Abstract:
System and method for enabling user access of cloud assets are described. In one embodiment, a method comprises authenticating a user to a system comprising a cloud computing environment in which a plurality of cloud assets are hosted; assembling a deployment associated with the authenticated user in accordance with a policy, the deployment comprising designated ones of the cloud assets; and providing a secure mechanism by which the designated ones of the cloud assets comprising the deployment are accessible by the authenticated user.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
       [0001]    This application is related to the following commonly-assigned, co-pending applications, each of which is also incorporated herein by reference in its entirety: 
         [0002]    1. U.S. patent application Ser. No. ______ (Atty. Docket No. 26530.157/IDR-1815); 
         [0003]    2. U.S. patent application Ser. No. ______ (Atty. Docket No. 26530.158/IDR-1816); 
         [0004]    3. U.S. patent application Ser. No. ______ (Atty. Docket No. 26530.159/IDR-1817); 
         [0005]    4. U.S. patent application Ser. No. ______ (Atty. Docket No. 26530.160/IDR-1818); 
         [0006]    5. U.S. patent application Ser. No. ______ (Atty. Docket No. 26530.161/IDR-1853); 
         [0007]    6. U.S. patent application Ser. No. ______ (Atty. Docket No. 26530.162/IDR-1838); 
         [0008]    7. U.S. patent application Ser. No. ______ (Atty. Docket No. 26530.163/IDR-1839); 
         [0009]    8. U.S. patent application Ser. No. ______ (Atty. Docket No. 26530.164/IDR-1840); and 
         [0010]    9. U.S. patent application Ser. No. ______ (Atty. Docket No. 26530.172/IDR-2045); 
         [0011]    10. U.S. patent application Ser. No. ______ (Atty. Docket No. 26530.173/IDR-2046); and 
         [0012]    11. U.S. patent application Ser. No. 12/197,833. 
     
    
     BACKGROUND 
       [0013]    Cloud computing is a type of computing in which dynamically scalable and typically virtualized resources are provided as services via the Internet. As a result, users need not, and typically do not, possess knowledge of, expertise in, or control over the technology and/or infrastructure implemented in the cloud. Cloud computing generally incorporates infrastructure as a service (“IaaS”), platform as a service (“PaaS”), and/or software as a service (“SaaS”). In a typical embodiment, cloud computing services provide common applications online, which applications are accessed using a web browser and the software and data for which are stored on servers comprising the cloud. 
         [0014]    Cloud computing customers typically do not own or possess the physical infrastructure that hosts their software platform; rather, the infrastructure is leased in some manner from a third-party provider. Cloud computing customers can avoid capital expenditures by paying a provider for only what they use on a utility, or resources consumed, basis or a subscription, or time-based, basis, for example. Sharing computing power and/or storage capacity among multiple lessees has many advantages, including improved utilization rates and an increase in overall computer usage. 
         [0015]    The Internet is rapidly spawning a host of “cloud providers” to provide infrastructure, platforms, and software as a service. Cloud providers such as Amazon.com (AWS), GoGrid, Eucalyptus, etc. are providing a host of new opportunities on the Internet but have not worked together to provide a common management nor execution platform. 
       SUMMARY 
       [0016]    One embodiment is a method for facilitating user access of cloud assets. The method comprises authenticating a user to a system comprising a cloud computing environment in which a plurality of cloud assets are hosted; assembling a deployment associated with the authenticated user in accordance with a policy, the deployment comprising designated ones of the cloud assets; and providing a secure mechanism by which the designated ones of the cloud assets comprising the deployment are accessible by the authenticated user. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0017]      FIG. 1  illustrates an exemplary IaaS cloud structure such as may be implemented in one embodiment. 
           [0018]      FIG. 2  is a flow diagram of one embodiment of a process for transparent access and management of user accessed cloud assets. 
           [0019]      FIG. 3  is a flow diagram of an alternative embodiment of a process for transparent access and management of user accessed cloud assets that provides for the reduction of the use of IP addresses. 
           [0020]      FIG. 4  is a flow diagram of another alternative embodiment of a process for transparent access and management of user accessed cloud assets in which a mechanism is provided for enabling a user to establish an identity with a secure bridge thereof. 
       
    
    
     DETAILED DESCRIPTION 
       [0021]    To better illustrate the advantages and features of the embodiments, a particular description of several embodiments will be provided with reference to the attached drawings. These drawings, and other embodiments described herein, only illustrate selected aspects of the embodiments and are not intended to limit the scope thereof. Further, despite reference to specific features illustrated in the example embodiments, it will nevertheless be understood that these features are not essential to all embodiments and no limitation of the scope thereof is thereby intended. Any alterations and further modifications in the described embodiments, and any further applications of the principles of the embodiments as described herein are contemplated as would normally occur to one skilled in the art. Furthermore, some items are shown in a simplified form, and inherently include components that are well known in the art. Further still, some items are illustrated as being in direct connection for the sake of simplicity and clarity. Despite the apparent direct connection, it is understood that such illustration does not preclude the existence of intermediate components not otherwise illustrated. 
         [0022]    The embodiments described herein provide a mechanism for allowing enterprises to use resources in a safe fashion without know the underlining topology or structure. The embodiments described herein further provide a mechanism to transparently start, route and secure virtual distributions, or deployments, in the public or private cloud as the user requests access. The embodiments described herein further provide a mechanism to transparently start, route and secure virtual distributions, or deployments, in the public or private cloud as the user authenticates to the system. The embodiments described herein further provide a mechanism to provide a personal computing and/or desktop environment running in a public cloud and to securely link the environment to an identity based client for local function. The embodiments described herein further provide a mechanism to provide a personal computing and/or desktop environment running in a private cloud and to securely link the environment to an identity based client for local function. 
         [0023]      FIG. 1  illustrates an exemplary IaaS cloud structure. As shown in  FIG. 1 , the cloud structure includes a hardware layer  100  comprising storage assets  102 , processing assets  104 , and network assets  106 . To facilitate usefulness of the cloud to a variety of enterprises, workloads are sponsored in the cloud as virtual machines possibly accessing virtualized storage and/or virtualized networks. This is accomplished via a virtualization layer  108 . Thus, the hardware layer  100  is insulated from the actual workloads to be sponsored in the cloud at a layer  110  by the virtualization layer  108  hardware, storage, and networking so that the operating system selected by the enterprise can be sponsored on whatever hardware the cloud provider makes available. Having established the hardware and virtualization layers  100 ,  108 , the assets  102 ,  104 , and  106  are available in a standardized way to workloads hosted in the workload layer  110 , which is the layer the customer typically views as the “cloud”. It will be recognized that some of the workloads sponsored in the cloud, specifically, workloads  111 , are workloads that are germane to the operation of the cloud and may consist of monitoring processes for enabling the cloud provider to monitor the health of the cloud, management processes to enable the cloud provider to ensure that service-level agreements are enforced, and so on. 
         [0024]    Enterprises using the cloud are represented by virtualization processes and storage shown as workloads  112 . These processes are typically started by an enterprise via a cloud portal or API utilized by administrative personnel or processes running at the enterprise or in the cloud. A typical cloud provider may be using standard ITIL practices and may utilize a configuration management database (“CMDB”)  114 , which affects the entire cloud infrastructure and which describes the practice and policies used for instantiating virtualized workloads and storage. 
         [0025]      FIG. 2  is a flow diagram of one embodiment of a process for transparent access and management of user accessed cloud assets. In the embodiment illustrated in  FIG. 2 , it will be assumed that a user  202  desires to access assets  204 ( 1 )- 204 ( 3 ),  206 , disposed in a private cloud  208  or assets  210 ( 1 )- 210 ( 3 ),  212 , disposed in a public cloud  214 . A secure bridge  216 , the operation of which is described in detail in U.S. patent application Ser. No. ______ (Atty. Docket No. 26530.160/IDR-1818), which has previously been incorporated by reference, enables authentication of the user  202  and, applying policy defined by the enterprise, uses the information gathered by the secure bridge  216  as a result of the authentication (such as roles, groups, etc.) as arguments to grant the appropriate rights and permission to access the assets  204 ( 1 )- 204 ( 3 ) and  206  in the private cloud  208 . As also described in the aforementioned patent application, the secure bridge  216  also enables the generation and sharing of cryptographic keys such that the communication between the user  202  and secure bridge  216  and assets  204 ( 1 )- 204 ( 3 ) and  206  to be protected. The keys can also be used to encrypt content and data items of the databases  206 ,  212 . 
         [0026]    It will be noted that, although the embodiment shown in  FIG. 2  comprises a private cloud connected to a public cloud, other arrangements are also possible, including private-to-private, public-to-public, as well as any combination of such arrangements, in which more than two clouds are linked as described. 
         [0027]    The authentication mechanisms employed by the secure bridge  216  have been described in the aforementioned patent application. Additionally, a method and mechanism for applying policy to such identity authentication, as well as to the policies stipulated to be used in creating the authentication of and identity, are described in U.S. patent application Ser. No. ______ (Atty. Docket No. 26530.161/IDR-1853), which has previously been incorporated by reference. The embodiments described herein provide a fortification channel  217  between the secure bridge  216  and a bridge  218  so that if the cloud assets to be accessed by the user  202  are in a public cloud, such as the cloud  214 , the communication channel  217  between the bridges  216 ,  218 , is cryptographically secure. 
         [0028]    The embodiments described herein provide for a library of cloud assets, such as virtual machines, such that a request from the user  202  may result in the instantiation of one or more virtual machines  210 ( 1 )- 210 ( 3 ). In one embodiment, the virtual machines  210 ( 1 )- 210 ( 3 ) may also already be running, in which case the user  202  accesses virtual machines that are already in operation. In another embodiment, there may be some mixture of already running virtual machines and others that need to be instantiated to accomplish the work to be performed. 
         [0029]    As disclosed in U.S. patent application Ser. No. ______ (Atty. Docket No. 26530.160/IDR-1818), cryptographic mechanisms may be communicated between the bridges  216 ,  218 , such that content stored in the database  212  or the database  206  may be secured from prying eyes and as also disclosed therein, content can be migrated between the databases  206 ,  212 , to effect the best access times according to the workloads that the user  202  is trying to perform. One embodiment also provides for the bridge  218  to apply policy to access requests from either the user  202  or the bridge  216  such that access may be granted or denied based on policy the references in the public cloud  214 . Additionally, the bridge  218  may use policy to determine when the unique instantiations of virtual machines, such as the virtual machines  210 ( 1 )- 210 ( 3 ), may need to be instantiated and assigned for access to the user  202  despite the fact that instantiations of such virtual machines may already be available. Likewise, policy statements may allow the user  202  to access already instantiated virtual machines in order to collaborate with other users (not shown) that may be communicating with the same instances. One embodiment also provides for either the sharing or full replication or partial replication access to the database  212  as is determined by policy at the bridge  218 . The same is true of assets  204 ( 1 )- 204 ( 3 ),  206 , in the private cloud  208 . 
         [0030]    One embodiment also provides methods and mechanisms such that once new or shared instantiations of processes or data are provided in the public cloud  214  or private cloud  208  as per policy, the user  202  is granted direct access to those instantiations, either via an IP address or some other access mechanism. As shown in  FIG. 3 , one embodiment also provides for the reduction of the use of IP addresses, as described in U.S. patent application Ser. No. ______ (Atty. Docket No. 26530.159/IDR-1817), which has previously been incorporated by reference. Referring to  FIG. 3 , a secure bridge  300  provides the same access and process mechanisms as the secure bridge  216  ( FIG. 2 ). Additionally, the bridge  218  ( FIG. 2 ) is represented in  FIG. 3  by distributors  302 ,  304 , interconnected via a distributor registry  305 , the operation of all of which is described in U.S. patent application Ser. No. ______ (Atty. Docket No. 26530.159/IDR-1817). As also noted in the aforementioned patent application, virtual routers  306 ,  308 , provide a NAT for translating a single external address to multiple internal addresses. 
         [0031]    The embodiments described herein utilize the mechanisms described hereinabove and in the related applications such that once the functions and features described above are performed to either instantiate new or share previous instantiations of virtual workloads in the public or private cloud, the user  202  ( FIG. 2 ) is granted access to the assets via the NAT (i.e., virtual routers  306 ,  308 ) ( FIG. 3 ) in the public or private cloud. It will be noted that all of the functions and/or methods described in connection with  FIG. 2  are also present in  FIG. 3 , which pertains to a library of assets and the instantiation of new or shared processes and/or storage, designated in  FIG. 3  by reference numerals  309 ( 1 )- 309 ( 4 ). It will be noted that the sharing of cryptographic materials as disclosed in one or more of aforementioned U.S. patent applications previously incorporated by reference provide for secure mediation between processes and storage depicted in  FIG. 3  and the user  202  ( FIG. 2 ). 
         [0032]    As best illustrated in  FIG. 4 , a mechanism is provided for enabling a user  400  to establish an identity with a secure bridge  402 , whereby in accordance with policy, the secure bridge  402  instructs distributors  404 ,  406 , working in conjunction with a distributor registry  407  as previously described, regarding characteristics of one or more virtual deployments (such as compute workloads characterized by the combination of one or more processes  408 ( 1 )- 408 ( 4 ) and one or more storage mechanisms  410 ) necessary to satisfy certain operating requirements of the user  400 . The embodiment also provides for the gathering of virtual deployment deposition information from the distributors  404 ,  406 , and distributor registry  407  in order to secure the deployment infrastructure such that the access of the deployment can be secured via a series of key mechanisms, including, but not limited to, generation of a key pair at the bridge  402 , whereby the private key is maintained only at the bridge  402  and the public key is populated to the components of the virtual deployment (e.g., processes  408 ( 1 )- 408 ( 4 ) and storage  410 ). The secure bridge  402  also restricts, via policy, the private key association to the selected identity established for the user  400 , thus ensuring that only the user  400  may gain access to the deployment. 
         [0033]    In one embodiment, the secure bridge  402  may maintain a relationship with the distributors  404 ,  406 , such that additional resources required for scaling the deployment may be bound to the user  400  and the appropriate security policies put into place to ensure that any new workloads generated for the deployment are also only accessible to the user  400 . In one embodiment, the secure bridge  402  handles deployment termination requests received from either the user or one or more deployment components. Termination requests prompt the user  400  to direct the clearing of sensitive information from the deployment according to policy and then to proceed via directing the distributors  404 ,  406 , to close out the deployment, returning the processes  408 ( 1 )- 408 ( 4 ) to the available component library maintained by the distributors  404 ,  406 . 
         [0034]    In one embodiment, termination of the deployment may also be initiated by the secure bridge  402  in reaction to policy and/or threat intrusion detection as outlined in U.S. patent application Ser. No. ______ (Atty. Docket No. 26530.163/IDR-1839), which has previously been incorporated by reference. In an embodiment, the distributors  404 ,  406 , may utilize mechanisms for handling TesselApps, as described in U.S. Patent Publication Nos. 2008/0256535, 2008/0244575, 2008/0307415, and 2008/0256538, which are hereby incorporated by reference in their entireties, for a user environment during the process of deployment creation. In an embodiment, the distributors  404 ,  406 , are used merely for the initiation and termination of the deployment components. Once the deployment is in place and secured, the secure bridge  402  directs access to the deployment via virtual router infrastructure  414 . 
         [0035]    It will be recognized that various ones of the elements, mechanisms, and/or modules described herein may be implemented using one or more general purpose computers or portions thereof executing software applications designed to perform the functions described or using one or more special purpose computers or portions thereof configured to perform the functions described. The software applications may comprise computer-executable instructions stored on computer-readable media. Additionally, repositories described herein may be implemented using databases or other appropriate storage media. 
         [0036]    While the preceding description shows and describes one or more embodiments, it will be understood by those skilled in the art that various changes in form and detail may be made therein without departing from the spirit and scope of the present disclosure. For example, various steps of the described methods may be executed in a different order or executed sequentially, combined, further divided, replaced with alternate steps, or removed entirely. In addition, various functions illustrated in the methods or described elsewhere in the disclosure may be combined to provide additional and/or alternate functions. Therefore, the claims should be interpreted in a broad manner, consistent with the present disclosure.