Trading Partner Agreements for Secure Cloud Resource Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud computing security mechanisms do not adequately address the sharing of resources such as CPU cycles and executables between partners in a Virtual Organization, lacking fine-grained controls and enforcement, especially in scenarios involving multiple organizations.
Innovation Solution
The implementation of Trading Partner Agreements (TPAs) that specify resources, transport protocols, and security mechanisms, along with a security policy, to govern the execution and transfer of executables between partners, using algorithms like MapReduce to determine the target execution location and enforce security constraints.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional cloud security mechanisms are used, then basic access control is provided, but fine-grained control and enforcement for resource sharing between partners is lacking
Solution Approach 1:
The security mechanism is segmented into multiple components: Trading Partner Agreements (TPAs) define security policies between partner pairs, while Execution Environment Descriptions (EEDs) provide fine-grained control over executable behavior. This segmentation allows independent configuration of security rules for different resource sharing scenarios without compromising overall system security.
Solution Approach 2:
Security policies are established in advance through Trading Partner Agreements before any resource sharing occurs. The TPAs pre-define acceptable behaviors, security constraints, and enforcement rules for future executable transfers and executions, enabling automated security verification without real-time intervention.
2Productivity
If executables are transferred and executed across partner boundaries, then resource utilization is optimized, but security risks and lack of enforcement increase
Solution Approach 1:
A cloud-based integration server acts as an intermediary between partners, mediating executable transfers and executions. The server verifies TPAs, enforces security policies, and coordinates the execution process, isolating partners from direct interaction while maintaining secure resource sharing capabilities.
Solution Approach 2:
The system implements continuous feedback through security policy verification at multiple stages: TPA validation before executable transfer, EED compliance checking during execution setup, and runtime monitoring of executable behavior. This feedback mechanism ensures security constraints are maintained while enabling resource sharing.
3Reliability
If Trading Partner Agreements with detailed security policies are implemented, then fine-grained control is achieved, but system complexity increases
Solution Approach 1:
The TPA framework provides universal security policy definitions that can be applied across multiple partner relationships and executable types. A single TPA structure handles diverse security requirements (authentication, authorization, resource constraints) through standardized fields, reducing the need for custom security configurations for each scenario.
Solution Approach 2:
The system enables self-service security configuration where partners autonomously negotiate and establish TPAs without manual intervention. The automated verification and enforcement mechanisms validate security policies against pre-defined rules, reducing the operational burden of managing complex security configurations.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
Certain example embodiments described herein relate to security systems and/or methods for cloud computing environments, More particularly, certain example embodiments described herein relate to the negotiation and subsequent use of Trading Partner Agreements (TPAs) between partners in a Virtual Organization, the TPAs enabling resources to be shared between the partners in a secure manner. In certain example embodiments, TPAs are negotiated, an algorithm is executed to determine where an executable is to be run, the resource is transferred to the location where it is to be run, and it is executed - with the TPAs collectively defining a security policy that constrains how and where it can be executed, the resources it can use, etc. The executable may be transferred to a location in a multipart (e.g., SMIME) message, along with header information and rights associated with the executable.