End-To-End Secure Cloud Computing

• US 20110289134A1
• Filed: 05/18/2010
• Published: 11/24/2011
• Est. Priority Date: 05/18/2010
• Status: Active Grant

• Current Assignee: Atlassian US, Inc. (Atlassian Corporation)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Knight, Joshua David, Becket, William R. III, Macwan, Sanjay, de los Reyes, Gustavo, Chawla, Deepak K., O'Hern, William, Birkes, Jerry
• Granted Patent: US 8,856,300 B2
• Time in Patent Office: Days
• US Class Current: 709/203
• CPC Class Codes: H04L 41/5003 Managing SLA; Interaction between SLA and QoS
• CPC Class Codes: H04L 47/70 Admission control; Resource allocation
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

A method includes receiving, at a control node of a cloud computing network, a first enterprise policy specific to the first enterprise and a second enterprise policy specific to the second enterprise, and managing communications between at least one user device of the first enterprise and the at least one enterprise application hosted on behalf of the first enterprise based on the first enterprise policy. The method also includes managing communications between at least one user device of the second enterprise and the at least one enterprise application hosted on behalf of the second enterprise based on the second enterprise policy.

Claims

1. In a cloud computing network hosting at least one enterprise application on behalf of a first enterprise and hosting at least one enterprise application on behalf of a second enterprise, a method comprising:

receiving, at a control node of the cloud computing network, a first enterprise policy specific to the first enterprise and a second enterprise policy specific to the second enterprise, the first enterprise policy representing security and access policies for the first enterprise and the second enterprise policy representing security and access policies for the second enterprise;

managing, at the control node, communications between at least one user device of the first enterprise and the at least one enterprise application hosted on behalf of the first enterprise based on the first enterprise policy; and

managing, at the control node, communications between at least one user device of the second enterprise and the at least one enterprise application hosted on behalf of the second enterprise based on the second enterprise policy.

2. The method of claim 1, further comprising:

managing, at the control node, communications between the at least one user device of the first enterprise and a public network based on the first enterprise policy.

3. The method of claim 1, wherein:

managing communications comprises providing, via the control node, at least one security service for communications between at least one user device of the first enterprise and the at least one enterprise application hosted on behalf of the first enterprise in accordance with the first enterprise policy.

4. The method of claim 3, wherein the at least one security service comprises at least one of:

authentication for access to an enterprise application executed at the cloud computing network;

packet filtering;

application layer filtering;

traffic routing;

traffic proxying;

traffic encryption;

traffic decryption; and

network address translation.

5. The method of claim 1, wherein the at least one user device of the first enterprise comprises a thin client device configured to operate as a graphical user interface for the at least one enterprise application hosted on behalf of the first enterprise.

6. The method of claim 5, further comprising:

configuring a select user device associated with the first enterprise as a conduit for communications between the thin client device and the at least one enterprise application hosted on behalf of the first enterprise.

7. The method of claim 6, wherein the select user device comprises a mobile device tethered to the thin client device.

8. A method comprising:

configuring a first set of user devices for use by a first enterprise to interface with at least one enterprise application hosted at a cloud computing network on behalf of the first enterprise, the cloud computing network managed by a service provider;

determining a first enterprise policy representing access and security policies specific to the first enterprise; and

providing the first enterprise policy to the service provider for use in managing communications between the first set of user devices and the at least one enterprise application hosted at the cloud computing network.

9. The method of claim 8, further comprising:

managing, at the cloud computing network, communications between the first set of user devices and the at least one enterprise application based on the first enterprise policy.

10. The method of claim 9, further comprising:

hosting at least one enterprise application at the cloud computing network on behalf of a second enterprise; and

managing, at the cloud computing network, communications between a second set of user devices of the second enterprise and the at least one enterprise application hosted on behalf of the second enterprise based on a second enterprise policy representing security and access policies specific to the second enterprise.

11. The method of claim 8, wherein configuring the first set of user devices comprises:

configuring a thin client device to prevent continued retention of data from an interaction with an enterprise application after the interaction has ended.

12. The method of claim 11, wherein configuring the first set of user devices further comprises:

configuring a user device as a conduit for communications between the thin client device and the at least one enterprise application hosted on behalf of the first enterprise.

13. The method of claim 12, wherein the user device comprises a mobile device tethered to the thin client device.

14. A cloud computing network managed by a service provider, the cloud computing network comprising:

at least one data center to host enterprise applications on behalf of a plurality of enterprises;

a policy database to store data representative of enterprise policies for the plurality of enterprises, each enterprise policy representing access and security policies specific to a corresponding enterprise; and

a control node to manage communications between at least one user device of an enterprise and at least one enterprise application hosted at the at least one data center on behalf of the enterprise based on the corresponding enterprise policy.

15. The network of claim 14, wherein the control node manages communications by providing at least one security service for communications between the at least one user device and the at least one enterprise application in accordance with the corresponding enterprise policy.

16. The network of claim 15, wherein the at least one security service comprises at least one of:

authentication and access control;

packet filtering;

application layer filtering;

email filtering;

uniform resource locator (URL) filtering;

traffic routing;

traffic proxying;

traffic encryption;

traffic decryption; and

network address translation.

17. The network of claim 14, further comprising:

the at least one user device of the enterprise.

18. The network of claim 17, wherein the at least one user device comprises a select user device operating as a conduit for communications between a thin client device associated with the enterprise and the at least one enterprise application hosted on behalf of the enterprise.

19. The network of claim 18, wherein the select user device comprises a computation-enabled mobile telephony device tethered to the thin client device.

20. The network of claim 18, wherein the thin client device is configured to prevent continued retention of data from an interaction with an enterprise application after the interaction has ended.