Defining an authorizer in a virtual computing infrastructure

• US 9,076,168 B2
• Filed: 11/17/2011
• Issued: 07/07/2015
• Est. Priority Date: 06/15/2010
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Van Biljon, Willem Robert, Pinkham, Christopher Conway, Cloran, Russell Andrew, Gorven, Michael Carl, Hardy, Alexandre, Divey, Brynmor K. B., Hoole, Quinton Robin, Kalele, Girish
• Primary Examiner(s): Gee, Jason K.
• Assistant Examiner(s): BUCKNOR, OLANREWAJU J
• Application Number:
  US13/299,157
• Publication Number:
  US 20120110636A1
• Time in Patent Office: 1,328 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06Q 30/04 Billing or invoicing
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03
• CPC Class Codes: G06Q 40/10 Tax strategies
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/60 Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources admission control or resource allocation H04L47/70
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04M 15/66 Policy and charging system

Abstract

An authorizing entity is allowed to grant permission to a subject to perform an action on an object in a cloud computing environment. An authorizer is defined as the entity having granting authority to delegate a predetermined permission. A subject is defined as a group to whom the permission is being delegated. An object is defined upon which an action is authorized within the cloud computing environment. The action being authorized in the cloud computing environment is defined. Members of the subject group are authorized to perform the permitted action on the object.

Claims

1. A method of allowing an authorizing entity to grant permission to a subject to perform an action on an object in a cloud computing environment having a plurality of computing nodes, the method comprising:

defining an authorizer value for an authorizer key in a permission, the authorizer value identifying an entity delegating the permission;

defining a subject value for a subject key in the permission, the subject value identifying a group to whom the permission is being delegated;

defining an object value for an object key in the permission, the object value identifying an object upon which action is authorized by the permission within the cloud computing environment;

defining an action value for an action key in the permission, the action value identifying an action authorized by the permission in the cloud computing environment;

determining that a path exists in a directed graph between (a) a node corresponding to the authorizer value and (b) another node corresponding to an initial set of permissions created in connection with a creation of a customer to which the group belongs; and

authorizing members of the subject group to perform a requested action on a requested object based on the defined values of the permission and the existence of the path.

2. The method of claim 1, wherein the object is a machine image from which data is accessed.

3. The method of claim 1, wherein the object is executed code.

4. The method of claim 1, wherein the object is a data store.

5. A cloud computing system, comprising:

at least one storage device configured to store a plurality of instructions; and

at least one processor device in communication with the at least one storage device, and configure to execute the plurality of instructions to;

define an authorizer value for an authorizer key in a permission, the authorizer value identifying an entity delegating the permission;

define a subject value for a subject key in the permission, the subject value identifying a group to whom the permission is being delegated;

define an object value for an object key in the permission, the object value identifying an object upon which action is authorized by the permission within the cloud computing environment;

define an action value for an action key in the permission, the action value identifying an action authorized by the permission in the cloud computing environment;

determine that a path in a directed graph exists between (a) a node corresponding to the authorizer value and (b) another node corresponding to an initial set of permissions created in connection with a creation of a customer to which the group belongs; and

authorize members of the subject group to perform a requested action on a requested object based on the defined values of the permission and the existence of the path.

6. The system of claim 5, wherein the object is a machine image from which data is accessed.

7. The system of claim 5, wherein the object is executed code.

8. The system of claim 5, wherein the object is a data store.