Granting Access to a Cloud Computing Environment Using Names in a Virtual Computing Infrastructure

• US 20120110651A1
• Filed: 11/17/2011
• Published: 05/03/2012
• Est. Priority Date: 06/15/2010
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Van Biljon, Willem Robert, Pinkham, Christopher Conway, Cloran, Russell Andrew, Gorven, Michael Carl, Hardy, Alexandre, Divey, Brynmor K.B., Hoole, Quinton Robin, Kalele, Girish
• Granted Patent: US 9,218,616 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06Q 30/04 Billing or invoicing
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03
• CPC Class Codes: G06Q 40/10 Tax strategies
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/60 Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources admission control or resource allocation H04L47/70
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04M 15/66 Policy and charging system

Abstract

Access to resources in a cloud computing environment having a plurality of computing nodes is described. A group of users is defined within the cloud computing environment. A first name is assigned to the group. At least one subgroup of users is defined from within the group. A second name is assigned to the at least one subgroup. The second name follows a hierarchical naming structure of the form/group/subgroup.

Claims

1. A method of granting access to resources in a cloud computing environment having a plurality of computing nodes, the method comprising:

defining a group of users within the cloud computing environment;

assigning a first name to the group;

defining at least one subgroup of users from within the group; and

assigning a second name to the at least one subgroup, the second name following a hierarchical naming structure of the form/group/subgroup.

2. The method of claim 1, further comprising

defining at least a sub-subgroup of users from within the subgroup;

and

assigning a third name to the sub-subgroup, the third name following a hierarchical naming structure of the form/group/subgroup/sub-subgroup.

3. The method of claim 1, further comprising:

defining a plurality of subgroups of users derived from the group of users, each subgroup in the plurality of subgroups being derived from another subgroup of users in the plurality of subgroups, the plurality of subgroups being organized in a hierarchy; and

assigning a plurality of names to each of the plurality of subgroups, each of the subgroups named in a hierarchical order.

4. A method of granting access to resources in a cloud computing environment having a plurality of computing nodes, the method comprising:

defining a first group of users and a second group of users within the cloud computing environment;

associating the first group of users with a name in the form x/first name;

associating the second group of users with a name in the form y/first name;

granting access to at least one cloud resource from a first set of resources based on the first name in the form x/first name; and

granting access to at least one cloud resource from a second set of resources based on the first name in the form y/first name.

5. The method of claim 4, further comprising:

defining at least one subgroup from within the first group and at least one subgroup from within the second group;

associating the subgroup from within the first group with a name in the form x/first name/second name;

associating the subgroup from within the second group with a name in the form y/first name/second name;

granting access to at least one cloud resource from a first set of resources based on the name in the form x/first name/second name; and

granting access to at least one cloud resource from a second set of resources based on the name in the form y/first name/second name.

6. A method of granting access to resources in a cloud computing environment having a plurality of computing nodes, the method comprising:

defining a group of users within the cloud computing environment;

associating with group of users a first set of permissions or privileges;

defining at least one subgroup of users from within the group;

associating with the at least one subgroup of users a second set of permissions or privileges in addition to the first set of permissions or privileges inherited from the group;

granting access to at least one cloud resource from a first set of resources based on the group of users; and

granting access to at least one cloud resource from the first set of resources and a second set of resources to the at least one subgroup of users.

7. The method of claim 6, further comprising:

defining at least a sub-subgroup of users from within the subgroup;

associating with the sub-sub group a third set of permissions or privileges in addition to the first and second set of permissions or privileges; and

granting access to at least one cloud resource from the first set of resources, the second set of resources and a third set of resources to the sub-sub group.

8. The method of claim 6, further comprising:

partitioning the plurality of permissions or privileges into a plurality of subsets of permissions or privileges, the plurality of subsets of permissions or privileges being organized in a hierarchy wherein each iteration of partitioning the plurality of permissions or privileges is derived from a prior subset; and

associating each subset of permissions or privileges from the plurality of subsets to a group of users, wherein the groups of users are partitioned and organized according to the hierarchy, wherein each partitioned group of users, in addition to its own subset of permissions or privileges, inherits the subset of permissions or privileges from the prior group of users.

9. A cloud computing system, comprising:

a plurality of computing nodes;

at least one storage configured to store a plurality of processing instructions; and

at least one processor in communication with the at least one storage, and configure to execute instructions to;

define a group of users within the cloud computing environment;

assign a first name to the group;

define at least one subgroup of users from within the group; and

assign a second name to the at least one subgroup, the second name following a hierarchical naming structure of the form/group/subgroup.

10. The system of claim 9, wherein the at least one processor is further configured to execute instructions to:

define at least a sub-subgroup of users from within the subgroup; and

assign a third name to the sub-subgroup, the third name following a hierarchical naming structure of the form/group/subgroup/sub-subgroup.

11. The system of claim 9, wherein the at least one processor is further configured to execute instructions to:

define a plurality of subgroups of users derived from the group of users, each subgroup in the plurality of subgroups being derived from another subgroup of users in the plurality of subgroups, the plurality of subgroups being organized in a hierarchy; and

assign a plurality of names to each of the plurality of subgroups, each of the subgroups named in a hierarchical order.

12. A cloud computing system, comprising:

a plurality of computing nodes;

at least one storage configured to store a plurality of processing instructions; and

at least one processor in communication with the at least one storage, and configure to execute instructions to;

define a first group of users and a second group of users within the cloud computing environment;

associate the first group of users with a name in the form x/first name;

associate the second group of users with a name in the form y/first name;

grant access to at least one cloud resource from a first set of resources based on the first name in the form x/first name; and

grant access to at least one cloud resource from a second set of resources based on the first name in the form y/first name.

13. The system of claim 12, wherein the at least one processor is further configured to execute instructions to:

define at least one subgroup from within the first group and at least one subgroup from within the second group;

associate the subgroup from within the first group with a name in the form x/first name/second name;

associate the subgroup from within the second group with a name in the form y/first name/second name;

grant access to at least one cloud resource from a first set of resources based on the name in the form x/first name/second name; and

grant access to at least one cloud resource from a second set of resources based on the name in the form y/first name/second name.

14. A cloud computing system, comprising:

a plurality of computing nodes;

at least one storage configured to store a plurality of processing instructions; and

at least one processor in communication with the at least one storage, and configure to execute instructions to;

define a group of users within the cloud computing environment;

associate with group of users a first set of permissions or privileges;

define at least one subgroup of users from within the group;

associate with the at least one subgroup of users a second set of permissions or privileges in addition to the first set of permissions or privileges inherited from the group;

grant access to at least one cloud resource from a first set of resources based on the group of users; and

grant access to at least one cloud resource from the first set of resources and a second set of resources to the at least one subgroup of users.

15. The system of claim 14, wherein the at least one processor is further configured to execute instructions to:

define at least a sub-subgroup of users from within the subgroup;

associate with the sub-sub group a third set of permissions or privileges in addition to the first and second set of permissions or privileges; and

grant access to at least one cloud resource from the first set of resources, the second set of resources and a third set of resources to the sub-sub group.

16. The system of claim 14, wherein the at least one processor is further configured to execute instructions to:

partition the plurality of permissions or privileges into a plurality of subsets of permissions or privileges, the plurality of subsets of permissions or privileges being organized in a hierarchy wherein each iteration of partitioning the plurality of permissions or privileges is derived from a prior subset; and

associate each subset of permissions or privileges from the plurality of subsets to a group of users, wherein the groups of users are partitioned and organized according to the hierarchy, wherein each partitioned group of users, in addition to its own subset of permissions or privileges, inherits the subset of permissions or privileges from the prior group of users.