Decoupling Hardware and Software Components of Network Security Devices to Provide Security Software as a Service in a Distributed Computing Environment

• US 20150033282A1
• Filed: 07/24/2013
• Published: 01/29/2015
• Est. Priority Date: 07/24/2013
• Status: Active Grant

• Current Assignee: Kyocera Corporation
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: O'Hern, William A., Amoroso, Edward A., Barry, Michelle, Ramos, Anthony, Solero, Daniel, Sparrell, Duncan Kirkwood, Dilts, Rodney
• Granted Patent: US 9,456,003 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 2009/4557 Distribution of virtual machine instances; Migration and load balancing
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

Concepts and technologies are disclosed herein for decoupling hardware and software components of network security devices to provide security software as a service in a distributed computing environment. A computer system includes a processor that can execute computer-executable instructions to perform various operations. The processor can perform operations to provide security services to one or more customer platforms. The operations can include receiving a network security software component from a security service provider, and deploying the network security software component within a distributed computing environment so that the network security software component can be executed by a computing resource of the distributed computing environment to provide a security service to the customer platform(s). The network security software component includes a software component that has been decoupled from a hardware component of a network security device by the security service provider.

Claims

1. A computer system, comprising:

a processor; and

a memory that stores computer-executable instructions which, when executed by the processor, cause the processor to perform operations comprising;

receiving a network security software component from a security service provider, wherein the network security software component has been decoupled from a hardware component of a network security device by the security service provider, and

deploying the network security software component within a distributed computing environment so that the network security software component can be executed by a computing resource associated with the distributed computing environment to provide a security service to a customer platform.

2. The computer system of claim 1, wherein the operations further comprise exposing an application programming interface to the customer platform to provide on-demand access to the security service provided by the network security software component.

3. The computer system of claim 2, wherein the operations further comprise:

receiving an application programming interface call from the customer platform; and

in response to receiving the application programming interface call, providing the security service to the customer platform.

4. The computer system of claim 3, wherein the customer platform comprises a mobile device.

5. The computer system of claim 3, wherein the application programming interface call identifies an asset associated with the customer platform for protection by the security service and a selection of the security service to protect the asset.

6. The computer system of claim 5, wherein the asset is a virtualized asset operating within the distributed computing environment.

7. The computer system of claim 5, wherein the operations further comprise provisioning the network security software component to protect the asset, and providing the security service to protect the asset.

8. The computer system of claim 7, wherein the operations further comprise:

receiving a further network security software component from a further security service provider, wherein the further network security software component has been decoupled from a further hardware component of a further network security device by the further security service provider, and

deploying the further network security software component within the distributed computing environment so that the further network security software component can be executed by the computing resource to provide a further security service to the customer platform.

9. The computer system claim 8, wherein the operations further comprise provisioning the further network security software component to protect the asset, and providing the further security service to the customer platform to further protect the asset.

10. The computer system of claim 8, wherein the operations further comprise provisioning the further network security software component to protect a further asset, and providing the further security service to the customer platform to protect the further asset independent of the security service provided to the customer platform to protect the asset.

11. A method, comprising:

receiving, at a computer system comprising a processor, a network security software component from a security service provider, wherein the network security software component has been decoupled from a hardware component of a network security device by the security service provider; and

deploying, by the computer system, the network security software component within a distributed computing environment so that the network security software component can be executed by a computing resource associated with the distributed computing environment to provide a security service to a customer platform.

12. The method of claim 11, further comprising exposing an application programming interface to the customer platform to provide on-demand access to the security service provided by the network security software component.

13. The method of claim 12, further comprising:

receiving an application programming interface call from the customer platform; and

in response to receiving the application programming interface call, providing the security service to the customer platform.

14. The method of claim 13, wherein the application programming interface call identifies an asset associated with the customer platform for protection by the security service and a selection of the security service to protect the asset.

15. The method of claim 11, wherein the computer system operates within the distributed computing environment.

16. The method of claim 14, further comprising provisioning the network security software component to protect the asset, and providing the security service to protect the asset.

17. The method of claim 14, further comprising charging the security service provider a fee for deploying the network security software component within the distributed computing environment.

18. The method of claim 17, further comprising charging the customer platform a fee for utilizing the security service.

19. A mobile device, comprising:

a processor; and

a memory that stores computer-executable instructions that, when executed by the processor, cause the processor to perform operations comprising;

launching a mobile client,

connecting to a security software service platform via the mobile client,

calling an application programming interface exposed by the security software service platform to request that a security service be enabled for the mobile device, and

in response to calling the application programming interface, receiving instructions to enable the security service.

20. The mobile device of claim 19, wherein the mobile device is a bring-your-own-device device for use within an enterprise network, and the security service comprises a traffic routing service that routes traffic originating from the mobile device to a security node operating within a distributed computing environment via control provided by the security software service platform.