Method for enhancing security access to a node in a homogenous cloud computing environment

• US 9,838,274 B2
• Filed: 11/19/2014
• Issued: 12/05/2017
• Est. Priority Date: 11/19/2014
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Alger, Joshua A., Hoy, Jeffrey R., Pellas, Barry J., Stecher, David M.
• Primary Examiner(s): Tiv, Backhean
• Application Number:
  US14/547,880
• Publication Number:
  US 20160142334A1
• Time in Patent Office: 1,112 Days
• CPC Class Codes: H04L 41/0803 Configuration setting
• CPC Class Codes: H04L 41/5041 characterised by the time relationship between creation and deployment of a service
• CPC Class Codes: H04L 47/785 among multiple network domains, e.g. multilateral agreements
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 67/1031 Controlling of the operation of servers by a load balancer, e.g. adding or removing servers that serve requests
• CPC Class Codes: H04W 4/60 Subscription-based services using application servers or record carriers, e.g. SIM application toolkits

Abstract

A method, system and computer-usable medium are disclosed for controlling access to a node deployed in a cloud environment. A new node, based upon a common image, is created in a cloud computing environment. A unique set of randomized system parameters are then generated for the new node, which is then mapped to a set of generic system parameters. A request to access the new node is intercepted, which contains the generic system parameters. The intercepted access request is then parsed to extract the set of generic system parameters, which are then replaced with the unique set of randomized system parameters associated with the target node to generate a modified access request. The modified access request is then forwarded to the target node.

Claims

1. A system comprising:

a processor;

a data bus coupled to the processor; and

a computer-usable medium embodying computer program code, the computer-usable medium being coupled to the data bus, the computer program code used for controlling access in a cloud environment and comprising instructions executable by the processor and configured for;

mapping a unique set of randomized system parameters to a set of generic system parameters, the unique set of randomized system parameters comprising a unique randomized root password value, a unique randomized virtual user password value, an opt path value and an app key value, the set of generic system parameters comprising a generic root user password, a generic virtual user password value, an opt path value and an app key value;

receiving a request to access a resource in the cloud environment, the request including the set of generic system parameters;

intercepting the request and replacing the set of generic system parameters with the unique set of randomized system parameters to produce a modified request; and

forwarding the modified request for access to the resource.

2. The system of claim 1, further comprising:

selecting the randomized system parameters for a node of the cloud environment; and

deploying the node using the randomized system parameters.

3. The system of claim 1, further comprising:

intercepting a response from the resource containing at least a portion of the unique set of randomized system parameters; and

replacing the portion with a corresponding portion of the set of generic system parameters.

4. The system of claim 1, further comprising:

changing the unique set of randomized system parameters at the resource to a temporary set of system parameters for a duration of a user session.

5. The system of claim 1, further comprising:

resetting the unique set of randomized system parameters for a set of resources in the cloud environment.

6. The system of claim 5 wherein:

the unique set of randomized system parameters are reset for all resources in the cloud environment.

7. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:

mapping a unique set of randomized system parameters to a set of generic system parameters, the unique set of randomized system parameters comprising a unique randomized root password value, a unique randomized virtual user password value, an opt path value and an app key value, the set of generic system parameters comprising a generic root user password, a generic virtual user password value, an opt path value and an app key value;

receiving a request to access a resource in the cloud environment, the request including the set of generic system parameters;

intercepting the request and replacing the set of generic system parameters with the unique set of randomized system parameters to produce a modified request; and

forwarding the modified request for access to the resource.

8. The non-transitory, computer-readable storage medium of claim 7, further comprising:

selecting the randomized system parameters for a node of the cloud environment; and

,

deploying the node using the randomized system parameters.

9. The non-transitory, computer-readable storage medium of claim 7, further comprising:

intercepting a response from the resource containing at least a portion of the unique set of randomized system parameters; and

replacing the portion with a corresponding portion of the set of generic system parameters.

10. The non-transitory, computer-readable storage medium of claim 7, further comprising:

changing the unique set of randomized system parameters at the resource to a temporary set of system parameters for a duration of a user session.

11. The non-transitory, computer-readable storage medium of claim 7, further comprising:

resetting the unique set of randomized system parameters for a set of resources in the cloud environment.

12. The non-transitory, computer-readable storage medium of claim 11, wherein:

the unique set of randomized system parameters are reset for all resources in the cloud environment.

13. The non-transitory, computer-readable storage medium of claim 7, wherein the computer executable instructions are deployable to a client system from a server system at a remote location.

14. The non-transitory, computer-readable storage medium of claim 7, wherein the computer executable instructions are provided by a service provider to a user on an on-demand basis.