Objects in a virtual computing infrastructure

• US 9,087,352 B2
• Filed: 11/17/2011
• Issued: 07/21/2015
• Est. Priority Date: 06/15/2010
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Van Biljon, Willem Robert, Pinkham, Christopher Conway, Cloran, Russell Andrew, Gorven, Michael Carl, Hardy, Alexandre, Divey, Brynmor K. B., Hoole, Quinton Robin, Kalele, Girish
• Primary Examiner(s): Gee, Jason K.
• Assistant Examiner(s): BUCKNOR, OLANREWAJU J
• Application Number:
  US13/299,262
• Publication Number:
  US 20120110180A1
• Time in Patent Office: 1,342 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06Q 30/04 Billing or invoicing
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03
• CPC Class Codes: G06Q 40/10 Tax strategies
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/60 Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources admission control or resource allocation H04L47/70
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04M 15/66 Policy and charging system

Abstract

An action is performed on an object in a cloud computing environment having a plurality of computing nodes. A policy path is determined from at least one permission within a policy of a customer. A first delegation path is determined from within the determined policy path. The first delegation path is directed to at least one object permission for the object upon which the action is to be performed. An authorized user is assigned from a second delegation path from within the determined policy path. The second delegation path is directed to at least one user permission for the action to be performed.

Claims

1. A method of performing an action on an object in a cloud computing environment having a plurality of computing nodes, the method comprising:

determining a policy path from at least one permission within a policy of a customer, the at least one permission comprising a set of key-value pairs describing a delegation of privileges;

determining a first delegation path from within the determined policy path, the first delegation path being directed to at least one object permission for the object upon which the action is to be performed, the at least one object permission comprising permissions created by an owner of the object and describing what actions may be performed on the object and by whom those actions may be performed, wherein the first delegation path is defined by values of the at least one permission; and

assigning an authorized user from a second delegation path from within the determined policy path, the second delegation path being directed to at least one user permission for the action to be performed, the at least one user permission describing what actions may be performed by one or more users belonging to the customer, wherein the second delegation path is defined by values of the at least one permission;

wherein determining the policy path involves determining an existence of a path in a directed graph in which each vertex is a different permission from each other vertex in the directed graph.

2. The method of claim 1, wherein determining a policy path includes determining that

the authorized user is the same as or a descendant of a subject specified in the at least one user permission;

the object on which the action is to be performed is the same as or a descendant of the object specified in the at least one object permission; and

an action in either the at least one user permission or the at least one object permission is unspecified or the same as the action requested.

3. The method of claim 1, wherein the at least one user permission shares a same value as the at least one object permission.

4. The method of claim 1, wherein the at least one user permission is a descendant of an object permission in a naming hierarchy.

5. The method of claim 1, wherein the object is a machine image from which data is accessed.

6. The method of claim 1, wherein the object is executed code.

7. The method of claim 1, wherein the object is a data store.

8. A cloud computing system, comprising:

a plurality of computing nodes;

at least one storage device configured to store a plurality of processing instructions; and

at least one hardware processor in communication with the at least one storage device, and configured to execute the plurality of processing instructions to;

determine a policy path from at least one permission within a policy of a customer, the at least one permission comprising a set of key-value pairs describing a delegation of privileges;

determine a first delegation path from within the determined policy path, the first delegation path being directed to at least one object permission for an object upon which an action is to be performed, the at least one object permission comprising permissions created by an owner of the object and describing what actions may be performed on the object and by whom those actions may be performed, wherein the first delegation path is defined by values of the at least one permission; and

assign an authorized user from a second delegation path from within the determined policy path, the second delegation path being directed to at least one user permission for the action to be performed, the at least one user permission describing what actions may be performed by one or more users belonging to the customer and wherein the second delegation path is defined by values of the at least one permission;

wherein the plurality of processing instructions to determine the policy path includes processing instructions to determine an existence of a path in a directed graph in which each vertex is a different permission from each other vertex in the directed graph.

9. The system of claim 8, wherein the plurality of processing instructions to determine the policy path includes instructions to determine that:

the authorized user is the same as or a descendant of a subject specified in the at least one user permission;

the object on which the action is to be performed is the same as or a descendant of the object specified in the at least one object permission; and

an action in either the at least one user permission or the at least one object permission is unspecified or the same as the action requested.

10. The system of claim 8, wherein the at least one user permission shares a same value as the at least one object permission.

11. The system of claim 8, wherein the at least one user permission is a descendant of an object permission, in a naming hierarchy.

12. The system of claim 8, wherein the object is a machine image from which data is accessed.

13. The system of claim 8, wherein the object is executed code.

14. The system of claim 8, wherein the object is a data store.