Protected application stack and method and system of utilizing
A secure appliance for use within a multi-tenant cloud computing environment which comprises: a) a policy enforcement point (PEP); b) a hardened Operating System (OS) capable of deploying applications; and c) at least one application capable of hosting services and application program interfaces (APIs).
1. A method, comprising:
running a first virtual policy enforcement point appliance using a hypervisor;
running a first operating system using the first virtual policy enforcement point appliance, the first operating system including a firewall; and
running a first application and a first policy enforcement point using the first operating system, the first virtual policy enforcement point appliance restricts all application layer communication to and from the first application to pass through the first policy enforcement point, the first policy enforcement point controls all application layer communication to and from the first application based on a set of policy constraints.
2. The method of claim 1 , further comprising:
running a second virtual policy enforcement point appliance using the hypervisor, the first virtual policy enforcement point appliance runs a first database, the second virtual policy enforcement point appliance runs a second database, wherein writes to the first database are replicated to the second database.
3. The method of claim 1 , further comprising:
running a cluster of virtual policy enforcement point appliances, the cluster of virtual policy enforcement point appliances including the first virtual policy enforcement point appliance; and
automatically synchronizing the set of policy constraints across each virtual policy enforcement point appliance of the cluster of virtual policy enforcement point appliances.
4. The method of claim 1 , further comprising:
running an HTTP load balancer, the HTTP load balancer distributes messages to a cluster of virtual policy enforcement point appliances.
5. The method of claim 1 , further comprising:
deactivating all services from the first operating system that do not support the first virtual policy enforcement point appliance.
6. The method of claim 1 , wherein:
the running a first virtual policy enforcement point appliance using a hypervisor includes running the hypervisor on a set of one or more hardware processors.
7. The method of claim 1 , further comprising:
receiving a message from a hardware server; and
determining, using the first policy enforcement point, whether to pass the message to the first application based on the set of policy constraints.
8. The method of claim 1 , further comprising:
running a second virtual policy enforcement point appliance using the hypervisor;
running a second application using the second virtual policy enforcement point appliance; and
controlling, using the first policy enforcement point, all application layer communication from the second application to the first application based on the set of policy constraints.
9. The method of claim 1 , wherein:
the first application communicates with the first policy enforcement point using a localhost connection.
10. A system, comprising:
a memory to store a set of policy constraints; and
a set of hardware processors to run a hypervisor, the hypervisor to run a first virtual policy enforcement point appliance, the first virtual policy enforcement point appliance to run a first operating system that includes a firewall, the first operating system to run a first application and a first policy enforcement point, the first virtual policy enforcement point appliance to restrict all application layer communication to and from the first application to pass through the first policy enforcement point, the first policy enforcement point to control all application layer communication to and from the first application based on the set of policy constraints.
11. The system of claim 10 , wherein:
the set of hardware processors is to receive a message from a second server, the first policy enforcement point to determine whether to pass the message to the first application based on the set of policy constraints.
12. The system of claim 10 , wherein:
the set of hardware processors is to run a second application, the first policy enforcement point to control all application layer communication from the second application to the first application based on the set of policy constraints.
13. The system of claim 10 , wherein:
the first application is to communicate with the first policy enforcement point using a localhost connection.
14. The system of claim 10 , wherein:
the hypervisor is to run a second virtual policy enforcement point appliance, the first virtual policy enforcement point appliance to run a first database, the second virtual policy enforcement point appliance to run a second database, the first database comprises a primary database in which writes to the first database are replicated through to the second database.
15. The system of claim 10 , wherein:
the hypervisor is to run a cluster of virtual policy enforcement point appliances, the cluster of virtual policy enforcement point appliances includes the first virtual policy enforcement point appliance, the cluster of virtual policy enforcement point appliances to synchronize the set of policy constraints across each virtual policy enforcement point appliance of the cluster of virtual policy enforcement point appliances.
16. The system of claim 10 , wherein:
the hypervisor is to run an HTTP load balancer, the HTTP load balancer to distribute messages to a cluster of virtual policy enforcement point appliances including the first virtual policy enforcement point appliance.
17. The system of claim 10 , wherein:
the hypervisor is to receive a message from a hardware server, the first policy enforcement point to pass the message to the first application if the set of policy constraints are satisfied.
18. The system of claim 10 , wherein:
the hypervisor is to run a second virtual policy enforcement point appliance, the second virtual policy enforcement point appliance to run a second application, the first policy enforcement point controls all application layer communication from the second application to the first application based on the set of policy constraints.
19. The system of claim 10 , wherein:
the first policy enforcement point is to receive an inbound message and relay the inbound message to the first application if the set of policy constraints are satisfied.
20. One or more storage devices containing processor readable code for programming one or more processors to perform a method, the processor readable code comprising:
processor readable code configured to run a first virtual policy enforcement point appliance using a hypervisor;
processor readable code configured to run a first operating system using the first virtual policy enforcement point appliance, the first operating system includes a firewall; and
processor readable code configured to run a first application and a first policy enforcement point using the first operating system, the first virtual policy enforcement point appliance restricts all application layer communication to and from the first application to pass through the first policy enforcement point, the first policy enforcement point controls all application layer communication to and from the first application based on a set of policy constraints.