White Paper

Understanding Unisys Secure Private Cloud

2

The emergence of public cloud computing has created an

irreversible trend in IT. But public clouds raise issues regarding

regulations with respect to data security and sheer data size

needed for many enterprise applications. Organizations are

moving to Private Clouds to take advantage of cloud capabilities

while maintaining control over data.

Unisys Secure Private Cloud (SPC) provides the advantage of

cloud computing principles and capabilities within an enterprise’s

data center. Unlike many private cloud solutions, SPC offers

adaptation capabilities so that cloud resources can be managed

as another “form factor” within the data center, using the current

management processes and tools.

In addition, integration with the Unisys Stealth™ Solution enables

administers to isolate resources that need to comply with specific

privacy regulations.

3

Table of Contents

Introduction 4

Secure Private Cloud Capabilities 4

Secure Private Cloud Concepts 4

Multi-Cloud Instances and Rich N-tenant Hierarchy 5

Hybrid Cloud Support – Support for Amazon EC2 6

Stealth - Defense in Depth for Regulated Data 6

Secure Private Cloud Use Cases 7

Test/Development Environment 7

Enterprise Production Applications 8

Enterprise Mission Critical Applications 8

High Value Service Provider 8

Conclusion 8

Additional References 8

4

Introduction According to the Gartner Data Center Conference poll-

December 2012, Private cloud computing is just past the

peak of the hype cycle and deployments are increasing

throughout 2013. A significant number of respondents

indicate they are putting a private Cloud plan together and

considering deploying the Private Clouds by the end of

2014. Management, operational processes and security

are still considered to be among the top 3 challenges in a

private cloud computing service among respondents.

Unisys Secure Private Cloud (SPC) enables customers to

gain the advantage of cloud computing principles and

capabilities within an enterprise’s data center. Through its

open framework and integration with the Unisys Stealth

Solution, SPC offers key differentiation and addresses the

key challenges faced by Private Cloud Customers.

Secure Private Cloud Capabilities Key capabilities of SPC include:

Service-Oriented Infrastructure – Cloud users can

use a web-based portal to commission and manage

their own infrastructure resources. This provides agility

for the cloud user as well as relieving administrators

from repetitive, low-level infrastructure tasks.

Utility – Infrastructure resources are optimized and

highly utilized by sharing resources among all cloud

users as appropriate. Utility computing includes

utilization monitoring for chargeback / showback.

Elasticity – As application workloads wax and wane,

the utility’s resources can be commissioned and

decommissioned to accommodate changing

requirements.

Ubiquity – Private cloud resources can be managed

as a service wherever internet/intranet access is

provided.

Unlike many private cloud solutions, SPC provides

adaptability and mission critical security.

Adaptability - Secure Private Cloud has been

architected to provide a cloud framework, with

adapters that connect to IT automation software. In

this way, resource requests can be integrated with

the datacenter’s own management processes,

including incident, configuration, asset and change

management processes. Adaptation to the

datacenter’s security model, through LDAP/Active

Directory integration, facilitates single sign-on, thus

allowing cloud resources to be accessed and

managed in the same manner as other datacenter

resources. Adaptability avoids the “cloud in a corner”

syndrome.

Mission Critical Security – Secure Private Cloud is

integrated with the Unisys Stealth technology, which

allows cloud administrators to isolate specific

resources that require compliance with specific

privacy regulations. Stealth provides encryption for all

data transmitted among the specific resources that

have these requirements. Built to meet requirements

of the U.S. Department of Defense to help secure

sensitive information, Unisys Stealth achieved the

National Security Agency’s National Information

Assurance Partnership Common Criteria EAL-4+

certification, protecting data-in-motion across any

network regardless if it is private or public.

Secure Private Cloud Concepts

This section provides the fundamental SPC concepts

that can be used to form a mental model of how the

cloud is architected and managed.

Within the SPC cloud, a tenant is defined as an

individual entity that is entitled, through a contract, to

provide virtual machine resources for cloud users. These

tenants might be the enterprise’s external customers, its

subsidiaries or its internal departments that require

management as separate entities. Depending on the

enterprise’s needs, SPC can be configured as a single-

tenant or a multitenant environment.

Tenants can have one or more projects. Projects are

used to further subdivide the tenant organization. You

can configure projects based on the needs of a tenant

environment. For example, you could configure one

project for each tenant department or each sub-

department, or you could configure projects based on

user responsibilities in the organization.

5

A blueprint defines a class of resources. Cloud users

can commission instances of these resources as a

service using the Secure Private Cloud Single Pane of

Glass. When users commission resources, they provide

values for a set of parameters, based on constraints that

the administrator or operator configures. Blueprints can

be refined to create new blueprints with specific

attributes that fit an organization’s requirements and

constraints. Cloud users request infrastructure as a

service through a service catalog that shows the

blueprints that are contracted for their project.

The number of resources available for an end user is

managed using contracts that provide the number of

entitled resources on a blueprint by blueprint basis.

Contracts are specified at the tenant level and can be

further refined at the project level.

The Secure Private Cloud’s value to the datacenter lies

on its ability to automate infrastructure management by

exposing infrastructure as a service.

Multi-Cloud Instances and Rich N-tenant Hierarchy The description above exposes the basic structure of the

Secure Private Cloud. Secure Private Cloud provides

additional structure to address enterprise-class

scalability and control.

The overall cloud can be partitioned into multiple “cloud

instances”. Each instance can be considered as an

independent cloud where all instances are managed

through the Single Pane of Glass. This addresses

scalability in the following ways. Multiple cloud instances

can be used to support dispersed geographical

locations. Similarly, multiple instances can be used to

effectively manage resources that are virtualized on

multiple instances of vCenter. Scalability of

administration is also enabled. The overall cloud

administrator is the “super user” of the cloud. As the

cloud grows, the cloud administrator can set up multiple

cloud instances that are administered by cloud

administrators who are “super users” of their instance.

In the below description, the structure is shown as

projects that are associated with tenants. A rich structure

can be established using “folders”. Multiple folders can

be defined for each tenant. Each folder can, in turn, have

sub-folders. An “N-level Hierarchy”, where N is unlimited,

can be constructed to create a structure that reflects the

enterprise’s organization. Folder Administrators can be

defined that have exclusive visibility and control of the

folder and all subfolders, projects and resources

throughout the folder’s sub tree. In this way, specific

organization can work in an autonomous manner.

6

Hybrid Cloud Support – Support for Amazon EC2 Enterprises today are looking favourably at public cloud to help them build their infrastructure natively on cloud. However public cloud raises issues related to control and security. According to a study by the Aberdeen Group, public cloud users suffered from an overall 25 percent of incidents related to audit deficiencies, data loss or data exposure, and unauthorized access. Hybrid cloud gives customers reliability, flexibility, as well as scalability to meet their agility and budgetary requirements.

With Secure Private Cloud release 2.5, user-commissioned virtual machines can now be hosted by a public cloud such as Amazon Web Services (AWS) besides the internal on-premise VMware vSphere ESX or ESXi workload virtualization servers. If user-commissioned virtual machines are hosted by a public cloud, the Secure Private Cloud portal can be configured to communicate with the cloud service so that users can use the portal to deploy and manage virtual machines.

Automated Provisioning of Internal IT and External public clouds.

As depicted in the graphic, customers can expose AWS specific resources in their service catalog and can commission and de-commission Amazon virtual resources.

The Secure Private Cloud environment enables you to take snapshots of your virtual machines at anytime. A virtual machine snapshot is a representation of the state of a virtual machine and its data at a given time. and are useful for storing a virtual machine state that you might need to restore as the current processing state in the future.

To help enterprises manage the machine images (templates) available from a public cloud, the Secure Private Cloud manages images so that you can select the ones that you want to use and import them into the cloud environment.

Hybrid Cloud and Rich N-Tenant Hierarchy

Enterprises can organize Amazon resources using SPC’s rich N-tenant hierarchy. In this way, an Amazon account can be managed with a multi-level hierarchical structure that reflects the enterprise’s organization.

Stealth - Defense in Depth for Regulated Data The Unisys Stealth technology has been available and integrated within SPC since release 2.2. In functional terms, Unisys Stealth enables the definition of “Communities of Interest” (COIs) where all VMs who are enabled can communicate within their COI using high-grade encryption as well as obfuscation algorithms that render the VMs “dark” to all resources outside the COI. Within SPC, VMS who are members of the same COI transmit through a software-defined “Stealth vLAN”. To understand the value of Stealth integration within SPC, consider a use case where isolation of VM functionality, as well as architectural isolation, is required to satisfy a security audit within the cloud.

PCI compliance requires that VMs handling card holder data must be isolated from other VMs that are not at the same “trust level”. Also, the transmission of information from one server to another or to the Internet must be encrypted. In addition to this, datacenter security practices often require isolation between the web, application and database tiers in a typical three tier application pattern.

Mixing VMs with varying trust levels and architectural levels using the same underlying hardware and network is a practice that requires considerable up-front planning

7

as well as complex processes and configuration. In some cases, isolation using separate host servers, along with firewalls, may remediate non-compliance.

Isolation using Firewalls and Separate Servers (a)

Graphic (a) above shows a typical approach to isolation of VMs in a three tiered application. Note the firewalls between the database/application/web tiers. Also note that the physical hosts are not totally utilized.

Isolation using Stealth Technology (b)

Graphic (b) shows how VMs that communicate using encryption, even though they may be a mix of “trust levels” to comply with requirements for isolation and encryption.

In the Unisys Stealth implementation, fewer servers are required. If another web server is needed to scale up web, application or database capabilities, it can be commissioned using a Stealth blueprint that determines its membership to the proper Stealth vLAN and it can be added to the pool of VMs without regard for the specific physical host server.

Secure Private Cloud Use Cases Use cases are defined and driven by various types of “users”. As such, the concept of “user” is a bit more complex in a cloud discussion than it is when discussing a single application. The following “users” are defined for these use cases as:

Administrators use the cloud management capabilities to define and control tenants, projects, contracts and blueprints.

Operators are responsible for manual administration of cloud resources that cannot be automated. Cloud operators receive notifications (by e-mail, by Remedy ticket, or by both) when any action occurs in the Secure Private Cloud portal. This includes when resources are commissioned, when operational changes take place, and if any errors occur during the commissioning process.

Cloud Users Commission, Decommission and manage their portion of the infrastructure in a service-oriented fashion.

Test/Development Environment

Administration of resources for Test and Development activities accounts for the majority of IT administrative costs. For every one server in production, four or more servers are managed for test and development. This use case is considered the “low hanging fruit” for private cloud deployment. In this use case, the cloud administrator defines the structure of the cloud as well as setting up the service catalog of blueprints. The cloud users are the technicians that are developing and testing their software.

Unisys has deployed SPC throughout the development and service organizations in their Engineering Resource Laboratory (ERL). Ninety-five percent of all resource requests can be satisfied through the service catalog that provides over 80 different services. When a developer selects a service, the parameters of the blueprint can be selected through the user interface.

The other 5% of user requests may require intervention of the cloud operator. The cloud operator also monitors cloud events, identifying error conditions as well as

6

monitoring the level of service that is being experienced by the cloud users

Although the Test/Development cloud started as a single tenant cloud, it has evolved to include multiple cloud instances, tenants and organizational folders for a number of reasons. One reason has been to manage test/development activities on a global basis. With the formation of multiple tenants and folders, specific organizations can have their own administrator and work fairly autonomously regarding the other tenants.

Multiple tenantss and folders not only implies autonomous management, but it also allows that each organization is isolated and contained from the others. Test/Development cloud uses defined tenants to support self-service infrastructure requests from non-Unisys contractors.

Enterprise Production Applications

The Secure Private Cloud has become the next phase of a continual process/cost improvement regarding the infrastructure needed to support critical Unisys productions systems, such as employee travel, benefits, time management, customer relationship management, sales support and others.

About five years ago, Unisys consolidated its datacenters and standardized its infrastructure. Cloud Computing was the next logical step, where many applications could share resources. As the workload changes, the production admins can quickly respond by commissioning and decommissioning from a service-oriented user interface.

Enterprise Mission Critical Applications

Mission critical applications are applications that have very specific service level objectives. These objectives focus on availability, response time and risk, such as providing high availability configurations and automation.

When a cloud user commissions infrastructure that has strict availability or performance objectives, SPC can commission these resources on specific physical components that can achieve these objectives, as specified in the underlying blueprints.

The Secure Private Cloud is currently being used to host mission critical Unisys mainframe operating systems (MCP and OS2200) that run applications that must meet specified service level objectives.

SPC can be configured to provide a highly available cloud management environment. This includes duplicate servers that can become active in the event that a management server fails. Even though failure of the cloud management will not impact the servers under management, the SPC high availability configuration provides the continuous access to cloud management capabilities.

High Value Service Providers Secure Private Cloud has been architected to provide an enterprise with a cloud management environment that can be used to set up a public cloud in which the enterprise’s customers are tenants of the cloud. The cloud administrator can set up the overall structure of the clouds, including the tenants, folders and the roles and permissions of the cloud structure. At the tenant level, each tenant administrator can then handle their individual part of the cloud in an autonomous fashion. Each tenant is isolated and contained using virtual LAN technology to segment the cloud. Each tenant can have their own set of blueprints and therefore provide their own customized service catalog for their cloud users. In this way, an enterprise can be a cloud provider in their own right.

Conclusion As with every cloud management product, Secure Private Cloud has an assumed concept of operations. The purpose of this document has been to present the foundational concepts that will help you form a mental model of the general structure and approach. This mental model will, in turn, assist as you explore the detailed documents and work directly with the management software.

Additional References Additional technical documents are available on the Unisys product support portal (authorization required) Unisys Secure Private Cloud 2.5 Product Support

For more information visit www.unisys.com © 2013 Unisys Corporation. All rights reserved. Unisys, the Unisys logo, ClearPath and Unisys Stealth are registered trademark of Unisys Corporation. All other brands and products referenced in this document are acknowledged to be the trademarks or registered trademarks of their respective holders.

Printed in the United States of America 11/13 13-0371