CLOUD PROTECTION TECHNIQUES

• US 20130111540A1
• Filed: 10/28/2011
• Published: 05/02/2013
• Est. Priority Date: 10/28/2011
• Status: Active Grant

• Current Assignee: Micro Focus Software, Inc. (Open Text Corporation)
• Original Assignee: Novell Incorporated (Open Text Corporation)
• Inventors: Sabin, Jason Allen
• Granted Patent: US 8,789,179 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/2123 Dummy operation
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Cloud protection techniques are provided. A security breach is detected in a source cloud environment. An enterprise system processing in the source cloud environment is immediately locked down and is dynamically migrated to a target cloud environment. While the enterprise system is migrating, the source cloud environment creates a fake environment with fake resources within the source cloud environment to dupe an intruder having access as a result of the security breach. Metrics and logs are gathered with respect to activities of the intruder within the source cloud environment.

Claims

1. A method implemented in a non-transitory machine-readable storage medium and processed by one or more processors of a source server device and configured to perform the method, comprising:

identifying, by the source server device, a security intrusion to a source cloud environment;

instructing, by the source server device, a cloud protection agent to shut down an enterprise system operating within the source cloud environment;

migrating, by the source server device, the enterprise system from the source cloud environment to a target cloud environment once the cloud protection agent indicates resources of the enterprise system are ready for migration; and

creating, by the source server device, a feigned enterprise system within the source cloud environment as migration proceeds.

2. The method of claim 1 further comprising, tracking, by the source server device, actions of an intruder with respect to the feigned enterprise system within the source cloud environment.

3. The method of claim 1 further comprising, notifying, by the source server device, administrative and user resources of the enterprise system of the migration to the target cloud environment.

4. The method of claim 1, wherein identifying further includes receiving notification from a security information and event management system of a specific security event trapped that indicates the security intrusion.

5. The method of claim 4, wherein receiving further includes evaluating the security event based on a policy to determine the security intrusion.

6. The method of claim 1, wherein instructing further includes providing configuration details to the cloud protection agent for the cloud protection agent to re-install itself and auto configure itself within the target cloud environment when the migration completes.

7. The method of claim 1, wherein migrating further includes requesting that the cloud protection agent assist in migrating some or all the resources associated with the migration.

8. The method of claim 1, wherein migrating further includes configuring the resources for installation in the target cloud environment.

9. The method of claim 1, wherein migrating further includes receiving a notice from a new instance of the cloud protection agent that the enterprise system is up and running in the target cloud environment.

10. The method of claim 9, wherein receiving further includes instantiating a new instance of the method within the target cloud environment.

11. The method of claim 1 wherein creating further includes accessing a policy that defines configuration actions and environmental settings to take and to configure so as to feign the appearance of the enterprise system to the intruder.

12. The method of claim 1, wherein creating further includes trapping and tying other security events occurring with intruder actions of the intruder in a log for real time and subsequent analysis.

13. The method of claim 12, wherein creating further includes establishing fake resources and fake network traffic within the feigned enterprise system to entice some of the intruder actions of the intruder within the source cloud environment.

14. A method implemented in a non-transitory machine-readable storage medium and processed by one or more processors of a target sever device configured to perform the method, comprising:

detecting, at the target service device, an instruction to initiate within a target cloud environment;

self configuring, by the target server device, the method for processing based on configuration settings accessible to the method and set from a prior instance of the method;

configuring, by the target server device, resources for an enterprise system based on configuration data; and

initiating, by the target server device, the resources to establish the enterprise system within the target cloud environment, the enterprise system representing another instance of the enterprise system that was migrated from a source cloud environment based on an identified security threat by a cloud protection manager.

15. The method of claim 14 further comprising, receiving, via a source server device, an indication from the cloud protection manager to prepare the enterprise system within the source cloud environment for migration to the target cloud environment, actions taken by the method are by a prior instance of the method and before a current instance of the method processes.

16. The method of claim 15, wherein receiving further includes configuring the resources for the enterprise system based on specific configuration details provided by the cloud protection manager.

17. The method of claim 14 further comprising, notifying, by the target server device, the cloud protection manager that the enterprise system is up and running and accessible from the target cloud environment.

18. The method of claim 14 further comprising, instantiating, by the target server device, a new instance of the cloud protection manager within the target cloud environment, the new instance of the cloud protection manager configured to communicate with the cloud protection manager of the source cloud environment.

19. A system, comprising:

a processor configured with a cloud protection manager that resides and is implemented within a non-transitory computer-readable storage medium and that executes on a source server device; and

another processor configured with a cloud protection agent that resides and is implemented within a non-transitory computer-readable storage medium and that executes on a target server device;

the cloud protection manager configured to detect a security threat in a source cloud environment and begin migration of an enterprise system to a target cloud environment, the cloud protection manager also configured to create a fake enterprise system within the source cloud environment and track actions taken by an intruder within the source cloud environment, and the cloud protection agent configured to assist in migrating the enterprise system and to install the enterprise system within the target cloud environment, and the cloud protection agent configured to notify the cloud protection manager once the enterprise system is up and running within the target cloud environment.

20. The system of claim 19, wherein the enterprise system is migrated as a virtual machine that processes within the target cloud environment.