Method and system for visibility and control over access transactions between clouds using resource authorization messages

• US 8,931,041 B1
• Filed: 07/29/2011
• Issued: 01/06/2015
• Est. Priority Date: 07/29/2011
• Status: Active Grant

• Current Assignee: Gen Digital Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Banerjee, Deb
• Primary Examiner(s): Bali, Vikkram
• Assistant Examiner(s): Mangialaschi, Tracy
• Application Number:
  US13/194,710
• Time in Patent Office: 1,257 Days
• Field of Search: 726/1
• US Class Current: 726/1
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

A computing system detects an access transaction based on one or more resource authorization messages transmitted via a resource authorization protocol. The access transaction pertains to access of a protected resource by a consumer cloud, the protected resource hosted by a provider cloud. The computing system generates relationship data based on the resource authorization messages. The relationship data can indicate a resource owner that is granting the access, the consumer cloud, and/or the provider cloud. The computing system performs an access control action in relation to the access transaction based on the relationship data. The access control action can be allowing the consumer cloud access to the protected resource or denying the consumer cloud access to the protected resource.

Claims

1. A method comprising:

detecting, by a computing system, an access transaction comprising one or more resource authorization messages transmitted via a resource authorization protocol, the access transaction pertaining to a consumer cloud requesting access to a protected resource hosted by a provider cloud;

generating, by the computing system, relationship data based on the resource authorization messages, the relationship data indicating the provider cloud hosting the protected resource, the consumer cloud requesting access, and a resource owner that is granting the access;

identifying a trust cloud type assigned to the consumer cloud; and

performing, by the computing system, an access control action in relation to the access transaction based on the relationship data, policy data and the trust cloud type assigned to the consumer cloud, wherein the access control action is at least one of allowing the consumer cloud access to the protected resource or denying the consumer cloud access to the protected resource.

2. The method of claim 1, wherein the resource authorization protocol is Open Authentication (OAuth) protocol.

3. The method of claim 1, further comprising:

storing the policy data specifying cloud type criteria for access control actions;

storing security profile data for the resource owner indicating a security level for the resource owner; and

generating a cloud trust model based on the relationship data, the security profile data, and the policy data, wherein the cloud trust model indicates a degree of the consumer cloud being a trusted cloud.

4. The method of claim 3, further comprising:

detecting a subsequent access transaction based on one or more subsequent resource authorization messages, the access transaction pertaining to access of the protected resource by the consumer cloud, the protected resource hosted by the provider cloud;

generating the relationship data based on the subsequent resource authorization messages; and

updating the cloud trust model based on the relationship data pertaining to the subsequent access transaction.

5. The method of claim 3, further comprising:

implementing the cloud trust model as a graph model, the graph model comprising nodes and edges connecting at least a subset of the nodes, the nodes representing users, consumer clouds, and provider clouds, and the edges representing relationships between the nodes; and

determining the access control action to be performed using a belief propagation technique and the graph model.

6. The method of claim 1, wherein detecting the access transaction comprises:

accessing the one or more resource authorization messages originating from outside an enterprise firewall.

7. The method of claim 1, wherein the relationship data further comprises the protected resource to be accessed.

8. A system comprising:

a memory; and

a processing device coupled with the memory to

detect an access transaction comprising one or more resource authorization messages transmitted via a resource authorization protocol, the access transaction pertaining to a consumer cloud requesting access to a protected resource, the protected resource hosted by a provider cloud;

generate relationship data based on the resource authorization messages, the relationship data indicating the provider cloud hosting the protected resource, the consumer cloud requesting access, and a resource owner that is granting the access;

identify a trust cloud type assigned to the consumer cloud; and

perform an access control action in relation to the access transaction based on the relationship data, policy data and the trust cloud type assigned to the consumer cloud, wherein the access control action is at least one of allowing the consumer cloud access to the protected resource or denying the consumer cloud access to the protected resource.

9. The system of claim 8, wherein the resource authorization protocol is Open Authorization (OAuth) protocol.

10. The system of claim 8, wherein:

the memory is further to store the policy data specifying cloud type criteria for access control actions, and security profile data for the resource owner indicating a security level for the resource owner; and

the processing device is further to generate a cloud trust model based on the relationship data, the security profile data, and the policy data, wherein the cloud trust model indicates a degree of the consumer cloud being a trusted cloud.

11. The system of claim 10, wherein the processing device is further to:

detect a subsequent access transaction based on one or more subsequent resource authorization messages, the access transaction pertaining to access of the protected resource by the consumer cloud, the protected resource hosted by the provider cloud;

generate the relationship data based on the subsequent resource authorization messages; and

update the cloud trust model based on the relationship data pertaining to the subsequent access transaction.

12. The system of claim 10, wherein the processing device is further to:

implement the cloud trust model as a graph model, the graph model comprising nodes and edges connecting at least a subset of the nodes, the nodes representing users, consumer clouds, and provider clouds, and the edges representing relationships between the nodes; and

determine the access control action to be performed using a belief propagation technique and the graph model.

13. The system of claim 8, further comprising:

at least one of a reverse proxy and a forward proxy to intercept the one or more resource authorization messages originating from outside an enterprise firewall.

14. The system of claim 13, wherein the processing device is to detect the access transaction by:

accessing the resource authorization messages originating from outside the enterprise firewall.

15. A non-transitory computer readable storage medium including instructions that, when executed by a processor, cause the processor to perform a method comprising:

detecting an access transaction comprising one or more resource authorization messages transmitted via a resource authorization protocol, the access transaction pertaining to a consumer cloud requesting access to a protected resource hosted by a provider cloud;

generating, by the processor, relationship data based on the resource authorization messages, the relationship data indicating the provider cloud hosting the protected resource, the consumer cloud requesting access, and a resource owner that is granting the access;

identifying a trust cloud type assigned to the consumer cloud; and

performing an access control action in relation to the access transaction based on the relationship data, policy data and the trust cloud type assigned to the consumer cloud, wherein the access control action is at least one of allowing the consumer cloud access to the protected resource or denying the consumer cloud access to the protected resource.

16. The non-transitory computer readable storage medium of claim 15, wherein the resource authorization protocol is Open Authentication (OAuth) protocol.

17. The non-transitory computer readable storage medium of claim 15, further comprising:

storing the policy data specifying cloud type criteria for access control actions;

storing security profile data for the resource owner indicating a security level for the resource owner; and

generating a cloud trust model based on the relationship data, the security profile data, and the policy data, wherein the cloud trust model indicates a degree of the consumer cloud being a trusted cloud.

18. The non-transitory computer readable storage medium of claim 17, further comprising:

detecting a subsequent access transaction based on one or more subsequent resource authorization messages, the access transaction pertaining to access of the protected resource by the consumer cloud, the protected resource hosted by the provider cloud;

generating the relationship data based on the subsequent resource authorization messages; and

updating the cloud trust model based on the relationship data pertaining to the subsequent access transaction.

19. The non-transitory computer readable storage medium of claim 17, further comprising:

implementing the cloud trust model as a graph model, the graph model comprising nodes and edges connecting at least a subset of the nodes, the nodes representing users, consumer clouds, and provider clouds, and the edges representing relationships between the nodes; and

determining the access control action to be performed using a belief propagation technique and the graph model.

20. The non-transitory computer readable storage medium of claim 15, wherein detecting the access transaction comprises:

accessing the one or more resource authorization messages originating from outside an enterprise firewall.