Private consolidated cloud service architecture

Patent metadata

Field	Value
Publication number	US-10609031-B2
Application number	US-201715824248-A
Country	US
Kind code	B2
Filing date	Nov 28, 2017
Priority date	Nov 28, 2017
Publication date	Mar 31, 2020
Grant date	Mar 31, 2020

Abstract

Mechanisms are provided for providing a private consolidated cloud service architecture. The mechanisms operate to implement a private consolidated cloud service (PCCS) engine. The PCCS engine generates a private consolidated cloud (PCC) for a consumer based on one or more PCC characteristics specified by a request from the consumer. The PCCS engine also generates, in the PCC, for each of a plurality of public cloud services, a private instance of the public cloud service in the PCC. The PCC receives, from a consumer device, a request for processing of consumer private data by a specified private instance of a public cloud service in the PCC. The private instance of the public cloud service in the PCC performs the requested processing of consumer private data within the PCC without exposing the consumer private data outside the PCC. The PCC provides results of the requested processing to one of the consumer device or the public cloud service.

First claim

What is claimed is:

1. A method, in a data processing system comprising a processor and a memory, wherein the memory comprises instructions which are executed by the processor to configure the processor to implement a private consolidated cloud service (PCCS) engine, the method comprising:
generating, by the PCCS engine, a private consolidated cloud (PCC) for a consumer based on one or more PCC characteristics specified by a request from the consumer;
generating, by the PCCS engine, in the PCC, for each of a plurality of public cloud services, a private instance of the public cloud service in the PCC;
receiving, by the PCC, from a consumer device, a request for processing of consumer private data by a specified private instance of a public cloud service in the PCC;
performing, by the private instance of the public cloud service in the PCC, the requested processing of consumer private data within the PCC without exposing the consumer private data outside the PCC; and
providing, by the PCC, results of the requested processing to one of the consumer device or the public cloud service, wherein the private data is maintained in a virtual safe box within the PCC that is secured by one or more security keys, and wherein the PCC is isolated from other PCCs of other consumers.

2. The method of claim 1 , wherein the one or more PCC characteristics comprises a security pattern requirement that applies to all private instances of public cloud services in the PCC.

3. The method of claim 2 , wherein at least two private instances of public cloud services in the PCC implement the security pattern requirement using different security mechanisms.

4. The method of claim 1 , wherein the consumer device is one of a wearable activity tracker device, a smart appliance, or a smart phone.

5. The method of claim 1 , further comprising:
receiving, by the PCCS engine from a consumer, a selection of a public cloud service to be included in the PCC; and
determining, by the PCCS engine, whether the public cloud service meets at least one requirement specified by the one or more PCC characteristics, wherein a private instance of the public cloud service is generated in response to determining that the public cloud service meets at least one requirement specified by the one or more PCC characteristics.

6. The method of claim 1 , further comprising:
receiving, by the PCCS engine from a consumer, an input specifying a portion of the private data that may be communicated to a public cloud service outside of the PCC; and
transmitting, by the PCC, the portion of the private data to the public cloud service.

7. The method of claim 1 , further comprising, receiving, by the PCCS engine from a consumer, a selection of a public cloud service to be included in the PCC, and in response to receiving the selection:
determining, by the PCCS engine, whether the public cloud service supports private instantiation in the PCC;
in response to determining that the public cloud service supports private instantiation in the PCC, receiving an installation data package from the public cloud service and executing the installation data package within the PCC to generate a private instance of the public cloud service or executing an installation operation by the public cloud service to generate a private instance of the public cloud service within the PCC; and
in response to determining that the public cloud service does not support private instantiation in the PCC, obtaining instructions from the public cloud service that are executed within the PCC to process private data within the PCC and provide results data back to the public cloud service.

8. The method of claim 1 , wherein generating, in the PCC, for each of the plurality of public cloud services a private instance comprises, for each public cloud service:
determining whether the public cloud service advertises a security pattern that meets a security pattern requirement specified in the one or more PCC characteristics;
in response to a determination that the public cloud service does not advertise a security pattern that meets the security pattern requirement, inhibiting instantiation of a private instance of the public cloud service in the PCC; and
in response to a determination that the public cloud service does advertise a security pattern that meets the security pattern requirement, generating a private instance of the public cloud service in the PCC and configuring the private instance of the public cloud service to implement a configuration specific to the consumer.

9. The method of claim 1 , further comprising:
receiving, by the PCCS engine from a consumer, a selection of a portion of private data that is permitted to be transmitted outside the PCC to a specified recipient; and
configuring, by the PCCS engine, the PCC to implement an anonymization mechanism to anonymize the portion of private data prior to transmission of the portion of private data outside the PCC to the specified recipient.

10. A computer program product comprising a computer readable storage medium having a computer readable program stored therein, wherein the computer readable program, when executed on a computing device, causes the computing device to:
generate a private consolidated cloud (PCC) for a consumer based on one or more PCC characteristics specified by a request from the consumer;
generate, in the PCC, for each of a plurality of public cloud services, a private instance of the public cloud service in the PCC;
receive, by the PCC, from a consumer device, a request for processing of consumer private data by a specified private instance of a public cloud service in the PCC;
perform, by the private instance of the public cloud service in the PCC, the requested processing of consumer private data within the PCC without exposing the consumer private data outside the PCC; and
provide, by the PCC, results of the requested processing to one of the consumer device or the public cloud service, wherein the private data is maintained in a virtual safe box within the PCC that is secured by one or more security keys, and wherein the PCC is isolated from other PCCs of other consumers.

11. The computer program product of claim 10 , wherein the one or more PCC characteristics comprises a security pattern requirement that applies to all private instances of public cloud services in the PCC.

12. The computer program product of claim 11 , wherein at least two private instances of public cloud services in the PCC implement the security pattern requirement using different security mechanisms.

13. The computer program product of claim 10 , wherein the consumer device is one of a wearable activity tracker device, a smart appliance, or a smart phone.

14. The computer program product of claim 10 , wherein the computer readable program further causes the computing device to:
receive, from a consumer, a selection of a public cloud service to be included in the PCC; and
determine whether the public cloud service meets at least one requirement specified by the one or more PCC characteristics, wherein a private instance of the public cloud service is generated in response to determining that the public cloud service meets at least one requirement specified by the one or more PCC characteristics.

15. The computer program product of claim 10 , wherein the computer readable program further causes the computing device to:
receive, from a consumer, an input specifying a portion of the private data that may be communicated to a public cloud service outside of the PCC; and
transmit, by the PCC, the portion of the private data to the publi

Assignees

• IBM

Inventors

• Bender Michael
• Childress Rhonda L
• Kumhyr David B
• Ng Joanna W

Classifications

• H04L63/065

  for group communications (cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833) · CPC title

• H04L63/10 Primary

  for controlling access to devices or network resources · CPC title

• H04L67/12

  specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• H04L63/02 Primary

  for separating internal from external traffic, e.g. firewalls · CPC title