Embedded security blades for cloud service providers

• US 8,813,174 B1
• Filed: 12/30/2011
• Issued: 08/19/2014
• Est. Priority Date: 05/03/2011
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Koeten, Robert, Popp, Nicolas
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Tran, Tongoc
• Application Number:
  US13/341,202
• Time in Patent Office: 963 Days
• Field of Search: 726 1- 3, 726/12, 726/18, 713/152, 713/155, 713/168, 709/223, 709/250
• US Class Current: 726/1
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 41/022 Multivendor or multi-standard integration
• CPC Class Codes: H04L 41/0226 Mapping or translating multiple network management protocols
• CPC Class Codes: H04L 41/0253 using browsers or web-pages for accessing management information
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/30 Profiles

Abstract

A policy manager generates a uniform cloud service and information security policy based on a plurality of access contexts. The policy manager distributes the uniform cloud service and information security policy to a plurality of security blades, the security blades located within a plurality of cloud services and configured to control access for a user device to the cloud services and the information contained therein based on the uniform cloud service and information security policy.

Claims

1. A method, comprising:

generating, by a processor, a uniform cloud service and information security policy based on a plurality of access contexts; and

distributing the uniform cloud service and information security policy to a plurality of security blades, the security blades located within a plurality of cloud services and configured to provide access for a user device to the cloud services and to serve as a policy enforcement point for the uniform cloud service and information security policy, wherein distributing the uniform cloud service and information security policy comprises providing an application programming interface (API) to the plurality of security blades, the security blades to call the API to receive an updated version of the uniform cloud service and information security policy.

2. The method of claim 1, wherein the plurality of cloud services comprises at least one of public cloud services or private cloud services.

3. The method of claim 1, wherein the uniform cloud service and information security policy is generated and distributed by a policy manager.

4. The method of claim 1, wherein the plurality of access contexts comprises at least one of an identity of a user making the request, a type of the user device, a type of network over which the request was received, or a type of information requested.

5. The method of claim 1, further comprising:

receiving the plurality of access contexts from a system administrator.

6. The method of claim 1, wherein the security blades are configured to:

receive a request from the user device to access a corresponding cloud service;

compare a feature of the request to the uniform cloud service and information security policy for the cloud service; and

if the feature satisfies a condition of the policy, grant the user device access to the cloud service.

7. A system, comprising:

a memory; and

a processor coupled with the memory to;

generate a uniform cloud service information and security policy based on a plurality of access contexts; and

distribute the uniform cloud service information and security policy to a plurality of security blades, the security blades located within a plurality of cloud services and configured to provide access for a user device to the cloud services and to serve as a policy enforcement point for the uniform cloud services information and security policy, wherein to distribute the uniform cloud service and information security policy, the processor to provide an application programming interface (API) to the plurality of security blades, the security blades to call the API to receive an updated version of the uniform cloud service and information security policy.

8. The system of claim 7, wherein the plurality of cloud services comprises at least one of public cloud services or private cloud services.

9. The system of claim 7, wherein the uniform cloud service information and security policy is generated and distributed by a policy manager.

10. The system of claim 7, wherein the plurality of access contexts comprises at least one of an identity of a user making the request, a type of the user device, a type of network over which the request was received, or a type of information requested.

11. The system of claim 7, the processor further to:

receive the plurality of access contexts from a system administrator.

12. The system of claim 7, wherein the security blades are configured to:

receive a request from the user device to access a corresponding cloud service;

compare a feature of the request to the uniform cloud service information and security policy for the cloud service; and

if the feature satisfies a condition of the policy, grant the user device access to the cloud service and information contained therein.

13. A non-transitory computer readable storage medium including instructions that, when executed by a processor, cause the processor to perform a method comprising:

generating, by the processor, a uniform cloud service information and security policy based on a plurality of access contexts; and

distributing the uniform cloud service information and security policy to a plurality of security blades, the security blades located within a plurality of cloud services and configured to provide access for a user device to the cloud services and to serve as a policy enforcement point for the uniform cloud services information and security policy, wherein distributing the uniform cloud service and information security policy comprises providing an application programming interface (API) to the plurality of security blades, the security blades to call the API to receive an updated version of the uniform cloud service and information security policy.

14. The non-transitory computer readable storage medium of claim 13, wherein the plurality of cloud services comprises at least one of public cloud services or private cloud services.

15. The non-transitory computer readable storage medium of claim 13, wherein the uniform cloud service information and security policy is generated and distributed by a policy manager.

16. The non-transitory computer readable storage medium of claim 13, wherein the plurality of access contexts comprises at least one of an identity of a user making the request, a type of the user device, a type of network over which the request was received, or a type of information requested.

17. The non-transitory computer readable storage medium of claim 13, wherein the security blades are configured to:

receive a request from the user device to access a corresponding cloud service;

compare a feature of the request to the uniform cloud service information and security policy for the cloud service; and

if the feature satisfies a condition of the policy, grant the user device access to the cloud service.