Shared Page Access Control Among Cloud Objects In A Distributed Cloud Environment

• US 20150058926A1
• Filed: 08/23/2013
• Published: 02/26/2015
• Est. Priority Date: 08/23/2013
• Status: Abandoned Application

• Current Assignee: GlobalFoundries, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Archer, Charles J., Cao, Bin, Mann, Phillip V.
• Application Number:
  US13/975,025
• Publication Number:
  US 20150058926A1
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

A management system in a distributed cloud environment that includes a plurality of cloud object, may administer shared page access control among cloud objects. Such shared access control includes: receiving, by the management system from a requesting cloud object, a request to access a shared page; discovering, by the management system, one or more page attributes of the shared page, where the one or more page attributes of the shared page include attributes specified by one or more cloud objects of the distributed cloud environment; identifying, by the management system in dependence upon the page attributes, one more access control measures to perform; performing, by the management system in dependence upon the page attributes, the access control measures; and determining, by the management system, whether to grant the requesting cloud object access to the shared page.

Claims

1. A method of shared page access control among cloud objects in a distributed cloud environment, the distributed cloud environment including management system coupled for data communications to a plurality of cloud objects, the method comprising:

receiving, by the management system from a requesting cloud object, a request to access a shared page;

discovering, by the management system, one or more page attributes of the shared page, wherein the one or more page attributes of the shared page comprise attributes specified by one or more cloud objects of the distributed cloud environment;

identifying, by the management system in dependence upon the page attributes, one more access control measures to perform;

performing, by the management system in dependence upon the page attributes, the access control measures; and

determining, by the management system, whether to grant the requesting cloud object access to the shared page.

2. The method of claim 1 wherein performing, by the management system in dependence upon the page attributes, the access control measures further comprises:

notifying cloud objects sharing the page of a write access attempt in dependence upon page attributes specifying one or more cloud objects not having write access to the shared page, where the request to access the shared page comprises a write access request received from one of the cloud objects specified as not having write access.

3. The method of claim 1 wherein performing, by the management system in dependence upon the page attributes, the access control measures further comprises:

notifying all cloud objects sharing the page of a read access attempt in dependence upon page attributes specifying one or more cloud objects not having read access to the shared page, where the request to access the shared page comprises a read access request received from one of the cloud objects specified as not having read access.

4. The method of claim 1 wherein performing, by the management system in dependence upon the page attributes, the access control measures further comprises:

notifying all cloud objects sharing the page of any access attempt.

5. The method of claim 1 wherein performing, by the management system in dependence upon the page attributes, the access control measures further comprises:

responsive to receiving the access request, tracking subsequent access requests by the requesting cloud object, to any other memory page.

6. The method of claim 1 wherein performing, by the management system in dependence upon the page attributes, the access control measures further comprises:

responsive to receiving a read access request, creating a copy of the shared page.

7. The method of claim 1 wherein performing, by the management system in dependence upon the page attributes, the access control measures further comprises:

updating the page attributes to specify different access control measures to perform upon subsequent access requests.

8. The method of claim 1 wherein the page attributes specify a plurality of access control measures to perform.

9. An apparatus for shared page access control among cloud objects in a distributed cloud environment, the distributed cloud environment including management system coupled for data communications to a plurality of cloud objects, a computer memory operatively coupled to the computer processor, the computer memory having disposed within it computer program instructions that, when executed by the computer processor, cause the apparatus to carry out the steps of:

receiving, by the management system from a requesting cloud object, a request to access a shared page;

discovering, by the management system, one or more page attributes of the shared page, wherein the one or more page attributes of the shared page comprise attributes specified by one or more cloud objects of the distributed cloud environment;

identifying, by the management system in dependence upon the page attributes, one more access control measures to perform;

performing, by the management system in dependence upon the page attributes, the access control measures; and

determining, by the management system, whether to grant the requesting cloud object access to the shared page.

10. The apparatus of claim 9 wherein performing, by the management system in dependence upon the page attributes, the access control measures further comprises:

notifying cloud objects sharing the page of a write access attempt in dependence upon page attributes specifying one or more cloud objects not having write access to the shared page, where the request to access the shared page comprises a write access request received from one of the cloud objects specified as not having write access.

11. The apparatus of claim 9 wherein performing, by the management system in dependence upon the page attributes, the access control measures further comprises:

notifying all cloud objects sharing the page of a read access attempt in dependence upon page attributes specifying one or more cloud objects not having read access to the shared page, where the request to access the shared page comprises a read access request received from one of the cloud objects specified as not having read access.

12. The apparatus of claim 9 wherein performing, by the management system in dependence upon the page attributes, the access control measures further comprises:

notifying all cloud objects sharing the page of any access attempt.

13. The apparatus of claim 9 wherein performing, by the management system in dependence upon the page attributes, the access control measures further comprises:

responsive to receiving the access request, tracking subsequent access requests by the requesting cloud object, to any other memory page.

14. The apparatus of claim 9 wherein performing, by the management system in dependence upon the page attributes, the access control measures further comprises:

responsive to receiving a read access request, creating a copy of the shared page.

15. The apparatus of claim 9 wherein the page attributes specify a plurality of access control measures to perform.

16. A computer program product for shared page access control among cloud objects in a distributed cloud environment, the distributed cloud environment including management system coupled for data communications to a plurality of cloud objects, the computer program product disposed upon a computer readable medium, the computer program product comprising computer program instructions that, when executed, cause a computer to carry out the steps of:

receiving, by the management system from a requesting cloud object, a request to access a shared page;

discovering, by the management system, one or more page attributes of the shared page, wherein the one or more page attributes of the shared page comprise attributes specified by one or more cloud objects of the distributed cloud environment;

identifying, by the management system in dependence upon the page attributes, one more access control measures to perform;

performing, by the management system in dependence upon the page attributes, the access control measures; and

determining, by the management system, whether to grant the requesting cloud object access to the shared page.

17. The computer program product of claim 16 wherein performing, by the management system in dependence upon the page attributes, the access control measures further comprises:

notifying cloud objects sharing the page of a write access attempt in dependence upon page attributes specifying one or more cloud objects not having write access to the shared page, where the request to access the shared page comprises a write access request received from one of the cloud objects specified as not having write access.

18. The computer program product of claim 16 wherein performing, by the management system in dependence upon the page attributes, the access control measures further comprises:

notifying all cloud objects sharing the page of a read access attempt in dependence upon page attributes specifying one or more cloud objects not having read access to the shared page, where the request to access the shared page comprises a read access request received from one of the cloud objects specified as not having read access.

19. The computer program product of claim 16 wherein performing, by the management system in dependence upon the page attributes, the access control measures further comprises:

notifying all cloud objects sharing the page of any access attempt.

20. The computer program product of claim 16 wherein performing, by the management system in dependence upon the page attributes, the access control measures further comprises:

responsive to receiving the access request, tracking subsequent access requests by the requesting cloud object, to any other memory page.