Collaborative rules based security

A cloud computing security system. An access manager module includes first and second client profiles. The first client profile has a first set of rules enabling access to a first set of cloud computing system resources, and the second client profile has a second set of rules enabling access to a second set of cloud computing system resources. A security logic module is in communication with the access manager module. The security logic module is configured to receive an access request for access to one of the first and second sets of cloud computing system resources. Responsive to determining that the access request complies with at least one of the first set of rules and the second set of rules, the security logic module is configured to provide an access grant that grants access to at least one of the first and second sets of cloud computing system resources.

BACKGROUND INFORMATION

The present disclosure relates generally to data processing systems and, in particular, to a method, computer program product, and apparatus for collaborative rules based security. Still more particularly, the present disclosure relates to a method, computer program product, and apparatus for collaborative rules-based security associated with cloud computing systems.

Cloud computing refers to providing computing resources, software, and information to clients on demand over the Internet, in a manner similar to an electricity grid. Cloud computing system services may include, without limitation, data as a service (DAAS), software as a service (SAAS), platform as a service (PAAS), infrastructure as a service (IAAS), and network as a service (NAAS).

Cloud computing services enable clients to purchase access to computing services that are supported on computer hardware and software owned and maintained by a cloud computing system provider. The cloud computing service users are able to purchase only those cloud computing services they require without having the burden of purchasing and maintaining the hardware, software, and information technologies necessary to support those services.

Cloud computing enables users to obtain easy access to cloud computing services over the Internet from remote computing sites. Users typically access cloud computing services through a web browser which enables the user to access cloud computing system software and applications as if the software, applications, and other data were installed locally on the users own computer.

As cloud computing systems become more readily available and demand for cloud computing system services increases, the need for faster, more efficient, reliable, and secure access to those services becomes increasingly important. Therefore, it would be advantageous to have a method and apparatus that takes into account one or more of the issues discussed above, as well as possibly other issues.

SUMMARY

An advantageous embodiment of the present disclosure provides a cloud computing security system. An access manager module includes first and second client profiles. The first client profile has a first set of rules enabling access to a first set of cloud computing system resources, and the second client profile has a second set of rules enabling access to a second set of cloud computing system resources. A security logic module is in communication with the access manager module. The security logic module is configured to receive an access request for access to one of the first and second sets of cloud computing system resources. Responsive to determining that the access request complies with at least one of the first set of rules and the second set of rules, the security logic module is configured to provide an access grant that grants access to at least one of the first and second sets of cloud computing system resources.

The advantageous embodiments also provide for a method for implementing cloud computing system security, the method implemented by a processor. An access request to at least one cloud computing system resource is evaluated against a set of rules associated with a requestor to determine compliance of the access request to the set of rules. Access is granted to the at least one cloud computing system resource to the requestor in response to a determination of compliance.

The advantageous embodiments also provide for a cloud computing apparatus. The cloud computing apparatus includes a security logic module. The cloud computing apparatus includes an access manager module in communication with the security logic module, wherein the access manager module is configured to receive an access request from a client device for access to at least one cloud computing system resource. The cloud computing apparatus includes a request validator module operatively coupled to the access manager module and configured to determine whether the access request is a valid request and whether a requestor associated with the client device is a valid candidate for utilization of the security logic module. The access manager module includes a plurality of client profiles, each profile in the plurality of client profiles having a set of rules defining granular access to the at least one cloud computing system resource by the client device. An access grant is provided upon determination of request compliance with the set of rules. The cloud computing apparatus includes an association definition module configured to establish a model network resource association compliant with the access grant.

The features, functions, and advantages can be achieved independently in various embodiments of the present disclosure or may be combined in yet other advantageous embodiments in which further details can be seen with reference to the following description and drawings.

DETAILED DESCRIPTION

The advantageous embodiments recognize that providers of cloud computing system services require secure means to deliver access to clients that are reliable and efficient. The advantageous embodiments recognize that there is a growing need for greater security and control over client access to cloud computing system resources.

Referring now toFIG. 1, a cloud computing system is shown in accordance with an advantageous embodiment. Cloud computing system100is a system for providing cloud computing system services to clients over the Internet. Cloud computing system100may be considered a cloud computing security system.

Cloud computing system100may be implemented as a system having computing resources available for utilization by clients. Examples of such resources include but are not limited to set of cloud computing system resources102. Cloud computing system100may also be implemented using a number of modules, as described further below. As used herein the term “module” refers to any of computer hardware, software, or a combination thereof that is configured to perform a corresponding function, such as those indicated below. Modules may be part of, or connected to, other modules in a manner calculated to achieve the functions of cloud computing system100, as described below.

Set of cloud computing system resources102is a set of one or more cloud computing system resources. A cloud computing system resource within set of cloud computing system resources102may include, without limitation, data as a service (DAAS)102A, platform as a service (PAAS)102B, software as a service (SAAS)102C, infrastructure as a service (IAAS)102D, network as a service (NAAS)102E, or any other service that may be provided by a cloud computing system. Set of cloud computing system resources102may be considered to be multiple sets of cloud computing system resources that are distinct from each other. Thus, for example, set of cloud computing system resources102may include a first set of cloud computing system resources102F and a second set of cloud computing system resources102G. First and second sets of cloud computing system resources102F and102G may include any of the services described above, or other resources. First and second sets of cloud computing system resources102F and102G may be the same sets of resources, or may be different sets of resources. First and second sets of cloud computing system resources102F and102G may be logical arrangements of resources for purposes of association with client profiles, such as first client profile107and second client profile108.

Access manager module104, in this example, is a cloud computing system component for managing client requests for access to at least one cloud computing system resource in set of cloud computing system resources102. Access manager module104may include, without limitation, plurality of client profiles105. Plurality of client profiles105is shown as having first client profile107and second client profile108. However, plurality of client profiles105may include more client profiles, or in an alternative advantageous embodiment may include only one client profile.

Each client profile in plurality of client profiles105includes a set of rules. As used herein, the term “set” refers to one or more items, unless defined otherwise herein. For example, first client profile107includes first set of rules106, and second client profile108includes second set of rules110. Each of first set of rules106and second set of rules110may include a single rule, or two or more rules. Each of first and second sets of rules enable access to one or more resources in set of cloud computing system resources102. Thus, for example, first set of rules106may enable access to first set of cloud computing system resources102F and second set of rules110may enable access to second set of cloud computing system resources102G. These two sets of cloud computing system resources may be the same or may be different. In an advantageous embodiment, access manager module104may maintain a profile, such as first client profile107, associated with requestor119. A corresponding set of rules, such as set of rules106, may define granular access to at least one cloud computing system resource in set of cloud computing system resources102.

In an embodiment, access to set of cloud computing system resources102may constitute granular access. Granular access refers to discrete access to resources in which access to a particular cloud computing resource is isolated to specific requestors and particular network service providers. Granular access enables isolation of access by a requestor to physical and logical cloud computing system resources, access to parts of a particular cloud computing resource, as well as discrete limitations on access to data available on cloud computing system100.

For example, but without limitation, security logic module112permits a user access to a resource, such as an email server. The granular access defined by rules in plurality of client profiles105may limit that user access to a particular email account on that email server, or even limit the user to sending emails to a select group of recipients. Likewise, granular access may be used to control data access and/or limit sharing of data between users accessing collaborative resources on cloud computing system100. Thus, for example, granular access may be used to limit sharing of data between users who are using the same network as a service resources or data as a service resources.

Security logic module112applies a set of rules, such as first or second sets of rules106or110, to enable granular access for various users requesting access to one or more cloud computing system resources. These various users may be one or more users, including human users, requests from hardware components, requests from software components, or combinations thereof, any of whom may be considered to be requestor119. Security logic module112may be a “security as a service” (SECaaS) collaborative, rules-based security logic component.

Security logic module112applies rules-based guidelines to resources within cloud computing system100for granularity of access provided to clients. Security logic module112applies rules, such as first set of rules106, to determine which hardware and/or software cloud computing system resources may be made available to a particular client, as well as cloud computing system platform hardware and software resource availability.

In an embodiment, security logic module112may be characterized as being in communication with access manager module104. Security logic module112may be configured to receive an access request114for access to one of the first and second sets of cloud computing system resources102F or102G. Security logic module112may be further configured to determine whether the access request114complies with at least one of the first set of rules106and the second set of rules110. If access request114complies with at least one of the first and second sets of rules, then security logic module112is configured to provide an access grant134that grants access to at least one of the first and second sets of cloud computing system resources102F or102G. Access grant134may take the form of notification132, or may be a part of notification132. Access grant134might instead take the form of an acceptance of a challenge issued by one or more of set of cloud computing system resources102. The advantageous embodiments described herein contemplate that access grant134may be associated with either notification132or the acceptance of a challenge. Thus, the term “access grant” should not be considered limited by how access is actually achieved.

Security logic module112isolates client access to hardware and software based cloud computing services based on security logic. Security logic module112receives access request114for access to set of cloud computing system resources102from a client device118associated with requestor119.

Client device118may be implemented as any type of data processing system, such as, without limitation, data processing system500shown inFIG. 5below. Client device118is a computing device associated with requestor119requesting access to at least one cloud computing system resource in set of cloud computing system resources102.

Requestor119requests access to physical and/or logical resources available on cloud computing system100, such as set of cloud computing system resources102. Requestor119may be a user external to cloud computing system100. Requestor119may be an entity, such as, without limitation, an individual, an organization, or any other type of entity.

In this example, client device118is a remote cloud computing service client associated with first client profile107. Client device118is requesting access to set of cloud computing system resources102provided by cloud computing system100.

Set of cloud computing system resources102may include resources that are hardware resources, software resources, or resources that are a combination of both hardware and software resources available on cloud computing system100.

Access request114is sent to cloud computing system100via network service120associated with client device118. Request validator module122determines whether access request114is a valid request. In an advantageous embodiment, request validator module122may be configured to compare access request114with at least one of the first and second sets of rules106and110to determine compliance of access request114with those rules. In an advantageous embodiment, request validator module122is further configured to interrogate access request114and determine whether requestor119associated with access request114is a valid candidate for utilization of security logic module112. Likewise, request validator module122may be further configured to interrogate access request114to determine whether a network service associated with the access request114is a valid candidate for utilization of the security logic module112.

Request validator module122may interrogate access request114to determine whether client device118is a valid candidate for access to set of cloud computing system resources102. Request validator module122may also interrogate access request114to determine if network service120associated with client device118is a valid candidate for access to set of cloud computing system resources102.

Profile compliance module124evaluates access request114against first set of rules106associated with first client profile107to determine whether access request114is in compliance with first set of rules106. In an example, first set of rules106may specify that client device118may utilize third tier and second tier billing software services, but client device118may not utilize the top tier billing software.

Security logic module112denies access to client device118if access request114is non-compliant with first set of rules106. In other words, if any rule in first set of rules106does not permit client device118to access and/or utilize set of cloud computing system resources102, security logic module112does not authorize access request114.

In response to a determination that access request114is in compliance with first set of rules106, association definition module126establishes model network resource association128to be compliant with the access grant134. Model network resource association128is an association of set of cloud computing system resources102to client device118. Association definition module126modifies first client profile107of client device118to accommodate model network resource association128. Association definition module126may create or maintain a network service association definition129. Thus, in an advantageous embodiment, responsive to evaluating the access request114and a determination of compliance with a set of rules such as first set of rules106, association definition module126may establish a model network resource association128to form a network services association definition129. Likewise, responsive to evaluating the access request114, the access manager module104may modify a profile associated with requestor119, such as first client profile107, within plurality of client profiles105to include a network service association definition129. This function might also be performed by association definition module126.

In an advantageous embodiment, at least one cloud computing system resource may be a network as a service, such as network as a service102E. In this case, security logic module112may enable granular access to shared data102I in collaborative environment102H accessed through network as a service102E.

Notification preparation module130generates notification132to client device118. Notification132may transmit either access grant134, indicating an acceptance of access request114, or access denial136, indicating a denial of access request114.

Some, part, or all of the components shown inFIG. 1may be considered computer processing means or data processing means.FIG. 1is intended as an example, and not as an architectural limitation for the different advantageous embodiments.

FIG. 2is a cloud computing system with a set of cloud service clients in accordance with an advantageous embodiment. Cloud computing system200is a cloud computing system, such as cloud computing system100inFIG. 1.FIG. 2is intended as an example, and not as an architectural limitation for the different advantageous embodiments.

Cloud computing system200may include, without limitation, hardware, software, and/or wetware. The hardware associated with cloud computing system200may include any type of hardware, such as, without limitation, a servers, a routers, a hard drives, a processors, a secondary data storage device, as well as any other type of computer hardware.

Cloud computing system200may utilize one or more network architectures, such as, without limitation, the Internet, Extranet, Ethernet, Intranet, local area network (LAN), virtual private network (VPN), perimeter network, and/or any other type of network.

Cloud computing system200may provide any type of cloud services, such as, without limitation, data as a service, software as a service, platform as a service, infrastructure as a service, network as a service, or any other service that may be provided by a cloud computing system.

In this example, cloud computing system200provides services to client A202, client B204, and client C206over an Internet connection. Cloud computing system200in this example is only providing services to three clients. However, cloud computing system200may provide services to any number of clients over the Internet.

FIG. 3is a block diagram illustrating a cloud computing system in accordance with an advantageous embodiment. Cloud computing system300may be implemented as any type of networked data processing system for providing services to clients over the Internet, such as, without limitation, cloud computing system100inFIG. 1and cloud computing system200inFIG. 2.

Infrastructure as a service302may provide computer infrastructure as a platform virtualization environment to clients as a service. Infrastructure as a service302may provide clients with access to services, software, and data maintained and supported on cloud computing system300.

An example of infrastructure as a service302may be network as a service304. Network as a service304may provide access to network resources to remote clients on demand. In this manner, cloud computing system300may provide network resources and network management services to clients.

Platform as a service306may deliver computer platform services to clients. A platform refers to the hardware architecture and software framework that allows software to run. Platform as a service306provides a virtualized platform for running software to clients over the Internet or other network connection.

Data as a service308provides data on demand to remote clients. Data as a service308reduces client costs associated with data storage devices, data organization, and data backup.

Software as a service310delivers access to software over the Internet or other network to remote clients. The remote client accesses and utilizes the software without installing or running the software on the local computer utilized by the remote client.

Returning to infrastructure as a service302, an example of network as a service304may be security logic module312. Security logic module312is a rules based logic module for controlling and managing access to cloud computing system300services, such as, without limitation, security logic module112inFIG. 1. Security logic module312controls access to services by a requesting client based on contractual obligations, which may take the form of set of profiles314containing set of rules316.

Set of profiles314is a set of one or more client profiles, such as, without limitation, plurality of client profiles105inFIG. 1. In this example, set of profiles314is implemented within security logic module312. However, set of profiles314may be stored in a database or other data storage device implemented separately from security logic module312that is accessible to security logic module312.

Set of profiles314includes set of rules316which delineate discrete and granular access applied to clients requesting access to cloud computing system services based on business logic, contractual agreements, relationships, as well as any other criteria. Clients may access the services associated with the physical devices and/or logical devices associated with cloud computing system300through network as a service304by requesting access through security logic module312. Accessing the physical devices and/or logical devices contained in network as a service304through security logic module312grants secure access to cloud computing system resources and data. Likewise, security logic module312may be implemented to enable granular access to shared data in a collaborative environment in a set of cloud computing system resources accessed through the network as a service.

Some, part, or all of the components shown inFIG. 3may be considered computer processing means or data processing means.FIG. 3is intended as an example, and not as an architectural limitation for the different advantageous embodiments.

FIG. 4is a block diagram illustrating a security logic module in accordance with an advantageous embodiment. Security logic module400may be implemented as a rule-based security logic component, such as security logic module112inFIG. 1and security logic module312inFIG. 3.

Security logic module400receives a request for access to cloud computing services from clients402associated with network provider404over Internet406. Security logic module400allows clients402to access services associated with a cloud computing system based on rules associated with clients402. Security logic module400controls clients402access to physical devices and/or logical devices contained in network as a service408. One or more of clients402may be assigned participant address space410within network as a service408.

Some, part, or all of the components shown inFIG. 4may be considered computer processing means or data processing means.FIG. 4is intended as an example, and not as an architectural limitation for the different advantageous embodiments.

Turning now toFIG. 5, an illustration of a data processing system is depicted in accordance with an advantageous embodiment. Data processing system500may be a data processing system within a cloud computing system, such as cloud computing system100inFIG. 1, cloud computing system200inFIG. 2, and cloud computing system300inFIG. 3. Data processing system500may also be implemented as a client computer, such as client202-206inFIG. 2or a client in clients402inFIG. 4.

In this example, data processing system500includes communications fabric502, which provides communications between processor unit504, memory506, persistent storage508, communications unit510, input/output (I/O) unit512, and display514.

Memory506and persistent storage508are examples of storage devices516. A storage device is any piece of hardware that is capable of storing information, such as, for example, without limitation, data, program code in functional form, and/or other suitable information either on a temporary basis and/or a permanent basis. Storage devices516may also be referred to as computer readable storage devices in these examples. Memory506, may be, for example and without limitation, a random access memory or any other suitable volatile or non-volatile storage device. Persistent storage508may take various forms, depending on the particular implementation.

For example, persistent storage508may contain one or more components or devices. For example, persistent storage508may be a hard drive, a flash memory, a rewritable optical disk, a rewritable magnetic tape, or some combination of the above. The media used by persistent storage508also may be removable. For example, a removable hard drive may be used for persistent storage508.

Communications unit510, in these examples, provides for communications with other data processing systems or devices. In these examples, communications unit510is a network interface card. Communications unit510may provide communications through the use of either or both physical and wireless communications links.

Input/output unit512allows for input and output of data with other devices that may be connected to data processing system500. For example, input/output unit512may provide a connection for user input through a keyboard, a mouse, and/or some other suitable input device. Further, input/output unit512may send output to a printer. Display514provides a mechanism to display information to a user.

Instructions for the operating system, applications, and/or programs may be located in storage devices516, which are in communication with processor unit504through communications fabric502. In these examples, the instructions are in a functional form on persistent storage508. These instructions may be loaded into memory506for execution by processor unit504. The processes of the different advantageous embodiments may be performed by processor unit504using computer implemented instructions, which may be located in a memory, such as memory506.

These instructions are referred to as program code, computer usable program code, or computer readable program code that may be read and executed by a processor in processor unit504. The program code in the different advantageous embodiments may be embodied on different physical or computer readable storage media, such as memory506or persistent storage508.

Program code518is located in a functional form on computer readable media520that is selectively removable and may be loaded onto or transferred to data processing system500for execution by processor unit504. Program code518and computer readable media520form computer program product522in these examples. In one example, computer readable media520may be computer readable storage media524or computer readable signal media526. Computer readable storage media524may include, for example, an optical or magnetic disk that is inserted or placed into a drive or other device that is part of persistent storage508for transfer onto a storage device, such as a hard drive, that is part of persistent storage508. Computer readable storage media524also may take the form of a persistent storage, such as a hard drive, a thumb drive, or a flash memory, that is connected to data processing system500. In some instances, computer readable storage media524may not be removable from data processing system500. In these examples, computer readable storage media524is a non-transitory computer readable storage medium.

Alternatively, program code518may be transferred to data processing system500using computer readable signal media526. Computer readable signal media526may be, for example, a propagated data signal containing program code518. For example, computer readable signal media526may be an electromagnetic signal, an optical signal, and/or any other suitable type of signal. These signals may be transmitted over communications links, such as wireless communications links, optical fiber cable, coaxial cable, a wire, and/or any other suitable type of communications link. In other words, the communications link and/or the connection may be physical or wireless in the examples.

In some advantageous embodiments, program code518may be downloaded over a network to persistent storage508from another device or data processing system through computer readable signal media526for use within data processing system500. For instance, program code stored in a computer readable storage medium in a server data processing system may be downloaded over a network from the server to data processing system500. The data processing system providing program code518may be a server computer, a client computer, or some other device capable of storing and transmitting program code518.

The different components illustrated for data processing system500are not meant to provide architectural limitations to the manner in which different advantageous embodiments may be implemented. The different advantageous embodiments may be implemented in a data processing system including components in addition to or in place of those illustrated for data processing system500. Other components shown inFIG. 5can be varied from the examples shown. The different advantageous embodiments may be implemented using any hardware device or system capable of running program code. As one example, the data processing system may include organic components integrated with inorganic components and/or may be comprised entirely of organic components excluding a human being. For example, a storage device may be comprised of an organic semiconductor.

In still another example, processor unit504may be implemented using a combination of processors found in computers and hardware units. Processor unit504may have a number of hardware units and a number of processors that are configured to run program code518. With this depicted example, some of the processes may be implemented in the number of hardware units, while other processes may be implemented in the number of processors.

As another example, a storage device in data processing system500is any hardware apparatus that may store data. Memory506, persistent storage508, and computer readable media520are examples of storage devices in a tangible form.

Some, part, or all of the components shown inFIG. 5may be considered computer processing means or data processing means.FIG. 5is intended as an example, and not as an architectural limitation for the different advantageous embodiments.

FIG. 6is an illustration of a flowchart of a process for cloud computing system security in accordance with an advantageous embodiment. The process inFIG. 6may be implemented in a rules based security component, such as security logic module112inFIG. 1, security logic module312inFIG. 3, or security logic module400inFIG. 4.

The process begins by evaluating a request for access to at least one cloud computing system resource against a set of rules associated with a requestor (operation602). The process makes a determination as to whether the request is in compliance with the set of rules (operation604).

If the request is in compliance with the set of rules, an access grant is provided to the at least one cloud computing system resource (operation606). The process terminates thereafter. Returning now to step604, if the request is non-compliant with the set of rules, access to the at least one cloud computing system resource is denied (operation608) with the process terminating thereafter.

FIG. 7is an illustration of a flowchart of a process for cloud computing services security in accordance with an advantageous embodiment. The process inFIG. 7may be implemented in a rules based security component, such as security logic module112inFIG. 1, security logic module312inFIG. 3, or security logic module400inFIG. 4.

The process begins by receiving a request for access to a resource of a cloud computing system from a requestor (operation702). A determination is made as to whether the requestor and a network service of the requestor is a valid candidate (operation704). If the requestor and the network service are valid candidates, a network service association definition is established (operation706).

A profile associated with the requestor is updated to accommodate the network service association definition (operation708). A notification of access grant is generated (operation710). The notification is sent to the requestor (operation712) with the process terminating thereafter.

Returning now to operation704, if the requestor or the network service is not a valid candidate, a notification of denial of the request is generated (operation714). The notification is sent to the requestor (operation712) with the process terminating thereafter.

The different advantageous embodiments can take the form of an entirely hardware embodiment, an entirely software embodiment, or an advantageous embodiment containing both hardware and software elements. Some advantageous embodiments are implemented in software, which includes but is not limited to forms, such as, for example, firmware, resident software, and microcode.

In one advantageous embodiment, a method and system for cloud computing system security is provided. An access manager includes a plurality of client profiles. Each profile in the plurality of client profiles includes a set of rules enabling access to a set of cloud computing system resources. A security logic module communicates with the access manager to receive a request for access to at least one cloud computing system resource. Access is granted and denied upon determining access request compliance with the set of rules.

In another advantageous embodiment, an access manager evaluates an access request to at least one cloud computing system resource against a set of rules associated with a requestor to determine compliance. The access manager grants access to the at least one cloud computing system resource to the requestor in response to the determined compliance.

Access to the resource is granted in response to a determination that the request is in compliance with the set of rules. Access to the resource is denied in response to a determination that the request is non-compliant with the set of rules.

The security logic module of the advantageous embodiments provide a network pattern to enable various users to share data, services, and cost information based on rights of the users on a need to know basis. The security logic module permits users to collaborate throughout a project lifecycle, to share physical devices, logical devices, data and other resources, and obtain more secure access to cloud computing services.

The flowcharts and block diagrams in the different depicted advantageous embodiments illustrate the architecture, functionality, and operation of some possible implementations of apparatus, methods and computer program products. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of computer usable or readable program code, which comprises one or more executable instructions for implementing the specified function or functions. In some alternative implementations, the function or functions noted in the block may occur out of the order noted in the figures. For example, in some cases, two blocks shown in succession may be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved.

As used herein, the phrase “at least one of”, when used with a list of items, means that different combinations of one or more of the listed items may be used and only one of each item in the list may be needed. For example, “at least one of item A, item B, and item C” may include, for example, without limitation, item A only, both item A and item B, or all of item A, item B, and item C. This example also may include item A, item B, and item C or item B and item C.