SYSTEM AND METHOD FOR DYNAMIC SECURITY PROVISIONING OF COMPUTING RESOURCES

• US 20050251573A1
• Filed: 09/17/2004
• Published: 11/10/2005
• Est. Priority Date: 05/06/2004
• Status: Active Grant

• Current Assignee: Liberty Peak Ventures, LLC (Dominion Harbor Enterprises, LLC)
• Original Assignee: American Express Travel Related Services Company, Inc. (American Express Company)
• Inventors: Petrone, James F., Merkow, Mark
• Granted Patent: US 7,827,294 B2
• Time in Patent Office: Days
• US Class Current: 709/226
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

The present invention facilitates the dynamic provisioning of computing and data assets in a commodity computing environment. The invention provides a system and method for dynamically provisioning and deprovisioning computing resources based on multi-dimensional decision criteria. By employing specialized computing components configured to assess an asset and requestor of an asset, a provisioning engine is able to transform the input from the computing components into a specific configuration of computing resource provisioning and security controls. According to the rules and policies applying to a security domain, the provisioning engine may dynamically allocate computing resources in a manner that is both safe and efficient for the asset.

Claims

1. A computer implemented method for dynamically provisioning computing resources, said method including:

receiving a request for computing resources, wherein said request is associated with an asset;

determining at least one of asset classification, business value and resource classification related to said asset; and

,

provisioning said computing resources based on said determining step.

2. The method of claim 1 further including determining a data classification of said asset.

3. The method of claim 1 wherein said determining asset classification further includes determining if said asset is at least one of public, business confidential, private, and secret.

4. The method of claim 1 wherein said determining business value further includes determining if said asset business value is at least one of low, medium and high.

5. The method of claim 1 wherein said determining resource classification further includes determining if said resource classification is at least one of “

trusted”

for internal entities and “

non-trusted”

for external entities.

6. The method of claim 1 further including assigning said assets to at least one of a plurality of security domains, wherein each security domain includes a different degree of security controls.

7. The method of claim 1 further including assigning said assets to at least one of a plurality of security domains, wherein each security domain includes a different degree of security controls, and further provisioning based upon said security domain placement.

8. The method of claim 1 further including assigning said assets to at least one of a plurality of security domains based on said determining step.

9. The method of claim 1 further including de-provisioning said computing resources.

10. The method of claim 1 further including de-provisioning said computing resources. when said computing resources are no longer needed by said asset.

11. The method of claim 1 further including verifying software inventory of at least one of an internal client and external client.

12. The method of claim 1 further including applying encryption to asset data based on said asset classification.

13. The method of claim 1 further including defining which processes may be suspended in the event said asset requires additional computing resources.

14. The method of claim 1 further including verifying software inventory of at least one of an internal client and external client.

15. The method of claim 1 further including storing policies regarding processing assets when computing resources are limited due to failures of at least one of software and hardware.

18. The system of claim 1 further including a server configured to communicate with at least one of an internal and external client.

19. The system of claim 1 further including a domain database configured to store domain rules and policies.

20. The system of claim 1 further including a connection manager configured to direct at least one of an internal client and external client to comply with software requirements.

21. The system of claim 1 further including a policy manager configured to apply encryption to asset data based on said asset classification.

22. The system of claim 1 further including a configuration manager configured to identify which processes may be suspended in the event an asset requires additional computing resources.

23. The system of claim 1 further including a risk manager configured to verify software inventory of at least one of an internal client and external client.

24. The system of claim 1 further including a recovery manager configured to store policies regarding processing assets when computing resources are limited due to equipment or software failure.

16. A machine-readable medium having stored thereon a plurality of instructions, said plurality of instructions when executed by a processor, cause said processor to perform a method comprising:

receiving a request for computing resources, wherein said request is associated with an asset;

determining at least one of asset classification, business value and resource classification related to said asset; and

,

provisioning said computing resources based on said determining step.

17. A system configured to facilitate dynamically provisioning computing resources, said system including a provisioning engine configured to receive a request for computing resources, wherein said request is associated with an asset, determine at least one of asset classification, business value and resource classification related to said asset based upon input from a manager component;

and, provision said computing resources based on said determining step.