SAFEMASHUPS CLOUD TRUST BROKER

• US 20110047381A1
• Filed: 08/20/2010
• Published: 02/24/2011
• Est. Priority Date: 08/21/2009
• Status: Abandoned Application

• Current Assignee: Board of Regents of the University of Texas System (University of Texas System)
• Original Assignee: Board of Regents of the University of Texas System (University of Texas System)
• Inventors: GANESAN, Ravi, Wolff, Todd
• Application Number:
  US12/859,986
• Publication Number:
  US 20110047381A1
• Time in Patent Office: Days
• US Class Current: 713/169
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 69/32 Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level
• CPC Class Codes: H04L 69/321 Interlayer communication protocols or service data unit [SDU] definitions; Interfaces between layers
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869

Abstract

The present invention provides a new method for policy enforcement in a virtualized or cloud environment. We break down the environment into layers, which are further sub-divided into security units. Each security unit has a security profile based on its own security properties and those of the layers below. The security profile also reflects the floor, ceiling and wall security properties. Each security unit has an agent which is used to establish communications with other security units. Such communication is mediated by a cloud trust broker which determines if the communication is permitted based on access control list or else retrieves the security profiles and applies pre-defined rules. If the communications are allowed the cloud trust broker runs a mutual authentication and key distribution protocol that results in the two security units obtaining a session key which they can then use for further communications which can proceed directly.

Claims

1. A method for enforcing security policies in a virtualized or cloud environment wherein:

a) the infrastructure is divided into layers encompassing physical facilities, hardware, virtualization, guest operating system, applications, user desktop and browser;

b) each layer is divided into security units;

c) each security unit contains security profiles with attestations about the security of the said unit, including attestations about the floor, ceiling and wall security properties;

d) each security unit has an agent that can be used to establish communications with other security units for the transfer of data or processing; and

e) a cloud trust broker is present to mediate such communications.

2. A method according to claim 1 wherein

a. when a first security unit wishes to communicate to a second security unit, it initiates a connection to the cloud trust broker;

b. which examines an access control list and determines if such communications are permissible, and if permissible;

c. runs a mutual authentication and key distribution protocol between the two security units;

d. resulting in the two security units obtaining a shared session key for further communications.

3. A method according to claim 2 wherein instead of consulting an access control list, the cloud trust broker retrieves the security profiles of both security units and makes a determination of whether communication is permissible based on a set of rules.