Data isolation in shared resource environments

A system of facilitating data isolation in a shared resource environment, said system comprising:

• a sharable resource within the shared resource environment, said sharable resource comprising a plurality of data connections to enable communication within the shared resource environment absent use of an external network;
• a processor in communications with the sharable resource, wherein the system is capable of performing a method, said method comprising identifying to the sharable resource a data connection of the plurality of data connections to be placed in isolation mode, for increased data security, from any communication within the sharable resource between data connections thereof, and to require that communication with-to and from the data connection to-pass through a component external to the sharable resource which controls communication between sharing entities which share the sharable resource;
• isolating by the sharable resource the data connection of the plurality of data connections by placing the data connection in the isolation mode, wherein communication within the sharable resource from the isolated data connection to all other data connections of the plurality of data connections is blocked, and wherein communication within the sharable resource to the isolated data connection from all other data connections of the plurality of data connections is blocked, but communication within the sharable resource between the other data connections of the plurality of data connections of the sharable resource is unaffected by placing the data connection in isolation mode;
• and
• wherein the isolating includes a plurality of types of isolation, including isolated forward and isolated drop,
• wherein the isolated forward type of isolation comprises forwarding to the component external to the sharable resource all communication from the isolated data connection destined for any other data connection of the plurality of data connections, and all communication destined for the isolated data connection from any other data connection of the plurality of data connections, and wherein the isolating comprises setting an access control indicator to indicate isolated forward or isolated drop, and forward in the isolated forward represents that a packet will be sent onto the network, and drop in the isolated drop represents the packet will be terminated in the sharable resource and not sent onto the network.

A computer program product to facilitate data isolation in a shared resource environment, said computer program product comprising:

• a non-transitory storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising:
• having a sharable resource within the shared resource environment, said sharable resource comprising a plurality of data connections to enable communication within the shared resource environment absent use of an external network;
• identifying to the sharable resource a data connection of the plurality of data connections to be placed in isolation mode, for increased data security, from any communication within the sharable resource between data connections thereof, and to require that communication to and from the data connection to-pass through a component external to the sharable resource which controls communication between sharing entities which share the sharable resource;
• isolating by the sharable resource the data connection of the plurality of data connections by placing the data connection in the isolation mode, wherein the isolating blocks communication within the sharable resource from the isolated data connection to all other data connections of the plurality of data connections, and blocks communication within the sharable resource to the isolated data connection from all other data connections of the plurality of data connections, but communication within the sharable resource between the other data connections of the plurality of data connections of the sharable resource is unaffected by the isolating;
• and
• wherein the isolating includes a plurality of types of isolation, including isolated forward and isolated drop,
• wherein the isolated forward type of isolation comprises forwarding to the component external to the sharable resource all communication from the isolated data connection destined for any other data connection of the plurality of data connections, and all communication destined for the isolated data connection from any other data connection of the plurality of data connections, and wherein the isolating comprises setting an access control indicator to indicate isolated forward or isolated drop, and forward in the isolated forward represents that a packet will be sent onto the network, and drop in the isolated drop represents the packet will be terminated in the sharable resource and not sent onto the network.