Techniques for establishing a trusted cloud service

• US 10,021,144 B2
• Filed: 06/13/2016
• Issued: 07/10/2018
• Est. Priority Date: 05/04/2011
• Status: Active Grant

• Current Assignee: Micro Focus Software, Inc. (Open Text Corporation)
• Original Assignee: Micro Focus Software, Inc. (Open Text Corporation)
• Inventors: Bergeson, Bruce L., Tietjen, Carl, McClain, Carolyn B., Henderson, Larry Hal, Carter, Stephen R
• Primary Examiner(s): Holder, Bradley
• Application Number:
  US15/180,365
• Publication Number:
  US 20160352779A1
• Time in Patent Office: 757 Days
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Techniques for establishing a trusted cloud service are provided. Packages are created for services that include certificates, configuration information, trust information, and images for deploying instances of the services. The packages can be used to deploy the services in trusted environments and authenticated to deploy in sub environments of un-trusted environments. The sub environments are trusted by the trusted environments. Also, clouds are prospected for purposes of identifying desirable clouds and creating the packages for deployment.

Claims

1. A method, comprising:

obtaining, by a deployer application that executes on one or more processors of a network, a specification for a target cloud environment that is a set of cooperating processors, storage libraries, and software systems that form a logical computing infrastructure;

configuring, by the deployer application, a package that includes a service image for a service based on the specification for the target cloud environment, wherein configuring further includes providing instructions within the package for generating keys and certificates for security processing by the service once initiated within the target cloud environment;

providing, by the deployer application, the package to the target cloud environment for instantiation of the service on the target cloud environment; and

interacting, by the deployer application, with the service when deployed from the service image within the target cloud environment, and wherein interacting further includes authenticating, by the deployer application, the service and the target cloud environment during initial interactions with the service before the service is permitted to operate within the target cloud environment based on credentials generated by a portion of the service image once deployed in the target cloud environment.

2. The method of claim 1, wherein obtaining further includes obtaining the specification as a hardware configuration and software configuration for the target cloud environment.

3. The method of claim 2, wherein obtaining further includes requesting the specification from the target cloud environment.

4. The method of claim 2, wherein configuring further includes providing keys and certificates within the package for security processing by the service once initiated within the target cloud environment.

5. The method of claim 2, wherein interacting further includes interacting with one or more sub services of the service from the target cloud environment.

6. A system, comprising:

a hardware processor; and

a service deployer application executing on the hardware processor over a network, the service deployer application configured to;

obtain a specification for a target cloud environment that is a set of cooperating processors, storage libraries, and software systems that form a logical computing infrastructure;

create a package for a service image of a service with the package customized for the target cloud environment based on the specification;

configure the package with security to authenticate the service within the target cloud environment and to provide instructions to generate keys and certificates within the package to perform security processing by the service once initiated within the target cloud environment;

cause the service to be deployed from the service image of the package within the target cloud environment; and

authenticate the service and the target cloud environment before the service is permitted to continue to process within the target cloud environment, based on credentials generated by at least a portion of the service image when deployed to the target cloud environment.

7. The system of claim 6, wherein the service deployer application is further configured to interact with the service and sub services of the service once initiated within the target cloud environment.