System and method for dynamic security provisioning of computing resources
View Patent ↗The present invention facilitates the dynamic provisioning of computing and data assets in a commodity computing environment. The invention provides a system and method for dynamically provisioning and de-provisioning computing resources based on multi-dimensional decision criteria. By employing specialized computing components configured to assess an asset and requestor of an asset, a provisioning engine is able to transform the input from the computing components into a specific configuration of computing resource provisioning and security controls. According to the rules and policies applying to a security domain, the provisioning engine may dynamically allocate computing resources in a manner that is both safe and efficient for the asset.
1. A method, comprising:
determining, by a computer based system for dynamically provisioning computing resources, an asset classification of an asset, a business value of said asset, and a resource classification related to said asset,
dynamically assigning, by said computer based system, said asset to one of a plurality of security domains based on said resource classification and at least one of: (1) a source of a request for a computing resource, wherein said request is associated with said asset and (2) said determining, wherein each security domain corresponds to a different degree of security control based on the business value of said asset;
applying, by said computer based system, an increasing level of encryption to asset data based on said asset classification; and
provisioning, by said computer based system, said computing resource based on said one of said plurality of security domains.
2. The method of claim 1 , further comprising determining, by said computer based system, a data classification of said asset.
3. The method of claim 1 , wherein said asset classification is at least one of:
a public asset, a business confidential asset, a private asset, and a secret asset.
4. The method of claim 1 , wherein said business value of said asset is one of:
a low value, a medium value, and a high value.
5. The method of claim 1 , wherein said resource classification is one of: a trusted classification for internal entities and a non-trusted classification for external entities.
6. The method of claim 1 , further comprising de-provisioning, by said computer based system, said computing resource.
7. The method of claim 1 , further comprising de-provisioning, by said computer based system, said computing resource when said computing resource is no longer needed by said asset.
8. The method of claim 1 , further comprising verifying, by said computer based system, a software inventory of at least one of: an internal client and an external client.
9. The method of claim 1 , further comprising defining, by said computer based system, which processes may be suspended if said asset requires an additional computing resource.
10. The method of claim 1 , further comprising storing, by said computer based system, policies regarding processing assets when computing resources are limited due to a failure of at least one of: software and hardware.
11. The method of claim 1 , further comprising determining a geographical source from which said request originates and applying at least one of a patch and a privacy rule based on said geographical source determination.
12. A machine-readable non-transitory medium having stored thereon a plurality of instructions that, when executed by a computer based system for dynamically provisioning computing resources, cause said computer based system to perform operations comprising:
determining, by said computer based system, an asset classification of an asset, a business value of said asset, and a resource classification related to said asset,
dynamically assigning, by said computer based system, said asset to one of a plurality of security domains based on said resource classification and at least one of: (1) a source of a request for a computing resource, wherein said request is associated with said asset and (2) said determining, wherein each security domain corresponds to a different degree of security control based on the business value of said asset;
applying, by said computer based system, an increasing level of encryption to asset data based on said asset classification; and
provisioning, by said computer based system, said computing resource based on said one of said plurality of security domains.
13. A system configured to facilitate dynamic provisioning of computing resources, said system comprising a provisioning engine having a memory and processor, said provisioning engine performs operations comprising:
determining, by said provisioning engine, an asset classification of an asset, a business value of said asset, and a resource classification related to said asset,
dynamically assigning, by said provisioning engine, said asset to one of a plurality of security domains based on said resource classification and at least one of: (1) a source of a request for a computing resource, wherein said request is associated with said asset and (2) said determining, wherein each security domain corresponds to a different degree of security control based on the business value of said asset;
applying, by said provisioning engine, an increasing level of encryption to asset data based on said asset classification; and
provisioning, by said provisioning engine, said computing resource based on said one of said plurality of security domains.
14. The system of claim 13 , further comprising a server configured to communicate with at least one of: an internal and an external client.
15. The system of claim 13 , further comprising a domain database configured to store domain rules and policies.
16. The system of claim 13 , further comprising a connection manager instruction module configured to direct at least one of: an internal client and an external client to comply with software requirements.
17. The system of claim 13 , further comprising a configuration manager instruction module configured to identify which processes may be suspended if an asset requires additional computing resource.
18. The system of claim 13 , further comprising a risk manager instruction module configured to verify software inventory of at least one of: an internal client and an external client.
19. The system of claim 13 , further comprising a recovery manager instruction module configured to store policies regarding processing assets when computing resources are limited due to at least one of: an equipment failure and a software failure.