Management of secure data in cloud-based network

• US 9,112,836 B2
• Filed: 01/14/2014
• Issued: 08/18/2015
• Est. Priority Date: 05/29/2008
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Ferris, James Michael
• Primary Examiner(s): Lanier, Benjamin
• Assistant Examiner(s): Cribbs, Malcolm
• Application Number:
  US14/154,372
• Publication Number:
  US 20140129833A1
• Time in Patent Office: 581 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/389 Keeping log of transactions for guaranteeing non-repudiation of a transaction
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

A processor receives a request to access secure data. The processor translates the request in order to locate the secure data in a secure data store. The processor retrieves the secure data from the secure data store. The processor encodes the secure data to generate protected secure data. The processor transmits the protected secure data from the secure data store to at least one instantiated virtual machine in a cloud-based network.

Claims

1. A method comprising:

receiving, by a processor from an instantiated virtual machine in a cloud-based network, a request to access secure data;

translating, by the processor, the request in order to locate the secure data in a secure data store located at a data facility, wherein the request indirectly references the secure data in the secure data store;

retrieving, by the processor, the secure data from the secure data store with the translated request;

applying, by the processor, a protective mechanism to the secure data to generate protected secure data, wherein applying the protective mechanism comprises masking the secure data to generate masked data;

transmitting the protected secure data from the secure data store to the instantiated virtual machine in the cloud-based network;

decoding the protected secure data in the instantiated virtual machine to generate decoded secure data;

operating on decoded secure data in the instantiated virtual machine to generate updated secure data; and

transmitting the updated secure data from the instantiated virtual machine to the secure data store.

2. The method of claim 1, wherein the secure data store comprises an on-premise data store.

3. The method of claim 1, wherein the translating comprises translating an address into a secure data table.

4. The method of claim 1, wherein the receiving, translating, retrieving, applying, and transmitting are performed by a cloud management system.

5. The method of claim 4, wherein the secure data store is co-located with the cloud management system.

6. The method of claim 4, wherein the secure data store is located external to the cloud management system.

7. The method of claim 1, wherein the applying the protective mechanism to the secure data comprises encrypting the secure data.

8. The method of claim 1, wherein at least one the instantiated virtual machine comprises a migrated image of an on-premise machine.

9. The method of claim 1, wherein the secure data comprises at least one of user identification data, account data, medical data, technical data, or financial data.

10. A system, comprising:

a memory;

a processor, operatively couple to the memory, the processor to;

receive a request for secure data from an instantiated virtual machine in a cloud-based network,

translate the request in order to locate the secure data in a secure data store,

retrieve the secure data from the secure data store located at a data facility, wherein the request indirectly references the secure data in the secure data store,

apply a protective mechanism to the secure data to generate protected secure data, the protective mechanism being a masking operation to generate masked data,

transmit the protected secure data from the secure data store to the instantiated virtual machine in the cloud-based network;

decode the protected secure data in the instantiated virtual machine to generate decoded secure data;

operate on decoded secure data in the instantiated virtual machine to generate updated secure data; and

transmit the updated secure data from the instantiated virtual machine to the secure data store.

11. The system of claim 10, wherein the secure data store comprises an on-premise data store.

12. The system of claim 10, wherein the processor is further to apply the protective mechanism to the secure data by encrypting the secure data.

13. The system of claim 10, wherein the processor is further to decode the protected secure data in the at least one instantiated virtual machine to generate decoded secure data.

14. A non-transitory computer-readable storage medium programmed to comprise instructions that, when executed by a processor, cause the processor to comprising:

receive, by the processor from an instantiated virtual machine in a cloud-based network, a request to access secure data;

translate, by the processor, the request in order to locate the secure data in a secure data store located at a data facility, wherein the request indirectly references the secure data in the secure data store;

retrieve, by the processor, the secure data from the secure data store with the translated request;

apply, by the processor, a protective mechanism to the secure data to generate protected secure data, wherein applying the protective mechanism comprises masking the secure data to generate masked data;

transmit the protected secure data from the secure data store to the instantiated virtual machine in the cloud-based network;

decode the protected secure data in the instantiated virtual machine to generate decoded secure data;

operate on decoded secure data in the instantiated virtual machine to generate updated secure data; and

transmit the updated secure data from the instantiated virtual machine to the secure data store.

15. The non-transitory computer-readable storage medium of claim 14, wherein the secure data store comprises an on-premise data store.