US 2023/0146669 A1 · RESOURCE UNIT ISOLATION FOR INCREASED SAFETY AND SECURITY IN CLOUD SERVICES

Abstract

The techniques disclosed herein enable improved security as well as more scalable and reliable job execution by utilizing granular security boundaries and certificate-based authentication for all communication within cloud-based platforms. To manage a cloud-based platform, a system receives a plurality of jobs and associated certificates at a first security boundary that are to be executed at various resource units within a second security boundary. The system then authenticates each certificate before transmitting each job to its respective resource unit for execution. In addition, the system is further configured to monitor active certificates for compromise and accordingly isolate various security boundaries in the event of a security breach. By isolating portions of the cloud-based platform within security boundaries, the system can mitigate the impact of security breaches. Furthermore, certificate-based authentication addresses performance constraints to enable more efficient and scalable job execution.

Claims20

Dependent claims

A method comprising:

receiving a plurality of jobs within a first security boundary comprising an administrative entity and a job queue, wherein each job of the plurality of jobs is associated with a certificate that identifies a user account;
selecting an individual job from the plurality of jobs at the job queue for execution within a second security boundary comprising a plurality of resource units, wherein the individual job defines a destination resource unit at the second security boundary;
selecting the destination resource unit from the plurality of resource units within the second security boundary;
determining that the certificate associated with the individual job matches a predefined certificate signature;
in response to determining that the certificate associated with the individual job matches the predefined certificate signature, receiving the individual job from the administrative entity within the first security boundary at the destination resource unit within the second security boundary for execution;
and
executing, at the destination resource unit within the second security boundary, one or more functions defined by the individual job.

4 more elements

A system comprising:

one or more processing units;
and
a computer-readable medium having encoded thereon computer-readable instructions that when executed, cause the one or more processing units to:
receive a plurality of jobs within a first security boundary comprising an administrative entity and a job queue, wherein each job of the plurality of jobs is associated with a certificate that identifies a user account;
select an individual job from the plurality of jobs at the job queue for execution within a second security boundary comprising a plurality of resource units, wherein the individual job defines a destination resource unit at the second security boundary;
select the destination resource unit from the plurality of resource units within the second security boundary;
determine that the certificate associated with the individual job matches a predefined certificate signature;
in response to determining that the certificate associated with the individual job matches the predefined certificate signature, receive the individual job from the administrative entity within the first security boundary at the destination resource unit within the second security boundary for execution;
and
execute, at the destination resource unit within the second security boundary, one or more functions defined by the individual job.

7 more elements

A system comprising:

one or more processing units;
and
a computer-readable medium having encoded thereon computer-readable instructions that when executed, cause the one or more processing units to:
generate communication data at a resource unit of a plurality of resource units within a first security boundary for transmission to an administrative entity within a second security boundary;
associate a certificate with the communication data that identifies the resource unit;
determine, at the administrative entity within the second security boundary, whether the certificate associated with the communication data matches a predefined certificate signature;
and
in an event the certificate associated with the communication data matches the predefined certificate signature, receive the communication data from the resource unit within the first security boundary at the administrative entity within the second security boundary.

5 more elements

Dependencies are inferred from the claim text.

Resource unit isolation for increased safety and security in cloud services

Life of this patent

Resource unit isolation for increased safety and security in cloud services

Life of this patent

Abstract

Claims20