Protected application stack and method and system of utilizing
A secure appliance for use within a multi-tenant cloud computing environment which comprises: a) a policy enforcement point (PEP); b) a hardened Operating System (OS) capable of deploying applications; and c) at least one application capable of hosting services and application program interfaces (APIs).
1. A server computer, comprising:
a memory, the memory stores a set of policy constraints; and
a set of hardware processors in communication with the memory, the set of hardware processors executes a hypervisor, the hypervisor executes a first virtual policy enforcement point appliance, the first virtual policy enforcement point appliance runs a first operating system that includes a firewall, the first operating system runs a first application and a first policy enforcement point, the first virtual policy enforcement point appliance restricts all application layer communication to and from the first application to pass through the first policy enforcement point, the first policy enforcement point controls all application layer communication to and from the first application based on the set of policy constraints.
2. The server computer of claim 1 , wherein:
the set of hardware processors receives a message from a second server different from the server computer, the first policy enforcement point determines whether to pass the message to the first application based on the set of policy constraints.
3. The server computer of claim 1 , wherein:
the first virtual policy enforcement point appliance provides individual application isolation for only the first application.
4. The server computer of claim 1 , wherein:
the set of hardware processors executes a second application, the first policy enforcement point controls all application layer communication from the second application to the first application based on the set of policy constraints.
5. The server computer of claim 4 , wherein:
the first application communicates with the first policy enforcement point using a localhost connection.
6. The server computer of claim 1 , wherein:
the first policy enforcement point communicates with the first application using exclusively localhost connections.
7. A system, comprising:
a first hardware processor, the first hardware processor executes a hypervisor, the hypervisor executes a first virtual policy enforcement point appliance, the first virtual policy enforcement point appliance runs a first operating system that includes a firewall, the first operating system runs a first application and a first policy enforcement point, the first virtual policy enforcement point appliance restricts all application layer communication to and from the first application to pass through the first policy enforcement point, the first policy enforcement point controls all application layer communication to and from the first application based on a first set of policy constraints; and
a second hardware processor, the second hardware processor in communication with the first hardware processor, the second hardware processor executes a third application, the first policy enforcement point controls all application layer communication from the third application to the first application based on the first set of policy constraints.
8. The system of claim 7 , wherein:
the hypervisor executes a second virtual policy enforcement point appliance, the second virtual policy enforcement point appliance runs a second operating system that includes a second firewall, the second operating system runs a second application and a second policy enforcement point, the second virtual policy enforcement point appliance restricts all application layer communication to and from the second application to pass through the second policy enforcement point.
9. The system of claim 8 , wherein:
the second operating system is different from the first operating system.
10. The system of claim 8 , wherein:
the second policy enforcement point controls all application layer communication to and from the second application based on the first set of policy constraints.
11. The system of claim 7 , wherein:
the first virtual policy enforcement point appliance provides individual application isolation for only the first application.
12. The system of claim 7 , wherein:
the first application communicates with the first policy enforcement point using a localhost connection.
13. The system of claim 7 , wherein:
the first policy enforcement point communicates with the first application using exclusively localhost connections.
14. A system, comprising:
a first hardware server, the first hardware server executes a hypervisor, the hypervisor executes a first virtual policy enforcement point appliance, the first virtual policy enforcement point appliance runs a first operating system that includes a firewall, the first operating system runs a first application and a first policy enforcement point, the first virtual policy enforcement point appliance restricts all application layer communication to and from the first application to pass through the first policy enforcement point, the first policy enforcement point controls all application layer communication to and from the first application based on a first set of policy constraints; and
a second hardware server, the second hardware server executes a third application, the first policy enforcement point controls all application layer communication from the third application to the first application based on the first set of policy constraints.
15. The system of claim 14 , wherein:
the first hardware server receives a message from the second hardware server, the first policy enforcement point determines whether to pass the message to the first application based on the first set of policy constraints.
16. The system of claim 15 , wherein:
the hypervisor executes a second virtual policy enforcement point appliance, the second virtual policy enforcement point appliance runs a second operating system that includes a second firewall, the second operating system runs a second application and a second policy enforcement point, the second virtual policy enforcement point appliance restricts all application layer communication to and from the second application to pass through the second policy enforcement point.
17. The system of claim 16 , wherein:
the second operating system is different from the first operating system.
18. The system of claim 14 , wherein:
the first application communicates with the first policy enforcement point using a localhost connection.
19. The system of claim 14 , wherein:
the first virtual policy enforcement point appliance provides individual application isolation for only the first application.