System, method, and software for providing access control enforcement capabilities in cloud computing systems

Patent metadata

Field	Value
Publication number	US-10326765-B2
Application number	US-201615346145-A
Country	US
Kind code	B2
Filing date	Nov 8, 2016
Priority date	Sep 23, 2009
Publication date	Jun 18, 2019
Grant date	Jun 18, 2019

Abstract

According to one embodiment, a system comprises one or more processors coupled to a memory. The one or more processors when executing logic encoded in the memory provide a topology manager. The topology manager is configured to maintain a security topology of a plurality of hosts. The security topology associates one or more virtual hosts policies with a plurality of virtual hosts in a cloud computing deployment. The topology manager is also configured to request a query for one or more hosts that are candidates to be enforced. A portability manager is configured to receive a request to deploy an access control agent on the one or more candidate hosts, determine an optimal agent to be deployed from a list of available agents, and deploy the optimal agent on the one or more candidate hosts.

First claim

What is claimed is:

1. A system comprising one or more processors coupled to a memory, the one or more processors being configured to execute logic encoded in the memory to:
maintain a security topology of a plurality of virtual hosts in a cloud computing deployment, the security topology associating a plurality of security policies with the plurality of virtual hosts, the security policies including access control security policies;
wherein each of the plurality of virtual hosts comprises operations systems that support server virtualization;
determine if one or more hosts from among the plurality of virtual hosts are in compliance with their corresponding one or more access control security policies;
access a topology manager having an access control topology, wherein the access control topology includes a security policy that identifies a respective security policy for each particular one of the plurality of virtual hosts, wherein the respective security policy is selected from a plurality of different security policies governing the plurality of virtual hosts;
identify one or more candidate hosts that are capable of complying with the one or more security policies associated with the one or more virtual hosts in response to determining that the one or more virtual hosts are not in compliance with their corresponding one or more access control security policies;
repackage the one or more virtual hosts for deployment on the identified one or more candidate host;
determining that each of the one or more candidate hosts are provided by a specific vendor;
in response to determining that the one or more candidate hosts are provided by the specific vendor, including in a unique vendor package that includes the one or more virtual hosts for deployment, instructions and configurations in compliance with the specific vendor; and
port the repackaged one or more virtual hosts to the one or more candidate hosts.

2. The system of claim 1 , wherein:
the unique vendor package comprises an optimal access control agent that is configured to deploy on the specific vendor's candidate host, the access control agent being configured to control entry points to the one or more candidate hosts.

3. The system of claim 2 , wherein the access control agent is configured to control entry points to the cloud computing deployment by:
intercepting cloud management calls from an administrator;
determining whether cloud management calls are authorized; and
preparing the cloud management calls for interaction with a specific vendor.

4. The system of claim 1 , wherein the one or more processors are further configured to execute logic encoded in the memory to extract non-functional characteristics of the cloud computing deployment.

5. The system of claim 4 , wherein the non-functional characteristics comprise a virtual host name, a virtual host identifier, and a list of virtual host configuration data.

6. The system of claim 1 , wherein the one or more processors are further configured to execute logic encoded in the memory to maintain a security topology by:
requesting discovery of a list of hosts deployed on the cloud computing deployment; and
associating the list of hosts with the one or more security policies.

7. The system of claim 6 , wherein the one or more processors are further configured to execute logic encoded in the memory to maintain a security topology by:
requesting discovery of an updated list of hosts deployed on the cloud computing deployment;
resolving discrepancies between the list of hosts and the updated list of hosts; and
updating the security topology.

8. A method comprising:
maintaining a security topology of a plurality of hosts in a cloud computing deployment, the security topology associating one or more security policies with the plurality of hosts, the security policies including access control security policies;
determining if one or more of the plurality of hosts are in compliance with their corresponding one or more access control security policies;
in response to determining that the one or more of the plurality of hosts are not in compliance with their corresponding one or more access control security policies, identifying one or more candidate hosts that are capable of complying with the one or more security policies associated with the one or more of the plurality of hosts; and
repackaging the one or more hosts for deployment on the identified one or more candidate host;
determining that each of the one or more candidate hosts are provided by a specific vendor;
in response to determining that the one or more candidate hosts are provided by the specific vendor, including in a unique vendor package that includes the one or more virtual hosts for deployment, instructions and configurations in compliance with the specific vendor; and
porting the repackaged one or more hosts to the one or more candidate hosts.

9. The method of claim 8 , wherein:
the one or more candidate hosts are provided by a specific vendor, and
repackaging the one or more hosts comprises repackaging the one or more hosts as a unique vendor package, the unique vendor package comprising instructions and configurations in compliance with the specific vendor; and
the unique vendor package comprises an optimal access control agent that is configured to deploy on the specific vendor's candidate host, the access control agent being configured to control entry points to the one or more candidate hosts.

10. The method of claim 9 , wherein the access control agent controls entry points to the cloud computing deployment by:
intercepting cloud management calls from an administrator;
determining whether cloud management calls are authorized; and
preparing the cloud management calls for interaction with a specific vendor.

11. The method of claim 8 , further comprising extracting non-functional characteristics of the cloud computing deployment.

12. The method of claim 11 , wherein the non-functional characteristics comprise a virtual host name, a virtual host identifier, and a list of virtual host configuration data.

13. The method of claim 8 , wherein the method at the topology manager further comprises:
requesting discovery of a list of hosts deployed on the cloud computing deployment; and
associating the list of hosts with the one or more security policies.

14. The method of claim 13 , wherein the method further comprises:
requesting discovery of an updated list of hosts deployed on the cloud computing deployment;
resolving discrepancies between the list of hosts and the updated list of hosts; and
updating the security topology.

15. Logic encoded in one or more non-transitory computer-readable storage media for execution and when executed operable to:
maintain a security topology of a plurality of hosts in a cloud computing deployment, the security topology associating one or more security policies with the plurality of hosts, the security policies including access control security policies;
determine if one or more of the plurality of hosts are in compliance with their corresponding one or more access control security policies;
in response to determining that the one or more of the plurality of hosts are not in compliance with their corresponding one or more access control security policies, identify one or more candidate hosts that are capable of complying with the one or more security policies associated with the one or more of the plurality of hosts;
repackage the one or more hosts for deployment on the identified one or more candidate host;
determine that each of the one or more candidate hosts

Assignees

• Ca Inc

Inventors

• Hadar Ethan
• Vax Nimrod
• Jerbi Amir
• Kletskin Michael

Classifications

• G06F2209/505

  Clust · CPC title

• G06F9/5072

  Grid computing · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/10 Primary

  for controlling access to devices or network resources · CPC title