Authentication and authorization methods for cloud computing platform security

Patent metadata

Field	Value
Publication number	US-9288214-B2
Application number	US-201414319235-A
Country	US
Kind code	B2
Filing date	Jun 30, 2014
Priority date	Jun 30, 2011
Publication date	Mar 15, 2016
Grant date	Mar 15, 2016

Abstract

An authentication and authorization plug-in model for a cloud computing environment enables cloud customers to retain control over their enterprise information when their applications are deployed in the cloud. The cloud service provider provides a pluggable interface for customer security modules. When a customer deploys an application, the cloud environment administrator allocates a resource group for the customer's application and data. The customer registers its own authentication and authorization security module with the cloud security service, and that security module is then used to control what persons or entities can access information associated with the deployed application. To further balance the rights of the various parties, a third party notary service protects the privacy and the access right of the customer when its application and information are deployed in the cloud.

First claim

Having described our invention, what we now claim is as follows:

1. A method for authentication and authorization in an environment wherein computing resources are hosted in a shared pool of configurable computing resources, comprising:
receiving a request from a first entity for access to the shared pool of configurable computing resources managed by a second entity;
upon execution of an agreement among the first entity, the second entity and a third entity that is distinct from the first entity and the second entity, assigning the first entity a resource group;
receiving and storing in the resource group information associated with permitted users of the first entity;
registering a plug-in security module associated with the first entity in a plug-in service operated by the second entity in association with the shared pool of configurable computing resources;
enabling access to the resource group via the plug-in security module; and
upon receiving a permission to disassociate the first entity from the resource group, returning the resource group to the shared pool.

2. The method as described in claim 1 wherein returning the resource group to the shared pool occurs upon occurrence of an event that is one of: a violation of the agreement by the first entity, and termination of the agreement.

3. The method as described in claim 1 wherein the step of returning the resource group comprises:
upon occurrence of an event, issuing a request to the third party, the request seeking permission to disassociate the first entity from the resource group; and
receiving a response from the third party, the response indicating that the second entity has permission to disassociate the first entity from the resource group.

4. The method as described in claim 3 further including deleting the information associated with permitted users of the first entity prior to returning the resource group to the shared pool.

5. The method as described in claim 1 wherein access to the resource group by users associated with the second entity is restricted.

6. The method as described in claim 1 wherein the agreement is secured cryptographically so that it cannot be repudiated by either the first entity or the second entity.

7. Apparatus for authentication and authorization in an environment wherein computing resources are hosted in a shared pool of configurable computing resources, comprising:
a processor;
computer memory holding computer program instructions that when executed by the processor perform a method comprising:
receiving a request from a first entity for access to the shared pool of configurable computing resources managed by a second entity;
upon execution of an agreement among the first entity, the second entity and a third entity that is distinct from the first entity and the second entity, assigning the first entity a resource group;
receiving and storing in the resource group information associated with permitted users of the first entity;
registering a plug-in security module associated with the first entity in a plug-in service operated by the second entity in association with the shared pool of configurable computing resources; and
enabling access to the resource group via the plug-in security module; and
upon receiving a permission to disassociate the first entity from the resource group, returning the resource group to the shared pool.

8. The apparatus as described in claim 7 wherein returning the resource group to the shared pool occurs upon occurrence of an event that is one of: a violation of the agreement by the first entity, and termination of the agreement.

9. The apparatus as described in claim 7 wherein the step of returning the resource group comprises:
upon occurrence of an event, issuing a request to the third party, the request seeking permission to disassociate the first entity from the resource group; and
receiving a response from the third party, the response indicating that the second entity has permission to disassociate the first entity from the resource group.

10. The apparatus as described in claim 9 wherein the method further includes deleting the information associated with permitted users of the first entity prior to returning the resource group to the shared pool.

11. The apparatus as described in claim 7 wherein access to the resource group by users associated with the second entity is restricted.

12. The apparatus as described in claim 7 wherein the agreement is secured cryptographically so that it cannot be repudiated by either the first entity or the second entity.

13. A computer program product in a non-transitory computer readable medium for use in a data processing system for authentication and authorization in an environment wherein computing resources are hosted in a shared pool of configurable computing resources, the computer program product holding computer program instructions which, when executed by the data processing system, perform a method comprising:
receiving a request from a first entity for access to the shared pool of configurable computing resources managed by a second entity;
upon execution of an agreement among the first entity, the second entity and a third entity that is distinct from the first entity and the second entity, assigning the first entity a resource group;
receiving and storing in the resource group information associated with permitted users of the first entity;
registering a plug-in security module associated with the first entity in a plug-in service operated by the second entity in association with the shared pool of configurable computing resources;
enabling access to the resource group via the plug-in security module; and
upon receiving a permission to disassociate the first entity from the resource group, returning the resource group to the shared pool.

14. The computer program product as described in claim 13 wherein returning the resource group to the shared pool upon occurrence of an event that is one of: a violation of the agreement, and termination of the agreement.

15. The computer program product as described in claim 13 wherein returning the resource group comprises:
upon occurrence of an event, issuing a request to the third party, the request seeking permission to disassociate the first entity from the resource group; and
receiving a response from the third party, the response indicating that the second entity has permission to disassociate the first entity from the resource group.

16. The computer program product as described in claim 15 wherein the method further includes deleting the information associated with permitted users of the first entity prior to returning the resource group to the shared pool.

17. The computer program product as described in claim 13 wherein access to the resource group by users associated with the second entity is restricted.

18. The computer program product as described in claim 13 wherein the agreement is secured cryptographically so that it cannot be repudiated by either the first entity or the second entity.

Assignees

• IBM

Inventors

• Chang David Yu
• Benantar Messaoud
• Chang John Yow-Chun
• Venkataramappa Vishwanath

Classifications

• H04L67/42

  Electricity · mapped topic

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• G06F2221/2115

  Third party · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/0815 Primary

  providing single-sign-on or federations · CPC title