Patent Publication Number: US-8977750-B2

Title: Extending security platforms to cloud-based networks

Description:
FIELD 
     The present teachings relate to systems and methods for extending security platforms to cloud-based networks, and more particularly to platforms and techniques for extending the security policies for managed networks to partitions of the network that are exposed to or incorporated in external cloud networks. 
     BACKGROUND OF RELATED ART 
     The advent of cloud-based computing architectures has opened new possibilities for the rapid, and scalable deployment of virtual Web stores, media outlets, and other on-line sites or services. In general, a cloud-based architecture deploys a set of hosted resources such as processors, operating systems, software and other components that can be combined or strung together to form virtual machines. A user or customer can request the instantiation of a virtual machine or set of machines from those resources from a central server or management system to perform intended tasks or applications. For example, a user may wish to set up and instantiate a virtual server from the cloud to create a storefront to market products or services on a temporary basis, for instance, to sell tickets to an upcoming sports or musical performance. The user can lease or subscribe to the set of resources needed to build and run the set of instantiated virtual machines on a comparatively short-term basis, such as hours or days, for their intended application. Another type of software entity that has found certain application in certain spaces is software appliances, which generally speaking can represent relatively self-contained software installations including full or customized partial operating system installations, combined with selected applications in a single installation or update package. 
     Currently, a network operator can manage a set of machines within a conventional network using known network management platforms, such as the commercially available Tivoli™ platform provided by IBM Corp. or other platforms. Current known network management platforms do not, however, incorporate the ability to extend network management functions to machines within the network that are exposed to an external could, either by way of supplying resources to the cloud or consuming resources from the cloud. Currently, no mechanism exists for systems administrators to adapt for the special circumstances and parameters required to securely maintain a subset of machines within a managed network that are exposed to the cloud. Thus, there is a need in the art for methods and systems that provide extensions of security services to machines under network management that may communicate with or form a part of an external cloud or clouds. 
    
    
     
       DESCRIPTION OF THE DRAWINGS 
       The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments of the present teachings and together with the description, serve to explain the principles of the present teachings. In the figures: 
         FIG. 1  illustrates an overall cloud system architecture in which various embodiments of the present teachings can be practiced; 
         FIG. 2  illustrates an overall cloud system architecture in which various embodiments of the present teachings can be practiced in another regard including multiple cloud arrangements, according to various embodiments; 
         FIG. 3  illustrates an overall environment in which systems and methods for extending security platforms to cloud-based networks can operate, according to various embodiments; 
         FIG. 4  illustrates an exemplary diagram of hardware and other resources that can be incorporated into a network security engine according to various embodiments; and 
         FIG. 5  illustrates an overall flowchart for security processing in systems and methods for extending security platforms to cloud-based networks, according to various embodiments. 
     
    
    
     DESCRIPTION OF EMBODIMENTS 
     Embodiments of the present teachings relate to systems and methods for systems and methods for extending security platforms to cloud-based networks. More particularly, embodiments relate to platforms and techniques for extending the security functions of network management platforms or other security engines to permit a subset or all of a managed network to be exposed to an external cloud environment, without compromising the security policies ordinarily in place for the managed network for internal operation. In terms of operational environments, a security management engine can communicate with a set of managed machines, such as personal computers, servers, virtual machines, and/or other devices, and manage the security of those machines under the supervision of that platform. A security management engine can establish a set of security policies for managed machines in its domain. The set of security policies can contain security parameters such as one or more access control lists, authentication criteria, access control parameters for processor, storage, or memory limits for individual users or groups of users, permitted schedules for defined tasks or services, and/or other security functions. According to embodiments, the security management engine can establish and maintain a set of default security policies for use in regular network operations, such as regular wired or wireless network operations on a corporate campus or other facility. According to embodiments, the security management engine can further establish and maintain a partitioned security class within the set of security policies to govern machines in the managed network that communicate with or form part of an external cloud environment. The partitioned security class can identify machines Which are configured to communicate with or form part of an external cloud environment, and specify a set of security policies or rules specific to a cloud scenario. 
     The partitioned security class can, for example, specify that a cloud-qualified partition within the set of managed machines be made available to an external cloud for processor harvesting between 12:00 am and 7:00 am on given days of the week, to permit the harvesting of processor throughput by a cooperating external cloud during low-use intervals. The partitioned security class can, for the time that the cloud-qualified partition of the managed network is communicating with the external cloud, specify that access to the internal databases or storage of the managed network be turned off for the machines participating in the cloud environment, or that user profiles for participating machines be blocked or hidden from view by the cloud. Other security configurations can be specified for or in the partitioned security class. A set of machines within a managed network can therefore be deployed to or retrieve resources from the cloud, while maintaining the security of the internal network with which participating machines are normally associated. 
     Embodiments of the present teachings thereby relate to systems and methods which operate in a managed network environment interacting with cloud computing networks. More particularly, embodiments relate to platforms and techniques in which a cloud environment extracts resources from or provides resources to a managed network, such as an internal corporate, academic, or other network, under the control of a network security engine configured to adapt multiple security classes to cloud-based activities. 
     Reference will now be made in detail to exemplary embodiments of the present teachings, which are illustrated in the accompanying drawings. Where possible the same reference numbers will be used throughout the drawings to refer to the same or like parts. 
       FIG. 1  illustrates an overall cloud computing environment, in which systems and methods for extending security platforms to cloud-based networks, according to embodiments of the present teachings. Embodiments described herein can be implemented in or supported by a cloud network architecture. As used herein, a “cloud” can comprise a collection of resources that can be invoked to instantiate a virtual machine, process, or other resource for a limited or defined duration. As shown for example in  FIG. 1 , the collection of resources supporting a cloud  102  can comprise a set of resource servers  108  configured to deliver computing components needed to instantiate a virtual machine, process, or other resource. For example, one group of resource servers can host and serve an operating system or components thereof to deliver to and instantiate a virtual machine. Another group of resource servers can accept requests to host computing cycles or processor time, to supply a defined level of processing power for a virtual machine. A further group of resource servers can host and serve applications to load on an instantiation of a virtual machine, such as an email client, a browser application, a messaging application, or other applications or software. Other types of resource servers are possible. 
     In embodiments, the entire set of resource servers  108  or other hardware or software resources used to support the cloud  102  along with its instantiated virtual machines is managed by a cloud management system  104 . The cloud management system  104  can comprise a dedicated or centralized server and/or other software, hardware, and network tools that communicate via one or more networks  106  such as the Internet or other public or private network with all sets of resource servers to manage the cloud  102  and its operation. To instantiate a new set of virtual machines, a user can transmit an instantiation request to the cloud management system  104  for the particular type of virtual machine they wish to invoke for their intended application. A user can for instance make a request to instantiate a set of virtual machines configured for email, messaging or other applications from the cloud  102 . The request can be received and processed by the cloud management system  104 , which identifies the type of virtual machine, process, or other resource being requested. The cloud management system  104  can then identify the collection of resources necessary to instantiate that machine or resource. In embodiments, the set of instantiated virtual machines or other resources can for example comprise virtual transaction servers used to support Web storefronts, or other transaction sites. 
     In embodiments, the user&#39;s instantiation request can specify a variety of parameters defining the operation of the set of virtual machines to be invoked. The instantiation request, for example, can specify a defined period of time for which the instantiated machine or process is needed. The period of time can be, for example, an hour, a day, or other increment of time. In embodiments, the user&#39;s instantiation request can specify the instantiation of a set of virtual machines or processes on a task basis, rather than for a predetermined amount of time. For instance, a user could request resources until a software update is completed. The user&#39;s instantiation request can specify other parameters that define the configuration and operation of the set of virtual machines or other instantiated resources. For example, the request can specify an amount of processing power or input/output (I/O) throughput the user wishes to be available to each instance of the virtual machine or other resource. In embodiments, the requesting user can for instance specify a service level agreement (SLA) acceptable for their application. Other parameters and settings can be used. One skilled in the art will realize that the user&#39;s request can likewise include combinations of the foregoing exemplary parameters, and others. 
     When the request to instantiate a set of virtual machines or other resources has been received and the necessary resources to build that machine or resource have been identified, the cloud management system  104  can communicate with one or more set of resource servers  108  to locate resources to supply the required components. The cloud management system  104  can select providers from the diverse set of resource servers  108  to assemble the various components needed to build the requested set of virtual machines or other resources. It may be noted that in some embodiments, permanent storage such as hard disk arrays may not be included or located within the set of resource servers  108  available to the cloud management system  104 , since the set of instantiated virtual machines or other resources may be intended to operate on a purely transient or temporary basis. In embodiments, other hardware, software or other resources not strictly located or hosted in the cloud can be leveraged as needed. For example, other software services that are provided outside of the cloud  102  and hosted by third parties can be invoked by in-cloud virtual machines. For further example, other non-cloud hardware and/or storage services can be utilized as an extension to the cloud  102 , either on an on-demand or subscribed or decided basis. 
     With the resource requirements identified, the cloud management system  104  can extract and build the set of virtual machines or other resources on a dynamic or on-demand basis. For example, one set of resource servers  108  can respond to an instantiation request for a given quantity of processor cycles with an offer to deliver that computational power immediately and guaranteed for the next hour. A further set of resource servers  108  can offer to immediately supply communication bandwidth, for example on a guaranteed minimum or best-efforts basis. In other embodiments, the set of virtual machines or other resources can be built on a batch basis or at a particular future time. For example, a set of resource servers  108  can respond to a request for instantiation at a programmed time with an offer to deliver the specified quantity of processor cycles within a specific amount of time, such as the next 12 hours. 
     The cloud management system  104  can select group of servers in the set of resource servers  108  that match or best match the instantiation request for each component needed to build the virtual machine or other resource. The cloud management system  104  can then coordinate the integration of the completed group of servers from the set of resource servers  108 , to build and launch the requested set of virtual machines or other resources. The cloud management system  104  can track the combined group of servers selected from the set of resource servers  108 , or other distributed resources that are dynamically or temporarily combined, to produce and manage the requested virtual machine population or other resources. 
     In embodiments, the cloud management system  104  can generate a resource aggregation table that identifies the various sets of resource servers that will be used to supply the components of the virtual machine or process. The sets of resource servers can be identified by unique identifiers such as, for instance, Internet Protocol (IP) addresses or other addresses. The cloud management system  104  can register the finalized group of servers in the set resource servers  108  contributing to an instantiated machine or process. 
     The cloud management system  104  can then set up and launch the initiation process for the virtual machines, processes, or other resources to be delivered from the cloud. The cloud management system  104  can for instance transmit an instantiation command or instruction to the registered group of servers in set of resource servers  108 . The cloud management system  104  can receive a confirmation message back from each participating server in set of resource servers  108  indicating a status regarding the provisioning of their respective resources. Various sets of resource servers can confirm, for example, the availability of a dedicated amount of processor cycles, amounts of electronic memory, communications bandwidth, or applications or other software prepared to be served. 
     As shown for example in  FIG. 2 , the cloud management system  104  can then instantiate one or more than one set of virtual machines  116 , or other processes based on the resources supplied by the registered set of resource servers  108 . In embodiments, the cloud management system  104  can instantiate a given number, for example, 10, 500, 1000, or other numbers of virtual machines to be made available to users on a network  114 , such as the Internet or other public or private network. Each virtual machine can be assigned an instantiated machine ID that can be stored in the resource aggregation table, or other record or image of the instantiated population. Additionally, the cloud management system  104  can store the duration of each virtual machine and the collection of resources utilized by the complete set of instantiated virtual machines  116 . 
     In embodiments, the cloud management system  104  can further store, track and manage a user&#39;s identity and associated set of rights or entitlements to software, hardware, and other resources. Each user that populates a set of virtual machines in the cloud can have specific rights and resources assigned and made available to them. The cloud management system  104  can track and configure specific actions that a user can perform, such as provision a set of virtual machines with software applications or other resources, configure a set of virtual machines to desired specifications, submit jobs to the set of virtual machines or other host, manage other users of the set of instantiated virtual machines  116  or other resources, and other privileges or actions. The cloud management system  104  can further generate records of the usage of instantiated virtual machines to permit tracking, billing, and auditing of the services consumed by the user. In embodiments, the cloud management system  104  can for example meter the usage and/or duration of the set of instantiated virtual machines  116 , to generate subscription billing records for a user that has launched those machines. Other billing or value arrangements are possible. 
     The cloud management system  104  can configure each virtual machine to be made available to users of the one or more networks  106  via a browser interface, or other interface or mechanism. Each instantiated virtual machine can communicate with the cloud management system  104  and the underlying registered set of resource servers  108  via a standard Web application programming interface (API), or via other calls or interfaces. The set of instantiated virtual machines  116  can likewise communicate with each other, as well as other sites, servers, locations, and resources available via the Internet or other public or private networks, whether within a given cloud  102  or between clouds. 
     It may be noted that while a browser interface or other front-end can be used to view and operate the set of instantiated virtual machines  116  from a client or terminal, the processing, memory, communications, storage, and other hardware as well as software resources required to be combined to build the virtual machines or other resources are all hosted remotely in the cloud  102 . In embodiments, the set of virtual machines  116  or other resources may not depend on or require the user&#39;s own on-premise hardware or other resources. In embodiments, a user can therefore request and instantiate a set of virtual machines or other resources on a purely off-premise basis, for instance to build and launch a virtual storefront or other application. 
     Because the cloud management system  104  in one regard specifies, builds, operates and manages the set of instantiated virtual machines  116  on a logical level, the user can request and receive different sets of virtual machines and other resources on a real-time or near real-time basis, without a need to specify or install any particular hardware. The user&#39;s set of instantiated virtual machines  116 , processes, or other resources can be scaled up or down immediately or virtually immediately on an on-demand basis, if desired. In embodiments, the various sets of resource servers that are accessed by the cloud management system  104  to support a set of instantiated virtual machines  116  or processes can change or be substituted, over time. The type and operating characteristics of the set of instantiated virtual machines  116  can nevertheless remain constant or virtually constant, since instances are assembled from abstracted resources that can be selected and maintained from diverse sources based on uniform specifications. 
     In terms of network management of the set of instantiated virtual machines  116  that have been successfully configured and instantiated, the cloud management system  104  can perform various network management tasks including security, maintenance, and metering for billing or subscription purposes. The cloud management system  104  of a given cloud  102  can, for example, install or terminate applications or appliances on individual machines. The cloud management system  104  can monitor operating virtual machines to detect any virus or other rogue process on individual machines, and for instance terminate the infected application or virtual machine. The cloud management system  104  can likewise manage an entire set of instantiated virtual machines  116  or other resources on a collective basis, for instance, to push or delivery a software upgrade to all active virtual machines. Other management processes are possible. 
     In embodiments, more than one set of virtual machines can be instantiated in a given cloud at the same, overlapping or successive times. The cloud management system  104  can, in such implementations, build, launch and manage multiple sets of virtual machines based on the same or different underlying set of resource servers  108 , with populations of different sets of instantiated virtual machines  116  such as may be requested by different users. The cloud management system  104  can institute and enforce security protocols in a cloud  102  hosting multiple sets of virtual machines. Each of the individual sets of virtual machines can be hosted in a respective partition or sub-cloud of the resources of the cloud  102 . The cloud management system  104  of a cloud can for example deploy services specific to isolated or defined sub-clouds, or isolate individual workloads/processes within the cloud to a specific sub-cloud. The subdivision of the cloud  102  into distinct transient sub-clouds or other sub-components which have assured security and isolation features can assist in establishing a multiple user or multi-tenant cloud arrangement. In a multiple user scenario, each of the multiple users can use the cloud platform as a common utility while retaining the assurance that their information is secure from other users of the overall cloud system. In further embodiments, sub-clouds can nevertheless be configured to share resources, if desired. 
     In embodiments, and as also shown in  FIG. 2 , the set of instantiated virtual machines  116  generated in a first cloud  102  can also interact with a set of instantiated virtual machines or processes generated in a second, third or further cloud  102 . The cloud management system  104  of a first cloud  102  can interface with the cloud management system  104  of a second cloud  102 , to coordinate those domains and operate the clouds and/or virtual machines or processes on a combined basis. The cloud management system  104  of a given cloud  102  can track and manage individual virtual machines or other resources instantiated in that cloud, as well as the set of instantiated virtual machines or other resources in other clouds. 
     In the foregoing and other embodiments, the user making an instantiation request or otherwise accessing or utilizing the cloud network can be a person, customer, subscriber, administrator, corporation, organization, or other entity. In embodiments, the user can be or include another virtual machine, application or process. In further embodiments, multiple users or entities can share the use of a set of virtual machines or other resources. 
       FIG. 3  illustrates aspects of a network security engine  202  and its interaction with one or more external cloud  102  to manage a managed network  208 , according to various embodiments. In embodiments as shown, a network security engine  202  can communicate with a managed network  208  under its administrative and security control. Managed network  208  can communicate with network security engine  202  through one or more networks  106 , or other networks or connections. Managed network  208  can comprise a set of managed machines  210 , such as personal computers, servers, workstations, and/or other resources. Managed network  208  in embodiments can include or consist of a local area network, a metropolitan area network, a wide area network, a wired network, a wireless network, a virtual private network, and/or other types of networks or connections. In embodiments, managed network.  208  can be or include a campus-type network installation, such as an Ethernet domain or other network installed within a set of local buildings or facilities. Managed network  208  can comprise other types or configurations of networks. Set of managed machines  210  can, in embodiments, comprise hardware or virtualized machines. In configurations as shown, network security engine  202  can establish, access, and/or manage a set of security policies  204  to govern managed network  208  and its constituent machines. 
     In embodiments as shown, network security engine  202  and/or other logic or entities can designate, access, and/or configure, a cloud-accessible partition  214  to expose to one or more external cloud  102 . In embodiments, the cloud-accessible partition  214  can comprise a set of machines identified to be partially or fully dedicated, exposed, and/or made available to one or more cloud  102 . In embodiments, cloud-accessible partition  214  can be configured to provide hardware, software, and/or other resources to one or more cloud  102 , and/or to receive similar resources from one or more cloud  102 . In embodiments, cloud-accessible partition  214  can communicate or register with one or more cloud  102  via cloud management system  204 , and/or other intermediate entities or logic. In embodiments, cloud-accessible partition  214  can be initiated or configure by or via one or more constituent machine in managed network  208 , cloud management system  104 , by network security engine  202 , and/or other logic or entities. 
     According to various embodiments, a dedicated partitioned security class  212  can be established in set of security policies  204  to specially govern the operation of cloud-accessible partition  214 . In embodiments, partitioned security class  212  can be generated by network security engine  202 . Partitioned security class  212  can reflect security policies directed to the maintenance of cloud-accessible partition  214  in its interaction with one or more cloud  102 . In embodiments, partitioned security class  212  can automatically default to baseline policies for managed network  208  or other policies set in set of security policies  204 , when constituent machines of cloud-accessible partition  214  are not connected to or communicating with one or more cloud  102 . 
     When machines in cloud-accessible partition  214  are actively communicating with one or more cloud  102  or at other times, the participating machines in that partition can be governed via network security engine  202  using partitioned security class  212 . According to embodiments, partitioned security class  212  can host or contain policies, rules, and/or other parameters or logic to govern the operation of cloud-accessible partition  214  and the interaction of cloud-accessible partition  214  and one or more cloud  102 . 
     For instance, partitioned security class  212  can contain policies related to or specifying limitations or conditions on the availability or use of resources such as processor cycles, memory access, storage access, input/output bandwidth, scheduled access time, access to user profile data, access to, copying or execution rights for applications or other software, and/or the conditional delivery or use of other resources of cloud-accessible partition  214  by or via one or more cloud  102 . In embodiments, partitioned security class  212  can set limits or conditions on the consumption of inbound resources from one or more cloud  102  to cloud-accessible partition. In embodiments, the assigned of machines in managed network  208  to cloud-accessible partition  214  can be dynamic, and change over time. The security policies contained in partitioned security class  212  can be updated when the cloud-accessible partition  214  is updated, or at other times. In embodiments, multiple cloud-accessible partitions can be created in managed network  208 . In embodiments, multiple cloud-accessible partitions can be governed by the same partitioned security class  212 , or by different classes and associated security policies. In embodiments, set of security policies  204  can be configured to take precedence over partitioned security class  212  when a conflict or overlap occurs, or vice versa. 
       FIG. 4  illustrates an exemplary diagram of hardware and other resources that can be incorporated in a network security engine  202  configured to communicate with managed network  208 , one or more external cloud  102 , and other resources according to embodiments. In embodiments as shown, the network security engine  202  can comprise a processor  320  communicating with memory  322 , such as electronic random access memory, operating under control of or in conjunction with operating system  326 . Operating system  326  can be, for example, a distribution of the Linux™ operating system, the Unix™ operating system, or other open-source or proprietary operating system or platform. Processor  320  also communicates with a security store  328 , such as a database stored on a local hard drive. Processor  320  further communicates with network interface  324 , such as an Ethernet or wireless data connection, which in turn communicates with one or more networks  106 , such as the Internet or other public or private networks. Processor  320  also communicates with set of security policies  204 , including partitioned security class  212 , to execute control logic and perform cross-network security processes described herein. Other configurations of the network security engine  202 , associated network connections, and other hardware and software resources are possible. While  FIG. 4  illustrates the network security engine  202  as a standalone system comprises a combination of hardware and software, the network security engine  202  can also be implemented as a software application or program capable of being executed by a conventional computer platform. Likewise, the network security engine  202  can also be implemented as a software module or program module capable of being incorporated in other software applications and programs. In either case, the network security engine  202  can be implemented in any type of conventional proprietary or open-source computer language. 
       FIG. 5  illustrates a flowchart of processing for extending security platforms to a cloud-based network, according to various embodiments. In  502 , processing can begin. In  504 , set of managed machines  210  can be initialized or configured in managed network  208  via network security engine  202  and/or other resources or entities. In  506 , set of managed machines  210  in managed network  208  can be registered to network security engine  202 . In embodiments, machines can be identified and registered using physical and/or logical identifiers, such as a MAC (media access control) address or other identifier. In  508 , a set of security policies  204  can be generated and/or accessed by network security engine  202  for set of managed machines. Set of security policies  204  can, in general, provide parameters by which access to, or the operation of, set of managed machines  210  will be conducted, including, for instance, access policies for memory or storage, user authentication requirements, network access privileges, and/or other control policies. 
     In  510 , a cloud-accessible partition  214  within set of managed machines  210  can be identified to be exposed to the external cloud environment of one or more cloud  102 . In embodiments, the cloud-accessible partition  214  can be configured to provide or release resources to one or more cloud  102 , such as, for example, processor cycles, memory, storage, communications bandwidth, applications, and/or other hardware, software, and/or other resources. In embodiments, the cloud-accessible partition  214  can be configured to receive or consume resources from one or more cloud  102 . In embodiments, the cloud-accessible partition  214  can be configured to both provide to and extract resources from one or more cloud  102 . 
     In  512 , the network security engine  202  can generate a partitioned security class  212  in set of security policies  204 , to regulate the operation of the machines in cloud-accessible partition  214 . According to embodiments, partitioned security class  212  can host or contain policies, rules, and/or other parameters or logic to govern the operation of cloud-accessible partition  214  and the interaction of cloud-accessible partition  214  and one or more cloud  102 . For instance, cloud-accessible partition  214  can contain policies related to or specifying limitations or conditions on the availability or use of processor cycles, memory access, storage access, input/output bandwidth, scheduled access time, access to, copying or execution rights for applications or other software, access to user profile data, and/or the conditional use of other resources of cloud-accessible partition  214  by or via one or more cloud  102 . 
     In  514 , partitioned security class  212  can be applied to cloud-accessible partition  214  via network security engine  202 . In  516 , the interaction between cloud-accessible partition  214  and one or more cloud  102  can be regulated via partitioned security class  212  and its associated policies and logic. For instance, network security engine  202  can restrict access of one or more cloud  102  to cloud-accessible partition  214  to comparatively low-usage periods of managed network  208  such as overnight, weekend, or other periods. For further instance, partitioned security class  212  can prevent access to local storage of machines in cloud-accessible partition  214  by one or more cloud  102 , or require specified levels of authentication to allow access to those or other resources. 
     In  518 , a modified or updated cloud-accessible partition  214 , along with any corresponding partitioned security class  212 , can be generated or identified, as appropriate. For instance, cloud management system  104  associated with one or more cloud  102  can transmit a request for addition resources to managed network  208  and/or network security engine  202  or other entities, based on increased demand, in response to which additional machines can be dedicated to cloud-accessible partition  214 . In  520 , as understood by persons skilled in the art, processing can repeat, return to a prior processing point, jump to a further processing point, or end. 
     The foregoing description is illustrative, and variations in configuration and implementation may occur to persons skilled in the art. For example, while embodiments have been described in which a single network security engine  202  manages the security of managed network  208 , in embodiments, multiple security engines, servers, or other entities can cooperate to perform security functions. For further example, while embodiments have been described in which one cloud-assigned partition  214  communicates with or receives resources from one or more cloud  102 , in embodiments, multiple subnets or partitions or managed network  208  can be configured to interact with one or more cloud  102 . Other resources described as singular or integrated in some embodiments can in embodiments be plural or distributed, and resources described as embodiments as multiple or distributed can in embodiments be combined. The scope of the present teachings is accordingly intended to be limited only by the following claims.