Virtustream IP Holding Company LLC

Zuora, Inc.

Pritesh Parekh

Nicholas Kathmann

Qintao Zhao

Pushkala Pattabhiraman

Levon Stepanian

Oleg Mikheev

Joshy Austin

An apparatus comprises a processing device configured to receive, at a user interface of a trust platform configured to manage cloud assets operating in clouds of two or more cloud service providers, a specification of security and compliance policies of a given entity. The processing device is also configured to generate, based at least in part on the specified security and compliance policies of the given entity, security and compliance controls to be implemented for workloads of the given entity running on a subset of the cloud assets operating in the clouds of the two or more cloud service providers. The processing device is further configured to deploy, utilizing application programming interfaces of the trust platform, the generated security and compliance controls on first and second pluralities of monitoring tools operating in tenant and management environments of the clouds of the two or more cloud service providers.

Policy-driven management of security and compliance controls for multi-cloud workloads

Shown is single sign-on support access to tenant accounts in a multi-tenant service platform involving a proxy user account in an identity provider for a tenant account on the service platform having security metadata associated therewith, mapping in the identity provider maps a support user to a proxy user identifier, a corresponding security endpoint in the service platform and mapping of the proxy user account identifier to the tenant account and security metadata. The identity provider authenticates a request to access the tenant account on the service platform, obtains the security credentials for the proxy user identifier, and sends a security assertion with the proxy user identifier and the security metadata to the security endpoint. The endpoint receives and validates the security assertion against the mapping for the proxy user identifier to the tenant account and the security metadata in the service platform, and permits access by the support user to the tenant account in the service platform.

System and method for single sign-on technical support access to tenant accounts and data in a multi-tenant platform

An apparatus comprises a processing device configured to receive, at a user interface of a trust platform configured to manage cloud assets operating in clouds of cloud service providers, a request to view security and compliance risk for a given entity running workloads utilizing the cloud assets. The processing device is also configured to obtain, utilizing application programming interfaces of the trust platform, first and second sets of security and compliance telemetry data generated by first and second pluralities of monitoring tools operating in tenant and management environments of the clouds. The processing device is further configured to generate a unified view of security and compliance for the workloads of the given entity utilizing the first and second sets of security telemetry data, and to provide the unified view of security and compliance for the workloads of the given entity at the user interface of the trust platform.

Generating unified views of security and compliance for multi-cloud workloads

An apparatus comprises a processing device configured to receive, at a user interface of a trust platform configured to manage cloud assets operating in clouds of two or more cloud service providers, a request to view multi-cloud relative risk information for at least a subset of the cloud assets on which workloads of a given entity run. The processing device is also configured to obtain, utilizing application programming interfaces of the trust platform, first and second sets of cloud asset risk data generated by first and second pluralities of monitoring tools operating in tenant and management environments of the clouds of the two or more cloud service providers. The processing device is further configured to generate and provide, at the user interface of the trust platform, a unified view of the multi-cloud relative risk information utilizing the first and second sets of cloud asset risk data.

Relative risk ranking of cloud assets used in multi-cloud workloads

An apparatus comprises a processing device configured to receive, at a user interface of a trust platform configured to manage cloud assets operating in clouds of two or more cloud service providers, a specification of security and compliance controls to be implemented for workloads of a given entity running on a subset of the cloud assets. The processing device is also configured to obtain, utilizing application programming interfaces of the trust platform, information characterizing deployed security and compliance controls for the subset of the plurality of cloud assets from first and second pluralities of monitoring tools operating in tenant and management environments of the clouds. The processing device is further configured to modify, utilizing the application programming interfaces of the trust platform, the deployed security and compliance controls responsive to determining that there are discrepancies between the specified security and compliance controls and the deployed security and compliance controls.

Management of security and compliance controls for multi-cloud workloads

An apparatus comprises a processing device configured to receive, at a user interface of a trust platform configured to manage cloud assets operating in clouds of multiple cloud service providers, a request by a user to access a given cloud asset on which one or more workloads of a given entity run. The processing device is also configured to generate, on the given cloud asset utilizing application programming interfaces of the trust platform, a temporary user account responsive to determining that the requesting user is registered with the trust platform as an authorized user for the given entity and the given asset. The processing device is further configured to provide access credentials for the temporary user account to the requesting user, to monitor use of the temporary user account, and to remove the temporary user account from the given cloud asset based at least in part on the monitored use.

Growing community of inventors

Fremont, CA, United States of America

Pritesh Parekh