Method for managing a cloud computing system

Patent metadata

Field	Value
Publication number	US-11621961-B2
Application number	US-201816606952-A
Country	US
Kind code	B2
Filing date	Apr 13, 2018
Priority date	Apr 21, 2017
Publication date	Apr 4, 2023
Grant date	Apr 4, 2023

Abstract

A method for managing a cloud computing system, capable of allocating computing and network resources to a plurality of clients, each client being associated with at least one user likely to access the computing and network resources allocated to the client by the cloud computing system. This method includes, for at least one client of the cloud computing system: providing to the client a meta-model having a plurality of elements defining an access control model and an access control policy for the client; receiving an instance of the meta-model provided by the client, this instance defining, for the client, an access control model and an access control policy based on this access control model; and applying the access control policy to control an access of a user of the client to at least one resource allocated to the client by the cloud computing system.

First claim

The invention claimed is:

1. A method for managing a cloud computing system, able to allocate computing and network resources to a plurality of clients, each client being associated with at least one user likely to access computing and network resources allocated to the client by the cloud computing system, said method being performed by at least one hardware element of the cloud computing system and comprising:
providing, to said plurality of clients, via a control interface of the cloud computing system common to said plurality of clients, a meta-model comprising a plurality of model parameters, said meta-model being common to the plurality of clients and allowing each of the plurality of clients to instantiate a plurality of distinct access control models of at least two different types and access control policies, by parameterizing the plurality of model parameters of the meta-model;
receiving via said control interface, from each of the plurality of clients a respective instance of the meta-model, each received instance defining for said respective client an access control model and an access control policy based on this access control model, as parameterized by the respective client, wherein the instance of the meta-model provided by the client defines an access control model of the RBAC (Role-Based Access Control), OrBAC (Organization-Based Access Control), ACL (Access-Control List), DTE (Domain and Type Enforcement), ABAC (Attribute-Based Access Control) or MLS (MultiLevel Security) type; and
for each of the plurality of clients, applying said access control policy of the respective instance of the meta-model to control access of a user of the client to at least one resource allocated to the client by the cloud computing system.

2. The management method according to claim 1 , wherein the plurality of model parameters of the meta-model parametrized by each of the plurality of clients comprises:
a perimeter of the access control model defining a plurality of entities involved in the access control policy of the client;
metadata defining, for each entity, at least one attribute category associated with that entity;
data defining possible values for each attribute category defined by the metadata;
at least one meta-rule identifying one or several attribute categories defined by the metadata and used to provide an instruction in accordance with the access control policy of the client;
at least one access control rule based on said at least one meta-rule and providing an instruction in accordance with the access control policy of the client; and
a set of values assigned by the client to each entity defined for this client in the perimeter of the access control model, for each attribute category associated with this entity and comprised in a meta-rule, said assigned values being selected from the data.

3. The method according to claim 2 , wherein said plurality of entities comprises at least one subject, and/or at least one object, and/or at least one action.

4. The method according to claim 2 , wherein at least one attribute category defined for an entity is selected from:
a security level;
a role;
a type; and
a field.

5. The method according to claim 2 , wherein at least one instruction provided by said at least one rule comprises an authorization or a denial of access to a determined resource allocated to the client by the cloud computing system.

6. A method for instantiating, by a client, a cloud computing system able to allocate computing and network resources to a plurality of clients, each client being associated with at least one user likely to access the computing and network resources allocated to the client by the cloud computing system, said method comprising:
obtaining a meta-model provided by the cloud computing system via a control interface of the cloud computing system, said meta-model being common to the plurality of clients and allowing each of the plurality of clients to instantiate a plurality of distinct access control models of at least two different types and access control policies, by parameterizing a plurality of model parameters of the meta-model;
instantiating the meta-model creating an instance defining for said client an access control model and an access control policy based on this access control model, as parameterized by said client, wherein the instance of the meta-model instantiated by the client defines an access control model of the RBAC (Role-Based Access Control), OrBAC (Organization-Based Access Control), ACL (Access-Control List), DTE (Domain and Type Enforcement), ABAC (Attribute-Based Access Control) or MLS (MultiLevel Security) type; and
providing, via said control interface, said instance to the cloud computing system.

7. The instantiation method according to claim 6 wherein the plurality of model parameters of the meta-model parametrized by the client comprises:
a perimeter of the access control model defining a plurality of entities involved in the access control policy of the client;
metadata defining, for each entity, at least one attribute category associated with that entity;
data defining possible values for each attribute category defined by the metadata;
at least one meta-rule identifying at least one attribute category defined by the metadata and used to provide an instruction in accordance with the access control policy of the client;
at least one access control rule defining said at least one meta-rule and providing an instruction in accordance with the access control policy of the client; and
a set of values assigned by the client to each entity defined for this client in the perimeter of the access control model, for each attribute category associated with this entity and comprised in a meta-rule, said assigned values being selected from the data.

8. A cloud computing system able to allocate computing and network resources to a plurality of clients, each client being associated with at least one user likely to access computing and network resources allocated to the client by the cloud computing system, said system comprising:
a processor; and
a non-transitory computer-readable medium comprising instructions stored thereon, which when executed by the processor configure the cloud computing system to:
provide the plurality of clients a meta-model, via a control interface of the cloud computing system common to said plurality of clients, said meta-model being common to the plurality of clients and allowing each of the plurality of clients to instantiate a plurality of distinct access control models of at least two different types and access control policies, by parameterizing a plurality of model parameters of the meta-model;
receive, via said control interface, from each of the plurality of clients a respective instance of the meta-model, each received instance defining for said respective client an access control model and an access control policy based on this access control model, as parameterized by the respective client, wherein the instance of the meta-model provided by the client defines an access control model of the RBAC (Role-Based Access Control), OrBAC (Organization-Based Access Control), ACL (Access-Control List), DTE (Domain and Type Enforcement), ABAC (Attribute-Based Access Control) or MLS (MultiLevel Security) type; and
for each of the plurality of clients, apply said access control policy of the respective instance of the meta-model to control an access of a user of the client to at least one resource allocated to the client by the cloud computing system.

9. A device of a client of a cloud computing system able to allocate computing and network resources to a plurality of clients, each client being associated with at least one user like

Assignees

• Orange

Inventors

• He Ruan
• Han Xiao

Classifications

• H04L63/10 Primary

  for controlling access to devices or network resources · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• G06Q10/0631

  Resource planning, allocation, distributing or scheduling for enterprises or organisations · CPC title

• G06Q10/10

  Office automation; Time management · CPC title

• G06F16/906

  Clustering; Classification · CPC title