Defining an Authorizer in a Virtual Computing Infrastructure

• US 20120110636A1
• Filed: 11/17/2011
• Published: 05/03/2012
• Est. Priority Date: 06/15/2010
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: VAN BILJON, Willem Robert, Pinkham, Christopher Conway, Gorven, Michael Carl, Hardy, Alexandre, Hoole, Quinton Robin, Kalele, Girish, Cloran, Russell Andrew, Divey, Brynmor K. B.
• Granted Patent: US 9,076,168 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06Q 30/04 Billing or invoicing
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03
• CPC Class Codes: G06Q 40/10 Tax strategies
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/60 Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources admission control or resource allocation H04L47/70
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04M 15/66 Policy and charging system

Abstract

An authorizing entity is allowed to grant permission to a subject to perform an action on an object in a cloud computing environment. An authorizer is defined as the entity having granting authority to delegate a predetermined permission. A subject is defined as a group to whom the permission is being delegated. An object is defined upon which an action is authorized within the cloud computing environment. The action being authorized in the cloud computing environment is defined. Members of the subject group are authorized to perform the permitted action on the object.

Claims

1. A method of allowing an authorizing entity to grant permission to a subject to perform an action on an object in a cloud computing environment having a plurality of computing nodes, the method comprising:

defining an authorizer as the entity having granting authority to delegate a predetermined permission;

defining a subject as a group to whom the permission is being delegated;

defining an object upon which an action is authorized within the cloud computing environment;

defining the action being authorized in the cloud computing environment; and

authorizing members of the subject group to perform the permitted action on the object.

2. The method of claim 1, wherein the object is a machine image from which data is accessed.

3. The method of claim 1, wherein the object is executed code.

4. The method of claim 1, wherein the object is a data store.

5. A method of granting permission to access a cloud computing environment having a plurality of computing nodes, the method comprising:

determining a policy to which a plurality of permissions is associated;

determining a first permission associated with the policy; and

determining a second permission associated with the policy, wherein an authorizer of the second permission is compatible with at least one from a group consisting of a subject, action, or object associated with the first permission.

6. The method of claim 5, wherein the authorizer of the second permission share a same value as the subject associated with the first permission.

7. The method of claim 5, wherein the authorizer is a descendant of a subject associated with the first permission, in a naming hierarchy.

8. A cloud computing system, comprising:

a plurality of computing nodes;

at least one storage configured to store a plurality of processing instructions; and

at least one processor in communication with the at least one storage, and configure to execute instructions to;

define an authorizer as the entity having granting authority to delegate a predetermined permission;

define a subject as a group to whom the permission is being delegated;

define an object upon which an action is authorized within the cloud computing environment;

define the action being authorized in the cloud computing environment; and

authorize members of the subject group to perform the permitted action on the object.

9. The system of claim 8, wherein the object is a machine image from which data is accessed.

10. The system of claim 8, wherein the object is executed code.

11. The method of claim 8, wherein the object is a data store.

12. A cloud computing system, comprising:

a plurality of computing nodes;

at least one storage configured to store a plurality of processing instructions; and

at least one processor in communication with the at least one storage, and configure to execute instructions to;

determine a policy to which a plurality of permissions is associated;

determine a first permission associated with the policy; and

determine a second permission associated with the policy, wherein an authorizer of the second permission is compatible with at least one from a group consisting of a subject, action, or object associated with the first permission.

13. The system of claim 12, wherein the authorizer of the second permission share a same value as the subject associated with the first permission.

14. The system of claim 12, wherein the authorizer is a descendant of a subject associated with the first permission, in a naming hierarchy.