SYSTEM AND METHOD FOR SUPPORTING SECURE APPLICATION DEPLOYMENT IN A CLOUD

• US 20130191539A1
• Filed: 01/23/2012
• Published: 07/25/2013
• Est. Priority Date: 01/23/2012
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Sailer, Anca, Sahu, Sambit, Shaikh, Hidayatullah
• Granted Patent: US 8,984,132 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416

Abstract

A method of securely deploying a software application in the Internet cloud including identifying those aspects of a software application that use secure data, and those aspects of the application that use non-secure data, deploying the secure data on one or more secure servers that are not publicly accessible over the Internet, and deploying non-secure data on one or more cloud servers that are publicly available over the Internet, where communication between the secure servers and the cloud servers is managed using secure connections with access only to computation results.

Claims

1. A method of securely deploying a software application in the Internet cloud, comprising the steps of:

identifying those aspects of a software application that use secure data, and those aspects of the application that use non-secure data;

deploying the secure data on one or more secure servers that are not publicly accessible over the Internet; and

deploying non-secure data on one or more cloud servers that are publicly available over the Internet,

wherein communication between the secure servers and the cloud servers is managed using secure connections with access only to computation results.

2. The method of claim 1, further comprising associating a point-of-delivery terminal with the secure data of the application to manage the secure data.

3. The method of claim 2, further comprising providing an access policy to generate an exception when an application event accesses secure data wherein the event that is accessing secure data is managed by the point-of-delivery terminal associated with the secure data of the application.

4. The method of claim 1, further comprising profiling the application to identify those aspects of the application that use secure data, and those aspects of the application that use non-secure data, wherein an application profiler generates an annotated graph that indicates which application components need to be deployed on said one or more secure servers.

5. The method of claim 4, further comprising deploying to said secure servers any other application or application components that needs to access secure data.

6. A non-transitory program storage device readable by a computer, tangibly embodying a program of instructions executed by the computer to perform the method steps for securely deploying a software application in the Internet cloud, comprising the steps of:

identifying those aspects of a software application that use secure data, and those aspects of the application that use non-secure data;

deploying the secure data on one or more secure servers that are not publicly accessible over the Internet; and

deploying non-secure data on one or more cloud servers that are publicly available over the Internet,

wherein communication between the secure servers and the cloud servers is managed using secure connections with access only to computation results.

7. The computer readable program storage device of claim 6, the method further comprising associating a point-of-delivery terminal with the secure data of the application to manage the secure data.

8. The computer readable program storage device of claim 7, the method further comprising providing an access policy to generate an exception when an application event accesses secure data wherein the event that is accessing secure data is managed by the point-of-delivery terminal associated with the secure data of the application.

9. The computer readable program storage device of claim 6, the method further comprising profiling the application to identify those aspects of the application that use secure data, and those aspects of the application that use non-secure data, wherein an application profiler generates an annotated graph that indicates which application components need to be deployed on said one or more secure servers.

10. The computer readable program storage device of claim 9, the method further comprising deploying to said secure servers any other application or application components that needs to access secure data.