SECURITY INFRASTRUCTURE FOR CLOUD SERVICES

• US 20140075499A1
• Filed: 03/15/2013
• Published: 03/13/2014
• Est. Priority Date: 09/07/2012
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Arun, Gopalan, Chatterjee, Ramkrishna, Vasudevan, Ramesh
• Granted Patent: US 8,972,725 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: G06F 16/178 Techniques for file synchronisation in file systems
• CPC Class Codes: G06F 16/2282 Tablespace storage structures; Management thereof
• CPC Class Codes: G06F 16/2308 Concurrency control transaction processing G06F9/466
• CPC Class Codes: G06F 16/2365 Ensuring data consistency and integrity
• CPC Class Codes: G06F 16/27 Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
• CPC Class Codes: G06F 16/273 Asynchronous replication or reconciliation
• CPC Class Codes: G06F 16/283 Multi-dimensional databases or data warehouses, e.g. MOLAP or ROLAP
• CPC Class Codes: G06F 16/284 Relational databases
• CPC Class Codes: G06Q 10/06315 Needs-based resource requirements planning or analysis
• CPC Class Codes: G06Q 10/0633 Workflow analysis
• CPC Class Codes: G06Q 30/0633 Lists, e.g. purchase orders, compilation or processing
• CPC Class Codes: G06Q 30/0635 Processing of requisition or of purchase orders
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 41/0686 Additional information in the notification, e.g. enhancement of specific meta-data
• CPC Class Codes: H04L 41/50 Network service management, e.g. ensuring proper service fulfilment according to agreements
• CPC Class Codes: H04L 41/5041 characterised by the time relationship between creation and deployment of a service
• CPC Class Codes: H04L 41/5054 Automatic deployment of services triggered by the service manager, e.g. service implementation by automatic configuration of network components
• CPC Class Codes: H04L 41/5064 Customer relationship management
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 47/70 : Admission control; Resource allocation
• CPC Class Codes: H04L 63/10 : for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 : in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

A framework for handling a secure interaction between components in a cloud infrastructure system that wish to transfer information between each other during processing of a customer'"'"'s subscription order is described. The framework orders the security zones of components based on security levels and protects the transfer of information between components in security zones with different security levels. The assignment of a component to a security zone is based upon the sensitivity of the data handled by the components, the sensitivity of functions performed by the component, and the like.

Claims

1. A method comprising:

storing, by a cloud infrastructure system, subscription order information related to one or more services subscribed to by a customer, the service selected from one or more services provided by the cloud infrastructure system, the cloud infrastructure system comprising one or more computing devices;

receiving, by a computing device from the one or more computing devices, a request to transfer the information between a first component and a second component in the cloud infrastructure system, the first component and the second component executed by the one or more computing devices;

determining, by the computing device, a first security zone for the first component and a second security zone for the second component;

determining, by the computing device, a first security level associated with the first security zone and a second security level associated with the second security zone; and

determining, by the computing device, the transfer of information between the first component and the second component based upon the first security level, the second security level, and security rules information, wherein the security rules information specifies one or more rules related to the transfer of information between the first component and the second component.

2. The method of claim 1 wherein determining the transfer of information based on the first security level, the second security level and the security rules information comprises pushing information from the first component to the second component if the second security level associated with the second component is lower than the first security level associated with the first component or if the second security level associated with the second component is the same as the first security level associated with the first component.

3. The method of claim 2 wherein pushing the information from the first component to the second component comprises invoking a synchronous write API of the second component.

4. The method of claim 2 wherein pushing information from the first component to second component comprises publishing information to a queue in the second component, wherein an interaction between the first component and the second component is asynchronous.

5. The method of claim 1 wherein determining the transfer of information based on the first security level, the second security level and the security rules information comprises pulling information by the first component from the second component if the second security level associated with the second component is lower than the first security level of the first component or if the second security level associated with the second component is the same as the first security level associated with the first component.

6. The method of claim 5 wherein pulling the information from the second component comprises invoking a synchronous read API of the second component.

7. The method of claim 5 wherein pulling the information by the first component from the second component comprises the source component subscribing to an output queue in the target component and then pulling the information published in the queue for the source component.

13. The system of claim 1 further comprising assigning at least one of an existing security zone with an existing security level or a new security zone with a new security level to a new component in the cloud infrastructure system.

14. The system of claim 1 further comprising updating at least one of a security zone or a security level of the one or more components in the cloud infrastructure system.

8. A system comprising:

one or more computing devices configurable to provide one or more services;

a memory configurable to store subscription order information related to a subscription order ordering one or more services from the set of services; and

wherein a computing device from the one or more computing devices is configurable to;

receive a request to transfer the information between a first component and a second component in the cloud infrastructure system, the first component and the second component executed by the one or more computing devices;

determine a first security zone for the first component and a second security zone for the second component;

determine a first security level associated with the first security zone and a second security level associated with the second security zone; and

determine the transfer of information between the first component and the second component based upon the first security level, the second security level, and security rules information, wherein the security rules information specifies one or more rules related to the transfer of information between the first component and the second component.

9. The system of claim 8 wherein the computing device is configured to determine the transfer of information based on the first security level, the second security level and the security rules information by pushing information from the first component to the second component if the second security level associated with the second component is lower than the first security level associated with the first component or if the second security level associated with the second component is the same as the first security level associated with the first component.

10. The system of claim 9 wherein the computing device is configured to push the information from the first component to the second component by invoking a synchronous write API of the second component.

11. The system of claim 9 wherein the computing device is configured to push information from the first component to second component by publishing information to a queue in the second component, wherein an interaction between the first component and the second component is asynchronous.

12. The system of claim 8 wherein the computing device is configured to determine the transfer of information based on the first security level, the second security level and the security rules information by pulling information by the first component from the second component if the second security level associated with the second component is lower than the first security level of the first component or if the second security level associated with the second component is the same as the first security level associated with the first component.

15. A computer-readable memory storing a plurality of instructions executable by one or more processors, the plurality of instructions comprising:

instructions that cause at least one processor from the one or more processors to store subscription order information related to a subscription order ordering one or more services from a set of services;

instructions that cause at least one processor from the one or more processors to receive a request to transfer the information between a first component and a second component in the cloud infrastructure system, the first component and the second component executed by one or more computing devices;

instructions that cause at least one processor from the one or more processors to determine a first security zone for the first component and a second security zone for the second component;

instructions that cause at least one processor from the one or more processors to determine a first security level associated with the first security zone and a second security level associated with the second security zone; and

instructions that cause at least one processor from the one or more processors to determine the transfer of information between the first component and the second component based upon the first security level, the second security level, and security rules information, wherein the security rules information specifies one or more rules related to the transfer of information between the first component and the second component.

16. The computer-readable memory of claim 15 wherein the instructions that cause at least one processor from the one or more processors to determine the transfer of information based on the first security level, the second security level and the security rules information comprise instructions to push information from the first component to the second component if the second security level associated with the second component is lower than the first security level associated with the first component or if the second security level associated with the second component is the same as the first security level associated with the first component.

17. The computer-readable memory of claim 16 wherein the instructions that cause at least one processor from the one or more processors to push the information from the first component to the second component comprises instructions to invoke a synchronous write API of the second component.

18. The computer-readable memory of claim 15 wherein the instructions that cause at least one processor from the one or more processors to determine the transfer of information based on the first security level, the second security level and the security rules information comprise instructions to pull information by the first component from the second component if the second security level associated with the second component is lower than the first security level of the first component or if the second security level associated with the second component is the same as the first security level associated with the first component.

19. The computer-readable memory of claim 18 wherein the instructions that cause at least one processor from the one or more processors to pull the information from the second component comprises invoking a synchronous read API of the second component.

20. The computer-readable memory of claim 15 wherein the instructions that cause at least one processor from the one or more processors to pull the information by the first component from the second component comprise instructions for the source component to subscribe to an output queue in the target component and then pull the information published in the queue for the source component.