End-to-end secure cloud computing

• US 9,774,634 B2
• Filed: 05/12/2016
• Issued: 09/26/2017
• Est. Priority Date: 05/18/2010
• Status: Active Grant

• Current Assignee: Atlassian US, Inc. (Atlassian Corporation)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: de los Reyes, Gustavo, Beckett, William R., Birkes, Jerry, Chawla, Deepak K., Knight, Joshua David, Macwan, Sanjay, O'Hern, William
• Primary Examiner(s): McNally, Michael S
• Application Number:
  US15/152,880
• Publication Number:
  US 20160261637A1
• Time in Patent Office: 502 Days
• Field of Search: 726 1
• CPC Class Codes: H04L 41/5003 Managing SLA; Interaction between SLA and QoS
• CPC Class Codes: H04L 47/70 Admission control; Resource allocation
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

A method includes receiving, at a control node of a cloud computing network, a first enterprise policy specific to the first enterprise and a second enterprise policy specific to the second enterprise, and managing communications between at least one user device of the first enterprise and the at least one enterprise application hosted on behalf of the first enterprise based on the first enterprise policy. The method also includes managing communications between at least one user device of the second enterprise and the at least one enterprise application hosted on behalf of the second enterprise based on the second enterprise policy.

Claims

1. A system, comprising:

a memory that stores instructions; and

hardware that executes the instructions to perform operations, the operations comprising;

enforcing an enterprise policy of an enterprise so as to manage a communication between a thin client device of the enterprise and an enterprise application hosted by a network on behalf of the enterprise; and

configuring the thin client device to prevent storage of data associated with the enterprise application beyond a period of interaction between the thin client device and the enterprise application.

2. The system of claim 1, wherein the operations further comprise identifying the enterprise policy of the enterprise.

3. The system of claim 1, wherein the operations further comprise providing the enterprise policy to a service provider that manages the network.

4. The system of claim 1, wherein the operations further comprise identifying the enterprise application hosted by the network on behalf of the enterprise.

5. The system of claim 1, wherein the operations further comprise configuring the thin client device to prevent installation and execution of non-authorized software.

6. The system of claim 1, wherein the operations further comprise allocating resources of the network for hosting the enterprise application.

7. The system of claim 6, wherein the operations further comprise allocating the resources based on a requirement of the thin client device.

8. The system of claim 1, wherein the operations further comprise enabling the thin client device to utilize a wireless connection of a mobile device communicatively linked to the thin client device.

9. The system of claim 1, wherein the operations further comprise identifying enterprise data of the enterprise to be stored on the network.

10. The system of claim 1, wherein the operations further comprise installing a remote desktop protocol client at a user device associated with the thin client device.

11. The system of claim 1, wherein the operations further comprise configuring proxy information for a web browser implemented at a user device associated with the thin client device.

12. The system of claim 1, wherein the operations further comprise translating between a first encryption system utilized by a client system utilized by a user device associated with the thin client device and a second encryption system utilized by an internal secure network.

13. The system of claim 1, wherein the operations further comprise routing traffic in and out of the network in accordance with the enterprise policy.

14. A method, comprising:

managing, by enforcing an enterprise policy of an enterprise, a communication between a thin client device of the enterprise and an enterprise application hosted by a network on behalf of the enterprise; and

configuring, by utilizing instructions from a memory that are executed by a processor, the thin client device to prevent storage of data associated with the enterprise application beyond a period of interaction between the thin client device and the enterprise application.

15. The method of claim 14, further comprising modifying, based on the enterprise policy, a packet header for traffic coming from a user device associated with the thin client device.

16. The method of claim 14, further comprising enabling the thin client device to utilize a wireless connection of a mobile device communicatively linked to the thin client device.

17. The method of claim 14, further comprising tethering the thin client device to a user device via a wired connection.

18. The method of claim 14, further comprising creating the enterprise policy.

19. The method of claim 14, further comprising selecting a user device to operate as a conduit for the communication between the thin client device and the enterprise application.

20. A non-transitory computer-readable device comprising instructions, which, when loaded and executed by a processor, cause the processor to perform operations, the operations comprising:

generating an enterprise policy of an enterprise for managing a communication between a thin client device of the enterprise and an enterprise application hosted by a network on behalf of the enterprise; and

configuring the thin client device to prevent storage of data associated with the enterprise application beyond a period of interaction between the thin client device and the enterprise application.