Techniques for prevent information disclosure via dynamic secure cloud resources
View Patent ↗Techniques for preventing information disclosure via dynamic secure cloud resources are provided. Data (information) remotely housed on a particular cloud resource of a particular cloud is periodically, randomly, and dynamically changed to a different cloud resource within the same cloud or to a different cloud resource within an entirely different cloud. A requesting principal for the data is dynamically authenticated and a current location for the data is dynamically resolved and the principal is securely and dynamically connected to the current cloud resource and current cloud hosting the data for access.
1. A method implemented in a non-transitory machine-readable storage medium and processed by one or more processors configured to perform the method, comprising:
determining to move a remotely-housed resource from a first machine to a second machine over a network based on a policy evaluation for the remotely-housed resource and the policy evaluation indicating a change in a current location for the remotely-housed resource on the first machine is to be made to a new location on the second machine and the policy evaluation identifying the second machine, and a policy evaluated in the policy evaluation is randomly generated based on time, the remotely-housed resource is a particular resource that is managed over the network and is external or remote from a requesting principal that requests the remotely-housed resource, and wherein the remotely-housed resource is a document;
acquiring configuration details for the second machine, the configuration details include specific metadata for creating the second machine as a dynamically created and installed virtual machine;
wherein acquiring further includes generating the configuration details for a newly created virtual machine (VM), which is the second machine, or a workload and the configuration details include a randomly generated Internet Protocol (IP) address and a randomly generated communication port for communicating with the newly created VM or the workload;
obtaining an encryption key for the second machine that machine, the second machine generating the encryption key and the encryption key is for and associated with the second machine;
facilitate moving of the remotely-housed resource in an encrypted format using the encryption key from the first machine to the second machine; and
updating a mapping that maps the remotely-housed resource to the second machine, the mapping originally mapped the remotely-housed resource to the first machine.
2. The method of claim 1 , wherein acquiring further includes requesting the configuration details from a cloud-provisioning service, the second machine is a virtual machine dynamically created and instantiated by the cloud-provisioning service.
3. The method of claim 1 , wherein generating further includes cloning the newly created VM from a template.
4. The method of claim 1 , wherein obtaining further includes requesting that the second machine provide a public key from the second machine's private and public key pair, the public key is the encryption key.
5. The method of claim 1 , wherein facilitate moving further includes instructing the first machine to communicate with the second machine via the configuration details to provide the remotely-housed resource in the encrypted format.
6. The method of claim 1 , wherein facilitate moving further includes directly communicating with the second machine via the configuration details to provide the remotely-housed resource in the encrypted format.
7. The method of claim 1 , wherein updating further includes decommissioning the first machine.