End-to-end secure cloud computing

• US 9,392,023 B2
• Filed: 10/07/2014
• Issued: 07/12/2016
• Est. Priority Date: 05/18/2010
• Status: Active Grant

• Current Assignee: Atlassian US, Inc. (Atlassian Corporation)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: de los Reyes, Gustavo, Beckett, Willam R., Birkes, Jerry, Chawla, Deepak K., Knight, Joshua David, Macwan, Sanjay, O'Hern, William
• Primary Examiner(s): McNally, Michael S
• Application Number:
  US14/508,663
• Publication Number:
  US 20160099971A1
• Time in Patent Office: 644 Days
• Field of Search: 726/1
• US Class Current: 1/1
• CPC Class Codes: H04L 41/5003 Managing SLA; Interaction between SLA and QoS
• CPC Class Codes: H04L 47/70 Admission control; Resource allocation
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

A method includes receiving, at a control node of a cloud computing network, a first enterprise policy specific to the first enterprise and a second enterprise policy specific to the second enterprise, and managing communications between at least one user device of the first enterprise and the at least one enterprise application hosted on behalf of the first enterprise based on the first enterprise policy. The method also includes managing communications between at least one user device of the second enterprise and the at least one enterprise application hosted on behalf of the second enterprise based on the second enterprise policy.

Claims

1. A system, comprising:

a memory that stores instructions;

a processor that executes the instructions to perform operations, the operations comprising;

identifying an enterprise policy for an enterprise, wherein the enterprise policy includes a security and access policy for the enterprise;

enforcing the enterprise policy to manage a communication between a device of the enterprise and an enterprise application hosted by a cloud computing network on behalf of the enterprise; and

configuring a thin client device of the device to prevent storage of data associated with the enterprise application beyond a period of interaction between the thin client device and the enterprise application.

2. The system of claim 1, wherein the operations further comprise transmitting information representative of the enterprise policy to a service provider that manages the cloud computing network.

3. The system of claim 1, wherein the operations further comprise configuring the device of the enterprise to communicate with the cloud computing network so as to assist in operation of the enterprise application.

4. The system of claim 1, wherein the operations further comprise allocating, based on a service level agreement, resources of the cloud computing network utilized for hosting the enterprise application.

5. The system of claim 1, wherein the operations further comprise enforcing a security service for the communication between the device of the enterprise and the enterprise application hosted by the cloud computing network on behalf of the enterprise.

6. The system of claim 1, wherein the operations further comprise configuring the thin client device of the device to prevent installation and execution of non-authorized software.

7. The system of claim 1, wherein the operations further comprise enabling the device to establish a remote desktop session with the enterprise application.

8. The system of claim 1, wherein the operations further comprise identifying the enterprise application hosted by the cloud computing network on behalf of the enterprise.

9. A method, comprising:

identifying an enterprise policy for an enterprise, wherein the enterprise policy includes a security and access policy for the enterprise;

enforcing the enterprise policy to manage a communication between a device of the enterprise and an enterprise application hosted by a cloud computing network on behalf of the enterprise; and

configuring, by utilizing instructions from memory that are executed by a processor, a thin client device of the device to prevent storage of data associated with the enterprise application beyond a period of interaction between the thin client device and the enterprise application.

10. The method of claim 9, further comprising configuring proxy information for a browser application implemented on the device.

11. The method of claim 9, further comprising transmitting information representative of the enterprise policy to a service provider that manages the cloud computing network.

12. The method of claim 9, further comprising configuring the device of the enterprise to communicate with the cloud computing network so as to assist in operation of the enterprise application.

13. The method of claim 9, further comprising allocating, based on a service level agreement, resources of the cloud computing network utilized for hosting the enterprise application.

14. The method of claim 9, further comprising enforcing a security service for the communication between the device of the enterprise and the enterprise application hosted by the cloud computing network on behalf of the enterprise.

15. The method of claim 9, further comprising configuring the thin client device of the device to prevent installation and execution of non-authorized software.

16. The method of claim 9, further comprising enabling the device to establish a remote desktop session with the enterprise application.

17. The method of claim 9, further comprising identifying the enterprise application hosted by the cloud computing network on behalf of the enterprise.

18. A non-transitory computer-readable device comprising instructions, which, when loaded and executed by a processor, cause the processor to perform operations, the operations comprising:

identifying an enterprise policy for an enterprise, wherein the enterprise policy includes a security and access policy for the enterprise;

enforcing the enterprise policy to manage a communication between a device of the enterprise and an enterprise application hosted by a cloud computing network on behalf of the enterprise; and

configuring a thin client device of the device to prevent storage of data associated with the enterprise application beyond a period of interaction between the thin client device and the enterprise application.

19. The non-transitory computer-readable device of claim 18, wherein the operations further comprise allocating, based on a service level agreement, resources of the cloud computing network utilized for hosting the enterprise application.

20. The non-transitory computer-readable device of claim 18, wherein the operations further comprise configuring the thin client device of the device to prevent installation and execution of non-authorized software.