Extending infrastructure security to services in a cloud computing environment

A cloud deployment appliance (or other platform-as-a-service (IPAS) infrastructure software) includes a mechanism to deploy a product as a “shared service” to the cloud, as well as to enable the product to establish a trust relationship between itself and the appliance or IPAS. The mechanism further enables multiple products deployed to the cloud to form trust relationships with each other (despite the fact that each deployment and each product typically, by the nature of the cloud deployment, are intended to be isolated from one another). In addition, once deployed and provisioned into the cloud, a shared service can become part of a single sign-on (SSO) domain automatically. SSO is facilitated using a token-based exchange. Once a product registers with a token service, it can participate in SSO. This approach enables enforcement of consistent access control policy across product boundaries, and without requiring a user to perform any configuration.

BACKGROUND OF THE INVENTION

1. Technical Field

This disclosure relates generally to establishing a trusted computing environment across distinct security domains in the context of a “cloud” compute environment.

2. Background of the Related Art

An emerging information technology (IT) delivery model is cloud computing, by which shared resources, software and information are provided over the Internet to computers and other devices on-demand. Cloud computing can significantly reduce IT costs and complexities while improving workload optimization and service delivery. With this approach, an application instance can be hosted and made available from Internet-based resources that are accessible through a conventional Web browser over HTTP. An example application might be one that provides a common set of messaging functions, such as email, calendaring, contact management, and instant messaging. A user would then access the service directly over the Internet. Using this service, an enterprise would place its email, calendar and/or collaboration infrastructure in the cloud, and an end user would use an appropriate client to access his or her email, or perform a calendar operation.

Cloud compute resources are typically housed in large server farms that run network applications, typically using a virtualized architecture wherein applications run inside virtual servers, or so-called “virtual machines” (VMs), that are mapped onto physical servers in a data center facility. The virtual machines typically run on top of a hypervisor, which is a control program that allocates physical resources to the virtual machines.

It is known in the art to provide an appliance-based solution to facilitate rapid adoption and deployment of cloud-based offerings. One such appliance is IBM® Workload Deployer, which is based on the IBM DATAPOWER® 7199/9005 product family. Typically, the appliance is positioned directly between the business workloads that many organizations use and the underlying cloud infrastructure and platform components. Because of this unique position, the appliance can receive and act upon operational data, and it can monitor application workload demand conditions and adjust resource allocation or prioritization as required to achieve established service level agreements. IBM Workload Deployer (IWD) also may be used to manage a shared, multi-tenant environment, where isolation and security are important.

IBM Workload Deployer and, more generally, platform-as-a-service (PAS) infrastructure software (IPAS), can be extended by installing additional services for the cloud computing environment. Some examples include, for example, caching services to add a data caching capability to virtual applications, monitoring services to monitor health and performance status of virtual applications, and the like. Often, the new service is provided by a commercial product that has its own built-in security mechanisms including, for example, user management, authentication and access control. While it can be quite advantageous to add such services, there is no simple way to integrate such products with the cloud computing infrastructure to provide users seamless security integration with single sign-on (SSO) behavior, and consistent and unified access control policy. This is because, typically, these additional services are installed in a manner similar to any new deployment, meaning that they are installed into their own separate security domain (for isolation).

To illustrate the problem, it is well-known that different monitoring products frequently are used to monitor different parts and aspects of a system's resources. Thus, for example, there are monitor products that monitor health status and performance of physical resources, such as the virtual machine, CPU, memory and disk storage usage; other monitoring tools monitor database health, utilization and throughput performance. When installing such disparate products in an IBM Workload Deployer (or IPAS) environment, an administrator may receive a general warning that, say, a virtual machine is not functioning properly. To view the general status in more detail, the administrator then clicks on a resource link to one monitoring product but, by doing so, but then he or she discovers that the problem is caused by a database subsystem being monitored by another product. In this process, the administrator moves from one monitoring product to a different one, which involves traversing through different trust domains and different resource representations. This requirement greatly complicates the deployment and management operations.

Currently, there is no easy way to link multiple products together, to integrate them with the cloud computing infrastructure, and to present an integral management system.

This disclosure addresses this problem.

BRIEF SUMMARY

According to this disclosure, a cloud deployment appliance (or other platform-as-a-service (IPAS) infrastructure software) includes a mechanism to deploy a product as a “shared service” to the cloud, as well as to enable the product to establish a trust relationship between itself and the appliance or IPAS. The mechanism further enables multiple products deployed to the cloud to form trust relationships with each other (despite the fact that each deployment and each product typically, by the nature of the cloud deployment, are intended to be isolated from one another). In addition, once deployed and provisioned into the cloud, a shared service can become part of a single sign-on (SSO) domain automatically. SSO is facilitated using a token-based exchange. Once a product registers with a token service, it can participate in SSO. This approach enables enforcement of consistent access control policy across product boundaries, and without requiring a user to perform any configuration.

The foregoing has outlined some of the more pertinent features of the invention. These features should be construed to be merely illustrative. Many other beneficial results can be attained by applying the disclosed invention in a different manner or by modifying the invention as will be described.

DETAILED DESCRIPTION OF AN ILLUSTRATIVE EMBODIMENT

As will be seen, the techniques described herein may operate in conjunction within the standard client-server paradigm such as illustrated inFIG. 1in which client machines communicate with an Internet-accessible Web-based portal executing on a set of one or more machines. End users operate Internet-connectable devices (e.g., desktop computers, notebook computers, Internet-enabled mobile devices, or the like) that are capable of accessing and interacting with the portal. Typically, each client or server machine is a data processing system such as illustrated inFIG. 2comprising hardware and software, and these entities communicate with one another over a network, such as the Internet, an intranet, an extranet, a private network, or any other communications medium or link. A data processing system typically includes one or more processors, an operating system, one or more applications, and one or more utilities. The applications on the data processing system provide native support for Web services including, without limitation, support for HTTP, SOAP, XML, WSDL, UDDI, and WSFL, among others. Information regarding SOAP, WSDL, UDDI and WSFL is available from the World Wide Web Consortium (W3C), which is responsible for developing and maintaining these standards; further information regarding HTTP and XML is available from Internet Engineering Task Force (IETF). Familiarity with these standards is presumed.

Cloud Computing Model

Cloud computing is a model of service delivery for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g. networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal management effort or interaction with a provider of the service. This cloud model may include at least five characteristics, at least three service models, and at least four deployment models, all as more particularly described and defined in “Draft NIST Working Definition of Cloud Computing” by Peter Mell and Tim Grance, dated Oct. 7, 2009.

In particular, the following are typical Characteristics:

The Service Models typically are as follows:

The Deployment Models typically are as follows:

A cloud computing environment is service-oriented with a focus on statelessness, low coupling, modularity, and semantic interoperability. At the heart of cloud computing is an infrastructure comprising a network of interconnected nodes. A representative cloud computing node is as illustrated inFIG. 2above. In particular, in a cloud computing node there is a computer system/server, which is operational with numerous other general purpose or special purpose computing system environments or configurations. Examples of well-known computing systems, environments, and/or configurations that may be suitable for use with computer system/server include, but are not limited to, personal computer systems, server computer systems, thin clients, thick clients, hand-held or laptop devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputer systems, mainframe computer systems, and distributed cloud computing environments that include any of the above systems or devices, and the like. Computer system/server may be described in the general context of computer system-executable instructions, such as program modules, being executed by a computer system. Generally, program modules may include routines, programs, objects, components, logic, data structures, and so on that perform particular tasks or implement particular abstract data types. Computer system/server may be practiced in distributed cloud computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed cloud computing environment, program modules may be located in both local and remote computer system storage media including memory storage devices.

Referring now toFIG. 3, by way of additional background, a set of functional abstraction layers provided by a cloud computing environment is shown. It should be understood in advance that the components, layers, and functions shown inFIG. 3are intended to be illustrative only and embodiments of the invention are not limited thereto. As depicted, the following layers and corresponding functions are provided:

Thus, a representative cloud computing environment has a set of high level functional components that include a front end identity manager, a business support services (BSS) function component, an operational support services (OSS) function component, and the compute cloud component. The identity manager is responsible for interfacing with requesting clients to provide identity management, and this component may be implemented with one or more known systems, such as the Tivoli Federated Identity Manager (TFIM) that is available from IBM Corporation, of Armonk, N.Y. In appropriate circumstances TFIM may be used to provide federated single sign-on (F-SSO) to other cloud components. The business support services component provides certain administrative functions, such as billing support. The operational support services component is used to provide provisioning and management of the other cloud components, such as virtual machine (VM) instances. The cloud component represents the main computational resources, which are typically a plurality of virtual machine instances that are used to execute a target application that is being made available for access via the cloud. One or more databases are used to store directory, log, and other working data. All of these components (included the front end identity manager) are located “within” the cloud, but this is not a requirement. In an alternative embodiment, the identity manager may be operated externally to the cloud. The service provider also may be operated externally to the cloud.

Cloud Deployment Technologies

It is known to provide an appliance-based solution to facilitate rapid adoption and deployment of both Infrastructure and Platform as Service offerings. As described above, one such appliance is IBM Workload Deployer (IWD), and this appliance also may be used to manage a shared, multi-tenant environment, where isolation and security are of utmost importance. The secure nature of the physical appliance (sometimes referred to herein as a box) typically is provided by a self-disabling switch, which is triggered if the appliance cover is removed. This physical security enables the appliance to serve as a secure vault for credentials, which can be tied to virtual images throughout their entire lifecycle (in storage, being dispensed, running in the cloud, or being removed from the cloud). IBM Workload Deployer also contains a storage driver that streamlines the storage of image customizations. It also serves as a dedicated store for both pre-loaded and customized middleware virtual images and patterns. The appliance also includes advanced compression and storage techniques that enable a large number of these virtual images (each of which may be sizeable) to be stored.

In operation, the appliance can provision standard and customized middleware virtual images and patterns that can be securely deployed and managed within private or on-premise cloud computing environments. These virtual images can help organizations to develop, test, and deploy business applications easily and quickly, thus ending the manual, repetitive, and error prone processes that are often associated with creating these complex environments. Upon completion, resources are returned to the shared resource pool automatically for future use and are logged for internal charge-back purposes. The appliance also manages individual user and group access to resources, providing IT managers with the control needed to optimize efficiency at a fine-grain level.

Typically, the appliance includes hardware and firmware cryptographic support to encrypt all the data on hard disk. This data includes, without limitation, event log data. No users, including administrative users, can access any data on physical disk. In particular, the operating system (e.g., Linux) locks down the root account and does not provide a command shell, and the user does not have file system access. When an administrator performs a backup of the appliance, the backup image is encrypted to protect the confidentiality of the data. When restoring an encrypted image, a decryption key thus is needed to decrypt the backup image to enable the data to be restored to the appliance.

Referring toFIG. 4, a representative operating environment includes the physical appliance400, which interfaces to the cloud402. The appliance may be implemented using a data processing system such as described above with respect toFIG. 2. Preferably, the appliance400includes a Web 2.0-based user interface (UI), a command line interface (CLI), and REST-based application programming interfaces (APIs). The appliance provides a management function that enables the rapid deployment of cloud-based solutions. To that end, the appliance provides storage for (i) data404used to manage user and group access to resources, (ii) for pre-loaded and/or customizable middleware virtual images406, and (iii) for configurable patterns and script packages408. Patterns are logical descriptions of both the physical and virtual assets that comprise a particular solution. The management function and interfaces provide a template-based approach to construction that permits the rapid creation and modification of an otherwise complex set of hardware and software components. In particular, the use of patterns allows an organization to construct an individual element or integrated solution one time, and then to dispense the final product on demand. Typically, there are two types of patterns: virtual system patterns provide the most flexibility and customization options of the two types. It consists of an operating system and, potentially, additional software solutions, such as WebSphere® Application Server. Virtual application patterns are optimized and are constructed typically for the purpose of supporting a singular workload.

As also seen inFIG. 4, the on-premise or private cloud environment402on which the middleware application runs typically constitutes hypervisors, networking infrastructure, and storage devices that are allocated to the appliance. A representative environment may be implemented in the manner described above with respect toFIG. 3.

FIG. 5illustrates how the appliance can be used to build a custom private cloud. At step1, the hardware, hypervisors and networking for the cloud are identified. At step2, the user selects and customizes the virtual images. At step3, the user adds one or more script packages as needed to customize the deployed middleware environment. At step4, pre-installed or customized patterns are used to describe the middleware topology to be deployed. Patterns can be built from virtual images, e.g. using a drag-and-drop interface. At step5, the virtual systems are deployed to the cloud.

The references herein to IBM Workload Deployer are exemplary and should not be taken to limit the disclosed technique, which may be implemented on any appliance (or, more generally, machine) having the general characteristics and operating functionality that has been described. Specific references to IWD should be construed to include both the above-identified product, as well as other technologies that implement the functionality referenced above.

By way of additional background, it is assumed that the cloud environment (and a deployment appliance such as described) operates in a trust framework, which comprises a number of aspects. In this framework, public key technology is used to secure communications. The framework leverages a suite of security services that provide user authentication, token service, and a certificate authority. Every server process operative within the trust framework has its own (e.g., RSA) token and an RSA key pair. Trademark rights are claimed by a third party in the designation RSA. The server's identity and roles are represented by a server RSA token, which is signed by the token service; every request is endorsed by a server RSA key. Preferably, each cloud deployment has its own agent RSA token and RSA key pair. The agent's identity and roles are represented by an agent RSA token, which is signed by a deployment administrator RSA key; every request is signed by an agent RSA key. In addition, the integrity and confidentiality of requests are protected by transport layer encryption, such as SSL. Every server (and every deployment) has an SSL certificate and private key issued by the certificate authority.

Establishing Trust Relationships

In a cloud computing environment such as described, virtual machines (VMs) are regularly provided to handle different workload for different cloud customers. Because a VM is presumed to be provisioned in an unsecured environment, however, each VM should be in its own security zone. Each VM requires its own identity, token, keys and certificates, as well as a way to establish a trust relationship back to the cloud provider, preferably across different security domains.FIG. 6illustrates how a VM in a separate security zone can register itself and establish a trust relationship. During this process, and as will be described, the VM leverages two (2) mechanisms to establish the trust relationships. First, it receives registration artifacts from the cloud service provider; these artifacts include information the VM needs to talk to the cloud service provider. Second, the VM sends its own security information to the cloud service provider, preferably without revealing a private security key.

In general, this approach uses a security server, which is a process in the cloud that manages all of the security information within the cloud environment. When a virtual machine (VM) is provisioned, e.g., using the above-described appliance (or otherwise), the cloud service provider sends registration artifacts to the virtual machine through the security server. The registration artifacts typically include the security server's public key, security headers generated with the security server's private key, and an identification of the necessary roles for the VM to communicate back to the security server. Once the VM receives the registration artifacts, it generates a registration request to the security server using the information in the registration artifacts. The registration request typically includes the VM's public key, and a public certificate. The security server receives the VM's public key and the public certificate, adds the key to a key database, and stores the certificate in a trust key store. Once the security server processed the registration request from the VM, the security server generates a token and sends it back to the VM, thus completing the registration process and the key exchange.

FIG. 6illustrates how to establish a trust relationship between a shared service600and an IWD/IPAS security server602. In this embodiment, a deployment VM is provisioned to have shared service (e.g., RSA-based) token and associated (e.g., RSA-based) key pairs. Shared service providers specify an SSO services provisioning flag to be granted a shared service RSA token. Shared services otherwise are shielded from implementation details of the provisioning process.

FIG. 7is a more generalized example of setting up a trust relationship. In this embodiment, the IWD/IPAS system service700(in this example) establishes a trust relationship with the IWD/IPAS security server702. In this example, the deployment VM is provided with registration artifacts, which include a one-time use security token and a registration identifier (ID). In this approach, the system service700registers a set of one or more RSA public keys and, upon registration, receives corresponding RSA tokens. In theFIG. 7embodiment, the system service700retains its private key; thus, this approach is more secure that than shown inFIG. 6. InFIG. 7, neither entity has private keys of the other entity, so the two entities are on more equal terms with respect to the trust relationship. Also, the approach inFIG. 7is more flexible in that it enables a shared service itself to determine how many tokens it needs. The approach inFIG. 7further assumes that the two separate entities establish the trust relationship using a third channel by which a first entity gives a second entity (to which it desires the trust relationship) a minimum amount of secret data (e.g., a token) so as to construct the trust relationship.

Extending Infrastructure Security to Services

With the above as background, the subject matter of this disclosure is now described. Without limitation, the subject matter may be implemented within or in association with a cloud deployment appliance as has been described.

As used herein, a “shared service” is a service that is deployed by a cloud administrator and used by multiple virtual application deployments. Shared services may be of many different types, such as a caching service, a monitoring service, a proxy service (that provides routing and load balancing to multiple deployed web applications), and others.

A “shared services security model” according to this disclosure has several characteristic: a common security model for all IWD/IPAS shared services, and common security services for all IWD/IPAS shared services. Under the common security model, the IWD/IPAS security server manages user identity and access control policy, an IWD/IPAS security services utility library shields SSO token exchange details from shared services providers, and shared services providers extend IWD/IPAS access control to shared service resources. The common security services comprise user authentication services, user and group membership query, resource access control services, public key management, and trust relationship management. IWD/IPAS uses a security token (called RSAToken), to represent user identity and credentials, e.g., group membership and security roles. As will be described, IWD/IPAS also provides for user tokens, and these tokens are used to propagate user identity, credentials (group membership and security roles), and resource identifiers. In general, tokens (whether security tokens, or user tokens) are internal (system) constructs that are managed by a token service. A token exchange mechanism is used to facilitate shared services provisioning, as is now described.

This security model provides a seamless layer of security infrastructure to an application (with its own security infrastructure) running on a virtual machine in the cloud environment. A user (e.g., an administrator) registers to the layer of security infrastructure. Upon receiving a request by the user to add a service (e.g., a shared service) to the application (or to use that service, if previously deployed and enabled), the layer of security infrastructure is used to authenticate the user, preferably by communicating to the application using a private key. The application security infrastructure then adds (or enables access to) the service without requiring direct authentication from the user to the application security infrastructure.

FIG. 8illustrates the IWD/IPAS shared service single sign-on (SSO) model of this disclosure. This approach, as will be seen, facilitates integrating the shared service with a single sign-on to enable consistent and unified resource management across more than one service boundary. Familiarity with SSO operations is presumed. In this scenario, a representative “shared service” is a monitoring service (provided by a monitoring product), although this is not a limitation. The monitoring shared service may be accessed via its own monitor console; in this use case, however, access is desired via the deployment appliance console. In one use case scenario, which is merely exemplary, an administrator observes (in the IWS/IPAS console) a red status on a particular deployment, and clicks on the resource. This action leads the administrator to a monitoring console provided by the monitoring service. In this process, it is desired that the administrator is not required to register to the monitoring service software explicitly, does not need to authenticate to the monitoring software again, but can still view resources that he or she needs to monitor. The mechanism that is now described integrates such multiple services and provides SSO and consistent resource management across the service boundaries.

Thus, as illustrated, there interactions occur via IWD/IPAS console800, IWD/IPAS security service802, a monitor console804, and a monitor shared services provider806. The IWD/IPAS security service is implemented in the security server, which performs user identity management and access control policy management. This scenario assumes that the entities have established trust relationships in the manner previously described (in eitherFIG. 6orFIG. 7).

Although not shown, it is assumed that the user of the IWD/IPAS console has been authenticated in a known manner. The user is represented within the system (the IWD/IPAS console800and the IWD/IPAS security service802) by a first token805. This token is not provided (or exposed) to the user but, rather, is just an internal system data structure. The token, which identifies what privileges the user has and resources he or she can access, typically is maintained in the system in the clear and affords the user all deployment privileges suitable to the user's status. In other words, the first token is a general user token, includes no specific deployment constraints (with respect to the user's privileges). The first token805includes the usual information such as data identifying its “issuer” (the IWD/IPAS security service) and its “owner” (the IWD/IPAS appliance/console), key pairs, and the like.

According to the technique described above, the authenticated user selects a link (e.g., a button, an icon, an alert, or the like) in the IWD/IPAS console page identifying or otherwise associated with a resource (in this case, a resource being monitored by the service). As noted above, in one use case, the resource is associated with a particular status (e.g., a problem status), although this is not a limitation. As will be seen, this selection in effect triggers a “transfer of control” from the IWD/IPAS console800to the monitor console804so that the user can access and use the monitor shared service to determine the source of the problem (or otherwise to take some remedial or other permitted action). Because this transfer of control is carried out over a public network, a token exchange service is implemented. This token exchange service is provided by suitable software code (e.g., an IWD/IPAS security services utility library) that, preferably, is transparent to the shared services provider806and seamlessly to the end user. The operation works as follows.

At step812, the first user token805is signed and provided to the IWD/IPAS security service802. The security service802receives the token805, which is provided as cleartext, and, at step814, returns to the IWD/IPAS console800a secret816. The secret is protected by encryption and thus is opaque (and suitable for transport over the public network). At step818, the console808sends the secret816to the monitor console804. At step820, the monitor console signs request messages with the secret with its private key that is specified by a second “shared services” token815and, at step822, sends the signed messages and secret back to the IWD/IPAS security service802. The “shared services” token815is owned by the shared services provider806. The IWD/IPAS security service verifies the secret and, at step824, sends the monitor console804a shared services user token825. The shared services user token825differs from the first user token805in several important ways. Its “owner” is now the shared service, and it includes specific deployment constraints (whereas the general user token805did not). The shared services user token825includes the specific user identity and security roles that are authorized with respect to the shared service. The shared services user token825is used to access the monitor console automatically, after which the monitor console is displayed to the user. After the user selects (from the monitor console) some specific monitor operation, an access request is made from the monitor console804to the shared service806. The access request is shown at step826, and it includes the user identity and security roles that were propagated in the shared services user token. The shared service uses the user identity and security roles to facilitate its access control decision at step828. If access is permitted, the requested information (e.g., monitoring data) is provided at step830to complete the process.

In the shared service SSO model inFIG. 8, the token exchange is transparent to the user, and steps820,822and824are transparent to the shared services provider. As can be seen, and once the necessary trust relationships are established, the approach enables the shared service to participate seamlessly in the single sign-on (SSO) domain to facilitate unified access control.

FIG. 9illustrates a second embodiment, wherein the shared service is launched from a URL (such as a bookmark or icon in the first service console). This embodiment uses entities of the same type described inFIG. 8, namely, a web-based user interface (UI)900from the deployer appliance (or other IPAS), the security service902, the shared service web-based UI904, and the shared service906(represented by the URL). Appropriate trust relationships are presumed, as previously described. In this embodiment, the user901makes a request to access the monitoring shared service by selecting a bookmarked URL in the console900. This is step908. This action causes a redirect to a login page of the shared service UI904. This redirect is step910. In this embodiment, and instead of issuing a challenge to the user, the shared service UI904(having established the necessary trust relationship), issues a redirect to the IWD console900. This second redirect is step912. Steps910and912are transparent to the user901. At step914, the IWD console900issues a login challenge to the user901. The user posts his or her UID/password at step916. If the user901is authenticated, the IWD console900logs into the security service902at step918. The security service902responds at step920by returning the user token. At step922, the IWD console902issues a request to the security service for a secret token (e.g., an RSA Token). The security service responds at step924by returning the secret token. At step926, the IWD console900automatically redirects to the shared service page (the originally-requested URL), returning an IWD session token and the secret token it received from the security service at step924. At step926, the IWD900may optionally transform the resource identifier to one that is recognized by the shared service. At step928, the shared service makes a request to the security service902to exchange the secret token. The security service902responds at step930by returning the shared service user token. The shared service then issues the user the requested information at step932to complete the process.

As seen inFIG. 9, the redirects at steps910,912and926are transparent to the web client user. The steps922and924, and steps928and930, are transparent to the shared service provider. The token exchange in steps928and930inFIG. 9corresponds to the token exchange in steps822and824inFIG. 8.

The techniques herein facilitate shared service deployment in the cloud. The first embodiment is as described inFIG. 8. In this approach, when an administrator or deployer clicks on a first icon representing a service to be deployed, the system sends a secret token that represents the administrator or deployer to the service. Using a security server, the service exchanges the secret token with a user security token that represents the credentials of the administrator or the deployer. The service then validates the user security token by extracting user identity, group, security role, and resource identifier information. Using the extracted information, the service then makes access control decisions. In this approach, the user identity management, authentication and access control are managed by the cloud computing infrastructure. A service being deployed just needs to exchange and validate the user security token, validate the trust relationship, and then enforce the access control policy. The administrator or deployer is not challenged for authentication to the service and can access specified resource services with his or her own user credentials.

In theFIG. 9embodiment, and when the administrator or deployer clicks a second service icon (e.g., within a first service console), the service redirects to a management console for the cloud computing infrastructure. The redirect also specifies a resource and a second service to be accessed, as well as the secret token that represents the administrator or deployer. The cloud computing infrastructure forwards the secret token or optionally replaces it with a new secret token, and optionally transforms the resource identifier to one that is recognized by the second service. The console then redirects the request to the specified second service, which exchanges the secret token for a user security token to facilitate further access control, as described above. In this approach, the resource representation and optional conversion are performed by the cloud computing infrastructure software, so there is minimal processing required from the service.

The above-described subject matter provides many advantages. Generally, the techniques described herein enable the establishment of a trusted computing environment across security domains in a cloud computing environment. The described approach enables a cloud deployment appliance (or other IPAS) to easily integrate cloud computing infrastructure security and resource management with one or more additional services to provide seamless authentication and access control integration with minimal resource configuration synchronization and thus minimal management overhead. The approach reliably and securely extends cloud computing infrastructure security to one or more additional services, and it provides a mechanism to integrate multiple services and provide SSO and consistent resource management across service boundaries. Further, the techniques described herein enable application security infrastructure to add a new service without requiring direct authentication from the user to the application security infrastructure. Additional services may be integrated with a single sign-on (SSO). Using this approach, and has been described, consistent resource management is facilitated across more than one service boundary.

In this approach, the user identity management, authentication, and access control policy are managed by the cloud computing infrastructure, e.g., the IWD/IPAS. A service being shared just needs to exchange and validate the user security token, validate the trust relationship, and then enforce the access control policy. The IWD/IPAS administrator (or other deployer) does not need to be challenged for authentication to the service and can access specified resource services with just his or her IWD/IPAS user credentials.

While a preferred operating environment and use case (a cloud deployment appliance or other IPAS software) has been described, the techniques herein may be used in any other operating environment in which it is desired to deploy services.

As has been described, the functionality described above may be implemented as a standalone approach, e.g., a software-based function executed by a processor, or it may be available as a managed service (including as a web service via a SOAP/XML interface). The particular hardware and software implementation details described herein are merely for illustrative purposes are not meant to limit the scope of the described subject matter.

As explained, the scheme described herein may be implemented in or in conjunction with various server-side architectures including simple n-tier architectures, web portals, federated systems, and the like. The techniques herein may be practiced in a loosely-coupled server (including a “cloud”-based) environment.

In a representative embodiment, the interfaces and utility are implemented in a special purpose computing platform, preferably in software executed by one or more processors. The software is maintained in one or more data stores or memories associated with the one or more processors, and the software may be implemented as one or more computer programs. Collectively, this special-purpose hardware and software comprises the functionality described above.

In the preferred embodiment, the functionality provided herein is implemented as an adjunct or extension to an existing cloud compute deployment management solution.

Having described our invention, what we now claim is as follows.