firmware, and hardware. Although a single server system 106 is illustrated, some embodiments contemplate system 100 including any suitable number of server systems 106. Moreover, although referred to as a “server system,” some embodiments contemplate server system 106 comprising any suitable type of processing device or devices.
  • [0016]
    Server system 106 may be communicatively coupled to cloud computing systems 108 and 110 via network 112. Although not illustrated, user system 102 and administrative system 104 may be communicatively coupled to one another as well as to server system 106 via network 112. Network 112 facilitates wireless or wireline communication. Network 112 may communicate, for example, IP packets, Frame Relay frames, Asynchronous Transfer Mode (ATM) cells, voice, video, data, and other suitable information between network addresses. Network 112 may include one or more local area networks (LANs), radio access networks (RANs), metropolitan area networks (MANS), wide area networks (WANs), all or a portion of the global computer network known as the Internet, and/or any other communication system or systems at one or more locations.
  • [0017]
    Server system 106 may include a processing module 114 and a memory module 116. Processing module 114 may include one or more microprocessors, controllers, or any other suitable computing devices or computing resources. Processing module 114 may work, either alone or with other components of system 100, to provide a portion or all of the functionality of system 100 described herein. Memory module 116 may take the form of volatile or non-volatile memory including, without limitation, magnetic media, optical media, random access memory (RAM), read-only memory (ROM), removable media, or any other suitable memory component. Although a single server system 106 is illustrated, some embodiments contemplate system 100 including any suitable number of server systems 106. Moreover, although referred to as a “server system,” some embodiments contemplate server system 106 comprising any suitable type of processing device or devices.
  • [0018]
    System 100 may include one or more cloud computing systems 108 and 110. Cloud computing systems 108 and 110 may include one or more electronic computing devices operable to receive, transmit, process, and store data associated with system 100. For example, cloud computing systems 108 and 110 may include one or more general-purpose PCs, Macintoshes, workstations, Unix-based computers, server computers, one or more server pools, or any other suitable devices. In short, cloud computing systems 108 and 110 may include any suitable combination of software, firmware, and hardware. It should be noted that although two cloud computing systems 108 and 110 are illustrated, any suitable number of cloud computing systems may be included in system 100. In addition, there may be multiple groups of cloud computing systems in system 100.
  • [0019]
    In certain embodiments, cloud computing systems 108 and 110 provide computing resources 124 and 126, respectively, to user systems 102 and administrative systems 104 and charges user systems 102 and administrative systems 104 for their specific use of computing resources 124 and 126. For example, cloud computing resources 124 and 126 may include one or more virtual machines. As another example, cloud computing resources 124 and 126 may include one or more machine images. A machine image may refer to a bootable file that includes a particular configuration and operating system. As yet another example, cloud computing resources 124 and 126 may include one or more Intel x86 based servers that provide a combination of hardware and software resources.
  • [0020]
    In certain embodiments, computing resources 124 and 126 may be accessible by cloud computing interfaces 120. From the perspective of user systems 102 and administrative systems 104, renting computing resources from cloud computing interfaces 120 has implications for application providers and IT architects that develop solutions targeted for internal enterprise deployment, rather than on cloud computing systems 108 and 110. For example, an IT architect may desire to deploy web servers, load balancers, and front-end interfaces remotely on cloud computing systems 108 and 110 but keep a database in a local IT environment. Further, from an ITIL process perspective, many large organizations may implement an ITIL approach by performing well-defined automated processes. Since an ITIL process may be agnostic to platform and technological tools, it may be desirable to integrate such practices with advances in technology, such as cloud computing systems 108 and 110.
  • [0021]
    In certain embodiments, server system 106 may include a cloud computing system architecture 118. Cloud computing system architecture 118 may refer to any suitable hardware and/or software operable to integrate ITIL software components with cloud computing systems 108 and 110 and their respective computing resources 124 and 126. For example, a connection may be established between cloud computing system architecture 118 and cloud computing systems 108 and 110. A second connection may be established between cloud computing system architecture 118 and an external integration architecture that includes the ITIL software components. As described in more detail below, cloud computing system architecture 118 includes management components that provide integration points to connect the ITIL software components with computing resources 124 and 126 of cloud computing systems 108 and 110.
  • [0022]
    In certain embodiments, a secure connection may be established between cloud computing system architecture 118 and cloud computing systems 108 and 110 over network 112. For example, a secure Hypertext Transfer Protocol (HTTP) connection may be established between cloud computing system architecture 118 and cloud computing systems 108 and 110. A secure HTTP protocol refers to a protocol that provides the ability for secure transactions to take place over network 112. In alternative networks, any suitable data communications protocol may be used to establish a secure connection. Additional details of example embodiments of cloud computing system architecture 118 are discussed in more detail below.
  • [0023]
    FIG. 2 illustrates external integration architecture 122 and cloud computing system architecture 118 of FIG. 1 according to some embodiments. As described above, external integration architecture 122 may include several ITIL software components. For example, external integration architecture 122 may include an ITIL software component that enables organization of the IT strategies and ongoing initiatives. As another example, external integration architecture 122 may include an ITIL software component that sets and monitors agreements based on service requests, negotiates with supply chain managers, sets agreements for operations and services, and/or catalogs the results. As yet another example, external integration architecture 122 may include an ITIL software component that captures defined and offered services. As yet another example, external integration architecture 122 may include an ITIL software component that performs continuous analysis in order to evaluate service trends for optimization. As yet another example, external integration architecture 122 may include an ITIL software component that maintains the deployment of the designed services, tracking and reporting the deployed assets within an organization, and/or maintains information on the topology and system infrastructure and the life cycle for design changes and releases. As yet another example, external integration architecture 122 may include an ITIL software component that measures the services provided on an ongoing basis with the goal of ensuring a high level of quality is maintained across the IT investments, displays the overall status and health of the system to the consumer, and/or maintains ongoing provisioning, recovery, backup and redundancy of the IT assets within a data center, including countermeasures and remedies. As yet another example, external integration architecture 122 may include an ITIL software component that provides proactive planning capabilities through the analysis of IT behavior, detects, utilization patterns and change history, determines if Service Level Agreements (SLAs) are being met, alerts a consumer that a problem is starting to appear, which may provide the consumer with the possibility of mitigating the issue before it becomes critical. As yet another example, external integration architecture 122 may include an ITIL software component that manages users and controls their access to the resources in the system based on, for example, their organizational role. As yet another example, external integration architecture 122 may include an ITIL software component that manages the distributed data stores for the organization, provisions and allocates storage resources, and/or provides the ability to restore IT services back to operation through a workflow and life cycle of incidents that concludes with incident resolution. As described in more detail below, computing system architecture 118 includes management components that provide integration points to connect the ITIL software components with computing resources of cloud computing systems 108 and 110.
  • [0024]
    FIG. 3 illustrates example details of the external integration architecture 122, the cloud computing system architecture 118, and the cloud computing interfaces 120 (collectively, the “system 300”) of FIGS. 1 and 2 according to some embodiments. The system 300 features a federated configuration management database (CMDB) 310, a hosts discovery component 320, a topology manager 330, a portability manager 340, a cloud access control manager 350, a benchmarking manager 360, a utility computing module 370, and cloud users component 380. Although this particular implementation of the system 300 is illustrated and primarily described, embodiments may include any suitable implementation of the system 300 according to particular needs.
  • [0025]
    In some embodiments, the federated CMDB 310 may be responsible for storing updated versions of new servers and hosts, as well as maintaining a “snapshot” of the IT deployed (and discovered) assets.
  • [0026]
    In some embodiments, the hosts discovery component 320 may be responsible for extracting a list of hosts from the federated CMDB 310 according to a criteria using a hosts-on-demand detection component 322. The hosts-on-demand detection component 322 may be responsible for activating requests from the federated CMDB 310. In some embodiments, the hosts-on-demand detection component 322 may produce the discovery of configuration items as a set or by certain criteria and may enable security managers to select specific IT sectors to be handled. The hosts-on-demand detection component 322 may correlate any discrepancies between the managed repositories and ensure that security blueprints are up to date.
  • [0027]
    In some embodiments, the topology manager 330 may trigger a query from the hosts-on-demand detection component 322 for a list of specific hosts according to a compliance need. In some embodiments, the topology manager 330 may feature an access control topology Model Data Repository (MDR) 332. The access control topology MDR 332 may contain a security topology 334 of all the hosts in the IT system that are candidates to be enforced, as well as their security policy 336 and their virtual host policy 338. The virtual host policy 338 may be used in cases of virtual host operation systems that support many images of virtual hosts, known as guests. In some embodiments, a need for enforcement may trigger either the deployment of agents using the portability manager 340 and/or the distribution of regular or virtual policies using the cloud access control manager 350.
  • [0028]
    In some embodiments, the portability manager 340 may manage provisioning transformation and portability of deployed images from one cloud computing system to another, due to SLA optimizations and/or on-demand provisioning of cloud resources as a result of a shortage of resources within the customer internal data center, or other reasons, by re-packing the deployed entities according to the cloud computing system definitions. In the illustrated embodiment, portability manager 340 includes an image design and modeling component 342, a package description component 344, and an image provisioning and deployment component 346. In certain embodiments, portability manager 340 may deploy machine images to at least one cloud computing system based on instructions from an external integration architecture, such as external integration architecture 122 of FIG. 2.
  • [0029]
    In one example embodiment, if one cloud computing system is not meeting SLA requirements, portability manager 340 may repack the deployed entity according to the new cloud computing system definitions and port it to a new cloud computing system. For example, image design and modeling component 342 may define a configuration model of the entities that need to be packaged. In one embodiment, the image design and modeling component 342 may update the package description component 344 to add definitions on upgrades and changes. The image design and modeling component 342 may also receive requests from the topology manager 330 to deploy an agent on the new server, determine an optimal version of agent to be deployed, and construct (model) the composition of components as an image. The image design and modeling component 342 may define a unique vender package and request to provision the image from the image provisioning and deployment component 346.
  • [0030]
    The package description component 344 may generate the packaging instructions and configuration descriptions for a specific cloud computing system. The image provisioning and deployment component 346 may initiate the actual deployment of a certain configured machine image for a specific cloud computing system. In some embodiments, the image provisioning and deployment component 346 may rollout, configure, or re-deploy a patch for an enforcing agent or install new enforcing agents based on discovered entities. Such action may be triggered, for example, by access control compliance needs. The image provisioning and deployment component 346 may maintain images to be deployed, and teachings of certain embodiments recognize that the image provisioning and deployment component 346 may include the capability to rapidly scale and solve multiple deployment needs. The image provisioning and deployment component 346 upload the image into the cloud by deploying the image through the utility computing module 370. In some embodiments, the image provisioning and deployment component 346 may obtain permission from the cloud access control manager 350 before uploading the image.
  • [0031]
    In some embodiments, the cloud access control manager 350 may provide the security aspects of controlling the entry points to the cloud computing systems. In the illustrated embodiment, the cloud access control manager 350 includes a cloud security sentry component 352, a security SLA requests component 354, and a wrapped cloud managed services component 356. In certain embodiments, cloud access control manager 350 may provide security for an external integration architecture, such as external integration architecture 122 of FIG. 2.
  • [0032]
    For example, the cloud security sentry 352 may provide managed guarded-call as a broker and provide interceptors to the utility computing module 370. As an interceptor, the cloud security sentry 352 may prohibit actual implementations of the cloud web services. The cloud security sentry 352 may prevent a non-authorized access to any related managing aspects originating from within the customer side (externally to the cloud). The cloud security sentry 352 may provide transient allocation of security permits to the provisioning and benchmarking components and enable only these components to access the cloud for changing images. The cloud security sentry 352 may also intercept security policy distribution that is activated directly from the topology and/or rents permissions to the provision and benchmarking components.
  • [0033]
    Security SLA requests component 354 may act as a remote proxy for compliance access control tools. Security SLA requests component 354 may mediate requests to deploy security and access control policies on roaming users, hosts, and servers. The security SLA requests component 354 may provide a bridge to IT access control in terms of administration operations; in some embodiments, the security SLA requests component 354 may act like a remote proxy for regular compliance access control tools. In some embodiments, the security SLA requests component 354 may forward and monitor requests of access policy and/or restrictions on moving the physical location of images, as well as request reports and monitoring information. In some embodiments, the security SLA requests component 354 may use the benchmarking manager 360 to extract the data from the cloud and provide limitations on the roaming capabilities of the cloud. The security SLA requests component 354 may invoke the utility computing module 370 for retrieving reports and monitoring data and for propagating security enforcement requests to the cloud vendor. The wrapped cloud managed services 356 may provide managed services, as well as prevent cloud administration un-authorized calls and serve as an interception guard.
  • [0034]
    In some embodiments, the benchmarking manager 360 may compare published capabilities of cloud computing systems and the relevant alternatives, including future self-investments in hardware and software as well as existing investments, by enabling comparative lists of cloud computing system attributes (such as provided hardware, cost for storage, cost for usage, and network bandwidth, as examples). In the illustrated embodiment, benchmarking manager 360 includes an attributes extractor component 362. In certain embodiments, benchmarking manager 360 may generate a comparative list of one or more published capabilities of the cloud computing systems and provide this information to an external integration architecture, such as external integration architecture 122 of FIG. 2.
  • [0035]
    For example, benchmarking manager 360 may access the non-functional characteristics of one or more cloud computing systems (such as pricing, supported hardware, SLA and quality attributes). These attributes may be provided to the attributes extractor component 362, which evaluates and composes accumulated values for each cloud computing system, comparing them against the customer quality attributes, which may provide customer specific prioritization of one or more cloud computing systems. In some embodiments, the attributes extractor component 362 may accumulate information such as virtual host name, virtual host identifiers (e.g., MAC addresses), and virtual machine configuration data (such as network interfaces, external disks, and input/output ports).
  • [0036]
    In some embodiments, the utility computing module 370 may include a delivery gateway 372, a distribution component 374, an agent data collection component 376, and a managed services component 378. The delivery gateway component 372 may be deployed within the cloud vendor's site and may be able to accept and delegate the need for internal policy enforcement on physical servers and virtual hosts (which may include operation systems that support hardware and operating system virtualization, or server virtualization). The distribution component 374 may be responsible for receiving and delegating the access control policy, delegating those to internal enforcement agents. The agent data collection component 376 may be responsible for collecting internal reporting information about the statuses of the system, delegating that information to the cloud users component 380. The managed services component 378 may include vendor proprietary services that provide interactions with the utility computing module 370 solutions.
  • [0037]
    In some embodiments, the cloud users 380 may allow regular administrators of the IT organization to interact with the cloud information, such as by using supervised services. The cloud users component 380 may include single sign-on capabilities. The cloud users component 380 may prepare interaction with the cloud specific calls by using the organization regular methodologies and unifying the different cloud vendor languages. In some embodiments, the cloud users 380 may obtain secured access to cloud resources through the cloud access control manager 350, which may intercept management calls from the cloud users 380.
  • [0038]
    Modifications, additions, or omissions may be made to the systems and apparatuses described herein without departing from the scope of the invention. The components of the systems and apparatuses may be integrated or separated. Moreover, the operations of the systems and apparatuses may be performed by more, fewer, or other components. The methods may include more, fewer, or other steps. Additionally, steps may be performed in any suitable order. Additionally, operations of the systems and apparatuses may be performed using any suitable logic. As used in this document, “each” refers to each member of a set or each member of a subset of a set.
  • [0039]
    Although several embodiments have been illustrated and described in detail, it will be recognized that substitutions and alterations are possible without departing from the spirit and scope of the present invention, as defined by the appended claims.
  • [0040]
    To aid the Patent Office, and any readers of any patent issued on this application in interpreting the claims appended hereto, applicants wish to note that they do not intend any of the appended claims to invoke paragraph 6 of 35 U.S.C. §112 as it exists on the date of filing hereof unless the words “means for” or “step for” are explicitly used in the particular claim.

Claims (21)

  1. 1. A system comprising one or more processors coupled to a memory, the one or more processors when executing logic encoded in the memory providing:
    a topology manager, configured to:
    maintain a security topology of a plurality of hosts, the security topology associating one or more virtual host policies with a plurality of virtual hosts in a cloud computing deployment; and
    request a query for one or more hosts that are candidates to be enforced (candidate hosts); and
    a portability manager, configured to:
    receive a request to deploy an access control agent on the one or more candidate hosts;
    determine an optimal agent to be deployed from a list of available agents; and
    deploy the optimal agent on the one or more candidate hosts.
  2. 2. The system of claim 1, wherein the candidate host is provided by a specific vendor, the portability manager further configured to:
    define a unique vendor package, the unique vendor package comprising instructions and configurations in compliance with the specific vendor; and
    package the unique vendor package with the optimal agent such that the optimal agent is configured to deploy on the specific vendor's candidate host.
  3. 3. The system of claim 1, further comprising:
    a cloud access control manager, configured to:
    intercept cloud management calls from an administrator;
    determine whether cloud management calls are authorized; and
    prepare the cloud management calls for interaction with a specific vendor.
  4. 4. The system of claim 1, further comprising:
    an attributes extractor, configured to:
    extract non-functional characteristics of the cloud computing deployment.
  5. 5. The system of claim 4, wherein the non-functional characteristics comprise a virtual host name, a virtual host identifier, and a list of virtual host configuration data.
  6. 6. The system of claim 1, the topology manager further configured to maintain a security topology by:
    requesting discovery of a list of virtual hosts deployed on the cloud computing deployment; and
    associating the list of virtual hosts with the one or more virtual host policies.
  7. 7. The system of claim 6, the topology manager further configured to maintain a security topology by:
    requesting discovery of an updated list of virtual hosts deployed on the cloud computing deployment;
    resolving discrepancies between the list of virtual hosts and the updated list of virtual hosts; and
    updating the security topology.
  8. 8. A method comprising:
    at a topology manager comprising logic encoded in one or more media for execution:
    maintaining a security topology of a plurality of hosts, the security topology associating one or more virtual host policies with a plurality of virtual hosts in a cloud computing deployment; and
    requesting a query for one or more hosts that are candidates to be enforced (candidate hosts); and
    at a portability manager comprising logic encoded in one or more media for execution:
    receiving a request to deploy an access control agent on the one or more candidate hosts;
    determining an optimal agent to be deployed from a list of available agents; and
    deploying the optimal agent on the one or more candidate hosts.
  9. 9. The method of claim 8, wherein the candidate host is provided by a specific vendor, the method at the portability manager further comprising:
    defining a unique vendor package, the unique vendor package comprising instructions and configurations in compliance with the specific vendor; and
    packaging the unique vendor package with the optimal agent such that the optimal agent is configured to deploy on the specific vendor's candidate host.
  10. 10. The method of claim 8, further comprising:
    at a cloud access control manager comprising logic encoded in one or more media for execution:
    intercepting cloud management calls from an administrator;
    determining whether-cloud management calls are authorized; and
    preparing the cloud management calls for interaction with a specific vendor.
  11. 11. The method of claim 8, further comprising:
    at an attributes extractor comprising logic encoded in one or more media for execution:
    extract non-functional characteristics of the cloud computing deployment.
  12. 12. The method of claim 11, wherein the non-functional characteristics comprise a virtual host name, a virtual host identifier, and a list of virtual host configuration data.
  13. 13. The method of claim 8, the method at the topology manager further comprising:
    requesting discovery of a list of virtual hosts deployed on the cloud computing deployment; and
    associating the list of virtual hosts with the one or more virtual host policies.
  14. 14. The method of claim 13, the method at the topology manager further comprising:
    requesting discovery of an updated list of virtual hosts deployed on the cloud computing deployment;
    resolving discrepancies between the list of virtual hosts and the updated list of virtual hosts; and
    updating the security topology.
  15. 15. Logic encoded in one or more computer-readable storage media for execution and when executed operable to provide:
    a topology manager, configured to:
    maintain a security topology of a plurality of hosts, the security topology associating one or more virtual host policies with a plurality of virtual hosts in a cloud computing deployment; and
    request a query for one or more hosts that are candidates to be enforced (candidate hosts); and
    a portability manager, configured to:
    receive a request to deploy an access control agent on the one or more candidate hosts;
    determine an optimal agent to be deployed from a list of available agents; and
    deploy the optimal agent on the one or more candidate hosts.
  16. 16. The logic of claim 15, wherein the candidate host is provided by a specific vendor, the portability manager further configured to:
    define a unique vendor package, the unique vendor package comprising instructions and configurations in compliance with the specific vendor; and
    package the unique vendor package with the optimal agent such that the optimal agent is configured to deploy on the specific vendor's candidate host.
  17. 17. The logic of claim 15, further providing:
    a cloud access control manager, configured to:
    intercept cloud management calls from an administrator;
    determine whether cloud management calls are authorized; and
    prepare the cloud management calls for interaction with a specific vendor.
  18. 18. The logic of claim 15, further providing:
    an attributes extractor, configured to:
    extract non-functional characteristics of the cloud computing deployment.
  19. 19. The logic of claim 18, wherein the non-functional characteristics comprise a virtual host name, a virtual host identifier, and a list of virtual host configuration data.
  20. 20. The logic of claim 15, the topology manager further configured to maintain a security topology by:
    requesting discovery of a list of virtual hosts deployed on the cloud computing deployment; and
    associating the list of virtual hosts with the one or more virtual host policies.
  21. 21. The logic of claim 20, the topology manager further configured to maintain a security topology by:
    requesting discovery of an updated list of virtual hosts deployed on the cloud computing deployment;
    resolving discrepancies between the list of virtual hosts and the updated list of virtual hosts; and
    updating the security topology.
US12565474 2009-09-23 2009-09-23 System, Method, and Software for Providing Access Control Enforcement Capabilities in Cloud Computing Systems Pending US20110072487A1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US12565474 US20110072487A1 (en) 2009-09-23 2009-09-23 System, Method, and Software for Providing Access Control Enforcement Capabilities in Cloud Computing Systems

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US12565474 US20110072487A1 (en) 2009-09-23 2009-09-23 System, Method, and Software for Providing Access Control Enforcement Capabilities in Cloud Computing Systems
US15346145 US20170054728A1 (en) 2009-09-23 2016-11-08 System, method, and software for providing access control enforcement capabilities in cloud computing systems

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15346145 Continuation US20170054728A1 (en) 2009-09-23 2016-11-08 System, method, and software for providing access control enforcement capabilities in cloud computing systems

Publications (1)

Publication Number Publication Date
US20110072487A1 true true US20110072487A1 (en) 2011-03-24

Family

ID=43757773

Family Applications (2)

Application Number Title Priority Date Filing Date
US12565474 Pending US20110072487A1 (en) 2009-09-23 2009-09-23 System, Method, and Software for Providing Access Control Enforcement Capabilities in Cloud Computing Systems
US15346145 Pending US20170054728A1 (en) 2009-09-23 2016-11-08 System, method, and software for providing access control enforcement capabilities in cloud computing systems

Family Applications After (1)

Application Number Title Priority Date Filing Date
US15346145 Pending US20170054728A1 (en) 2009-09-23 2016-11-08 System, method, and software for providing access control enforcement capabilities in cloud computing systems

Country Status (1)

Country Link
US (2) US20110072487A1 (en)

Cited By (61)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100137534A1 (en) * 2007-01-29 2010-06-03 Arkema France Method for preparing microgel particles by controlled radical polymerization in an aqueous dispersion using nitroxide control agents
US20110087960A1 (en) * 2009-10-13 2011-04-14 Google Inc. Power Metering and Control in Cloud Based Computer
US20110113337A1 (en) * 2009-10-13 2011-05-12 Google Inc. Individualized tab audio controls
US20110153751A1 (en) * 2009-12-18 2011-06-23 David Rice Content management systems and methods
CN102156839A (en) * 2011-04-12 2011-08-17 浪潮电子信息产业股份有限公司 Method for limiting authority of cloud computing privileged user by using mandatory access control
US20110246499A1 (en) * 2010-03-30 2011-10-06 Yuval Carmel Method and system for evaluating compliance within a configuration-management system
US20110296021A1 (en) * 2010-05-28 2011-12-01 International Business Machines Corporation Enabling Service Virtualization in a Cloud
US20120005359A1 (en) * 2010-07-01 2012-01-05 Scott Wayne Seago System and method for aggregation across cloud providers
US20120017085A1 (en) * 2010-07-15 2012-01-19 Carter Stephen R Techniques for identity-enabled interface deployment
WO2012023050A2 (en) 2010-08-20 2012-02-23 Overtis Group Limited Secure cloud computing system and method
US20120284380A1 (en) * 2011-05-03 2012-11-08 International Business Machines Corporation Identifying optimal virtual machine images in a networked computing environment
WO2012167108A1 (en) * 2011-06-03 2012-12-06 Apple Inc. Cloud storage
US20130018920A1 (en) * 2011-07-12 2013-01-17 Griffin Andrew M Configuration management database security
US20130167207A1 (en) * 2011-09-24 2013-06-27 Marc E. Davis Network Acquired Behavioral Fingerprint for Authentication
US20130282798A1 (en) * 2010-07-09 2013-10-24 State Street Corporation Systems and Methods for Private Cloud Computing
US20130291052A1 (en) * 2012-04-30 2013-10-31 Ca, Inc. Trusted public infrastructure grid cloud
US8631067B2 (en) 2010-07-01 2014-01-14 Red Hat, Inc. Architecture, system and method for providing a neutral application programming interface for accessing different cloud computing systems
US8639745B2 (en) 2010-07-01 2014-01-28 Red Hat, Inc. Providing a neutral interface to multiple cloud computing systems
US8639746B2 (en) 2010-07-01 2014-01-28 Red Hat, Inc. Architecture, system and method for mediating communications between a client computer system and a cloud computing system with a driver framework
US8639747B2 (en) 2010-07-01 2014-01-28 Red Hat, Inc. System and method for providing a cloud computing graphical user interface
WO2013173109A3 (en) * 2012-05-16 2014-02-20 Apple Inc. Locally backed cloud-based storage
US8688980B2 (en) 2011-09-24 2014-04-01 Elwha Llc Trust verification schema based transaction authorization
US8688768B2 (en) 2011-11-18 2014-04-01 Ca, Inc. System and method for hand-offs in cloud environments
US8700898B1 (en) 2012-10-02 2014-04-15 Ca, Inc. System and method for multi-layered sensitive data protection in a virtual computing environment
US8713704B2 (en) 2011-09-24 2014-04-29 Elwha Llc Behavioral fingerprint based authentication
US20140222991A1 (en) * 2013-02-05 2014-08-07 International Business Machines Corporation Sentry for information technology system blueprints
US8805971B1 (en) 2012-06-15 2014-08-12 Amazon Technologies, Inc. Client-specified schema extensions in cloud computing environments
US8806483B2 (en) 2011-04-13 2014-08-12 International Business Machines Corporation Determining starting values for virtual machine attributes in a networked computing environment
US8806485B2 (en) 2011-05-03 2014-08-12 International Business Machines Corporation Configuring virtual machine images in a networked computing environment
US8813225B1 (en) 2012-06-15 2014-08-19 Amazon Technologies, Inc. Provider-arbitrated mandatory access control policies in cloud computing environments
US8839447B2 (en) 2012-02-27 2014-09-16 Ca, Inc. System and method for virtual image security in a cloud environment
US8843998B2 (en) * 2011-06-27 2014-09-23 Cliqr Technologies, Inc. Apparatus, systems and methods for secure and selective access to services in hybrid public-private infrastructures
US8856077B1 (en) 2012-06-15 2014-10-07 Amazon Technologies, Inc. Account cloning service for cloud computing environments
US8862933B2 (en) 2011-02-09 2014-10-14 Cliqr Technologies, Inc. Apparatus, systems and methods for deployment and management of distributed computing systems and applications
US8868710B2 (en) 2011-11-18 2014-10-21 Amazon Technologies, Inc. Virtual network interface objects
CN104113879A (en) * 2014-08-13 2014-10-22 成都西加云杉科技有限公司 WiFi communication system deployed with cloud ACs (access controllers) and communication method adopting WiFi communication system deployed with cloud ACs
US8898304B2 (en) 2012-07-11 2014-11-25 Ca, Inc. Managing access to resources of computer systems using codified policies generated from policies
US8910278B2 (en) 2010-05-18 2014-12-09 Cloudnexa Managing services in a cloud computing environment
CN104254834A (en) * 2012-06-08 2014-12-31 惠普发展公司,有限责任合伙企业 Cloud application deployment portability
US8954964B2 (en) 2012-02-27 2015-02-10 Ca, Inc. System and method for isolated virtual image and appliance communication within a cloud environment
US8997173B2 (en) 2012-09-12 2015-03-31 Ca, Inc. Managing security clusters in cloud computing environments using autonomous security risk negotiation agents
US9015860B2 (en) 2011-09-24 2015-04-21 Elwha Llc Behavioral fingerprinting via derived personal relation
US20150128209A1 (en) * 2012-08-03 2015-05-07 Alcatel Lucent Mandatory protection control in virtual machines
WO2015065350A1 (en) * 2013-10-30 2015-05-07 Hewlett-Packard Development Company, L.P. Management of the lifecycle of a cloud service modeled as a topology
WO2015065353A1 (en) * 2013-10-30 2015-05-07 Hewlett-Packard Development Company, L.P. Managing the lifecycle of a cloud service modeled as topology decorated by a number of policies
CN104717212A (en) * 2014-10-21 2015-06-17 中华电信股份有限公司 Cloud virtual network security protection method and system
US9075788B1 (en) 2012-06-15 2015-07-07 Amazon Technologies, Inc. Account state simulation service for cloud computing environments
US9083687B2 (en) 2011-09-24 2015-07-14 Elwha Llc Multi-device behavioral fingerprinting
US9210178B1 (en) 2012-06-15 2015-12-08 Amazon Technologies, Inc. Mixed-mode authorization metadata manager for cloud computing environments
US20160080203A1 (en) * 2011-01-10 2016-03-17 Fiberlink Communications Corporation System and method for extending cloud services into the customer premise
US9298900B2 (en) 2011-09-24 2016-03-29 Elwha Llc Behavioral fingerprinting via inferred personal relation
US9348985B2 (en) 2011-11-23 2016-05-24 Elwha Llc Behavioral fingerprint controlled automatic task determination
US9389898B2 (en) 2012-10-02 2016-07-12 Ca, Inc. System and method for enforcement of security controls on virtual machines throughout life cycle state changes
US20160330330A1 (en) * 2014-01-08 2016-11-10 Vodafone Ip Licensing Limited Telecommunications networks
US9548962B2 (en) * 2012-05-11 2017-01-17 Alcatel Lucent Apparatus and method for providing a fluid security layer
US9591060B1 (en) 2013-06-04 2017-03-07 Ca, Inc. Transferring applications between computer systems
US9621404B2 (en) 2011-09-24 2017-04-11 Elwha Llc Behavioral fingerprinting with social networking
US9729549B2 (en) 2011-09-24 2017-08-08 Elwha Llc Behavioral fingerprinting with adaptive development
US9787499B2 (en) 2014-09-19 2017-10-10 Amazon Technologies, Inc. Private alias endpoints for isolated virtual networks
US9825967B2 (en) 2011-09-24 2017-11-21 Elwha Llc Behavioral fingerprinting via social networking interaction
US9916545B1 (en) 2012-02-29 2018-03-13 Amazon Technologies, Inc. Portable network interfaces for authentication and license enforcement

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150293259A1 (en) * 2012-11-14 2015-10-15 Halliburton Energy Services, Inc. System and method for cloud logging system

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5968176A (en) * 1997-05-29 1999-10-19 3Com Corporation Multilayer firewall system
US20090052451A1 (en) * 2007-08-21 2009-02-26 Etheridge James K Access control list management system
US20090228967A1 (en) * 2008-03-05 2009-09-10 Microsoft Corporation Flexible Scalable Application Authorization For Cloud Computing Environments
US20090327905A1 (en) * 2008-06-27 2009-12-31 Microsoft Corporation Integrated client for access to remote resources
US20100217850A1 (en) * 2009-02-24 2010-08-26 James Michael Ferris Systems and methods for extending security platforms to cloud-based networks

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8359386B2 (en) * 2009-04-16 2013-01-22 Dell Products, Lp System and method of migrating virtualized environments
US8290998B2 (en) * 2009-05-20 2012-10-16 Sap Ag Systems and methods for generating cloud computing landscapes
US9116748B2 (en) * 2009-06-01 2015-08-25 Telefonaktiebolaget L M Ericsson (Publ) System and method for determining processing elements allocation
US20110016214A1 (en) * 2009-07-15 2011-01-20 Cluster Resources, Inc. System and method of brokering cloud computing resources

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5968176A (en) * 1997-05-29 1999-10-19 3Com Corporation Multilayer firewall system
US20090052451A1 (en) * 2007-08-21 2009-02-26 Etheridge James K Access control list management system
US20090228967A1 (en) * 2008-03-05 2009-09-10 Microsoft Corporation Flexible Scalable Application Authorization For Cloud Computing Environments
US20090327905A1 (en) * 2008-06-27 2009-12-31 Microsoft Corporation Integrated client for access to remote resources
US20100217850A1 (en) * 2009-02-24 2010-08-26 James Michael Ferris Systems and methods for extending security platforms to cloud-based networks

Cited By (98)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100137534A1 (en) * 2007-01-29 2010-06-03 Arkema France Method for preparing microgel particles by controlled radical polymerization in an aqueous dispersion using nitroxide control agents
US20110087960A1 (en) * 2009-10-13 2011-04-14 Google Inc. Power Metering and Control in Cloud Based Computer
US20110087690A1 (en) * 2009-10-13 2011-04-14 Google Inc. Cloud based file storage service
US20110087776A1 (en) * 2009-10-13 2011-04-14 Google Inc. Cloud based computer power management
US20110088039A1 (en) * 2009-10-13 2011-04-14 Google Inc. Power Monitoring and Control in Cloud Based Computer
US20110113337A1 (en) * 2009-10-13 2011-05-12 Google Inc. Individualized tab audio controls
US8996891B2 (en) 2009-10-13 2015-03-31 Google Inc. Power monitoring and control in cloud based computer
US8984399B2 (en) 2009-10-13 2015-03-17 Google Inc. Power metering and control in cloud based computer
US8499253B2 (en) 2009-10-13 2013-07-30 Google Inc. Individualized tab audio controls
US8620879B2 (en) * 2009-10-13 2013-12-31 Google Inc. Cloud based file storage service
US8584033B2 (en) 2009-10-13 2013-11-12 Google Inc. Individualized tab audio controls
US20110153751A1 (en) * 2009-12-18 2011-06-23 David Rice Content management systems and methods
US20110246499A1 (en) * 2010-03-30 2011-10-06 Yuval Carmel Method and system for evaluating compliance within a configuration-management system
US8910278B2 (en) 2010-05-18 2014-12-09 Cloudnexa Managing services in a cloud computing environment
US8661132B2 (en) * 2010-05-28 2014-02-25 International Business Machines Corporation Enabling service virtualization in a cloud
US20110296021A1 (en) * 2010-05-28 2011-12-01 International Business Machines Corporation Enabling Service Virtualization in a Cloud
US9063791B2 (en) 2010-05-28 2015-06-23 International Business Machines Corporation Enabling service virtualization in a cloud
US8639746B2 (en) 2010-07-01 2014-01-28 Red Hat, Inc. Architecture, system and method for mediating communications between a client computer system and a cloud computing system with a driver framework
US8725891B2 (en) * 2010-07-01 2014-05-13 Red Hat, Inc. Aggregation across cloud providers
US9270730B2 (en) 2010-07-01 2016-02-23 Red Hat, Inc. Providing an interface to multiple cloud computing systems
US20120005359A1 (en) * 2010-07-01 2012-01-05 Scott Wayne Seago System and method for aggregation across cloud providers
US8631067B2 (en) 2010-07-01 2014-01-14 Red Hat, Inc. Architecture, system and method for providing a neutral application programming interface for accessing different cloud computing systems
US8639745B2 (en) 2010-07-01 2014-01-28 Red Hat, Inc. Providing a neutral interface to multiple cloud computing systems
US8639747B2 (en) 2010-07-01 2014-01-28 Red Hat, Inc. System and method for providing a cloud computing graphical user interface
US20130282798A1 (en) * 2010-07-09 2013-10-24 State Street Corporation Systems and Methods for Private Cloud Computing
US9137106B2 (en) * 2010-07-09 2015-09-15 State Street Corporation Systems and methods for private cloud computing
US20120017085A1 (en) * 2010-07-15 2012-01-19 Carter Stephen R Techniques for identity-enabled interface deployment
US9183374B2 (en) * 2010-07-15 2015-11-10 Novell, Inc. Techniques for identity-enabled interface deployment
US20160261607A1 (en) * 2010-07-15 2016-09-08 Novell, Inc. Techniques for identity-enabled interface deployment
WO2012023050A2 (en) 2010-08-20 2012-02-23 Overtis Group Limited Secure cloud computing system and method
US20160099835A1 (en) * 2011-01-10 2016-04-07 Fiberlink Communications Corporation System and method for extending cloud services into the customer premise
US9722868B2 (en) * 2011-01-10 2017-08-01 International Business Machines Corporation System and method for extending cloud services into the customer premise
US20160080203A1 (en) * 2011-01-10 2016-03-17 Fiberlink Communications Corporation System and method for extending cloud services into the customer premise
US9794117B2 (en) * 2011-01-10 2017-10-17 International Business Machines Corporation System and method for extending cloud services into the customer premise
US8862933B2 (en) 2011-02-09 2014-10-14 Cliqr Technologies, Inc. Apparatus, systems and methods for deployment and management of distributed computing systems and applications
CN102156839A (en) * 2011-04-12 2011-08-17 浪潮电子信息产业股份有限公司 Method for limiting authority of cloud computing privileged user by using mandatory access control
US8806483B2 (en) 2011-04-13 2014-08-12 International Business Machines Corporation Determining starting values for virtual machine attributes in a networked computing environment
US8806485B2 (en) 2011-05-03 2014-08-12 International Business Machines Corporation Configuring virtual machine images in a networked computing environment
US8793377B2 (en) * 2011-05-03 2014-07-29 International Business Machines Corporation Identifying optimal virtual machine images in a networked computing environment
US20120284380A1 (en) * 2011-05-03 2012-11-08 International Business Machines Corporation Identifying optimal virtual machine images in a networked computing environment
CN103620599A (en) * 2011-06-03 2014-03-05 苹果公司 Cloud storage
WO2012167108A1 (en) * 2011-06-03 2012-12-06 Apple Inc. Cloud storage
KR101596559B1 (en) 2011-06-03 2016-02-22 애플 인크. Cloud storage
KR20140014268A (en) * 2011-06-03 2014-02-05 애플 인크. Cloud storage
US9208201B2 (en) 2011-06-03 2015-12-08 Apple Inc. Cloud storage
US8843998B2 (en) * 2011-06-27 2014-09-23 Cliqr Technologies, Inc. Apparatus, systems and methods for secure and selective access to services in hybrid public-private infrastructures
US20130018920A1 (en) * 2011-07-12 2013-01-17 Griffin Andrew M Configuration management database security
US9729549B2 (en) 2011-09-24 2017-08-08 Elwha Llc Behavioral fingerprinting with adaptive development
US8869241B2 (en) * 2011-09-24 2014-10-21 Elwha Llc Network acquired behavioral fingerprint for authentication
US9298900B2 (en) 2011-09-24 2016-03-29 Elwha Llc Behavioral fingerprinting via inferred personal relation
US9621404B2 (en) 2011-09-24 2017-04-11 Elwha Llc Behavioral fingerprinting with social networking
US9083687B2 (en) 2011-09-24 2015-07-14 Elwha Llc Multi-device behavioral fingerprinting
US8688980B2 (en) 2011-09-24 2014-04-01 Elwha Llc Trust verification schema based transaction authorization
US9825967B2 (en) 2011-09-24 2017-11-21 Elwha Llc Behavioral fingerprinting via social networking interaction
US20130167207A1 (en) * 2011-09-24 2013-06-27 Marc E. Davis Network Acquired Behavioral Fingerprint for Authentication
US8713704B2 (en) 2011-09-24 2014-04-29 Elwha Llc Behavioral fingerprint based authentication
US9015860B2 (en) 2011-09-24 2015-04-21 Elwha Llc Behavioral fingerprinting via derived personal relation
US8688768B2 (en) 2011-11-18 2014-04-01 Ca, Inc. System and method for hand-offs in cloud environments
US9369403B2 (en) 2011-11-18 2016-06-14 Amazon Technologies, Inc. Virtual network interface objects
US9088575B2 (en) 2011-11-18 2015-07-21 Ca, Inc. System and method for hand-offs in cloud environments
US8868710B2 (en) 2011-11-18 2014-10-21 Amazon Technologies, Inc. Virtual network interface objects
US9348985B2 (en) 2011-11-23 2016-05-24 Elwha Llc Behavioral fingerprint controlled automatic task determination
US9436832B2 (en) 2012-02-27 2016-09-06 Ca, Inc. System and method for virtual image security in a cloud environment
US8839447B2 (en) 2012-02-27 2014-09-16 Ca, Inc. System and method for virtual image security in a cloud environment
US8954964B2 (en) 2012-02-27 2015-02-10 Ca, Inc. System and method for isolated virtual image and appliance communication within a cloud environment
US9817687B2 (en) 2012-02-27 2017-11-14 Ca, Inc. System and method for isolated virtual image and appliance communication within a cloud environment
US9916545B1 (en) 2012-02-29 2018-03-13 Amazon Technologies, Inc. Portable network interfaces for authentication and license enforcement
US20160359911A1 (en) * 2012-04-30 2016-12-08 Ca, Inc. Trusted public infrastructure grid cloud
US9626526B2 (en) * 2012-04-30 2017-04-18 Ca, Inc. Trusted public infrastructure grid cloud
US20130291052A1 (en) * 2012-04-30 2013-10-31 Ca, Inc. Trusted public infrastructure grid cloud
US9548962B2 (en) * 2012-05-11 2017-01-17 Alcatel Lucent Apparatus and method for providing a fluid security layer
WO2013173109A3 (en) * 2012-05-16 2014-02-20 Apple Inc. Locally backed cloud-based storage
US9882824B2 (en) 2012-06-08 2018-01-30 Hewlett Packard Enterpise Development Lp Cloud application deployment portability
CN104254834A (en) * 2012-06-08 2014-12-31 惠普发展公司,有限责任合伙企业 Cloud application deployment portability
EP2859441A4 (en) * 2012-06-08 2016-03-30 Hewlett Packard Development Co Cloud application deployment portability
US8856077B1 (en) 2012-06-15 2014-10-07 Amazon Technologies, Inc. Account cloning service for cloud computing environments
US8813225B1 (en) 2012-06-15 2014-08-19 Amazon Technologies, Inc. Provider-arbitrated mandatory access control policies in cloud computing environments
US9565260B2 (en) 2012-06-15 2017-02-07 Amazon Technologies, Inc. Account state simulation service for cloud computing environments
US9210178B1 (en) 2012-06-15 2015-12-08 Amazon Technologies, Inc. Mixed-mode authorization metadata manager for cloud computing environments
US9075788B1 (en) 2012-06-15 2015-07-07 Amazon Technologies, Inc. Account state simulation service for cloud computing environments
US8805971B1 (en) 2012-06-15 2014-08-12 Amazon Technologies, Inc. Client-specified schema extensions in cloud computing environments
US8898304B2 (en) 2012-07-11 2014-11-25 Ca, Inc. Managing access to resources of computer systems using codified policies generated from policies
US9374377B2 (en) * 2012-08-03 2016-06-21 Alcatel Lucent Mandatory protection control in virtual machines
US20150128209A1 (en) * 2012-08-03 2015-05-07 Alcatel Lucent Mandatory protection control in virtual machines
US8997173B2 (en) 2012-09-12 2015-03-31 Ca, Inc. Managing security clusters in cloud computing environments using autonomous security risk negotiation agents
US9009471B2 (en) 2012-10-02 2015-04-14 Ca, Inc. System and method for multi-layered sensitive data protection in a virtual computing environment
US8700898B1 (en) 2012-10-02 2014-04-15 Ca, Inc. System and method for multi-layered sensitive data protection in a virtual computing environment
US9389898B2 (en) 2012-10-02 2016-07-12 Ca, Inc. System and method for enforcement of security controls on virtual machines throughout life cycle state changes
US20140222991A1 (en) * 2013-02-05 2014-08-07 International Business Machines Corporation Sentry for information technology system blueprints
US20140223001A1 (en) * 2013-02-05 2014-08-07 International Business Machines Corporation Sentry for information technology system blueprints
US9591060B1 (en) 2013-06-04 2017-03-07 Ca, Inc. Transferring applications between computer systems
US20160277250A1 (en) * 2013-10-30 2016-09-22 Hewlett Packard Enterprise Development Lp Managing the lifecycle of a cloud service modeled as topology decorated by a number of policies
WO2015065350A1 (en) * 2013-10-30 2015-05-07 Hewlett-Packard Development Company, L.P. Management of the lifecycle of a cloud service modeled as a topology
WO2015065353A1 (en) * 2013-10-30 2015-05-07 Hewlett-Packard Development Company, L.P. Managing the lifecycle of a cloud service modeled as topology decorated by a number of policies
US20160330330A1 (en) * 2014-01-08 2016-11-10 Vodafone Ip Licensing Limited Telecommunications networks
CN104113879A (en) * 2014-08-13 2014-10-22 成都西加云杉科技有限公司 WiFi communication system deployed with cloud ACs (access controllers) and communication method adopting WiFi communication system deployed with cloud ACs
US9787499B2 (en) 2014-09-19 2017-10-10 Amazon Technologies, Inc. Private alias endpoints for isolated virtual networks
CN104717212A (en) * 2014-10-21 2015-06-17 中华电信股份有限公司 Cloud virtual network security protection method and system

Also Published As

Publication number Publication date Type
US20170054728A1 (en) 2017-02-23 application

Similar Documents

Publication Publication Date Title
Alhamad et al. Conceptual SLA framework for cloud computing
US8032634B1 (en) Approach for allocating resources to an apparatus based on resource requirements
US8234650B1 (en) Approach for allocating resources to an apparatus
US8046694B1 (en) Multi-server control panel
Badger et al. Cloud computing synopsis and recommendations
Rimal et al. A taxonomy and survey of cloud computing systems
US8391834B2 (en) Security techniques for device assisted services
Endo et al. A survey on open-source cloud computing solutions
US8448170B2 (en) System and method for providing annotated service blueprints in an intelligent workload management system
Padhy et al. Cloud computing: security issues and research challenges
US7463648B1 (en) Approach for allocating resources to an apparatus based on optional resource requirements
US8179809B1 (en) Approach for allocating resources to an apparatus based on suspendable resource requirements
US7703102B1 (en) Approach for allocating resources to an apparatus based on preemptable resource requirements
US7370013B1 (en) Approach for determining an amount to bill a customer for the use of resources
US8931038B2 (en) System and method for a cloud computing abstraction layer
US20110296000A1 (en) Systems and methods for exporting usage history data as input to a management platform of a target cloud-based network
US20030115204A1 (en) Structure of policy information for storage, network and data management applications
US8281307B2 (en) Virtual solution composition and deployment system and method
US20130291052A1 (en) Trusted public infrastructure grid cloud
US7801976B2 (en) Service-oriented architecture systems and methods
US20070006278A1 (en) Automated dissemination of enterprise policy for runtime customization of resource arbitration
US7523092B2 (en) Optimization of aspects of information technology structures
Zhang et al. Cloud computing: state-of-the-art and research challenges
US20040186905A1 (en) System and method for provisioning resources
US20090210427A1 (en) Secure Business Continuity and Disaster Recovery Platform for Multiple Protected Systems

Legal Events

Date Code Title Description
AS Assignment

Owner name: COMPUTER ASSOCIATES THINK, INC., NEW YORK

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:HADAR, ETHAN (NMI);VAX, NIMROD (NMI);JERBI, AMIR (NMI);AND OTHERS;SIGNING DATES FROM 20090908 TO 20090920;REEL/FRAME:023274/0871

AS Assignment

Owner name: COMPUTER ASSOCIATES THINK, INC., NEW YORK

Free format text: CORRECTIVE ASSIGNMENT TO CORRECT THE ASSIGNMENT EXECUTION DATE FOR AMIR JERBI PREVIOUSLY RECORDED ON REEL 023274 FRAME 0871. ASSIGNOR(S) HEREBY CONFIRMS THE ASSIGNMENT EXECUTION DATE IS 09/07/2009.;ASSIGNORS:HADAR, ETHAN;VAX, NIMROD;JERBI, AMIR;AND OTHERS;SIGNING DATES FROM 20090907 TO 20090920;REEL/FRAME:023383/0917

AS Assignment

Owner name: CA, INC., NEW YORK

Free format text: MERGER;ASSIGNOR:COMPUTER ASSOCIATES THINK, INC.;REEL/FRAME:040255/0001

Effective date: 20120327