Security systems and/or methods for cloud computing environments

• US 8,656,453 B2
• Filed: 11/10/2010
• Issued: 02/18/2014
• Est. Priority Date: 11/10/2010
• Status: Active Grant

• Current Assignee: Software AG
• Original Assignee: Software AG
• Inventors: Punnoose, Vinay, Devanandam, Kayiti, Joshi, Satish Kumar, Nampally, Aditya Babu
• Primary Examiner(s): Zecher, Cordelia
• Assistant Examiner(s): AVERY, JEREMIAH L
• Application Number:
  US12/926,330
• Publication Number:
  US 20120116782A1
• Time in Patent Office: 1,196 Days
• Field of Search: None
• US Class Current: 726/1
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Certain example embodiments described herein relate to security systems and/or methods for cloud computing environments. More particularly, certain example embodiments described herein relate to the negotiation and subsequent use of Trading Partner Agreements (TPAs) between partners in a Virtual Organization, the TPAs enabling resources to be shared between the partners in a secure manner. In certain example embodiments, TPAs are negotiated, an algorithm is executed to determine where an executable is to be run, the resource is transferred to the location where it is to be run, and it is executed—with the TPAs collectively defining a security policy that constrains how and where it can be executed, the resources it can use, etc. The executable may be transferred to a location in a multipart (e.g., SMIME) message, along with header information and rights associated with the executable.

Claims

1. A computer-implemented method in a cloud computing environment including at least first and second partners that share a distributed file system, wherein:

one or more Trading Partner Agreements (TPAs) are negotiated between two or more of the at least first and second partners, each said TPA specifying;

any resources allocated by the partners in the TPA,

a transport protocol to be used by the partners in the TPA, and

a security mechanism to be used by the partners in the TPA; and

wherein a security policy is formed from the TPAs,

the method comprising;

transferring, using a computing system of the cloud computing environment, an executable to the target partner or target partner instance in accordance with a TPA negotiated between the target partner or target partner instance and the source partner or source partner instance; and

invoking the executable on the target partner or target partner instance within constraints specified by the security policy.

2. The method of claim 1, wherein the security policy is accessible by each said partner.

3. The method of claim 1, wherein each said TPA is negotiated and packaged according to an XML schema.

4. The method of claim 1, wherein the TPAs are negotiated and the security policy is formed at design time.

5. The method of claim 1, wherein the security mechanism specifies that a digital signature and/or encryption is/are to be used.

6. The method of claim 1, wherein the security mechanism specifies permissions for any of the allocated resources.

7. The method of claim 6, wherein the resource is a file or file system and the permissions for the file or file system include at least one of read, write, and execute action permissions.

8. The method of claim 6, wherein the resource is a socket and the permissions for the socket include accept connect action permissions.

9. The method of claim 1, further comprising:

running an algorithm to determine a target partner or target partner instance to which an executable from a source partner or source partner instance is to be distributed.

10. The method of claim 1, further comprising defining a multipart message, the multipart message including:

a header including sender and receiver information, and

a payload container containing the executable to be transferred and rights associated with the executable to be transferred.

11. The method of claim 10, further comprising packaging into a first message the header and payload container.

12. The method of claim 11, wherein the first message is signed in accordance with the TPA negotiated between the target partner or target partner instance and the source partner or source partner instance, the signature and the first message being packaged together into the multipart message.

13. The method of claim 12, further comprising encrypting at least a portion of the payload container in accordance with the TPA negotiated between the target partner or target partner instance and the source partner or source partner instance.

14. The method of claim 13, wherein the multipart message is an SMIME message.

15. A cloud computing system, comprising:

a plurality of partner servers and/or partner server instances;

a distributed file system shared by the plurality of partner servers and/or partner server instances; and

a software module comprising an algorithm that, when executed, determines a target partner server or target partner server instance to which an executable from a source partner server or source partner server instance is to be distributed, wherein;

one or more Trading Partner Agreements (TPAs) are negotiated between two or more of the plurality of partner servers and/or partner server instances, each said TPA specifying;

any resources allocated by the partner servers and/or partner server instances that are a party to the TPA,

a transport protocol to be used by the partner servers and/or partner server instances that are a party to the TPA, and

a security mechanism to be used by the partner servers and/or partner server instances that are a party to the TPA;

wherein a security policy is formed from the TPAs;

wherein the source partner server or source partner server instance includes a first processor configured to cause the executable to be transferred to the target partner server or target partner server instance in accordance with a TPA negotiated between the target partner server or target partner server instance and the source partner server or source partner server instance; and

wherein the target partner server or target partner server instance includes a second processor configured to invoke the executable, once received, on the target partner server or target partner server instance, within constraints specified by the security policy.

16. The cloud computing system of claim 15, wherein each said TPA is negotiated and packaged according to an XML schema.

17. The cloud computing system of claim 15, wherein the security mechanism specifies that a digital signature and/or encryption is/are to be used.

18. The cloud computing system of claim 15, wherein the security mechanism specifies permissions for any of the allocated resources.

19. The cloud computing system of claim 15, wherein the first processor is further configured to define a multipart message, the multipart message including:

a header including sender and receiver information, and

a payload container containing the executable to be transferred and rights associated with the executable to be transferred.

20. The cloud computing system of claim 19, wherein the first processor is further configured to:

package into a first message the header and payload container, and

sign the first message in accordance with the TPA negotiated between the target partner server or target partner server instance and the source partner server or source partner server instance, the signature and the first message being packaged together into the multipart message.

21. The cloud computing system of claim 19, further comprising encrypting at least a portion of the payload container in accordance with the TPA negotiated between the target partner server or target partner server instance and the source partner server or source partner server instance.

22. The cloud computing system of claim 15, wherein the multipart message is an SMIME message.

23. A computing system for sharing resources among and/or between partners in a virtual organization, the partners adhering to Trading Partner Agreements (TPAs) negotiated between at least two of said partners in the virtual organization, the computer system:

a memory; and

a processing system that includes at least one processor that is coupled to the memory, the processing system configured to;

run an algorithm to determine a target partner server or target partner server instance to which an executable from a source partner server or source partner server instance is to be distributed;

transfer the executable to the target partner server or target partner server instance in accordance with a TPA negotiated between the target partner server or target partner server instance and the source partner server or source partner server instance; and

invoke the executable on the target partner server or target partner server instance within constraints specified by a security policy, the security policy including each said TPA,

wherein the TPA specifies;

any resources allocated by the partners in the TPA,

a transport protocol to be used by the partners in the TPA, and

a security mechanism to be used by the partners in the TPA.

24. The computing system of claim 23, wherein the constraints specified by the security policy help ensure that the executable was not altered during transmit among and/or between partner servers and/or partner server instances.

25. The computing system of claim 23, wherein the constraints specified by the security policy help ensure that the executable was sent by the partner that claims to have sent it.

26. The computing system of claim 23, wherein the constraints specified by the security policy help ensure that the executable can only use resources of or on the target partner server or target partner server instance as specified in the TPA negotiated between the target partner server or target partner server instance and the source partner server or source partner server instance.