SECURING INFORMATION WITHIN A CLOUD COMPUTING ENVIRONMENT

• US 20110264907A1
• Filed: 04/27/2010
• Published: 10/27/2011
• Est. Priority Date: 04/27/2010
• Status: Active Grant

• Current Assignee: Kyndryl Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Merrill, David P., Lingafelt, Charles S., Betz, Linda N., Ho, Wesley J.
• Granted Patent: US 8,826,001 B2
• Time in Patent Office: Days
• US Class Current: 713/153
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Embodiments of the invention provide a solution for securing information within a Cloud computing environment. Specifically, an encryption service/gateway is provided to handle encryption/decryption of information for all users in the Cloud computing environment. Typically, the encryption service is implemented between Cloud portals and a storage Cloud. Through the use of a browser/portal plug-in (or the like), the configuration and processing of the security process is managed for the Cloud computing environment user by pointing all traffic for which security is desired to this encryption service so that it can perform encryption (or decryption in the case of document retrieval) as needed (e.g., on the fly) between the user and the Cloud.

Claims

1. A method for securing information within a Cloud computing environment, comprising:

receiving a communication containing information to be secured from an endpoint at a central encryption service;

encrypting the information at the central encryption service; and

communicating the encrypted information to a Cloud storage system from the central encryption service.

2. The method of claim 1, the information comprising an electronic document.

3. The method of claim 1, the endpoint being a browser.

4. The method of claim 1, the endpoint, the central encryption service, and the Cloud storage system comprising at least three distinct systems, the central encryption service being implemented by a trusted third party entity.

5. The method of claim 1, further comprising:

receiving a request for the information from the endpoint on the central encryption service;

receiving the information from the Cloud storage system on the central encryption service;

decrypting the information on the central encryption service; and

communicating the decrypted information to the endpoint in fulfillment of the request.

6. The method of claim 5, further comprising receiving a set of encryption keys, the encrypting comprising encrypting the information at the central encryption service using the set of encryption keys, and the decrypting comprising decrypting the information at the central encryption service using the set of encryption keys.

7. A system for securing information within a Cloud computing environment, comprising:

a memory medium comprising instructions;

a bus coupled to the memory medium; and

a processor coupled to the bus that when executing the instructions causes the system to;

receive a communication containing information to be secured from an endpoint at a central encryption service;

encrypt the information at the central encryption service; and

communicate the encrypted information to a Cloud storage system from the central encryption service.

8. The system of claim 7, the information comprising an electronic document.

9. The system of claim 7, the endpoint being a browser.

10. The system of claim 7, the endpoint, the central encryption service, and the Cloud storage system comprising at least three distinct systems.

11. The system of claim 7, the system further being caused to:

receive a request for the information from the endpoint on the central encryption service;

receive the information from the Cloud storage system on the central encryption service;

decrypt the information on the central encryption service; and

communicate the decrypted information to the endpoint in fulfillment of the request.

12. The system of claim 11, the system further being caused to receive a set of encryption keys, the system further being caused to encrypt the information at the central encryption service using the set of encryption keys, and decrypt the information at the central encryption service using the set of encryption keys.

13. A computer readable medium containing a program product for securing information within a Cloud computing environment, the computer readable medium comprising program code for causing a computer to:

receive a communication containing information to be secured from an endpoint at a central encryption service;

encrypt the information at the central encryption service; and

communicate the encrypted information to a Cloud storage system from the central encryption service.

14. The computer readable medium containing the program product of claim 13, the information comprising an electronic document.

15. The computer readable medium containing the program product of claim 13, the endpoint being a browser.

16. The computer readable medium containing the program product of claim 13, the endpoint, the central encryption service, and the Cloud storage system comprising at least three distinct systems.

17. The computer readable medium containing the program product of claim 13, the computer readable medium further comprising program code for causing the computer to:

receive a request for the information from the endpoint on the central encryption service;

receive the information from the Cloud storage system on the central encryption service;

decrypt the information on the central encryption service; and

communicate the decrypted information to the endpoint in fulfillment of the request.

18. The computer readable medium containing the program product of claim 17, the system further being caused to receive a set of encryption keys, the system further being caused to encrypt the information at the central encryption service using the set of encryption keys, and decrypt the information at the central encryption service using the set of encryption keys.

19. A method for deploying an application for securing information within a Cloud computing environment, comprising:

providing a computer infrastructure being operable to;

receive a communication containing information to be secured from an endpoint at a central encryption service;

encrypt the information at the central encryption service; and

communicate the encrypted information to a Cloud storage system from the central encryption service.

20. A method for securing information within a Cloud computing environment, comprising:

receiving a communication containing information to be secured from an endpoint at a central encryption service;

encrypting the information at the central encryption service;

communicating the encrypted information to the endpoint from the central encryption service; and

communicating the encrypted information from the endpoint to a Cloud storage system for storage.

21. The method of claim 20, the information comprising an electronic document, and the endpoint being a browser.

22. The method of claim 20, the endpoint, the central encryption service, and the Cloud storage system comprising at least three distinct systems.

23. The method of claim 20, further comprising:

receiving the encrypted information from the Cloud storage system at the endpoint;

communicating the encrypted information to the central encryption service;

decrypting the information on the central encryption service; and

communicating the decrypted information to the endpoint from the central encryption service.

24. A system for securing information within a Cloud computing environment, comprising:

a memory medium comprising instructions;

a bus coupled to the memory medium; and

a processor coupled to the bus that when executing the instructions caused the system to;

receive a communication containing information to be secured from an endpoint at a central encryption service;

encrypt the information at the central encryption service;

communicate the encrypted information to the endpoint from the central encryption service; and

communicate the encrypted information from the endpoint to a Cloud storage system for storage.

25. The system of claim 24, the information comprising an electronic document, and the endpoint being a browser.

26. The system of claim 24, the endpoint, the central encryption service, and he Cloud storage system comprising at least three distinct systems.

27. The system of claim 24, the system further being caused to:

receive the encrypted information from the Cloud storage system at the endpoint;

communicate the encrypted information to the central encryption service;

decrypt the information on the central encryption service; and

communicate the decrypted information to the endpoint from the central encryption service.

28. A computer readable medium containing a program product for securing information within a Cloud computing environment, the computer readable medium comprising program code for causing a computer to:

receive a communication containing information to be secured from an endpoint at a central encryption service;

encrypt the information at the central encryption service;

communicate the encrypted information to the endpoint from the central encryption service; and

communicate the encrypted information from the endpoint to a Cloud storage system for storage.

30. The computer readable medium containing a program product of claim 30, the endpoint, the central encryption service, and the Cloud storage system comprising at least three distinct systems

29. The computer readable medium containing a program product of claim 30, the information comprising an electronic document, and the endpoint being a browser.

31. The computer readable medium containing a program product of claim 30, the computer readable medium further comprising program code for causing the computer to:

receive the encrypted information from the Cloud storage computer readable medium containing a program product at the endpoint;

communicate the encrypted information to the central encryption service;

decrypt the information on the central encryption service; and

communicate the decrypted information to the endpoint from the central encryption service.

33. A method for deploying an application for securing information within a Cloud computing environment, comprising:

providing a computer infrastructure being operable to;

receive a communication containing information to be secured from an endpoint at a central encryption service;

encrypt the information at the central encryption service;

communicate the encrypted information to the endpoint from the central encryption service; and

communicate the encrypted information from the endpoint to a Cloud storage system for storage.