End-to-end secure cloud computing

• US 10,440,060 B2
• Filed: 09/22/2017
• Issued: 10/08/2019
• Est. Priority Date: 05/18/2010
• Status: Active Grant

• Current Assignee: Atlassian US, Inc. (Atlassian Corporation)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: de los Reyes, Gustavo, Beckett, William R., Birkes, Jerry, Chawla, Deepak K., Knight, Joshua David, Macwan, Sanjay, O'Hern, William
• Primary Examiner(s): McNally, Michael S
• Application Number:
  US15/712,626
• Publication Number:
  US 20180013797A1
• Time in Patent Office: 746 Days
• Field of Search: 726 1
• CPC Class Codes: H04L 41/5003 Managing SLA; Interaction between SLA and QoS
• CPC Class Codes: H04L 47/70 Admission control; Resource allocation
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

A method includes receiving, at a control node of a cloud computing network, a first enterprise policy specific to the first enterprise and a second enterprise policy specific to the second enterprise, and managing communications between at least one user device of the first enterprise and the at least one enterprise application hosted on behalf of the first enterprise based on the first enterprise policy. The method also includes managing communications between at least one user device of the second enterprise and the at least one enterprise application hosted on behalf of the second enterprise based on the second enterprise policy.

Claims

1. A system, comprising:

a memory that stores instructions; and

a processor that executes the instructions to perform operations, the operations comprising;

managing, by enforcing a policy of an enterprise, a communication between a thin client device of the enterprise and an application; and

configuring the thin client device to directly prevent storage of data beyond a period of interaction between the thin client device and the application, wherein the configuring of the thin client device prevents loss of the data from the enterprise via the thin client device.

2. The system of claim 1, wherein the operations further comprise identifying the application.

3. The system of claim 1, wherein the operations further comprise coordinating an installation of the application to a data center of a network.

4. The system of claim 1, wherein the operations further comprise configuring a user device associated with the thin client device to communicate with a network hosting the application.

5. The system of claim 4, wherein the operations further comprise configuring proxy information for a graphical user interface application implemented at the user device.

6. The system of claim 1, wherein the operations further comprise allocating a resource of a network for hosting the application.

7. The system of claim 6, wherein the operations further comprise allocating the resource subject to a service level agreement.

8. The system of claim 1, wherein the operations further comprise configuring the thin client device to prevent installation of non-authorized software.

9. The system of claim 1, wherein the operations further comprise configuring the thin client device to prevent execution of non-authorized software.

10. The system of claim 1, wherein the operations further comprise configuring the thin client device with a remote desktop protocol agent so as to establish a remote desktop session with the application.

11. The system of claim 1, wherein the operations further comprise modifying a packet header for traffic associated with the thin client device.

12. The system of claim 1, wherein the operations further comprise transmitting information representative of the policy to a service provider.

13. The system of claim 1, wherein the operations further comprise enforcing a security service for the communication.

14. A method, comprising:

enforcing a policy of an enterprise so as to manage a communication between a client device of the enterprise and an application; and

configuring, by utilizing instructions from a memory that are executed by a processor, the client device to directly prevent storage of data beyond a period of interaction between the client device and the application, wherein the configuring of the thin client device prevents loss of the data from the enterprise via the thin client device.

15. The method of claim 14, further comprising enforcing a security service for the communication.

16. The method of claim 14, further comprising tethering the client device to another device.

17. The method of claim 14, further comprising generating the policy.

18. The method of claim 14, further comprising routing traffic in accordance with the policy.

19. The method of claim 14, further comprising coordinating an installation of the application to a data center of a network.

20. A non-transitory computer-readable device comprising instructions, which, when loaded and executed by a processor, cause the processor to perform operations, the operations comprising:

generating a policy of an enterprise for managing a communication between a client device of the enterprise and an application; and

configuring the client device to directly prevent storage of data beyond a period of interaction between the client device and the application, wherein the configuring of the thin client device prevents loss of the data from the enterprise via the thin client device.