Techniques for establishing a trusted cloud service

• US 9,369,494 B2
• Filed: 08/13/2014
• Issued: 06/14/2016
• Est. Priority Date: 05/04/2011
• Status: Active Grant

• Current Assignee: Micro Focus Software, Inc. (Open Text Corporation)
• Original Assignee: Novell Incorporated (Open Text Corporation)
• Inventors: Bergeson, Bruce L., Tietjen, Carl, McClain, Carolyn B., Henderson, Larry Hal, Carter, Stephen R
• Primary Examiner(s): HOLDER, BRADLEY W
• Application Number:
  US14/458,523
• Publication Number:
  US 20140351894A1
• Time in Patent Office: 671 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Techniques for establishing a trusted cloud service are provided. Packages are created for services that include certificates, configuration information, trust information, and images for deploying instances of the services. The packages can be used to deploy the services in trusted environments and authenticated to deploy in sub environments of un-trusted environments. The sub environments are trusted by the trusted environments. Also, clouds are prospected for purposes of identifying desirable clouds and creating the packages for deployment.

Claims

1. A method, comprising:

obtaining, by a hardware processor, an environment specification for a trusted target environment, the environment specification obtained within an initiating trusted environment;

creating, by the hardware processor, a package using the environment specification to include;

certificates, keys, a service image for a migrating service that is migrating to the trusted target environment, a service identifier for the migrating service, and a package identifier for the package;

establishing, by the hardware processor, trust configuration information for the trusted target environment having a trust configuration identifier;

including, by the hardware processor, the trust configuration information in the package;

sending, by the hardware processor, the package to a target service in the trusted target environment for deployment of an instance of the migrating service, via the service image, within the trusted target environment by processing components of the package;

receiving notice from the trusted target environment that the instance of the migrating service is deployed for interacting with the initiating trusted environment; and

receiving interaction from the instance of the migrating service by one or more other services within the initiating trusted environment.

2. The method of claim 1, wherein obtaining further includes recognizing the initiating trusted environment and the trusted target environment are in a same physical location or in clouds owned by a same cloud provider.

3. The method of claim 1, wherein obtaining further includes recognizing the initiating trusted environment and the trusted target environment are in different physical locations or in clouds owned by different cloud providers.

4. The method of claim 1, wherein creating further includes generating the certificates and the keys within the initiating trusted environment.

5. The method of claim 1, wherein creating further includes receiving the certificates and keys from the trusted target environment.

6. A non-transitory computer-readable medium having executable instructions that when executed by a hardware computing device performs a method, to:

obtain an environment specification for a trusted target environment, the environment specification obtained within an initiating trusted environment;

create a package to migrate a service image for a service to the trusted target environment using the environment specification, establishing trust configuration information for the trusted target environment having a trust configuration identifier, the package including trust configuration information, and the packaging including certificates, keys, a service image for a migrating service that is migrating to the trusted target environment, a service identifier for the migrating service, and a package identifier for the package;

send the package to a target service in the trusted target environment for deploying an instance of the migrating service using the package through the service image and by processing components of the package within the trusted environment;

receive notice from the trusted environment that an instance of the migrating service is deployed for interacting with the initiating trusted environment; and

receive interaction from the instance of the migrating service by one or more other services within the initiating trusted environment.

7. The medium of claim 6, wherein the instruction to obtain further includes instructions to locate the specification in one or more clouds owned by a same cloud provider.

8. The medium of claim 6, wherein the instruction to obtain further includes instructions to acquire the specification from the trusted environment.

9. The medium of claim 6, wherein the instruction to create further includes instructions to provide the certificates and the keys within the package for use by the service once deployed to the trusted environment.

10. The medium of claim 9, wherein the instruction to provide further includes instructions to receive the certificates and the keys from the trusted environment.

11. The medium of claim 9, wherein the instruction to provide further includes instructions to generate the certificate and the keys independent of the trusted environment.

12. A system, comprising:

a hardware processor;

an ad hoc and trusted service deployer configured and adapted to;

i) execute on the hardware processor, ii) obtain an environment specification for a trusted target environment, the environment specification obtained within an initiating trusted environment, iii) create a deployment package based on the environment specification for a trusted target environment for a service being deployed to the trusted target environment, the package including certificates, keys, a service image for a migrating service that is migrating to the trusted target environment, a service identifier for the migrating service, and a package identifier for the package, iv) establish trust configuration information for the trusted target environment having a trust configuration identifier, v) include the trust configuration information in the package, vi) send the package to a target service in the trusted target environment for deployment of an instance of the migrating service, via the service image, within the trusted target environment by processing components of the package, vii) receive notice from the trusted target environment that an instance of the migrating service is deployed for interacting with the initiating trusted environment, and viii) receive interaction from the instance of the migrating service by one or more other services within the initiating trusted environment.

13. The system of claim 12, wherein the ad hoc and trusted service deployer is further adapted and configured to create the keys and the certificates within the deployment package for use by the service once deployed in the trusted environment.

14. The system of claim 12, wherein the ad hoc and trusted service deployer is further configured and adapted to obtain the specification from the trusted environment.

15. The system of claim 12, wherein the ad hoc and trusted service deployer is further adapted and configured, in iii), to:

send the package to a trusted service deployer within the trusted environment.