# US 10,122,724 B2 · Detection and management of unauthorized use of cloud computing services > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,122,724 B2 - Document ID: US10122724B2 - Status: Granted - Kind: B2 - Application number: 14/953,810 - Filed: 2015-11-30 - Published: 2016-03-24 - Granted: 2018-11-06 - Earliest claimed: 2012-06-26 - Assignees: AT&T Intellectual Property I, L.P. - Applicants: AT&T Intellectual Property I, L.P. - Inventors: Flemming Elleboe; Luis Francisco Albisu; Joseph Bentfield; Janet Kerns; Jonathan Sheriffs - Web page: https://patentgrep.com/patent/US10122724B2 ## CPC - H04L 63/101: {Access control lists [ACL]} - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 2463/146: Tracing the source of attacks - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Concepts and technologies disclosed herein are for detecting and managing unauthorized use of cloud computing services from within an internal network of a business or other organization. A computer system may be configured to identify a plurality of Web resources that have been accessed by computing devices from within the internal network. The computer system may also be configured to obtain Internet protocol (“IP”) information from a network component of the internal network. The IP information may be used to determine whether each of the plurality of Web resources is a cloud computing service resource. The computer system may also be configured to block access to a cloud computing service resource of the plurality of Web resources upon determining that the IP information identifies the cloud computing service resource as being unauthorized. ## Claims ### Claim 1 A method comprising: aggregating, by a computing system comprising a processor, access logs from a plurality of network edge components communicatively coupled to an internal network; obtaining, by the computer system, internet protocol information from the access logs, the internet protocol information comprising destination internet protocol addresses and source internet protocol addresses; generating, by the computing system, a list of unique networks accessed from within the internal network based on the internet protocol information contained within the access logs; identifying, by the computing system based on the internet protocol information, a cloud computing service resource that has been accessed from within the internal network; determining, by the computing system, that the cloud computing service resource is not approved to be accessed from within the internal network, where the cloud computing service resource is designated as an unauthorized cloud computing service resource; generating an unauthorized list comprising at least one source internet protocol address that has been used to access the unauthorized cloud computing service resource; sending, to a vendor management team via the computing system comprising a processor, information about the unauthorized cloud computing service resource that has been accessed from within the internal network; determining, by the computing system, based upon feedback received from the vendor management team, whether a vendor agreement exists between a first entity associated with the internal network and a second entity associated with the unauthorized cloud computing service resource that has been accessed from within the internal network; in response to determining, based upon the feedback received from the vendor management team, that no vendor agreement exists between the first entity associated with the internal network and the second entity associated with the unauthorized cloud computing service resource, instructing, by the computing system, a network edge component to block access to the unauthorized cloud computing service resource from the internal network; instructing, by the computing system, a device management application to identify any cloud computing service software applications that are installed on a computing device within the internal network; determining, by the computing system, that a cloud computing service software application associated with the unauthorized cloud computing service resource is resident on the computing device within the internal network; and appending, by the computing system, an internet protocol address associated with the computing device to the unauthorized list. ### Claim 2 (depends on 1) The method of claim 1, further comprising instructing, by the computing system, the device management application to delete the cloud computing service software application associated with the unauthorized cloud computing service resource. ### Claim 3 (depends on 1) The method of claim 1, further comprising in response to determining, based upon the feedback received from the vendor management team, that a vendor agreement exists between the first entity associated with the internal network and the second entity associated with the unauthorized cloud computing service resource, removing, by the computing system, the unauthorized cloud computing service resource from the unauthorized list. ### Claim 4 (depends on 1) The method of claim 1, wherein generating, by the computing system, the unauthorized list comprising the at least one source internet protocol address that has been used to access the unauthorized cloud computing service resource is based on searching the access logs from the plurality of network edge components. ### Claim 5 (depends on 1) The method of claim 1, wherein determining, by the computing system, based upon the feedback received from the vendor management team, whether a vendor agreement exists between the first entity associated with the internal network and the second entity associated with the unauthorized cloud computing service resource comprises determining, by the computing system, based upon the feedback received from the vendor management team, whether the vendor agreement exists between an owner or operator associated with the internal network and an operator associated with the unauthorized cloud computing service resource. ### Claim 6 (depends on 1) The method of claim 1, wherein determining, by the computing system, based upon the feedback received from the vendor management team, whether a vendor agreement exists between the first entity associated with the internal network and the second entity associated with the unauthorized cloud computing service resource comprises determining, by the computing system, based upon the feedback received from the vendor management team, whether the vendor agreement exists between the an owner or operator associated with the internal network and an owner associated with the unauthorized cloud computing service resource. ### Claim 7 A computer storage medium comprising computer-executable instructions that, when executed by a processor of a computing system, cause the computing system to perform operations comprising: aggregating access logs from a plurality of network edge components communicatively coupled to an internal network; obtaining internet protocol information from the access logs, the internet protocol information comprising destination internet protocol addresses and source internet protocol addresses; generating a list of unique networks accessed from within the internal network based on the internet protocol information contained within the access logs; identifying, based on the internet protocol information, a cloud computing service resource that has been accessed from within the internal network; determining that the cloud computing service resource is not approved to be accessed from within the internal network, where the cloud computing service resource is designated as an unauthorized cloud computing service resource; generating an unauthorized list comprising at least one source internet protocol address that has been used to access the unauthorized cloud computing service resource; sending, to a vendor management team, information about the unauthorized cloud computing service resource that has been accessed from within the internal network; determining, based upon feedback received from the vendor management team, whether a vendor agreement exists between a first entity associated with the internal network and a second entity associated with the unauthorized cloud computing service resource that has been accessed from within the internal network; in response to determining, based upon the feedback received from the vendor management team, that no vendor agreement exists between the first entity associated with the internal network and the second entity associated with the unauthorized cloud computing service resource, instructing a network edge component to block access to the unauthorized cloud computing service resource from the internal network instructing a device management application to identify any cloud computing service software applications that are installed on a computing device within the internal network; determining that a cloud computing service software application associated with the unauthorized cloud computing service resource is resident on the computing device within the internal network; and appending an internet protocol address associated with the computing device to the unauthorized list. ### Claim 8 (depends on 7) The computer storage medium of claim 7, wherein the operations further comprise instructing the device management application to delete the cloud computing service software application associated with the unauthorized cloud computing service resource. ### Claim 9 (depends on 7) The computer storage medium of claim 7, wherein the operations further comprise in response to determining, based upon the feedback received from the vendor management team, that a vendor agreement exists between the first entity associated with the internal network and the second entity associated with the unauthorized cloud computing service resource, removing the unauthorized cloud computing service resource from the unauthorized list. ### Claim 10 (depends on 9) The computer storage medium of claim 9, wherein generating the unauthorized list comprising the at least one source internet protocol address that has been used to access the unauthorized cloud computing service resource is based on searching the access logs from the plurality of network edge components. ### Claim 11 (depends on 7) The computer storage medium of claim 7, wherein determining, based upon the feedback received from the vendor management team, whether a vendor agreement exists between the first entity associated with the internal network and the second entity associated with the unauthorized cloud computing service resource comprises determining, based upon the feedback received from the vendor management team, whether the vendor agreement exists between an owner or operator associated with the internal network and an operator associated with the unauthorized cloud computing service resource. ### Claim 12 (depends on 7) The computer storage medium of claim 7, wherein determining, based upon the feedback received from the vendor management team, whether a vendor agreement exists between the first entity associated with the internal network and the second entity associated with the unauthorized cloud computing service resource comprises determining, based upon the feedback received from the vendor management team, whether the vendor agreement exists between an owner or operator associated with the internal network and an owner associated with the unauthorized cloud computing service resource. ### Claim 13 A computing system comprising: a processor; and memory that stores instructions that, when executed by the processor, cause the computing system to perform operations comprising aggregating access logs from a plurality of network edge components communicatively coupled to an internal network; obtaining internet protocol information from the access logs, the internet protocol information comprising destination internet protocol addresses and source internet protocol addresses; generating a list of unique networks accessed from within the internal network based on the internet protocol information contained within the access logs; identifying, based on the internet protocol information, a cloud computing service resource that has been accessed from within the internal network; determining that the cloud computing service resource is not approved to be accessed from within the internal network, where the cloud computing service resource is designated as an unauthorized cloud computing service resource; generating an unauthorized list comprising at least one source internet protocol address that has been used to access the unauthorized cloud computing service resource; sending, to a vendor management team, information about the unauthorized cloud computing service resource that has been accessed from within the internal network, determining, based upon feedback received from the vendor management team, whether a vendor agreement exists between a first entity associated with the internal network and a second entity associated with the unauthorized cloud computing service resource that has been accessed from within the internal network, in response to determining, based upon the feedback received from the vendor management team, that no vendor agreement exists between the first entity associated with the internal network and the second entity associated with the unauthorized cloud computing service resource, instructing a network edge component to block access to the unauthorized cloud computing service resource from the internal network instructing a device management application to identify any cloud computing service software applications that are installed on a computing device within the internal network; determining that a cloud computing service software application associated with the unauthorized cloud computing service resource is resident on the computing device within the internal network; and appending an internet protocol address associated with the computing device to the unauthorized list. ### Claim 14 (depends on 13) The computing system of claim 13, wherein the operations further comprise instructing the device management application to delete the cloud computing service software application associated with the unauthorized cloud computing service resource. ### Claim 15 (depends on 13) The computing system of claim 13, wherein the operations further comprise in response to determining, based upon the feedback received from the vendor management team, that a vendor agreement exists between the first entity associated with the internal network and the second entity associated with the unauthorized cloud computing service resource, removing the unauthorized cloud computing service resource from the unauthorized list. ### Claim 16 (depends on 15) The computing system of claim 15, wherein generating the unauthorized list comprising the at least one source internet protocol address that has been used to access the unauthorized cloud computing service resource. ### Claim 17 (depends on 13) The computing system of claim 13, wherein determining, based upon the feedback received from the vendor management team, whether a vendor agreement exists between the first entity associated with the internal network and the second entity associated with the unauthorized cloud computing service resource comprises determining, based upon the feedback received from the vendor management team, whether the vendor agreement exists between an owner or operator associated with the internal network and an operator associated with the unauthorized cloud computing service resource. ### Claim 18 (depends on 13) The computing system of claim 13, wherein determining, based upon the feedback received from the vendor management team, whether a vendor agreement exists between the first entity associated with the internal network and the second entity associated with the unauthorized cloud computing service resource comprises determining, based upon the feedback received from the vendor management team, whether the vendor agreement exists between an owner or operator associated with the internal network and an owner associated with the unauthorized cloud computing service resource. ### Claim 19 (depends on 13) The computing system of claim 13, wherein the unauthorized cloud computing service resource provides, at least in part, a platform as a service. ### Claim 20 (depends on 13) The computing system of claim 13, wherein the unauthorized cloud computing service resource provides, at least in part, a software as a service.