Efficient cloud resource protection

• US 10,742,629 B2
• Filed: 02/28/2017
• Issued: 08/11/2020
• Est. Priority Date: 02/28/2017
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Krauss, Kirk J.
• Primary Examiner(s): Williams, Jeffery L
• Application Number:
  US15/445,937
• Publication Number:
  US 20180248882A1
• Time in Patent Office: 1,260 Days
• Field of Search: None
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 9/445 Program loading or initiating bootstrapping G06F9/4401; security arrangements for program loading or initiating G06F21/57
• CPC Class Codes: G06F 9/5027 the resource being a machine, e.g. CPUs, Servers, Terminals
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

A cloud resource protection method, system, and computer program product include authenticating a user on a first computer that is part of a distributed system, based on the authentication, assigning to the user, on the first computer, a token indicating a set of permissions, receiving a directive from the user to initiate, via the first computer, the execution of a process associated with a class, based on the token, initiating, on a second computer, the execution of the process, with no further authentication, granting the process access to a data set, access to which is restricted to one or more of the plurality of classes, and providing a data item from the data set to the user.

Claims

1. A computer-implemented cloud resource protection method performed in a cloud-computing environment, the method comprising:

authenticating a user on a first computer that is part of a distributed system;

based on the authentication, assigning to the user, on the first computer, a data structure indicating a set of permissions;

receiving a directive from the user to initiate, via the first computer, an execution of a process associated with a first class, wherein the first class is one of a plurality of classes and is associated with one or more permissions of the set of permissions;

based on the data structure, initiating, on a second computer, the execution of the process;

with no further authentication, controlling access by granting the process access to a data set, access to which is restricted to one or more classes of the plurality of classes, wherein the one or more classes of the plurality of classes includes the first class associated with the process;

providing a data item from the data set to the user;

while the process runs, dynamically assigning the process to the process class based on one of;

a loadable module that is loaded by an application;

a service accessed by the application;

or

data used by the application; and

assigning a process to the first class, such that via a class-based access control policy, the process assigned to the first class accessing the data of the class is controlled, on demand,

further comprising;

with no further authentication, migrating the process from the second computer to a third computer; and

with no further authentication, providing a further data item from the data set to the user, and

an abstraction component, embodied in the cloud computing environment, that facilitates the migration such that if any virtual memory regions belonging to the process being migrated cannot be placed in their prior address ranges, then any pointers to those regions are updated throughout the virtual memory at migration time.

2. The computer-implemented method of claim 1, further comprising, with further authentication, granting the process access to another data set, access to which is restricted via controls.

3. The computer-implemented method of claim 1, further comprising:

further authenticating a second user;

based on the further authentication, assigning to the second user a further data structure indicating a further set of permissions;

receiving a directive from the second user to initiate an execution of a further process of a second class associated with a further one or more permissions of the further set of permissions;

based on the further data structure, initiating the execution of the further process;

with no further authentication, granting the further process access to the data set; and

providing a data item from the data set to the second user.

4. The computer-implemented method of claim 3, wherein the one or more classes of the plurality of classes includes the second class.

11. The computer-implemented method of claim 1, wherein the providing provides the data item from the data set to the user via the second computer in the distributed system.

12. The computer-implemented method of claim 1, wherein, with no further authentication, the granting grants the process access to the data set via the second computer in the distributed system.

13. The computer-implemented method of claim 1, wherein the migrating migrates the process from the second computer to the third computer without migrating the virtual machine.

5. A computer program product for cloud resource protection embodied in a cloud computing environment, the computer program product comprising a computer-readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform:

authenticating a user on a first computer that is part of a distributed system;

based on the authentication, assigning to the user, on the first computer, a data structure indicating a set of permissions;

receiving a directive from the user to initiate, via the first computer, an execution of a process associated with a first class, wherein the first class is one of a plurality of classes and is associated with one or more permissions of the set of permissions;

based on the data structure, initiating, on a second computer, the execution of the process;

with no further authentication, controlling access by granting the process access to a data set, access to which is restricted to one or more classes of the plurality of classes, wherein the one or more classes of the plurality of classes includes the first class associated with the process;

providing a data item from the data set to the user;

while the process runs, dynamically assigning the process to the process class based on one of;

a loadable module that is loaded by an application;

a service accessed by the application;

or

data used by the application; and

assigning a process to the first class, such that via a class-based access control policy, the process assigned to the first class accessing the data of the class is controlled, on demand,

further comprising;

with no further authentication, migrating the process from the second computer to a third computer; and

with no further authentication, providing a further data item from the data set to the user, and

an abstraction component, embodied in the cloud computing environment, that facilitates the migrating such that if any virtual memory regions belonging to the process being migrated cannot be placed in their prior address ranges, then any pointers to those regions are updated throughout the virtual memory at migration time.

6. The computer program product of claim 5, further comprising, with further authentication, granting the process access to another data set, access to which is restricted via controls.

7. The computer program product of claim 5, further comprising:

further authenticating a second user;

based on the further authentication, assigning to the second user a further data structure indicating a further set of permissions;

receiving a directive from the second user to initiate an execution of a further process of a second class associated with a further one or more permissions of the further set of permissions;

based on the further data structure, initiating the execution of the further process;

with no further authentication, granting the further process access to the data set; and

providing a data item from the data set to the second user.

8. The computer program product of claim 7, wherein the one or more classes of the plurality of classes includes the second class.

9. A cloud resource protection system embodied in a cloud computing environment, said system comprising:

a processor; and

a memory, the memory storing instructions to cause the processor to perform;

authenticating a user on a first computer that is part of a distributed system;

based on the authentication, assigning to the user, on the first computer, a data structure indicating a set of permissions;

receiving a directive from the user to initiate, via the first computer, an execution of a process associated with a first class, wherein the first class is one of a plurality of classes and is associated with one or more permissions of the set of permissions;

based on the data structure, initiating, on a second computer, the execution of the process;

with no further authentication, controlling access by granting the process access to a data set, access to which is restricted to one or more classes of the plurality of classes, wherein the one or more classes of the plurality of classes includes the first class associated with the process;

providing a data item from the data set to the user;

while the process runs, dynamically assigning the process to the process class based on one of;

a loadable module that is loaded by an application;

a service accessed by the application;

or

data used by the application; and

assigning a process to the first class, such that via a class-based access control policy, the process assigned to the first class accessing the data of the class is controlled, on demand,

further comprising;

with no further authentication, migrating the process from the second computer to a third computer; and

with no further authentication;

providing a further data item from the data set to the user, and

an abstraction component, embodied in the cloud computing environment, that facilitates the migrating such that if any virtual memory regions belonging to the process being migrated cannot be placed in their prior address ranges, then any pointers to those regions are updated throughout the virtual memory at migration time.

10. The system of claim 9, further comprising, with further authentication, granting the process access to another data set, access to which is restricted via controls.