System and method for dynamic security provisioning of computing resources
View Patent ↗The present invention facilitates the dynamic provisioning of computing and data assets in a commodity computing environment. The invention provides a system and method for dynamically provisioning and de-provisioning computing resources based on multi-dimensional decision criteria. By employing specialized computing components configured to assess an asset and requestor of an asset, a provisioning engine is able to transform the input from the computing components into a specific configuration of computing resource provisioning and security controls. According to the rules and policies applying to a security domain, the provisioning engine may dynamically allocate computing resources in a manner that is both safe and efficient for the asset.
1. A method, comprising:
assigning, by a computer based system for provisioning resources, an asset to one of a plurality of security domains based on a resource classification related to said asset and at least one of: (1) a source of a request for a resource, wherein said request is associated with said asset and (2) a business value of said asset, wherein said plurality of security domains correspond to varying degrees of security control based on said business value of said asset;
applying, by said computer based system, an increasing level of encryption to asset data based on an asset classification; and
provisioning, by said computer based system, said resource based on said one of said plurality of security domains.
2. The method of claim 1 , further comprising determining, by said computer based system, a data classification of said asset.
3. The method of claim 1 , wherein said asset classification is at least one of: a public asset, a business confidential asset, a private asset, and a secret asset.
4. The method of claim 1 , wherein said business value of said asset is one of: a low value, a medium value, and a high value.
5. The method of claim 1 , wherein said resource classification is one of: a trusted classification for internal entities and a non-trusted classification for external entities.
6. The method of claim 1 , further comprising de-provisioning, by said computer based system, said resource.
7. The method of claim 1 , further comprising de-provisioning, by said computer based system, said resource in response to said resource no longer being needed by said asset.
8. The method of claim 1 , further comprising verifying, by said computer based system, a software inventory of at least one of: an internal client and an external client.
9. The method of claim 1 , further comprising defining, by said computer based system, which processes may be suspended in response to said asset requiring an additional resource.
10. The method of claim 1 , further comprising storing, by said computer based system, policies regarding processing assets in response to resources being limited due to a failure of at least one of: software and hardware.
11. The method of claim 1 , further comprising determining a geographical source from which said request originates and applying at least one of a patch and a privacy rule based on said geographical source determination.
12. A machine-readable non-transitory medium having stored thereon a plurality of instructions that, when executed by a computer based system for provisioning resources, cause said computer based system to perform operations comprising:
assigning, by said computer based system, an asset to one of a plurality of security domains based on a resource classification related to said asset and at least one of: (1) a source of a request for a resource, wherein said request is associated with said asset and (2) a business value of said asset, wherein said plurality of security domains correspond to varying degrees of security control based on said business value of said asset;
applying, by said computer based system, an increasing level of encryption to asset data based on an asset classification; and
provisioning, by said computer based system, said resource based on said one of said plurality of security domains.
13. A system configured to facilitate provisioning of resources, said system comprising a provisioning engine having a memory and processor, said provisioning engine performs operations comprising:
assigning, by said provisioning engine, an asset to one of a plurality of security domains based on a resource classification related to said asset and at least one of: (1) a source of a request for a resource, wherein said request is associated with said asset and (2) a business value of said asset, wherein said plurality of security domains correspond to varying degrees of security control based on said business value of said asset;
applying, by said provisioning engine, an increasing level of encryption to asset data based on an asset classification; and
provisioning, by said provisioning engine, said resource based on said one of said plurality of security domains.
14. The system of claim 13 , further comprising a server configured to communicate with at least one of: an internal and an external client.
15. The system of claim 13 , further comprising a domain database configured to store domain rules and policies.
16. The system of claim 13 , further comprising a connection manager instruction module configured to direct at least one of: an internal client and an external client to comply with software requirements.
17. The system of claim 13 , further comprising a configuration manager instruction module configured to identify which processes may be suspended in response to an asset requiring an additional resource.
18. The system of claim 13 , further comprising a risk manager instruction module configured to verify software inventory of at least one of: an internal client and an external client.
19. The system of claim 13 , further comprising a recovery manager instruction module configured to store policies regarding processing assets in response to resources being limited due to at least one of: an equipment failure and a software failure.
20. The system of claim 13 , further comprising de-provisioning said resource.