Method to define an enforceable generic security policy and apply it using cloud-specific security constructs
AssigneeDell Products L.P.
InventorsChooi Peng Low, Shoham Levy, Michal Davidson
Life of this patent
Estimating the term…
Abstract
One example method includes receiving, from a client, generic security requirements concerning a cloud system, generating a generic security policy based on the generic security requirements, mapping the generic security policy to cloud-specific constructs to define a cloud-specific deployment security architecture, implementing the cloud-specific deployment security architecture at a cloud site, enabling the client to deploy the cloud system at the cloud site, and using the cloud-specific deployment security architecture to enforce the generic security policy during deployment of the cloud system.
Claims16
A method, comprising:
- in connection with an existing cloud site, receiving, from a client, generic security requirements concerning a cloud system that is to be deployed to the existing cloud site;
- generating, by a multi-cloud security service, a generic security policy based on the generic security requirements, wherein the generic security policy is independent of any particular cloud service provider and the generic security requirements comprise requirements concerning access key creation and usage;
- mapping the generic security policy to cloud-specific constructs of the existing cloud site by:
- determining a plurality of candidate cloud-specific security constructs supported by the existing cloud site based on the generic security policy, and
- selecting, from the plurality of candidate cloud-specific security constructs, a set of cloud-specific constructs based on one or more constraints comprising at least one of security level, cost, or performance;
- defining, based on the selected set of cloud-specific constructs, a cloud-specific deployment security architecture that is compliant with established security requirements of the existing cloud site, wherein defining the cloud-specific deployment architecture includes creating, and deploying to the cloud site, a key rotation function;
- implementing the cloud-specific deployment security architecture at the existing cloud site;
- automatically enforcing the generic security policy during deployment of the cloud system by configuring the existing cloud site using the selected set of cloud-specific constructs;
- enabling the client to deploy the cloud system at the existing cloud site without requiring the client to specify the cloud-specific constructs.
A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
- in connection with an existing cloud site, receiving, from a client, generic security requirements concerning a cloud system that is to be deployed to the existing cloud site;
- generating, by a multi-cloud security service, a generic security policy based on the generic security requirements, wherein the generic security policy is independent of any particular cloud service provider and the generic security requirements comprise requirements concerning access key creation and usage;
- mapping the generic security policy to cloud-specific constructs of the existing cloud site by:
- determining a plurality of candidate cloud-specific security constructs supported by the existing cloud site based on the generic security policy, and
- selecting, from the plurality of candidate cloud-specific security constructs, a set of cloud-specific constructs based on one or more constraints comprising at least one of security level, cost, or performance;
- defining, based on the selected set of cloud-specific constructs, a cloud-specific deployment security architecture that is compliant with established security requirements of the existing cloud site, wherein defining the cloud-specific deployment architecture includes creating, and deploying to the cloud site, a key rotation function;
- implementing the cloud-specific deployment security architecture at the existing cloud site;
- automatically enforcing the generic security policy during deployment of the cloud system by configuring the existing cloud site using the selected set of cloud-specific constructs;
- enabling the client to deploy the cloud system at the existing cloud site without requiring the client to specify the cloud-specific constructs.
Dependencies are inferred from the claim text.