MANAGING ROGUE CLOUD PROVIDER OPERATIONS

• US 20150006691A1
• Filed: 06/27/2013
• Published: 01/01/2015
• Est. Priority Date: 06/27/2013
• Status: Abandoned Application

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Satapathy, Soumendu S.
• Application Number:
  US13/928,646
• Publication Number:
  US 20150006691A1
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 41/5003 Managing SLA; Interaction between SLA and QoS
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals

Abstract

In one embodiment, a cloud-based storage system determines acceptability of a plurality of internet addresses, and determines a defined action to take in response to unacceptable internet addresses. Accordingly, in response to a cloud-based data storage operation, the system determines a destination address where data blocks are physically being stored, determines whether the destination address is an acceptable internet address, and in response to the destination address being an unacceptable internet address, performs the defined action. In another embodiment, the system may insert a data deletion probe into a data volume of a cloud storage system, and in response to initiating a data deletion request for cloud-stored data blocks of the data volume, confirms physical deletion of the data blocks in response to a data deletion operation using the data deletion probe.

Claims

1. A method, comprising:

determining acceptability of a plurality of internet addresses;

determining a defined action to take in response to unacceptable internet addresses;

in response to a cloud-based data storage operation, determining a destination address where data blocks are physically being stored;

determining whether the destination address is an acceptable internet address; and

in response to the destination address being an unacceptable internet address, performing the defined action.

2. The method as in claim 1, wherein determining acceptability comprises:

mapping internet address to geo-locations; and

distinguishing between acceptable and unacceptable geo-locations and corresponding internet addresses.

3. The method as in claim 1, wherein determining acceptability comprises:

distinguishing between acceptable and unacceptable internet addresses through a user-defined list.

4. The method as in claim 1, wherein the defined action comprises:

alerting a user that the destination address is an unacceptable internet address.

5. The method as in claim 1, wherein the defined action comprises:

preventing the storage operation.

6. The method as in claim 1, wherein the defined action comprises:

requesting user permission for the storage operation.

7. The method as in claim 1, wherein determining the destination address where data blocks are physically being stored comprises:

inserting a probe into the storage operation to determine the destination address.

8. The method as in claim 7, further comprising:

removing the probe upon completion of the storage operation.

9. The method as in claim 7, wherein the probe comprises customer handler code on a storage server associated with the storage operation.

10. The method as in claim 1, further comprising:

tracking a number of accesses to the data blocks; and

determining an access violation based on the number of accesses.

11. The method as in claim 1, wherein determining the destination address where data blocks are physically being stored is based on a logical block address of the data blocks.

12. The method as in claim 1, further comprising:

determining a customer associated with the data blocks for the storage operation; and

looking up a customer agreement associated with the customer,

wherein determining acceptability of the plurality of internet addresses is based on the customer agreement.

13. The method as in claim 1, further comprising:

confirming physical deletion of the data blocks in response to a data deletion operation.

14. Logic encoded in one or more non-transitory tangible media for execution and when executed by a machine operable to:

determine acceptability of a plurality of internet addresses;

determine a defined action to take in response to unacceptable internet addresses;

in response to a cloud-based data storage operation, determine a destination address where data blocks are physically being stored;

determine whether the destination address is an acceptable internet address; and

in response to the destination address being an unacceptable internet address, perform the defined action.

15. The logic as in claim 14, wherein the logic when executed to determine acceptability is further operable to:

map internet address to geo-locations; and

distinguish between acceptable and unacceptable geo-locations and corresponding internet addresses.

16. The logic as in claim 14, wherein the logic when executed to determine acceptability is further operable to:

distinguish between acceptable and unacceptable internet addresses through a user-defined list.

17. The logic as in claim 14, wherein the defined action is selected from a group consisting of:

alerting a user that the destination address is an unacceptable internet address;

preventing the storage operation; and

requesting user permission for the storage operation.

18. The logic as in claim 14, wherein the logic when executed to determine the destination address where data blocks are physically being stored is further operable to:

insert a probe into the storage operation to determine the destination address.

19. The logic as in claim 14, wherein the logic when executed is further operable to:

confirm physical deletion of the data blocks in response to a data deletion operation.

20. Logic encoded in one or more non-transitory tangible media for execution and when executed by a machine operable to:

insert a data deletion probe into a data volume of a cloud storage system;

initiate a data deletion request for cloud-stored data blocks of the data volume; and

confirm physical deletion of the data blocks in response to a data deletion operation using the data deletion probe.