Secure transfer of workloads across security regions
A framework for transferring workloads between security regions of an infrastructure service. For example, techniques for transferring workloads between security regions across a private network based on signatures associated with the security regions.
1 . A method for receiving a workload by a first security region of a cloud service provider (CSP) from a second security region of the cloud service provider, comprising:
receiving, via a device, an indication of signatures for verification of authorization of a transfer, the indication of signatures indicating signatures, the signatures comprising at least one signature associated with the first security region and at least one signature associated with the second security region;
receiving, via the device, an encrypted workload from the second security region; and
comparing one or more signatures of the encrypted workload with the signatures from the indication of signatures to determine whether transmission of the encrypted workload is authorized.
2 . The method of claim 1 , further comprising:
determining that the transmission of the encrypted workload is authorized based at least in part on the comparing the one or more signatures of the encrypted workload with the signatures from the indication of signatures;
decrypting the encrypted workload to produce a decrypted workload based at least in part on the determining that the transmission of the encrypted workload is authorized; and
providing the decrypted workload to the first security region for storage.
3 . The method of claim 1 , further comprising:
determining that the transmission of the encrypted workload is unauthorized based at least in part on the comparing the one or more signatures of the encrypted workload with the signatures from the indication of signatures; and
preventing the encrypted workload from being provided to the first security region based at least in part on the determining that the transmission of the encrypted workload is unauthorized.
4 . The method of claim 1 , wherein the indication of the signatures is received in a policy statement, wherein the policy statement includes an indication of regions between which workloads are authorized to be transferred, and wherein the transmission of the encrypted workload is authorized is further based on whether the policy statement indicates that workloads are authorized to be transferred between the first security region and the second security region.
5 . The method of claim 1 , further comprising:
comparing the one or more signatures of the encrypted workload with a signature of an object store of the first security region, wherein whether the transmission of the encrypted workload is authorized is determined further based on the comparing the one or more signatures of the encrypted workload with the signature of the object store.
6 . The method of claim 1 , further comprising:
comparing the one or more signatures of the encrypted workload with a signature of a customer replication tenancy of the first security region, wherein whether the transmission of the encrypted workload is authorized is determined further based on the comparing the one or more signatures of the encrypted workload with the signature of the customer replication tenancy.
7 . The method of claim 1 , wherein the encrypted workload includes data from a first isolated partition of the cloud service provider, and wherein the device is to store a decrypted workload corresponding to the encrypted workload in a second isolated partition of the cloud service provider if the transmission of the encrypted workload is authorized.
8 . The method of claim 1 , wherein the device is a first device, and wherein the method further comprise:
receiving, via the first device from a second device, a configuration for determining authorization of transmissions; and
determining whether the transmission of the encrypted workload is authorized based at least in part on the configuration.
9 . One or more non-transitory computer-readable media having instructions stored thereon, wherein the instructions, when executed by a device of a network, cause the device to:
receive an indication of signatures for verification of authorization of a transfer, the indication of signatures indicating signatures, the signatures comprising at least one signature associated with a first security region of a cloud service provider (CSP) and at least one signature associated with a second security region of the cloud service provider;
receive an encrypted workload from the second security region; and
compare one or more signatures of the encrypted workload with the signatures from the indication of signatures to determine whether transmission of the encrypted workload is authorized.
10 . The one or more non-transitory computer-readable media of claim 9 , wherein the instructions, when executed by the device, further cause the device to:
determine that the transmission of the encrypted workload is authorized based at least in part on the comparison of the one or more signatures of the encrypted workload with the signatures from the indication of signatures;
decrypt the encrypted workload to produce a decrypted workload based at least in part on the determination that the transmission of the encrypted workload is authorized; and
provide the decrypted workload to the first security region for storage.
11 . The one or more non-transitory computer-readable media of claim 9 , wherein the instructions, when executed by the device, further cause the device to:
determine that the transmission of the encrypted workload is unauthorized based at least in part on the comparison of the one or more signatures of the encrypted workload with the signatures from the indication of signatures; and
prevent the encrypted workload from being provided to the first security region based at least in part on the determination that the transmission of the encrypted workload is unauthorized.
12 . The one or more non-transitory computer-readable media of claim 9 , wherein the indication of the signatures is received in a policy statement, wherein the policy statement includes an indication of regions between which workloads are authorized to be transferred, and wherein the transmission of the encrypted workload is authorized is further based on whether the policy statement indicates that workloads are authorized to be transferred between the first security region and the second security region.
13 . The one or more non-transitory computer-readable media of claim 9 , wherein the instructions, when executed by the device, further cause the device to:
compare the one or more signatures of the encrypted workload with a signature of an object store of the first security region, wherein whether the transmission of the encrypted workload is authorized is determined further based on the comparison of the one or more signatures of the encrypted workload with the signature of the object store.
14 . The one or more non-transitory computer-readable media of claim 9 , wherein the instructions, when executed by the device, further cause the device to:
compare the one or more signatures of the encrypted workload with a signature of a customer replication tenancy of the first security region, wherein whether the transmission of the encrypted workload is authorized is determined further based on the comparison of the one or more signatures of the encrypted workload with the signature of the customer replication tenancy.
15 . The one or more non-transitory computer-readable media of claim 9 , wherein the encrypted workload includes data from a first isolated partition of the cloud service provider, and wherein the device is to store a decrypted workload corresponding to the encrypted workload in a second isolated partition of the cloud service provider if the transmission of the encrypted workload is authorized.
16 . The one or more non-transitory computer-readable media of claim 9 , wherein the device is a first device, and wherein the instructions, when executed by the first device, further cause the first device to:
receive, from a second device, a configuration for determining authorization of transmissions; and
determine whether the transmission of the encrypted workload is authorized based at least in part on the configuration.
17 . A private network, comprising:
a private network connection connected between a first security region of a cloud service provider (CSP) and a second security region of the cloud service provider; and
a device coupled to the private network connection and located at the first security region, the device to:
receive an indication of signatures for verification of authorization of a transfer, the indication of signatures indicating signatures, the signatures comprising at least one signature associated with the first security region and at least one signature associated with the second security region;
receive an encrypted workload from the second security region; and
compare one or more signatures of the encrypted workload with the signatures from the indication of signatures to determine whether transmission of the encrypted workload is authorized.
18 . The private network of claim 17 , wherein the device is further to:
determine that the transmission of the encrypted workload is authorized based at least in part on the comparison of the one or more signatures of the encrypted workload with the signatures from the indication of signatures;
decrypt the encrypted workload to produce a decrypted workload based at least in part on the determination that the transmission of the encrypted workload is authorized; and
provide the decrypted workload to the first security region for storage.
19 . The private network of claim 17 , wherein the device is further to:
determine that the transmission of the encrypted workload is unauthorized based at least in part on the comparison of the one or more signatures of the encrypted workload with the signatures from the indication of signatures; and
prevent the encrypted workload from being provided to the first security region based at least in part on the determination that the transmission of the encrypted workload is unauthorized.
20 . The private network of claim 17 , wherein the indication of the signatures is received in a policy statement, wherein the policy statement includes an indication of regions between which workloads are authorized to be transferred, and wherein the transmission of the encrypted workload is authorized is further based on whether the policy statement indicates that workloads are authorized to be transferred between the first security region and the second security region.