Decoupling hardware and software components of network security devices to provide security software as a service in a distributed computing environment

• US 9,456,003 B2
• Filed: 07/24/2013
• Issued: 09/27/2016
• Est. Priority Date: 07/24/2013
• Status: Active Grant

• Current Assignee: Kyocera Corporation
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: O'Hern, William A., Amoroso, Edward G., Barry, Michelle, Ramos, Anthony, Solero, Daniel, Sparrell, Duncan Kirkwood, Dilts, Rodney
• Primary Examiner(s): Hailu, Teshome
• Assistant Examiner(s): Le, Thanh
• Application Number:
  US13/949,695
• Publication Number:
  US 20150033282A1
• Time in Patent Office: 1,161 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 2009/4557 Distribution of virtual machine instances; Migration and load balancing
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

Concepts and technologies are disclosed herein for decoupling hardware and software components of network security devices to provide security software as a service in a distributed computing environment. A computer system includes a processor that can execute computer-executable instructions to perform various operations. The processor can perform operations to provide security services to one or more customer platforms. The operations can include receiving a network security software component from a security service provider, and deploying the network security software component within a distributed computing environment so that the network security software component can be executed by a computing resource of the distributed computing environment to provide a security service to the customer platform(s). The network security software component includes a software component that has been decoupled from a hardware component of a network security device by the security service provider.

Claims

1. A computer system, comprising:

a processor; and

a memory that stores computer-executable instructions which, when executed by the processor, cause the processor to perform operations comprising;

receiving a network security software component from a security service provider, wherein the network security software component has been decoupled from a hardware component of a network security device by the security service provider,

deploying the network security software component within a distributed computing environment so that the network security software component can be executed by a computing resource associated with the distributed computing environment to provide a security service to a customer platform;

exposing an application programming interface to the customer platform to provide on-demand access to the security service provided by the network security software component;

receiving an application programming interface call from the customer platform, wherein the application programming interface call identifies an asset associated with the customer platform for protection by the security service and a selection of the security service to protect the asset; and

in response to receiving the application programming interface call, providing the security service to the customer platform.

2. The computer system of claim 1, wherein the customer platform comprises a mobile device.

3. The computer system of claim 1, wherein the asset is a virtualized asset operating within the distributed computing environment.

4. The computer system of claim 1, wherein the operations further comprise provisioning the network security software component to protect the asset, and providing the security service to protect the asset.

5. The computer system of claim 4, wherein the operations further comprise:

receiving a further network security software component from a further security service provider, wherein the further network security software component has been decoupled from a further hardware component of a further network security device by the further security service provider, and

deploying the further network security software component within the distributed computing environment so that the further network security software component can be executed by the computing resource to provide a further security service to the customer platform.

6. The computer system claim 5, wherein the operations further comprise provisioning the further network security software component to protect the asset, and providing the further security service to the customer platform to further protect the asset.

7. The computer system of claim 5, wherein the operations further comprise provisioning the further network security software component to protect a further asset, and providing the further security service to the customer platform to protect the further asset independent of the security service provided to the customer platform to protect the asset.

8. A method comprising:

receiving, at a computer system comprising a processor, a network security software component from a security service provider, wherein the network security software component has been decoupled from a hardware component of a network security device by the security service provider;

deploying, by the computer system, the network security software component within a distributed computing environment so that the network security software component can be executed by a computing resource associated with the distributed computing environment to provide a security service to a customer platform;

exposing an application programming interface to the customer platform to provide on-demand access to the security service provided by the network security software component, wherein the application programming interface call identifies an asset associated with the customer platform for protection by the security service, and a selection of the security service to protect the asset;

receiving an application programming interface call from the customer platform; and

in response to receiving the application programming interface call, providing the security service to the customer platform.

9. The method of claim 8, wherein the computer system operates within the distributed computing environment.

10. The method of claim 8, further comprising provisioning the network security software component to protect the asset, and providing the security service to protect the asset.

11. The method of claim 8, further comprising charging the security service provider a fee for deploying the network security software component within the distributed computing environment.

12. The method of claim 11, further comprising charging the customer platform a fee for utilizing the security service.

13. A computer-readable storage medium having instructions stored thereon that, when executed by a processor, cause the processor to perform operations comprising:

receiving a network security software component from a security service provider, wherein the network security software component has been decoupled from a hardware component of a network security device by the security service provider;

deploying the network security software component within a distributed computing environment so that the network security software component can be executed by a computing resource associated with the distributed computing environment to provide a security service to a customer platform;

exposing an application programming interface to the customer platform to provide on-demand access to the security service provided by the network security software component;

receiving an application programming interface call from the customer platform, wherein the application programming interface call identifies an asset associated with the customer platform for protection by the security service and a selection of the security service to protect the asset; and

in response to receiving the application programming interface call, providing the security service to the customer platform.

14. The computer-readable storage medium of claim 13, wherein the asset is a virtualized asset operating within the distributed computing environment.

19. The computer-readable storage medium of claim 13, wherein the operations further comprise comprising charging the security service provider a fee for deploying the network security software component within the distributed computing environment.

20. The computer-readable storage medium of claim 19, wherein the operations further comprise charging the customer platform a fee for utilizing the security service.

15. The computer-readable storage medium of 13, wherein the operations further comprise provisioning the network security software component to protect the asset, and providing the security service to protect the asset.

16. The computer-readable storage medium of 15, wherein the operations further comprise:

receiving a further network security software component from a further security service provider, wherein the further network security software component has been decoupled from a further hardware component of a further network security device by the further security service provider; and

deploying the further network security software component within the distributed computing environment so that the further network security software component can be executed by the computing resource to provide a further security service to the customer platform.

17. The computer-readable storage medium of 16, wherein the operations further comprise provisioning the further network security software component to protect the asset, and providing the further security service to the customer platform to further protect the asset.

18. The computer-readable storage medium of 17, wherein the operations further comprise provisioning the further network security software component to protect a further asset, and providing the further security service to the customer platform to protect the further asset independent of the security service provided to the customer platform to protect the asset.