Context-based cloud security assurance system

Patent metadata

Field	Value
Publication number	US-9838431-B2
Application number	US-201414555739-A
Country	US
Kind code	B2
Filing date	Nov 28, 2014
Priority date	Nov 28, 2014
Publication date	Dec 5, 2017
Grant date	Dec 5, 2017

Abstract

A cloud infrastructure is enhanced to provide a context-based security assurance service to enable secure application deployment. The service inspects network and cloud topologies to identify potential security capabilities and needs. Preferably, these options are then surfaced to the user with easy-to-understand, pre-configured templates representing security assurance levels. When a template (e.g., representing a pre-configured assurance level) is selected by the user, the system then applies specific capabilities and controls to translate the user-selected generalized specification (e.g., “high security”) into granular requirements for a specific set of security resources. Preferably, the identification of these security resources is based on system configuration, administration, and information associated with the pre-configured template.

First claim

Having described our invention, what we now claim is as follows:

1. A method for improving a cloud application deployment service operative in a cloud application environment, comprising:
receiving information on a set of security capabilities available in the cloud application environment to define a security context, the security capabilities including identification of at least one security product or its current security settings;
receiving a selection of a security assurance level, wherein the security assurance level is specified in a template by a set of general security requirements, at least one of the set of general security requirements being specified in a manner that does not expose at least some specific security resource requirements necessary to implement the security assurance level, the template including an interface to enable receipt of an instruction to wire a security capability into an application being deployed by the cloud application deployment service;
for a given security assurance level, mapping the at least one of the set of general security requirements being specified to the identification of the at least one security product or its current security settings; and
responsive to receipt of the selection of the security assurance level that includes the mapping, and based at least in part on the security context, applying, via automation, configuration changes to a set of security resources in the cloud application environment to provide a context-based security assurance zone for the application being deployed by the cloud application deployment service, the configuration changes installing the at least one security product or adjusting its current security settings, and enforcing a wiring instruction as specified in the template, wherein enforcing the wiring instruction enforces a wiring restriction between a first security resource and a second security resource in response to receipt of an instruction to wire the security capability;
wherein the receiving and configuring steps are carried out in software executing in a hardware element.

2. The method as described in claim 1 further including providing a set of templates, each template having associated therewith one of the security assurance levels, and wherein the selection of the security assurance level corresponds to selection of a template.

3. The method as described in claim 2 wherein the set of templates are provided to an end user via user interface tooling associated with the cloud application environment, wherein receipt of the selection corresponds to a selection by the end user via the user interface tooling.

4. The method as described in claim 2 wherein the templates are provided to a security administrator via an administrative interface.

5. The method as described in claim 4 further including adjusting the set of security requirements associated with a template via the administrative interface.

6. The method as described in claim 1 wherein the method further includes adjusting the set of security resources configured.

7. The method as described in claim 6 wherein the adjusting occurs upon one of: de-configuration of a security environment when an application is un-deployed, modification of a security environment for a first application when a second application is deployed, and modification of a security environment for a first application when a second application having a higher security level than that of the first application is de-configured.

8. Apparatus, comprising:
a processor;
computer memory holding computer program instructions executed by the processor to improve a cloud application deployment service operative in a cloud application environment, the computer program instructions comprising:
program code, operative to receive information on a set of security capabilities available in the cloud application environment, to define a security context, the security capabilities including identification of at least one security product or its current security settings;
program code, operative to receive a selection of a security assurance level, wherein the security assurance level is specified in a template by a set of general security requirements, at least one of the set of general security requirements being specified in a manner that does not expose at least some specific security resource requirements necessary to implement the security assurance level, the template including an interface to enable receipt of an instruction to wire a security capability into an application being deployed by the cloud application deployment service;

program code, operative for a given security assurance level, to map the at least one of the set of general security requirements being specified to the identification of the at least one security product or its current security settings; and
program code, responsive to receipt of the selection of the security assurance level that includes the mapping, and based at least in part on the security context, to apply, via automation, configuration changes to a set of security resources in the cloud application environment to provide a context-based security assurance zone for the application being deployed by the cloud application deployment service, the configuration changes installing the at least one security product or adjusting its current security settings, and enforcing any a wiring instruction as specified in the template, wherein enforcing the wiring instruction enforces a wiring restriction between a first security resource and a second security resource in response to receipt of an instruction to wire the security capability.

9. The apparatus as described in claim 8 wherein the computer program instructions further include program code to provide a set of templates, each template having associated therewith one of the security assurance levels, and wherein the selection of the security assurance level corresponds to selection of a template.

10. The apparatus as described in claim 9 wherein the set of templates are provided to an end user via user interface tooling associated with the cloud application environment, wherein receipt of the selection corresponds to a selection by the end user via the user interface tooling.

11. The apparatus as described in claim 9 further including an administrative interface, and wherein the templates are provided to a security administrator via the administrative interface.

12. The apparatus as described in claim 11 wherein the computer program instructions further include program code to adjust the set of security requirements associated with a template via the administrative interface.

13. The apparatus as described in claim 8 further including program code operative to adjust the set of security resources configured.

14. The apparatus as described in claim 13 wherein the adjusting occurs upon one of: de-configuration of a security environment when an application is un-deployed, modification of a security environment for a first application when a second application is deployed, and modification of a security environment for a first application when a second application having a higher security level than that of the first application is de-configured.

15. A computer program product in a non-transitory computer readable medium for use in a data processing system, the computer program product holding computer program instructions executed by the data processing system to improve a cloud application deployment service operative in a cloud application environment, the computer program instructions comprising:
program code, operativ

Assignees

• IBM

Inventors

• Nagaratnam Nataraj
• Hoy Jeffrey Robert
• Iyer Sreekanth Ramakrishna
• Muppidi Sridhar R

Classifications

• H04W12/06

  Authentication · CPC title

• H04L12/08

  Allotting numbers to messages; Counting characters, words or messages · CPC title

• H04L41/0893

  Assignment of logical groups to network elements · CPC title

• G06F21/57

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• H04L41/5054

  Automatic deployment of services triggered by the service manager, e.g. service implementation by automatic configuration of network components · CPC title