Techniques for establishing a trusted cloud service

• US 8,813,192 B2
• Filed: 05/04/2011
• Issued: 08/19/2014
• Est. Priority Date: 05/04/2011
• Status: Expired due to Fees

• Current Assignee: Micro Focus Software, Inc. (Open Text Corporation)
• Original Assignee: Novell Incorporated (Open Text Corporation)
• Inventors: Bergeson, Bruce L., Tietjen, Carl, McClain, Carolyn B., Henderson, Larry Hal, Carter, Stephen R
• Primary Examiner(s): HOLDER, BRADLEY W
• Application Number:
  US13/100,937
• Publication Number:
  US 20120284780A1
• Time in Patent Office: 1,203 Days
• Field of Search: 726/4, 726/2, 726/3
• US Class Current: 726/4
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Techniques for establishing a trusted cloud service are provided. Packages are created for services that include certificates, configuration information, trust information, and images for deploying instances of the services. The packages can be used to deploy the services in trusted environments and authenticated to deploy in sub environments of un-trusted environments. The sub environments are trusted by the trusted environments. Also, clouds are prospected for purposes of identifying desirable clouds and creating the packages for deployment.

Claims

1. A method comprising:

obtaining, by an ad hoc and untrusted service deployer executing on one or more processors, an environment specification for a target environment that is un-trusted, the environment specification obtained within a trusted environment;

creating, by the ad hoc and untrusted service deployer, a package to include;

certificates, a service image for a migrating service that is migrating to the target environment, a service identifier for the migrating service, and a package identifier for the package;

establishing, by the ad hoc and untrusted service deployer, trust configuration information for the target environment having a trust configuration identifier;

including, by the ad hoc and untrusted service deployer, the trust configuration information in the package;

sending, by the ad hoc and untrusted service deployer, the package to a target service in the target environment for deployment of an instance of the migrating service, via the service image, within a created sub environment of the target environment that establishes trust with the trusted environment by processing components of the package;

authenticating, by the ad hoc and untrusted service deployer, the target service via information received back from the target service from the target environment and acquired by the target service from the package;

providing, by the ad hoc and untrusted service deployer, the target service a setup trust service for use in establishing the sub environment;

receiving, by the ad hoc and untrusted service deployer, a request from a sub environment service created with the sub environment to establish trust with the trusted environment; and

authenticating, by the ad hoc and untrusted service deployer, the sub environment as being trusted with the trusted environment based on interactions with the sub environment service.

2. The method of claim 1 further comprising, by the ad hoc and untrusted service deployer, interacting with the instance of the migrating service within the trusted environment, the instance of the migrating service processing in the trusted sub environment of the target environment.

3. The method of claim 2, wherein interacting further includes using the service identifier of the instance of the migrating service and a trusted sub environment identifier of the trusted sub environment when interacting.

4. The method of claim 1, wherein creating further includes identifying the certificates as public key certificates for keys used by the trusted environment to encrypt information that can only be decrypted by an associated private key of the trusted environment owned and controlled by the trusted environment.