Security management for cloud services
A cloud management node ( 102 ) in a public cloud ( 100 ) works together with a private management system ( 116 ) in a private cloud ( 114 ) to manage provisioning and access to cloud services from the private cloud ( 114 ). Private data does not need to be held or duplicated in the public cloud so that the data security is enhanced. The private management system ( 116 ) issues tokens for authorization so that user access to cloud services may be controlled. The cloud management node ( 102 ) receives provisioning requests from the private cloud ( 114 ) and selects and informs an appropriate service provider node ( 112 ) that a provisioning request is waiting. In examples an administrator at the private cloud ( 114 ) is able to manage cloud service access for many users in a simple effective manner and users are able to operate multiple cloud services from a single account.
1. A computer-implemented security management method comprising a plurality of steps executed at at least one management node in a public domain of a communications network, the steps comprising:
receiving a request message associated with a user for a resource provided by at least one service provider node in a public domain of the communications network;
authorizing the request message using information at a private management system in a private cloud of the communications network associated with the user;
enabling access to the service provider node if a check is successful;
sending a message to the service provider node to inform the service provider node that the request message is available at the management node; and
allowing the service provider node to collect the request message from the management node.
2. A method as claimed in claim 1 wherein authorizing the request message comprises receiving a token from the private management system the token specifying access of the user to the resource.
3. A method as claimed in claim 1 or claim 2 wherein the request message is received as a result of a redirection from the service provider node.
4. A method as claimed in claim 1 wherein the request message is received from a service provider node.
5. A method as claimed in claim 1 wherein authorizing the request message is achieved as a result of the user being logged onto a portal of the management node.
6. A method as claimed in claim 1 further comprising identifying a public key associated with the service provider node and encrypting the request message using the identified public key.
7. A method as claimed in claim 1 comprising receiving the request message comprising requirements of a resource and selecting one of a plurality of service provider nodes at least on a basis of the requirements and information about resources associated with the service provider nodes.
8. A method as claimed in claim 1 comprising formatting the request message according to a communications protocol of the service provider node.
9. A method as claimed in claim 1 comprising placing the request message into one of a plurality of queues, each queue being associated with a particular service provider or resource.
10. A method as claimed in claim 9 comprising storing data for each queue such that data by service provider and/or resource is obtained.
11. A method as claimed in claim 1 wherein allowing the service provider node to collect the message comprises enabling a service provider node to collect an encrypted message using representational state transfer (REST).
12. A method as claimed in claim 1 comprising receiving feedback from the service provider node about an operation triggered by the request message and sending information to the user about the feedback.
13. A method as claimed in claim 1 comprising storing data comprising details of messages collected by the service provider node.
14. A method as claimed in claim 1 comprising receiving the request message from a service provider node which requests to use a second resource associated with a second, different service provider node.
15. A management node in a public domain of a communications network comprising:
an input arranged to receive a request message associated with a user for a resource provided by at least one service provider node in a public domain of the communications network;
a processor arranged to authorize the request message using information at a private management system in a private cloud of the communications network associated with the user;
the processor being arranged to enable access to the service provider node if a check is successful;
an output arranged to send a message to the service provider node to inform the service provider node that the request message is available at the management node; and
the processor being arranged to allow the service provider node to collect the request message from the management node.
16. The management node of claim 15 , the processor arranged to authorize the request message using a token received from the private management system the token specifying access of the user to the resource.
17. The management node of claim 15 , the input arranged to receive the request message as a result of a redirection from the service provider node.
18. The management node of claim 15 , the input arranged to receive the request from a service provider node.
19. One or more non-transitory computer-readable storage media storing computer-readable instructions that when executed by a processor of a computer cause the computer to perform acts at at least one management node in a public domain of a communications network, the acts comprising:
receiving a request message associated with a user for a resource provided by at least one service provider node in the public domain of the communications network;
authorizing the request message using information at a private management system in a private cloud of the communications network associated with the user;
enabling access to the service provider node if a check is successful;
sending a message to the service provider node to inform the service provider node that the request message is available at the management node; and
allowing the service provider node to collect the request message from the management node.