Providing context-based visibility of cloud resources in a multi-tenant environment

• US 20150200958A1
• Filed: 09/30/2014
• Published: 07/16/2015
• Est. Priority Date: 01/16/2014
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Iyer, Sreekanth Ramakrishna, Kumar, Archana, Nagaratnam, Nataraj, Muppidi, Sridhar R., Bird, William Alexander
• Granted Patent: US 9,444,820 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 41/50 Network service management, e.g. ensuring proper service fulfilment according to agreements
• CPC Class Codes: H04L 47/70 Admission control; Resource allocation
• CPC Class Codes: H04L 47/78 Architectures of resource allocation
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A secure tag generation service is associated with a cloud infrastructure. This service establishes a security context for a particular cloud tenant based on a tenant'"'"'s security requirements, one or more cloud resource attributes, and the like. The security content is encoded into a data structure, such as a tag that uniquely identifies that security context. The tag is then encrypted. The encrypted tag is then propagated to one or more cloud management services, such as a logging service. When one or more cloud resources are then used, such use is associated with the encrypted security context tag. In this manner, the encrypted tag is used to monitor activities that are required to meet the security context. When it comes time to perform a security or compliance management task, any cloud system logs that reference the encrypted security context tag are correlated to generate a report for the security context.

Claims

1. A method of resource security and compliance monitoring in a multi-tenant cloud computing infrastructure, comprising:

for a given tenant, deriving a security context from cloud resource meta-data and user-specific input data;

propagating a data string uniquely representing the security context to one or more cloud resource automation systems that monitor the cloud computing infrastructure;

associating the data string to one or more activities being monitored by the one or more cloud resource automation systems; and

responsive to a request, correlating information that includes the data strings to generate a security context-specific response.

2. The method as described in claim 1 wherein the data string is a security context tag that encodes the cloud resource meta-data and user-specific input data.

3. The method as described in claim 2 wherein the data string is protected by a security wrapper generated by applying a given mathematical function to the security context tag.

4. The method as described in claim 3 further including removing the security wrapper prior to correlating the information.

5. The method as described in claim 1 further including updating the security context and the associated data string based on one of:

a runtime behavior, and an event.

6. The method as described in claim 1 wherein the security context-specific response is a report detailing one of:

user activity, resource usage, network monitoring, and workload execution.

7. The method as described in claim 6 wherein the report is specific to the given tenant and the given tenant'"'"'s security context.