Cloud security stack

Patent metadata

Field	Value
Publication number	US-11038842-B2
Application number	US-201815881267-A
Country	US
Kind code	B2
Filing date	Jan 26, 2018
Priority date	Jan 26, 2017
Publication date	Jun 15, 2021
Grant date	Jun 15, 2021

Abstract

Methods and systems for secure cloud provider communication are disclosed. A method may include receiving a request to transmit data from one of a first cloud provider, an entity network, and a second cloud provider to another of the first cloud provider, the entity network, and the second cloud provider. The method may further include determining levels of trust associated with the one of the first cloud provider, the entity network, and the second cloud provider and the another of the first cloud provider, the entity network, and the second cloud provider, wherein the levels of trust are based on endpoint control by the entity network. The method may also include transmitting the data from the one of the first cloud provider, the entity network, and the second cloud provider to a cloud security stack based on the determined levels of trust.

First claim

The invention claimed is:

1. A method for secure cloud provider communication, the method comprising:
receiving at a cloud security stack a request to transmit data from one of a first cloud provider, an entity network, and a second cloud provider to another of the first cloud provider, the entity network, and the second cloud provider;
employing a cloud security stack to determine levels of trust associated with the first cloud provider, the entity network, and the second cloud provider, wherein determining the levels of trust comprises:
electronically transmitting a set of required control criteria to the first cloud provider and the second cloud provider, wherein the required control criteria are at least one of data leakage protection controls, secure communication controls, endpoint stack controls, Internet controls, network stack controls, and resource controls;
electronically receiving communications from the first cloud provider and the second cloud provider, the communications indicating which of the required control criteria are met by the first cloud provider and the second cloud provider;
electronically validating that the indicated required control criteria are met by the first cloud provider and the second cloud provider; and
comparing the validated required control criteria for the first cloud provider and the second cloud provider with defined required control criteria for three different levels of trust;

employing a cloud security stack to designate the first cloud provider as having a first level of trust based on the comparing of the validated required control criteria to the defined required control criteria for the first cloud provider;
employing a cloud security stack to designate the second cloud provider as having a second level of trust based on the comparing of the validated required control criteria to the defined required control criteria for the second cloud provider;
transmitting the data from the one of the first cloud provider, the entity network, and the second cloud provider to a cloud security stack based on the designated levels of trust;
processing the data at the cloud security stack based on the designated levels of trust by inspecting the data at a network data loss prevention system of the cloud security stack to prevent data loss based on defined data loss prevention criteria; and
transmitting the data from the cloud security stack to one of the first cloud provider, the entity network, and the second cloud provider based on the processing of the data at the cloud security stack,
wherein the first cloud provider, the entity network, and the second cloud provider are each designated as having a different level of trust and communicate securely with each other based on the different levels of trust designated and the processing of the data at the cloud security stack.

2. The method of claim 1 , wherein the defined data loss prevention criteria includes conditions that are searched for within a data packet and action that are performed once the condition is found.

3. The method of claim 1 , wherein processing the data at the cloud security stack based on the designated levels of trust comprises:
inspecting, at an intrusion prevention system of the cloud security stack, the data to identify malicious activity based on defined intrusion prevention system criteria.

4. The method of claim 1 , wherein processing the data at the cloud security stack based on the designated levels of trust comprises:
capturing, at a packet capture system of the cloud security stack a copy of the data and storing the copy of the data.

5. The method of claim 1 , wherein processing the data at the cloud security stack based on the designated levels of trust comprises:
determining, at a firewall system of the cloud security stack, whether the data should pass through the cloud security stack based on defined firewall criteria.

6. The method of claim 1 , wherein processing the data at the cloud security stack based on the designated levels of trust comprises:
inspecting, at a firewall system of the cloud security stack, the data to ensure adherence to a network traffic protocol.

7. The method of claim 1 , wherein the levels of trust are based on endpoint control by the entity network and include a trusted level, the trusted level indicating an endpoint under control of the entity network meeting defined control criteria ensuring that the data is completely protected.

8. The method of claim 1 , wherein the levels of trust are based on endpoint control by the entity network and include a semi-trusted level, the semi-trusted level indicating an endpoint under control of the entity network meeting defined control criteria ensuring that the data is partially protected.

9. The method of claim 1 , wherein the levels of trust are based on endpoint control by the entity network and include an untrusted level, the untrusted level indicating an endpoint not under control of the entity network based on defined control criteria and indicating that the data unprotected.

10. The method of claim 1 , wherein the cloud security stack comprises a router, a switch, a firewall, an intrusion prevention system, a network data loss prevention system, a packet capture system, and a network tap.

11. The method of claim 1 , wherein the first cloud provider and the second cloud provider service the entity network.

12. The method of claim 1 , wherein the required control criteria comprises logging control.

13. The method of claim 1 , wherein the logging control comprises one or more of network traffic logs, physical server logs, hypervisor logs, provisioning logs, management logs, and delivery logs.

14. The method of claim 1 , wherein the network stack control controls at least one of a firewall, a packet capture review, and an identification and control device.

15. The method of claim 1 , wherein the data leakage protection controls comprise at least one of a host-based DLP and a network-based DLP.

16. The method of claim 1 , wherein the secure communication controls comprise at least one of a dedicated circuit, a Virtual Private Network (VPN) tunnel and IP address recognition.

17. The method of claim 1 , wherein the endpoint stack controls comprise at least one of a white listing, antivirus capability, Sureview capability, Encase capability, Enterprise Encryption key management system; host-based intrusion prevention systems/detection (IPS/IDS) and Active Directory Group Policy Objects.

18. The method of claim 1 , wherein the required control criteria further includes authorization controls comprising at least one of a Federated-SSO (Identity Federation) with the entity as an Identity Provider, and a multi-factor authentication for access to manage cloud.

19. A system for secure cloud provider communication, the system comprising:
a cloud security stack to control passage of network traffic between cloud providers servicing an entity network and between the cloud providers and the entity network, the cloud security stack determines trusted, semi-trusted and untrusted cloud providers based upon required control criteria, wherein the required control criteria includes at least one of data leakage protection controls, secure communication controls, endpoint stack controls, Internet controls, network stack controls, and resource controls;
wherein the cloud security stack is configured to:
receive a request to transmit data from one of a first cloud provider, an entity network, and a second cloud provider to another of the first cloud provider,

Assignees

• Walmart Apollo Llc

Inventors

• Gerber Christopher John
• Smith Michael David
• Pagan Mark Alan
• Crawford Benjamin Ivy

Classifications

• H04L63/105

  Multiple levels of security · CPC title

• H04L63/0209 Primary

  Architectural arrangements, e.g. perimeter networks or demilitarized zones · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L63/0227 Primary

  Filtering policies (mail message filtering H04L51/212) · CPC title