Systems and apparatuses for a secure mobile cloud framework for mobile computing and communication

• US 10,425,411 B2
• Filed: 03/13/2014
• Issued: 09/24/2019
• Est. Priority Date: 04/05/2012
• Status: Active Grant

• Current Assignee: Arizona Board of Regents (University of Arizona)
• Original Assignee: Arizona Board of Regents (University of Arizona)
• Inventors: Huang, Dijiang
• Primary Examiner(s): Hoffman, Brandon S
• Assistant Examiner(s): Woldemariam, Nega
• Application Number:
  US14/775,496
• Publication Number:
  US 20160044035A1
• Time in Patent Office: 2,021 Days
• Field of Search: 726 4
• CPC Class Codes: G06F 2009/45562 Creating, deleting, cloning virtual machine instances
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 3/0484 for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06F 9/5072 Grid computing
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 47/70 Admission control; Resource allocation
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3073 involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

Systems and apparatuses for a secure mobile cloud framework (referred to as MobiCloud) for mobile computing and communication are disclosed. Embodiments of MobiCloud transfer each mobile node from a traditional strictly layer-structured communication node into a service node (SN). Each SN may be used as a service provider or a service broker according its capability. Each SN may be incorporated as a virtualized component of the MobiCloud. In some embodiments, MobiCloud mirrors an SN to one or multiple virtual images in the Cloud for addressing communication and computation deficiencies of mobile devices. Virtual images can create a visualized MANET routing and communication layer that can maximally assist the mobile nodes to enable pervasive computing services for each mobile device owner. A secure data processing framework is disclosed for the MobiCloud.

Claims

1. A system comprising:

a plurality of mobile device computers, each executing one or more virtual machines via a corresponding one or more virtual images local to the respective mobile device computer; and

a network virtualization framework to virtualize the one or more virtual images of the plurality of mobile device computers using an Extended Semi-Shadow Image (ESSI) at the system to represent the one or more virtual machines executing at the plurality of mobile device computers;

a networking system coupled to the plurality of mobile device computers and configured to;

provide a portal for receiving, from a client device, parameters for the one or more virtual machines;

provision the one or more virtual machines on the plurality of mobile device computers based, at least in part, on the received parameters;

provide access to the one or more virtual machines through the portal;

receiving a task to perform by the one or more virtual machines, wherein the task involves at least one software component associated with an application root executing on the client device, and wherein the at least one software component is to be performed by either the client device or the one or more virtual machines; and

performing the task via the ESSI at the system on behalf of the respective one or more virtual machines executing at the plurality of mobile device computers.

2. The system of claim 1:

wherein each ESSI at the system provides extended capabilities in addition to duplicating functions of the respective mobile device computer upon which the virtual machine is executing; and

wherein the extended capabilities include running services not available via a mobile and ad hoc network (MANET) communication system within which the respective mobile device operates, the services including at least one of search services, data mining services, media processing services, and trust pre-establishment services via advance credential exchange and security key establishment.

3. The system of claim 1:

wherein the networking system is configured to provided access by providing an application programming interface (API); and

wherein the networking system comprises at least one of an extensible messaging and presence protocol (XMPP) server, a virtual private network (VPN) server, a content management web server, a public domain name system database, and a web portal.

4. The system of claim 1:

wherein each of the plurality of mobile device computers executing the one or more virtual machines execute the virtual machines via a corresponding one or more virtual images local to the respective mobile device computer; and

wherein each ESSI at the system representing the one or more virtual machines is one of an exact clone of one of the virtual images of the virtual machines or a partial clone of one of the virtual images of the virtual machines or an image containing extended physical device functions from a respective one of the mobile device computers upon which the virtual machine is executing.

5. The system of claim 1:

wherein the networking system is further configured to authenticate the client device by performing the steps of;

receiving a first request to activate a user account, wherein the request comprises a user public key;

sending the first request and the user public key to an identity management module;

sending a second request for a user certificate to a certificate authorization module;

recording user information to generate the second request;

verifying the second request for the user certificate; and

issuing the user certificate to the identity management module.

6. The system of claim 1, further comprising:

a plurality of sensors coupled to at least one computer of the plurality of computers, wherein at least one virtual machine of the one of more virtual machines comprises a

plurality of virtual sensor templates corresponding to the plurality of sensors, and wherein the portal is configured to provide access to the plurality of virtual sensor templates.

7. The system of claim 1, wherein the one or more virtual machines are configured to perform tasks related to at least one of web hosting, anti-virus, and anti-phishing.

8. The system of claim 1, further comprising:

a remote data store coupled to the plurality of computers, wherein the networking system is configured to provision storage from the remote data store within the respective ESSI for each of the one or more virtual machines through the portal; and

wherein the networking system is further configured to provision storage from the remote data store.

9. The system of claim 1, wherein the network virtualization framework is further configured to:

treat each mobile device computer as a Service Node (SN) within the networking system; and

mirror every Service Node to the Extended Semi-Shadow Images (ESSIs) in available via a service cloud established by the system to compensate for communication and computation deficiencies of the plurality of mobile device computers.

10. Non-transitory computer readable storage media having instructions stored thereupon that, when executed by a system having at least a processor and a memory therein, the instructions cause the system to perform operations comprising:

communicatively interfacing with a plurality of mobile device computers via a networking system, each of the plurality of mobile device computers executing one or more virtual machines via a corresponding one or more virtual images local to the respective mobile device computer; and

virtualizing, via a network virtualization framework, the one or more virtual images of the plurality of mobile device computers using an Extended Semi-Shadow Image (ESSI) at the system to represent the one or more virtual machines executing at the plurality of mobile device computers;

exposing a portal for receiving, from a client device, parameters for the one or more virtual machines;

provisioning the one or more virtual machines on the plurality of mobile device computers based, at least in part, on the received parameters;

providing access to the one or more virtual machines through the portal;

receiving a task to perform by the one or more virtual machines, wherein the task involves at least one software component associated with an application root executing on the client device, and wherein the at least one software component is to be performed by either the client device or the one or more virtual machines; and

performing the task via the ESSI at the system on behalf of the respective one or more virtual machines executing at the plurality of mobile device computers.

11. The non-transitory computer readable storage media of claim 10:

wherein each ESSI at the system provides extended capabilities in addition to duplicating functions of the respective mobile device computer upon which the virtual machine is executing; and

wherein the extended capabilities include running services not available via a mobile and ad hoc network (MANET) communication system within which the respective mobile device operates, the services including at least one of search services, data mining services, media processing services, and trust pre-establishment services via advance credential exchange and security key establishment.

12. The non-transitory computer readable storage media of claim 10:

wherein each of the plurality of mobile device computers executing the one or more virtual machines execute the virtual machines via a corresponding one or more virtual images local to the respective mobile device computer; and

wherein each ESSI at the system representing the one or more virtual machines is one of an exact clone of one of the virtual images of the virtual machines or a partial clone of one of the virtual images of the virtual machines or an image containing extended physical device functions from a respective one of the mobile device computers upon which the virtual machine is executing.

13. The non-transitory computer readable storage media of claim 10:

wherein the instructions include code to authenticate the client device; and

wherein the code for authenticating the client device comprises;

code to receive a first request to activate a user account, wherein the request comprises a user public key;

code to send the first request and the user public key to an identity management module;

code to send a second request for a user certificate to a certificate authorization module;

code to record user information to generate the second request;

code to verify the second request for the user certificate; and

code to issue the user certificate to the identity management module.

14. A mobile device comprising:

a processor;

a memory coupled to the processor;

wherein the processor is configured to perform operations comprising;

executing one or more virtual machines via a corresponding one or more virtual images local to the mobile device; and

virtualizing each of the one or more virtual images using an Extended Semi-Shadow Image (ESSI) hosted at a remote cloud system, wherein the ESSI hosted at the remote cloud system represents the one or more virtual machines executing locally at the mobile device;

receiving user input by an application root executing on the mobile device to perform a task involving at least one software component associated with the application root, wherein the at least one software component is to be performed by either the mobile device or the ESSI hosted at the remote cloud system;

offloading the task to the ESSI hosted at the remote cloud system;

wherein the offloading of the task comprises executing the at least one software component on the ESSI hosted at the remote cloud system separate from the application root.

15. The mobile device of claim 14, wherein the processor is further configured to perform operations including:

executing an internal process for receiving the user input and for communicating with an oriented service gateway initiative (OSGi) framework;

and wherein the OSGi framework comprises at least one of;

a first module that transmits broadcasted data;

a second module that listens to broadcasted data; and

a third module that tests broadcasted data.

16. The mobile device of claim 15, wherein the OSGi framework comprises a module that transmits broadcasted data, in which the module receives information from the internal process.

17. The mobile device of claim 15, wherein the OSGi framework comprises a module that listens to broadcasted data, in which the module sends information to the internal process.

18. The mobile device of claim 15, wherein the OSGi framework comprises a module that tests broadcasted data, in which the module provides commands to allow other modules access to the broadcasted data.

19. The mobile device of claim 14, wherein the processor is configured to offload the task to the virtual machine when a battery of the mobile device has a charge level below a first threshold.

20. The mobile device of claim 14, wherein the processor is configured to offload the task to the ESSI hosted at the remote cloud system by migrating the at least one software component to the ESSI hosted at the remote cloud system separate from the application root.

21. The mobile device of claim 14, wherein the at least one software component is a platform independent software component.