SYSTEM AND METHOD FOR PROVIDING KEY-ENCRYPTED STORAGE IN A CLOUD COMPUTING ENVIRONMENT

• US 20100235630A1
• Filed: 11/05/2009
• Published: 09/16/2010
• Est. Priority Date: 03/13/2009
• Status: Active Grant

• Current Assignee: Micro Focus Software, Inc. (Open Text Corporation)
• Original Assignee: Novell Incorporated (Open Text Corporation)
• Inventors: Carter, Stephen R., Olds, Dale Robert, McClain, Carolyn Bennion, Burch, Lloyd Leon, Allen, Jared Patrick
• Granted Patent: US 9,658,891 B2
• Time in Patent Office: Days
• US Class Current: 713/162
• CPC Class Codes: G06F 9/505 considering the load
• CPC Class Codes: H04L 45/586 of virtual routers
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

System and method for providing cloud computing services are described. In one embodiment, the system comprises a cloud computing environment comprising resources for supporting cloud workloads, each cloud workload having associated therewith an internal cloud address; and a routing system disposed between external workloads of an external computing environment and the cloud workloads, the routing system for directing traffic from an external address to the internal cloud addresses of the cloud workloads. A designated one of the cloud workloads obtains one key of a first pair of cryptographic keys, the first pair of cryptographic keys for decrypting encrypted storage hosted within the cloud computing environment.

Claims

1. A system for providing cloud computing services, the system comprising:

a cloud computing environment comprising resources for supporting cloud workloads, each cloud workload having associated therewith an internal cloud address; and

a routing system disposed between external workloads of an external computing environment and the cloud workloads, the routing system for directing traffic from an external address to the internal cloud addresses of the cloud workloads;

wherein a designated one of the cloud workloads obtains one key of a first pair of cryptographic keys, the first pair of cryptographic keys for decrypting encrypted storage hosted within the cloud computing environment.

2. The system of claim 1 further comprising a secure communications channel disposed between the cloud computing environment and the external computing environment.

3. The system of claim 2 wherein the secure communications channel comprises a secure bridge.

4. The system of claim 2 wherein the secure communications channel is implemented using cryptographic keys.

5. The system of claim 4 wherein the cryptographic keys for implementing the secure communications channel are held by both the external computing environment and the cloud computing environment.

6. The system of claim 1 wherein the one key of the first pair of cryptographic keys is obtained by the designated cloud workload from an external and trusted source.

7. The system of claim 1 wherein the designated cloud workload processes traffic for storage in the cloud computing environment to enable storage to be encrypted and decrypted as needed by one of the cloud workloads or the external workloads.

8. The system of claim 1 wherein the one key of the first pair of cryptographic keys is obtained by the designated cloud workload via a secure connection established using a second pair of cryptographic keys.

9. A system for providing cloud computing services, the system comprising:

cloud computing means comprising resources for supporting cloud workloads, each cloud workload having associated therewith an internal cloud address; and

routing system means disposed between external workloads of an external computing means and the cloud workloads, the routing system means for directing traffic from an external address to the internal cloud addresses of the cloud workloads;

wherein a designated one of the cloud workloads obtains one key of a first pair of cryptographic keys, the first pair of cryptographic keys for decrypting encrypted storage hosted within the cloud computing means.

10. The system of claim 9 further comprising means for enabling secure communications between the cloud computing means and the external computing means.

11. The system of claim 10 wherein the secure communications means comprises a secure bridge.

12. The system of claim 10 wherein the secure communications means is implemented using cryptographic keys.

13. The system of claim 12 wherein the cryptographic keys for implementing the secure communications means are held by both the external computing means and the cloud computing means.

14. The system of claim 9 wherein the one key of the first pair of cryptographic keys is obtained by the designated cloud workload from an external and trusted source.

15. The system of claim 9 wherein the one key of the first pair of cryptographic keys is obtained by the designated cloud workload via a secure connection established using a second pair of cryptographic keys.

16. A method for providing cloud computing services, the method comprising:

providing a cloud computing environment comprising resources for supporting cloud workloads, each cloud workload having associated therewith an internal cloud address; and

routing traffic between external workloads of an external computing environment and cloud workloads, the routing comprising forwarding traffic from a single external address to the internal cloud addresses of the cloud workloads;

wherein a designated one of the cloud workloads obtains one key of a first pair of cryptographic keys, the first pair of cryptographic keys for decrypting encrypted storage hosted within the cloud computing environment.

17. The method of claim 16 further comprising establishing a secure communications channel between the cloud computing environment and the external computing environment.

18. The method of claim 17 wherein the secure communications channel comprises a secure bridge.

19. The method of claim 17 wherein the secure communications channel is implemented using cryptographic keys.

20. The method of claim 16 wherein the one key of the first pair of cryptographic keys is obtained by the designated cloud workload from an external and trusted source.