Centralized request processing and security zone policy enforcement in a cloud infrastructure system

Patent metadata

Field	Value
Publication number	US-12261889-B2
Application number	US-202117393334-A
Country	US
Kind code	B2
Filing date	Aug 3, 2021
Priority date	Aug 21, 2020
Publication date	Mar 25, 2025
Grant date	Mar 25, 2025

Abstract

A cloud-based security solution that provides a robust and secure framework for managing and enforcing security policies related to various resources managed in the cloud is disclosed. The cloud-based security solution is implemented by a centralized application programming Interface (API) system and a security zone policy enforcement system in a cloud service provider infrastructure. The centralized API system receives an API request that identifies an operation to be performed on a resource in the CSPI. The system determines, from the API request, compartment information and context information associated with the resource. Responsive to determining the compartment information and the context information associated with the resource, the system determines that the resource resides in a compartment that is associated with a security zone. The system then processes the API request and transmits a result of processing of the API request to a user of the centralized API processing system.

First claim

What is claimed is:

1. A method comprising:
receiving, by a centralized application programming interface (API) request processing system in a cloud service provider infrastructure (CSPI), an API request, the API request identifying an operation to be performed on a resource, the centralized API request processing system configured to receive a plurality of API requests directed to a plurality of cloud services provided using the CSPI;
determining, by the centralized API request processing system and based upon the API request, that the resource resides in a compartment that is associated with a security zone;
transmitting, by the centralized API processing system and to a security zone policy enforcement system, information identifying the operation to be performed on the resource, the compartment in which the resource resides, and the security zone associated with the compartment;
obtaining, by the centralized API processing system and from the security zone policy enforcement system, a response indicative of whether the operation is permitted on the resource, the response generated by the security zone policy enforcement system based upon evaluating a set of one or more compartment policies associated with the compartment and a set of one or more security zone policies associated with the security zone, the evaluating comprising:
determining that the operation is permitted on the resource based on the set of one or more compartment policies;
upon determining that the operation is permitted on the resource based on the set of one or more compartment policies, determining that the operation is permitted on the resource based on the set of one or more security zone policies; and
upon determining that the operation is permitted on the resource based on the set of one or more security zone policies, transmitting a response indicating that the operation is permitted on the resource; and

upon determining that the response indicates that the operation is permitted to be performed on the resource, transmitting, by the centralized API processing system, the API request to a first cloud service from the plurality of cloud services.

2. The method of claim 1 , further comprising:
determining, by the centralized API request processing system, from the API request, a primary resource, wherein the primary resource is the resource identified in the API request; and
determining, by the centralized API request processing system, a secondary resource that is impacted by the API request, wherein the secondary resource is a resource that is associated with the primary resource.

3. The method of claim 2 , wherein the secondary resource is not identified as part of the API request.

4. The method of claim 2 , wherein the compartment comprises a compartment identifier and the set of one or more compartment policies associated with the resource identified in the API request.

5. The method of claim 2 , further comprising determining, based upon the API request, context information associated with the resource, wherein the context information is associated with the secondary resource impacted by the API request, wherein the context information comprises at least one of a resource identifier associated with the secondary resource, a compartment identifier associated with the secondary resource, or a resource state associated with the secondary resource.

6. The method of claim 5 , wherein the context information identifies the first cloud service provided using the CSPI configured to execute the API request.

7. The method of claim 1 further comprising:
receiving, by the centralized API processing system, a result of processing of the API request from the first cloud service; and
transmitting, by the centralized API processing system, the result to a user of the centralized API processing system.

8. The method of claim 1 , further comprising transmitting, by the centralized API request processing system, a message indicating a policy violation to a user of the centralized API processing system upon determining that the response indicates that the operation is not permitted to be performed on the resource.

9. The method of claim 1 , wherein a security zone policy in the set of one or more security zone policies is represented as a set of one or more expressions, wherein each expression in the set of expressions comprises a set of one or more conditions, and wherein each condition in the set of one or more conditions specifies a restriction on the operation to be performed on the resource.

10. The method of claim 9 , wherein the restriction specifies criteria requiring encryption of the resource, criteria that restricts a movement of the resource from the compartment that the resource resides in or criteria that prohibits the resource from being accessible from the public internet.

11. The method of claim 1 , further comprising:
determining, by the centralized request API processing system, that the user is authorized to perform the operation on the resource identified in the API request prior to determining the compartment associated with the resource.

12. The method of claim 1 , wherein the compartment associated with the resource is stored in a security zone specification associated with the API request.

13. The method of claim 1 , wherein:
the compartment of the resource is associated with a first tenancy corresponding to a first customer subscribing to one or more cloud services from the plurality of cloud services; and
the security zone is associated with a plurality of tenancies corresponding to a plurality of customers, each customer in the plurality of customers subscribing to at least one cloud service from the plurality of cloud services, the plurality of tenancies including the first tenancy.

14. A centralized request application programming interface (API) processing system in a cloud service provider infrastructure (CSPI) configured to provided secure resource access services, comprising:
a processor; and
a memory storing instructions that, when executed by the processor, configure the system to:
receive an API request, the API request identifying an operation to be performed on a resource, the centralized API request processing system configured to receive a plurality of API requests directed to a plurality of cloud services provided using the CSPI;
determine, based upon the API request, that the resource resides in a compartment that is associated with a security zone;
transmit, to a security zone policy enforcement system, information identifying the operation to be performed on the resource, the compartment in which the resource resides, and the security zone associated with the compartment;
obtain from the security zone policy enforcement system, a response indicative of whether the operation is permitted on the resource, the response generated by the security zone policy enforcement system based upon evaluating a set of one or more compartment policies associated with the compartment and a set of one or more security zone policies associated with the security zone, the evaluating comprising:
determining that the operation is permitted on the resource based on the set of one or more compartment policies;
upon determining that the operation is permitted on the resource based on the set of one or more compartment policies, determining that the operation is permitted on the resource based on the set of one or more security zone policies; and
upon determining that the operation is permitted on the resource based on the set of one or more security zone policies, transmitting a response indicating that the operation is permitted on th

Assignees

• Oracle Int Corp

Inventors

• Gattu Sreenivas
• Wei Qian
• Nadal Jonathan Jorge
• Tong Jun
• Alrahem Thoulfekar

Classifications

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/107

  wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title