US20110072487A1 - System, Method, and Software for Providing Access Control Enforcement Capabilities in Cloud Computing Systems - Google Patents

Abstract

According to one embodiment, a system comprises one or more processors coupled to a memory. The one or more processors when executing logic encoded in the memory provide a topology manager. The topology manager is configured to maintain a security topology of a plurality of hosts. The security topology associates one or more virtual hosts policies with a plurality of virtual hosts in a cloud computing deployment. The topology manager is also configured to request a query for one or more hosts that are candidates to be enforced. A portability manager is configured to receive a request to deploy an access control agent on the one or more candidate hosts, determine an optimal agent to be deployed from a list of available agents, and deploy the optimal agent on the one or more candidate hosts.

Description

TECHNICAL FIELD
• The present invention relates generally to computer management, and more particularly to a system, method, and software for enforcing access control in cloud computing systems.
BACKGROUND
• Cloud computing systems include computing resources. For example, cloud computing systems may include servers, network storage devices, and other information technology (IT) services. Cloud computing systems include proprietary interfaces to access their respective computing resources.
SUMMARY
• According to one embodiment, a system comprises one or more processors coupled to a memory. The one or more processors when executing logic encoded in the memory provide a topology manager. The topology manager is configured to maintain a security topology of a plurality of hosts. The security topology associates one or more virtual hosts policies with a plurality of virtual hosts in a cloud computing deployment. The topology manager is also configured to request a query for one or more hosts that are candidates to be enforced. A portability manager is configured to receive a request to deploy an access control agent on the one or more candidate hosts, determine an optimal agent to be deployed from a list of available agents, and deploy the optimal agent on the one or more candidate hosts.
• Certain embodiments of the present invention may provide one or more technical advantages. For example, a technical advantage of one embodiment may include the capability to prevent virtual machine sprawl. Another technical advantage of one embodiment may include the capability to protect the physical boundaries of virtual machines. Another technical advantage of one embodiment may include the capability to guard external management capabilities and prevent misuses of a cloud image by an unauthorized administrator. Another technical advantage of one embodiment may include the capability to accept and enforce customer security compliance needs on a cloud computing system.
• While specific advantages have been enumerated above, various embodiments may include all, some, or none of the enumerated advantages. Additionally, other technical advantages may become readily apparent to one of ordinary skill in the art after review of the following figures, description, and claims.
BRIEF DESCRIPTION OF THE DRAWINGS
• For a more complete understanding of the present invention and its features and advantages, reference is now made to the following description, taken in conjunction with the accompanying drawings, in which:
• FIG. 1 illustrates an example system for providing access control enforcement capabilities in cloud computing systems, according to certain embodiments;
• FIG. 2 illustrates an example external integration architecture and the cloud computing system architecture ofFIG. 1, according to certain embodiments; and
• FIG. 3 illustrates example details of the external integration architecture and cloud computing system architecture ofFIGS. 1 and 2, according to certain embodiments.
DESCRIPTION OF EXAMPLE EMBODIMENTS
• It should be understood at the outset that although example implementations of embodiments of the invention are illustrated below, the present invention may be implemented using any number of techniques, whether currently known or in existence. The present invention should in no way be limited to the example implementations, drawings, and techniques illustrated below. Additionally, the drawings are not necessarily drawn to scale.
• FIG. 1 illustrates anexample system100 for providing access control enforcement capabilities in cloud computing systems according to some embodiments.System100 may include one ormore user systems102 and one or moreadministrative systems104, one ormore server systems106, one or morecloud computing systems108 and110, and anetwork112. Although this particular implementation ofsystem100 is illustrated and primarily described, embodiments may include any suitable implementation ofsystem100 according to particular needs.
• In general,system100 is operable to integrate between IT Information Library (ITIL) software components (such as ITIL V3 and any future versions of ITIL in EITM) and cloud computing systems. In certain embodiments,system100 includes a cloud computing system architecture for integrating cloud computing systems with ITIL software components. For example, an external integration architecture may include several ITIL software components. According to certain embodiments, adapters are created in a cloud computing system architecture that bridge the architectural layer that encapsulates and abstracts the cloud computing systems while still integrating with enterprise ITIL software components. Thus, certain embodiments provide a set of components for life cycle phases of ITIL service management, from strategy to design, transition, and operation. In certain embodiments, the cloud computing system architecture is mapped to the different layers of the cloud computing systems, thus serving IT workshops and workers that rent cloud computing resources and manage the cloud computing systems within their own IT organization in an abstract manner. In certain embodiments, the cloud computing system architecture may serve the cloud computing system providers that manage their cloud computing systems and provide ITIL integration points to their customers.
• System100 may include one ormore user systems102 and one or moreadministrative systems104. “User system102” and “user ofuser system102” may be used interchangeably. A user ofuser system102 may include, for example, a human user or a computer program or other suitable software module for automatically interacting withuser system102. Likewise, “administrative system104” and “user ofadministrative system104” may be used interchangeably. A user ofadministrative system104 may include, for example, a human user or a computer program or other suitable software module for automatically interacting withadministrative system104.
• Eachuser system102 andadministrative system104 may include one or more computer systems at one or more locations. Each computer system may include any appropriate input devices (such as a keypad, touch screen, mouse, or other device that can accept information), output devices, mass storage media, or other suitable components for receiving, processing, storing, and communicating data. Both the input device and output device may include fixed or removable storage media such as a magnetic computer disk, CD-ROM, or other suitable media to both receive input from and provide output to a user ofadministrative system104. Each computer system may include a personal computer, workstation, network computer, kiosk, wireless data port, personal data assistant (PDA), one or more processors within these or other devices, or any other suitable processing device. As an example,system100 may include multipledistributed user systems102 and/oradministrative systems104.User systems102 andadministrative systems104 may be physically distributed, being in different locations geographically remote from each other and from the other components ofsystem100, or logically distributed, being at approximately the same location asother user systems102 andadministrative systems104 and the other components ofsystem100. For simplicity, the one ormore user systems102 andadministrative systems104 ofsystem100 are referred to throughout this description primarily in the singular. Althoughuser system102 andadministrative system104 are illustrated and primarily described as being separate, it is understood that the computer systems and the functionality associated withuser system102 andadministrative system104 may be combined or separated in any suitable manner.
• System100 may include one ormore server systems106, referred to primarily in the singular throughout the remainder of this description.Server system106 may include one or more electronic computing devices operable to receive, transmit, process, and store data associated withsystem100. For example,server system106 may include one or more general-purpose PCs, Macintoshes, workstations, Unix-based computers, server computers, one or more server pools, or any other suitable devices. In certain embodiments,server system106 includes a web server. In short,server system106 may include any suitable combination of software, firmware, and hardware. Although asingle server system106 is illustrated, some embodiments contemplatesystem100 including any suitable number ofserver systems106. Moreover, although referred to as a “server system,” some embodiments contemplateserver system106 comprising any suitable type of processing device or devices.
• Server system106 may be communicatively coupled tocloud computing systems108 and110 vianetwork112. Although not illustrated,user system102 andadministrative system104 may be communicatively coupled to one another as well as toserver system106 vianetwork112. Network112 facilitates wireless or wireline communication. Network112 may communicate, for example, IP packets, Frame Relay frames, Asynchronous Transfer Mode (ATM) cells, voice, video, data, and other suitable information between network addresses. Network112 may include one or more local area networks (LANs), radio access networks (RANs), metropolitan area networks (MANS), wide area networks (WANs), all or a portion of the global computer network known as the Internet, and/or any other communication system or systems at one or more locations.
• Server system106 may include aprocessing module114 and amemory module116.Processing module114 may include one or more microprocessors, controllers, or any other suitable computing devices or computing resources.Processing module114 may work, either alone or with other components ofsystem100, to provide a portion or all of the functionality ofsystem100 described herein.Memory module116 may take the form of volatile or non-volatile memory including, without limitation, magnetic media, optical media, random access memory (RAM), read-only memory (ROM), removable media, or any other suitable memory component. Although asingle server system106 is illustrated, some embodiments contemplatesystem100 including any suitable number ofserver systems106. Moreover, although referred to as a “server system,” some embodiments contemplateserver system106 comprising any suitable type of processing device or devices.
• System100 may include one or morecloud computing systems108 and110.Cloud computing systems108 and110 may include one or more electronic computing devices operable to receive, transmit, process, and store data associated withsystem100. For example,cloud computing systems108 and110 may include one or more general-purpose PCs, Macintoshes, workstations, Unix-based computers, server computers, one or more server pools, or any other suitable devices. In short,cloud computing systems108 and110 may include any suitable combination of software, firmware, and hardware. It should be noted that although twocloud computing systems108 and110 are illustrated, any suitable number of cloud computing systems may be included insystem100. In addition, there may be multiple groups of cloud computing systems insystem100.
• In certain embodiments,cloud computing systems108 and110 providecomputing resources124 and126, respectively, touser systems102 andadministrative systems104 andcharges user systems102 andadministrative systems104 for their specific use ofcomputing resources124 and126. For example,cloud computing resources124 and126 may include one or more virtual machines. As another example,cloud computing resources124 and126 may include one or more machine images. A machine image may refer to a bootable file that includes a particular configuration and operating system. As yet another example,cloud computing resources124 and126 may include one or more Intel x86 based servers that provide a combination of hardware and software resources.
• In certain embodiments, computingresources124 and126 may be accessible by cloud computing interfaces120. From the perspective ofuser systems102 andadministrative systems104, renting computing resources from cloud computing interfaces120 has implications for application providers and IT architects that develop solutions targeted for internal enterprise deployment, rather than oncloud computing systems108 and110. For example, an IT architect may desire to deploy web servers, load balancers, and front-end interfaces remotely oncloud computing systems108 and110 but keep a database in a local IT environment. Further, from an ITIL process perspective, many large organizations may implement an ITIL approach by performing well-defined automated processes. Since an ITIL process may be agnostic to platform and technological tools, it may be desirable to integrate such practices with advances in technology, such ascloud computing systems108 and110.
• In certain embodiments,server system106 may include a cloudcomputing system architecture118. Cloudcomputing system architecture118 may refer to any suitable hardware and/or software operable to integrate ITIL software components withcloud computing systems108 and110 and theirrespective computing resources124 and126. For example, a connection may be established between cloudcomputing system architecture118 andcloud computing systems108 and110. A second connection may be established between cloudcomputing system architecture118 and an external integration architecture that includes the ITIL software components. As described in more detail below, cloudcomputing system architecture118 includes management components that provide integration points to connect the ITIL software components withcomputing resources124 and126 ofcloud computing systems108 and110.
• In certain embodiments, a secure connection may be established between cloudcomputing system architecture118 andcloud computing systems108 and110 overnetwork112. For example, a secure Hypertext Transfer Protocol (HTTP) connection may be established between cloudcomputing system architecture118 andcloud computing systems108 and110. A secure HTTP protocol refers to a protocol that provides the ability for secure transactions to take place overnetwork112. In alternative networks, any suitable data communications protocol may be used to establish a secure connection. Additional details of example embodiments of cloudcomputing system architecture118 are discussed in more detail below.
• FIG. 2 illustratesexternal integration architecture122 and cloudcomputing system architecture118 ofFIG. 1 according to some embodiments. As described above,external integration architecture122 may include several ITIL software components. For example,external integration architecture122 may include an ITIL software component that enables organization of the IT strategies and ongoing initiatives. As another example,external integration architecture122 may include an ITIL software component that sets and monitors agreements based on service requests, negotiates with supply chain managers, sets agreements for operations and services, and/or catalogs the results. As yet another example,external integration architecture122 may include an ITIL software component that captures defined and offered services. As yet another example,external integration architecture122 may include an ITIL software component that performs continuous analysis in order to evaluate service trends for optimization. As yet another example,external integration architecture122 may include an ITIL software component that maintains the deployment of the designed services, tracking and reporting the deployed assets within an organization, and/or maintains information on the topology and system infrastructure and the life cycle for design changes and releases. As yet another example,external integration architecture122 may include an ITIL software component that measures the services provided on an ongoing basis with the goal of ensuring a high level of quality is maintained across the IT investments, displays the overall status and health of the system to the consumer, and/or maintains ongoing provisioning, recovery, backup and redundancy of the IT assets within a data center, including countermeasures and remedies. As yet another example,external integration architecture122 may include an ITIL software component that provides proactive planning capabilities through the analysis of IT behavior, detects, utilization patterns and change history, determines if Service Level Agreements (SLAs) are being met, alerts a consumer that a problem is starting to appear, which may provide the consumer with the possibility of mitigating the issue before it becomes critical. As yet another example,external integration architecture122 may include an ITIL software component that manages users and controls their access to the resources in the system based on, for example, their organizational role. As yet another example,external integration architecture122 may include an ITIL software component that manages the distributed data stores for the organization, provisions and allocates storage resources, and/or provides the ability to restore IT services back to operation through a workflow and life cycle of incidents that concludes with incident resolution. As described in more detail below,computing system architecture118 includes management components that provide integration points to connect the ITIL software components with computing resources ofcloud computing systems108 and110.
• FIG. 3 illustrates example details of theexternal integration architecture122, the cloudcomputing system architecture118, and the cloud computing interfaces120 (collectively, the “system300”) ofFIGS. 1 and 2 according to some embodiments. The system300 features a federated configuration management database (CMDB)310, ahosts discovery component320, atopology manager330, aportability manager340, a cloudaccess control manager350, abenchmarking manager360, autility computing module370, andcloud users component380. Although this particular implementation of the system300 is illustrated and primarily described, embodiments may include any suitable implementation of the system300 according to particular needs.
• In some embodiments, thefederated CMDB310 may be responsible for storing updated versions of new servers and hosts, as well as maintaining a “snapshot” of the IT deployed (and discovered) assets.
• In some embodiments, thehosts discovery component320 may be responsible for extracting a list of hosts from thefederated CMDB310 according to a criteria using a hosts-on-demand detection component322. The hosts-on-demand detection component322 may be responsible for activating requests from thefederated CMDB310. In some embodiments, the hosts-on-demand detection component322 may produce the discovery of configuration items as a set or by certain criteria and may enable security managers to select specific IT sectors to be handled. The hosts-on-demand detection component322 may correlate any discrepancies between the managed repositories and ensure that security blueprints are up to date.
• In some embodiments, thetopology manager330 may trigger a query from the hosts-on-demand detection component322 for a list of specific hosts according to a compliance need. In some embodiments, thetopology manager330 may feature an access control topology Model Data Repository (MDR)332. The accesscontrol topology MDR332 may contain asecurity topology334 of all the hosts in the IT system that are candidates to be enforced, as well as theirsecurity policy336 and theirvirtual host policy338. Thevirtual host policy338 may be used in cases of virtual host operation systems that support many images of virtual hosts, known as guests. In some embodiments, a need for enforcement may trigger either the deployment of agents using theportability manager340 and/or the distribution of regular or virtual policies using the cloudaccess control manager350.
• In some embodiments, theportability manager340 may manage provisioning transformation and portability of deployed images from one cloud computing system to another, due to SLA optimizations and/or on-demand provisioning of cloud resources as a result of a shortage of resources within the customer internal data center, or other reasons, by re-packing the deployed entities according to the cloud computing system definitions. In the illustrated embodiment,portability manager340 includes an image design andmodeling component342, apackage description component344, and an image provisioning anddeployment component346. In certain embodiments,portability manager340 may deploy machine images to at least one cloud computing system based on instructions from an external integration architecture, such asexternal integration architecture122 ofFIG. 2.
• In one example embodiment, if one cloud computing system is not meeting SLA requirements,portability manager340 may repack the deployed entity according to the new cloud computing system definitions and port it to a new cloud computing system. For example, image design andmodeling component342 may define a configuration model of the entities that need to be packaged. In one embodiment, the image design andmodeling component342 may update thepackage description component344 to add definitions on upgrades and changes. The image design andmodeling component342 may also receive requests from thetopology manager330 to deploy an agent on the new server, determine an optimal version of agent to be deployed, and construct (model) the composition of components as an image. The image design andmodeling component342 may define a unique vender package and request to provision the image from the image provisioning anddeployment component346.
• Thepackage description component344 may generate the packaging instructions and configuration descriptions for a specific cloud computing system. The image provisioning anddeployment component346 may initiate the actual deployment of a certain configured machine image for a specific cloud computing system. In some embodiments, the image provisioning anddeployment component346 may rollout, configure, or re-deploy a patch for an enforcing agent or install new enforcing agents based on discovered entities. Such action may be triggered, for example, by access control compliance needs. The image provisioning anddeployment component346 may maintain images to be deployed, and teachings of certain embodiments recognize that the image provisioning anddeployment component346 may include the capability to rapidly scale and solve multiple deployment needs. The image provisioning anddeployment component346 upload the image into the cloud by deploying the image through theutility computing module370. In some embodiments, the image provisioning anddeployment component346 may obtain permission from the cloudaccess control manager350 before uploading the image.
• In some embodiments, the cloudaccess control manager350 may provide the security aspects of controlling the entry points to the cloud computing systems. In the illustrated embodiment, the cloudaccess control manager350 includes a cloudsecurity sentry component352, a securitySLA requests component354, and a wrapped cloud managedservices component356. In certain embodiments, cloudaccess control manager350 may provide security for an external integration architecture, such asexternal integration architecture122 ofFIG. 2.
• For example, thecloud security sentry352 may provide managed guarded-call as a broker and provide interceptors to theutility computing module370. As an interceptor, thecloud security sentry352 may prohibit actual implementations of the cloud web services. Thecloud security sentry352 may prevent a non-authorized access to any related managing aspects originating from within the customer side (externally to the cloud). Thecloud security sentry352 may provide transient allocation of security permits to the provisioning and benchmarking components and enable only these components to access the cloud for changing images. Thecloud security sentry352 may also intercept security policy distribution that is activated directly from the topology and/or rents permissions to the provision and benchmarking components.
• Security SLA requestscomponent354 may act as a remote proxy for compliance access control tools. Security SLA requestscomponent354 may mediate requests to deploy security and access control policies on roaming users, hosts, and servers. The security SLA requestscomponent354 may provide a bridge to IT access control in terms of administration operations; in some embodiments, the security SLA requestscomponent354 may act like a remote proxy for regular compliance access control tools. In some embodiments, the security SLA requestscomponent354 may forward and monitor requests of access policy and/or restrictions on moving the physical location of images, as well as request reports and monitoring information. In some embodiments, the security SLA requestscomponent354 may use thebenchmarking manager360 to extract the data from the cloud and provide limitations on the roaming capabilities of the cloud. The security SLA requestscomponent354 may invoke theutility computing module370 for retrieving reports and monitoring data and for propagating security enforcement requests to the cloud vendor. The wrapped cloud managedservices356 may provide managed services, as well as prevent cloud administration un-authorized calls and serve as an interception guard.
• In some embodiments, thebenchmarking manager360 may compare published capabilities of cloud computing systems and the relevant alternatives, including future self-investments in hardware and software as well as existing investments, by enabling comparative lists of cloud computing system attributes (such as provided hardware, cost for storage, cost for usage, and network bandwidth, as examples). In the illustrated embodiment,benchmarking manager360 includes anattributes extractor component362. In certain embodiments,benchmarking manager360 may generate a comparative list of one or more published capabilities of the cloud computing systems and provide this information to an external integration architecture, such asexternal integration architecture122 ofFIG. 2.
• For example,benchmarking manager360 may access the non-functional characteristics of one or more cloud computing systems (such as pricing, supported hardware, SLA and quality attributes). These attributes may be provided to theattributes extractor component362, which evaluates and composes accumulated values for each cloud computing system, comparing them against the customer quality attributes, which may provide customer specific prioritization of one or more cloud computing systems. In some embodiments, theattributes extractor component362 may accumulate information such as virtual host name, virtual host identifiers (e.g., MAC addresses), and virtual machine configuration data (such as network interfaces, external disks, and input/output ports).
• In some embodiments, theutility computing module370 may include adelivery gateway372, adistribution component374, an agentdata collection component376, and a managedservices component378. Thedelivery gateway component372 may be deployed within the cloud vendor's site and may be able to accept and delegate the need for internal policy enforcement on physical servers and virtual hosts (which may include operation systems that support hardware and operating system virtualization, or server virtualization). Thedistribution component374 may be responsible for receiving and delegating the access control policy, delegating those to internal enforcement agents. The agentdata collection component376 may be responsible for collecting internal reporting information about the statuses of the system, delegating that information to thecloud users component380. The managedservices component378 may include vendor proprietary services that provide interactions with theutility computing module370 solutions.
• In some embodiments, thecloud users380 may allow regular administrators of the IT organization to interact with the cloud information, such as by using supervised services. Thecloud users component380 may include single sign-on capabilities. Thecloud users component380 may prepare interaction with the cloud specific calls by using the organization regular methodologies and unifying the different cloud vendor languages. In some embodiments, thecloud users380 may obtain secured access to cloud resources through the cloudaccess control manager350, which may intercept management calls from thecloud users380.
• Modifications, additions, or omissions may be made to the systems and apparatuses described herein without departing from the scope of the invention. The components of the systems and apparatuses may be integrated or separated. Moreover, the operations of the systems and apparatuses may be performed by more, fewer, or other components. The methods may include more, fewer, or other steps. Additionally, steps may be performed in any suitable order. Additionally, operations of the systems and apparatuses may be performed using any suitable logic. As used in this document, “each” refers to each member of a set or each member of a subset of a set.
• Although several embodiments have been illustrated and described in detail, it will be recognized that substitutions and alterations are possible without departing from the spirit and scope of the present invention, as defined by the appended claims.
• To aid the Patent Office, and any readers of any patent issued on this application in interpreting the claims appended hereto, applicants wish to note that they do not intend any of the appended claims to invoke paragraph 6 of 35 U.S.C. §112 as it exists on the date of filing hereof unless the words “means for” or “step for” are explicitly used in the particular claim.

Claims (21)

1. A system comprising one or more processors coupled to a memory, the one or more processors when executing logic encoded in the memory providing:

a topology manager, configured to:

maintain a security topology of a plurality of hosts, the security topology associating one or more virtual host policies with a plurality of virtual hosts in a cloud computing deployment; and

request a query for one or more hosts that are candidates to be enforced (candidate hosts); and

a portability manager, configured to:

receive a request to deploy an access control agent on the one or more candidate hosts;

determine an optimal agent to be deployed from a list of available agents; and

deploy the optimal agent on the one or more candidate hosts.

2. The system ofclaim 1, wherein the candidate host is provided by a specific vendor, the portability manager further configured to:

define a unique vendor package, the unique vendor package comprising instructions and configurations in compliance with the specific vendor; and

package the unique vendor package with the optimal agent such that the optimal agent is configured to deploy on the specific vendor's candidate host.

3. The system ofclaim 1, further comprising:

a cloud access control manager, configured to:

intercept cloud management calls from an administrator;

determine whether cloud management calls are authorized; and

prepare the cloud management calls for interaction with a specific vendor.

4. The system ofclaim 1, further comprising:

an attributes extractor, configured to:

extract non-functional characteristics of the cloud computing deployment.

5. The system ofclaim 4, wherein the non-functional characteristics comprise a virtual host name, a virtual host identifier, and a list of virtual host configuration data.

6. The system ofclaim 1, the topology manager further configured to maintain a security topology by:

requesting discovery of a list of virtual hosts deployed on the cloud computing deployment; and

associating the list of virtual hosts with the one or more virtual host policies.

7. The system ofclaim 6, the topology manager further configured to maintain a security topology by:

requesting discovery of an updated list of virtual hosts deployed on the cloud computing deployment;

resolving discrepancies between the list of virtual hosts and the updated list of virtual hosts; and

updating the security topology.

8. A method comprising:

at a topology manager comprising logic encoded in one or more media for execution:

maintaining a security topology of a plurality of hosts, the security topology associating one or more virtual host policies with a plurality of virtual hosts in a cloud computing deployment; and

requesting a query for one or more hosts that are candidates to be enforced (candidate hosts); and

at a portability manager comprising logic encoded in one or more media for execution:

receiving a request to deploy an access control agent on the one or more candidate hosts;

determining an optimal agent to be deployed from a list of available agents; and

deploying the optimal agent on the one or more candidate hosts.

9. The method ofclaim 8, wherein the candidate host is provided by a specific vendor, the method at the portability manager further comprising:

defining a unique vendor package, the unique vendor package comprising instructions and configurations in compliance with the specific vendor; and

packaging the unique vendor package with the optimal agent such that the optimal agent is configured to deploy on the specific vendor's candidate host.

10. The method ofclaim 8, further comprising:

at a cloud access control manager comprising logic encoded in one or more media for execution:

intercepting cloud management calls from an administrator;

determining whether-cloud management calls are authorized; and

preparing the cloud management calls for interaction with a specific vendor.

11. The method ofclaim 8, further comprising:

at an attributes extractor comprising logic encoded in one or more media for execution:

extract non-functional characteristics of the cloud computing deployment.

12. The method ofclaim 11, wherein the non-functional characteristics comprise a virtual host name, a virtual host identifier, and a list of virtual host configuration data.

13. The method ofclaim 8, the method at the topology manager further comprising:

requesting discovery of a list of virtual hosts deployed on the cloud computing deployment; and

associating the list of virtual hosts with the one or more virtual host policies.

14. The method ofclaim 13, the method at the topology manager further comprising:

requesting discovery of an updated list of virtual hosts deployed on the cloud computing deployment;

resolving discrepancies between the list of virtual hosts and the updated list of virtual hosts; and

updating the security topology.

15. Logic encoded in one or more computer-readable storage media for execution and when executed operable to provide:

a topology manager, configured to:

maintain a security topology of a plurality of hosts, the security topology associating one or more virtual host policies with a plurality of virtual hosts in a cloud computing deployment; and

request a query for one or more hosts that are candidates to be enforced (candidate hosts); and

a portability manager, configured to:

receive a request to deploy an access control agent on the one or more candidate hosts;

determine an optimal agent to be deployed from a list of available agents; and

deploy the optimal agent on the one or more candidate hosts.

16. The logic ofclaim 15, wherein the candidate host is provided by a specific vendor, the portability manager further configured to:

define a unique vendor package, the unique vendor package comprising instructions and configurations in compliance with the specific vendor; and

package the unique vendor package with the optimal agent such that the optimal agent is configured to deploy on the specific vendor's candidate host.

17. The logic ofclaim 15, further providing:

a cloud access control manager, configured to:

intercept cloud management calls from an administrator;

determine whether cloud management calls are authorized; and

prepare the cloud management calls for interaction with a specific vendor.

18. The logic ofclaim 15, further providing:

an attributes extractor, configured to:

extract non-functional characteristics of the cloud computing deployment.

19. The logic ofclaim 18, wherein the non-functional characteristics comprise a virtual host name, a virtual host identifier, and a list of virtual host configuration data.

20. The logic ofclaim 15, the topology manager further configured to maintain a security topology by:

requesting discovery of a list of virtual hosts deployed on the cloud computing deployment; and

associating the list of virtual hosts with the one or more virtual host policies.

21. The logic ofclaim 20, the topology manager further configured to maintain a security topology by:

requesting discovery of an updated list of virtual hosts deployed on the cloud computing deployment;

resolving discrepancies between the list of virtual hosts and the updated list of virtual hosts; and

updating the security topology.

Images