Apparatus, system and method for security management based on event correlation in a distributed multi-layered cloud environment

US11368489B2 · kind B2 · utility

Assignee

• NOKIA TECHNOLOGIES OY · FI

Inventors

• Iris Adam · Munich, DE
• Jing PING · Sichuan, CN
• Stephane Mahieu · Munich, DE

Key dates

• Filing date: Nov 20, 2017
• Grant date: Jun 21, 2022
• Expiry date: Apr 29, 2038

Classification

• Technology area (CPC H): Electricity
• CPC primary: H04L67/10
• WIPO field: Digital communication
• WIPO sector: Electrical engineering

Abstract

An apparatus for security management based on event correlation in a distributed multi-layered cloud environment is disclosed, wherein the distributed multi-layered cloud environment comprises at least one first layer cloud service provider, and at least one second layer cloud service provider as a tenant of the first layer cloud service provider, and the apparatus is installed at least on one cloud service provider of the first layer cloud service provider and the second layer cloud service provider, the apparatus comprising: a central processing module configured to: provide correlation as a Service (CORRaaS) to a plurality of tenants as virtualized security appliances or virtualized security functions for the plurality of tenants's lices, generate a second interface for allowing the plurality of tenants to configure the correlation as a Service (CORRaaS), and correlate and process security events from security functions in the plurality of tenants' slices to form processed security event data, and to detect or predict attacks or anomalies or incompliance with security requirements; and a third interface for transferring the processed security event data and/or log data and/or ra…