# US 2018/0027022 A1 · Application-based security rights in cloud environments > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0027022 A1 - Document ID: US20180027022A1 - Status: Published application - Kind: A1 - Application number: 15/700,767 - Filed: 2017-09-11 - Published: 2018-01-25 - Earliest claimed: 2015-08-08 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Nataraj Nagaratnam; Jeffrey Robert Hoy; Kaushal Kiran Kapadia; Ravi Krishnan Muthukrishnan; Sreekanth Ramakrishna Iyer - Web page: https://patentgrep.com/patent/US20180027022A1 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 21/10: Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/0254: {Stateful filtering} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract This disclosure provides the ability for a cloud application to specify its security requirements, the ability to have those requirements evaluated, e.g., against a specific cloud deployment environment, and the ability to enable the application to control a cloud-based security assurance service to provision additional security technology in the cloud to support deployment (or re-deployment elsewhere) of the application if the environment does not have the necessary topology and security resources deployed. To this end, the application queries the service by passing a set of application-based security rights. If the security capabilities provided by the security assurance service are sufficient or better than the application's security rights, the application functions normally. If, however, the security environment established by the security assurance service is insufficient for the application, the application is afforded one or more remediation options, e.g., issuing a request to upgrade the security environment, or the like. ## Claims ### Claim 1 A method to improve a cloud computing environment by enabling enforcement of security service requirements for a cloud application, comprising: deploying a secure application zone for the cloud application, the secure application zone configuring a set of security resources in an automated manner in response to receipt of a specification of a security assurance level, the security assurance level specifying one or more general security requirements in a manner that does not expose at least some specific tooling requirements necessary to implement the security assurance level security requirement; receiving a set of security service requirements specified by the cloud application, at least one security service requirement including one or more relationship-specific criteria associated with the cloud application; evaluating the security service requirements, including the relationship-specific criteria, against the set of security resources configured in the secure application zone; and responsive to a determination that the set of security resources configured in the secure application zone do not meet the security service requirements specified by the cloud application, receiving from the cloud application a request to take a given action that provides an assurance that the security service requirements specified by the cloud application are satisfied. ### Claim 2 (depends on 1) The method as described in claim 1 further including taking the given action responsive to the determination, wherein the given action is one of: a remediation action that attempts to meet the security service requirements specified by the cloud application, the remediation action being one of: restricting another cloud application from being hosted in association with the cloud application, requesting upgrade or reconfiguration of the set of security resources configured in the secure application zone, requesting transfer of the cloud application to another specific cloud security environment, and requesting transfer of the cloud application to another cloud platform. ### Claim 3 (depends on 2) The method as described in claim 2 wherein the given action temporarily de-activates the cloud application or prevents the cloud application from starting. ### Claim 4 (depends on 1) The method as described in claim 1 further including performing the evaluating operation using a changed set of security service requirements specified by the cloud application or a changed set of security resources configured in the secure application zone. ### Claim 5 (depends on 1) The method as described in claim 1 wherein the set of security service requirements specified by the cloud application further include one or more specific security resource requirements. ### Claim 6 (depends on 1) The method as described in claim 1 wherein evaluating the security service requirements specified by the cloud application against the set of security resources configured in the secure application zone includes: providing a security assurance service with a query that includes the set of security service requirements specified by the cloud application; and receiving from the security assurance service a response that includes the determination. ### Claim 7 Apparatus, comprising: a processor; computer memory holding computer program instructions executed by the processor to enforce security service requirements for a cloud application, the computer program instructions comprising program code operative to: deploy a secure application zone for the cloud application, the secure application zone configuring a set of security resources in an automated manner in response to receipt of a specification of a security assurance level, the security assurance level specifying one or more general security requirements in a manner that does not expose at least some specific tooling requirements necessary to implement the security assurance level security requirement; receive a set of security service requirements specified by the cloud application, at least one security service requirement including one or more relationship-specific criteria associated with the cloud application; evaluate the security service requirements, including the relationship-specific criteria, against the set of security resources configured in the secure application zone; and responsive to a determination that the set of security resources configured in the secure application zone do not meet the security service requirements specified by the cloud application, receive from the cloud application a request to take a given action that provides an assurance that the security service requirements specified by the cloud application are satisfied. ### Claim 8 (depends on 7) The apparatus as described in claim 7 wherein the program code is further operative to take the given action responsive to the determination, wherein the given action is a remediation action that attempts to meet the security service requirements specified by the cloud application, the remediation action being one of: restricting another cloud application from being hosted in association with the cloud application, requesting upgrade or reconfiguration of the set of security resources configured in the secure application zone, requesting transfer of the cloud application to another specific cloud security environment, and requesting transfer of the cloud application to another cloud platform. ### Claim 9 (depends on 8) The apparatus as described in claim 8 wherein the given action temporarily de-activates the cloud application or prevents the cloud application from starting. ### Claim 10 (depends on 7) The apparatus as described in claim 7 wherein the program code is operative to perform the evaluate operation using a changed set of security service requirements specified by the cloud application or a changed set of security resources configured in the secure application zone. ### Claim 11 (depends on 7) The apparatus as described in claim 7 wherein the set of security service requirements specified by the cloud application further include one or more specific security resource requirements. ### Claim 12 (depends on 7) The apparatus as described in claim 7 wherein the program code operative to evaluate the security service requirements specified by the cloud application against the set of security resources configured in the secure application zone is further operative to: provide a security assurance service with a query that includes the set of security service requirements specified by the cloud application; and receive from the security assurance service a response that includes the determination. ### Claim 13 A computer program product in a non-transitory computer readable medium for use in a data processing system, the computer program product holding computer program instructions executed by the data processing system to improve a cloud computing environment by enabling enforcement of security service requirements for a cloud application, the computer program instructions comprising program code operative to: deploy a secure application zone for the cloud application, the secure application zone configuring a set of security resources in an automated manner in response to receipt of a specification of a security assurance level, the security assurance level specifying one or more general security requirements in a manner that does not expose at least some specific tooling requirements necessary to implement the security assurance level security requirement; receive a set of security service requirements specified by the cloud application, at least one security service requirement including one or more relationship-specific criteria associated with the cloud application; evaluate the security service requirements, including the relationship-specific criteria, against the set of security resources configured in the secure application zone; and responsive to a determination that the set of security resources configured in the secure application zone do not meet the security service requirements specified by the cloud application, receive from the cloud application a request to take a given action that provides an assurance that the security service requirements specified by the cloud application are satisfied. ### Claim 14 (depends on 13) The computer program product as described in claim 13 wherein the program code is further operative to take a given action responsive to the determination, wherein the given action is a remediation action that attempts to meet the security service requirements specified by the cloud application, the remediation action being one of: restricting another cloud application from being hosted in association with the cloud application, requesting upgrade or reconfiguration of the set of security resources configured in the secure application zone, requesting transfer of the cloud application to another specific cloud security environment, and requesting transfer of the cloud application to another cloud platform. ### Claim 15 (depends on 14) The computer program product as described in claim 14 wherein the given action temporarily de-activates the cloud application or prevents the cloud application from starting. ### Claim 16 (depends on 13) The computer program product as described in claim 13 wherein the program code is operative to perform the evaluate operation using a changed set of security service requirements specified by the cloud application or a changed set of security resources configured in the secure application zone. ### Claim 17 (depends on 13) The computer program product as described in claim 13 wherein the set of security service requirements specified by the cloud application further include one or more specific security resource requirements. ### Claim 18 (depends on 13) The computer program product as described in claim 13 wherein the program code operative to evaluate the security service requirements specified by the cloud application against the set of security resources configured in the secure application zone is further operative to: provide a security assurance service with a query that includes the set of security service requirements specified by the cloud application; and receive from the security assurance service a response that includes the determination.