Unauthorized communication detection in hybrid cloud
Systems and methods are disclosed for detecting nonlegitimate communications in a hybrid cloud system. An example method comprises receiving a request from a service on a public cloud platform, calculating a unique signature for the service, and verifying the calculated unique signature against a local signature table on the public cloud platform. If the calculated unique signature is verified, then the calculated unique signature is sent to a security signature service on a private cloud platform. If the calculated unique signature is also verified against a global signature table on the private cloud platform, then a response to the request is received from the security signature service.
1. A method, comprising:
receiving a request from a service on a public cloud platform;
calculating a unique signature for the service;
verifying the calculated unique signature against a local signature table on the public cloud platform;
if the calculated unique signature is verified, then:
sending the calculated unique signature to a security signature service on a private cloud platform;
receiving a response to the request from the security signature service if the calculated unique signature is verified against a global signature table on the private cloud platform;
verifying, by the security signature service, the calculated unique signature against the global signature table; and
wherein if the calculated unique signature is verified against the global signature table, then
sending the request to a target service on the private cloud platform; and
sending a response to the request to a security control entity on the public cloud platform.
2. The method of claim 1 , further comprising:
if the calculated unique signature is not verified against the local signature table, then terminating the request before sending to the security signature service.
3. The method of claim 1 , further comprising:
if the calculated unique signature is not verified against the global signature table, then receiving an indication that the request is from an unauthorized service.
4. The method of claim 1 , wherein the security control entity in the public cloud platform calculates the unique signature.
5. The method of claim 1 , wherein the security control entity in the public cloud platform verifies the calculated unique signature against the local signature table.
6. The method of claim 1 , wherein the unique signature is calculated using indicators associated with software and hardware components used by the service.
7. The method of claim 1 , wherein the unique signature is calculated using one or more of a BIOS serial number, an RSA identifier, a virtual private network (VPN) identifier, a hardware component MAC address, a CPU serial number, a RAM part number, a monitor serial number, a Domain Name System (DNS) server identifier, a Dynamic Host Configuration Protocol (DHCP) server identifier, a static IP address, and a universally unique identifier (UUID).
8. A method, comprising:
deploying a service on a public cloud platform;
calculating a unique signature for the service;
storing the unique signature in a global signature table on a private cloud platform;
after receiving acknowledgement that the unique signature was stored in the global signature table, storing the unique signature in a local signature table in the public cloud platform;
receiving a request from the service at a security control entity on the public cloud platform;
calculating a unique signature for the request;
verifying the calculated unique signature against the local signature table;
verifying the calculated unique signature against the global signature table; and
sending the request to a target service on the private cloud platform if the calculated unique signature is verified against both the local signature table and the global signature table.
9. The method of claim 8 , wherein the unique signature is calculated by the security control entity on the public cloud platform, and wherein the security control entity sends the unique signature to a security signature service in the private cloud platform for storage in the global signature table.
10. The method of claim 8 , wherein the unique signature is calculated using indicators associated with software and hardware components used by the service.
11. The method of claim 8 , wherein the unique signature is calculated using one or more of a BIOS serial number, an RSA identifier, a virtual private network (VPN) identifier, a hardware component MAC address, a CPU serial number, a RAM part number, a monitor serial number, a Domain Name System (DNS) server identifier, a Dynamic Host Configuration Protocol (DHCP) server identifier, a static IP address, and a universally unique identifier (UUID).
12. A computer-readable storage device having instructions stored thereon for detecting nonlegitimate communications in a private cloud platform, wherein execution of the instructions by one or more processors causes the processors to:
establish a security signature service on the private cloud platform;
receive, at the security signature service, a calculated signature from a security control entity on a public cloud platform;
verify the calculated signature against a signature table on the private cloud platform;
if the calculated signature is verified, then:
send a request associated with the calculated signature to a target service on the private cloud platform;
receive a response to the request;
send the response to the security control entity on the public cloud platform; and
wherein if the calculated signature cannot be verified against the signature table on the private cloud platform, then send an indication to the security control entity that the request is from an unauthorized service.
13. The computer-readable storage device of claim 12 , wherein the calculated signature is received at the security signature service only if the calculated signature has been verified against a signature table on the public cloud platform.