Systems and methods for adding microservices into existing system environments

• US 10,013,550 B1
• Filed: 12/30/2016
• Issued: 07/03/2018
• Est. Priority Date: 12/30/2016
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: ShieldX Networks, Inc. (Fortinet Inc.)
• Inventors: Ahuja, Ratinder Paul Singh, Nedbal, Manuel, Hillel, Meni, Guzik, John Richard
• Primary Examiner(s): Lanier, Benjamin E
• Application Number:
  US15/396,219
• Publication Number:
  US 20180189494A1
• Time in Patent Office: 550 Days
• Field of Search: None
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06F 9/50 Allocation of resources, e.g. of the central processing unit [CPU]
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/1008 based on parameters of servers, e.g. available memory or workload monitoring of computer activity G06F11/30

Abstract

Systems and methods are disclosed that relate to network security within a virtual network, and how to add microservices in a scalable virtual network. For example, one embodiment discloses a method of receiving a deployment request to deploy a security microservice in a security service, the deployment request including a deployment specification. The method further includes determining whether an interface microservice is available on one or more hosts by accessing one or more host records for the one or more hosts, and selecting a host on which to deploy the security microservice utilizing the deployment specification. When the interface microservice does not exist on the selected host, the method further includes initializing the interface microservice on the selected host, attaching the interface microservice to a hypervisor of the selected host, connecting the security microservice to the interface microservice of the selected host, and deploying the security microservice on the selected host.

Claims

1. A computer-implemented method, comprising:

receiving a deployment request to deploy a security microservice in a security service, the deployment request including a deployment specification;

determining whether an interface microservice is included on one or more hosts by accessing one or more host records for the one or more hosts;

for hosts that include existing interface microservices,

selecting a best available host from the one or more of the hosts that include existing interface microservices, wherein the selecting of the best available host is based on an evaluation of the deployment specification;

for hosts that do not include existing interface microservices or when the one or more hosts that include existing interface microservices are not available,

selecting a best available host from the hosts that do not include existing interface microservices, wherein the selecting of the best available host is based on an evaluation of the deployment specification,

initializing the interface microservice on the selected host, and

attaching the interface microservice to a hypervisor of the selected host;

connecting the security microservice to the interface microservice of the selected host;

deploying the security microservice on the selected host; and

executing the security microservice.

2. The method of claim 1, further comprising:

retrieving a utilization history from one or more hosts in the security service; and

updating the deployment specification based on an analysis of the retrieved utilization history.

3. The method of claim 2, wherein the utilization history is one or more of a compute utilization history, a memory utilization history, a storage utilization history, and a network utilization history.

4. The method of claim 1, further comprising:

evaluating the one or more hosts that include existing interface microservices, wherein the evaluation includes;

analyzing host records of the hosts that include existing interface microservices to determine characteristics of each host, the characteristics for each host including a compute specification, a memory specification, and a storage specification, and

determining that the host has characteristics that satisfy the deployment specification of the deployment request.

5. The method of claim 1, wherein selecting the best available host from the one or more of the hosts that include existing interface microservices comprises:

determining that the host includes less than a maximum number of interface microservices and that the security microservice to be added to the host can be merged with the existing interface microservices.

6. The method of claim 1, wherein accessing the one or more host records for the one or more hosts comprises:

querying host records in a deployment database.

7. The method of claim 1, wherein the deployment request is received from an existing microservice in the security service.

8. The method of claim 1, wherein the deployment request is received based on an analysis of existing microservices in the security service.

9. One or more non-transitory computer-readable storage media storing instructions which, when executed by one or more hardware processors, cause performance of:

receiving a deployment request to deploy a security microservice in a security service, the deployment request including a deployment specification;

determining whether an interface microservice is included on one or more hosts by accessing one or more host records for the one or more hosts;

for hosts that include existing interface microservices,

selecting a best available host from the one or more of the hosts that include existing interface microservices, wherein the selecting of the best available host is based on an evaluation of the deployment specification;

for hosts that do not include existing interface microservices or when the one or more hosts that include existing interface microservices are not available,

selecting a best available host from the hosts that do not include existing interface microservices, wherein the selecting of the best available host is based on an evaluation of the deployment specification,

initializing the interface microservice on the selected host, and

attaching the interface microservice to a hypervisor of the selected host;

connecting the security microservice to the interface microservice of the selected host;

deploying the security microservice on the selected host; and

executing the security microservice.

10. The one or more non-transitory computer-readable storage media of claim 9, wherein the instructions which, when executed by the one or more computing devices, further cause:

retrieving a utilization history from one or more hosts in the security service; and

updating the deployment specification based on an analysis of the retrieved utilization history.

11. The one or more non-transitory computer-readable storage media of claim 10, wherein the utilization history is one or more of a compute utilization history, a memory utilization history, a storage utilization history, and a network utilization history.

12. The one or more non-transitory computer-readable storage media of claim 9, further comprising:

evaluating the one or more hosts that include existing interface microservices, wherein the evaluation includes;

analyzing host records of the hosts that include existing interface microservices to determine characteristics of each host, the characteristics for each host including a compute specification, a memory specification, and a storage specification, and

determining that the host has characteristics that satisfy the deployment specification of the deployment request.

13. The one or more non-transitory computer-readable storage media of claim 9, wherein selecting the best available host from the one or more of the hosts that include existing interface microservices comprises:

determining that the host includes less than a maximum number of interface microservices and that the security microservice to be added to the host can be merged with the existing interface microservices.

14. The one or more non-transitory computer-readable storage media of claim 9, wherein accessing the one or more host records for the one or more hosts comprises:

querying host records in a deployment database.

15. The one or more non-transitory computer-readable storage media of claim 9, wherein the deployment request is received from an existing microservice in the security service.

16. The one or more non-transitory computer-readable storage media of claim 9, wherein the deployment request is received based on an analysis of existing microservices in the security service.

17. An apparatus, comprising:

one or more hardware processors;

memory coupled to the one or more hardware processors, the memory storing instructions which, when executed by the one or more hardware processors, causes the apparatus to;

receive a deployment request to deploy a security microservice in a security service, the deployment request including a deployment specification;

determine whether an interface microservice is included on one or more hosts by accessing one or more host records for the one or more hosts;

for hosts that include existing interface microservices,

select a best available host from the one or more of the hosts that include existing interface microservices that are available, wherein the selecting of the best available host is based on an evaluation of the deployment specification;

for hosts that do not include existing interface microservices or when the one or more hosts that include existing interface microservices are not available,

select the best available host from the hosts that do not include existing interface microservices, wherein the selecting of the best available host is based on an evaluation of the deployment specification,

initializing the interface microservice on the selected host, and

attaching the interface microservice to a hypervisor of the selected host;

connect the security microservice to the interface microservice of the selected host;

deploy the security microservice on the selected host; and

execute the security microservice.

18. The apparatus of claim 17, wherein the instructions which, when executed by the one or more hardware processors, further causes the apparatus to:

retrieve a utilization history from one or more hosts in the security service; and

update the deployment specification based on an analysis of the retrieved utilization history.

19. The apparatus of claim 18, wherein the utilization history is one or more of a compute utilization history, a memory utilization history, a storage utilization history, and a network utilization history.

20. The apparatus of claim 17, wherein the instructions further cause the apparatus to:

evaluate the one or more hosts that include existing interface microservices, the evaluation including;

analyzing host records of the hosts that include existing interface microservices to determine characteristics of each host, the characteristics for each host including a compute specification, a memory specification, and a storage specification; and

determining that the host has characteristics that satisfy the deployment specification of the deployment request.

21. The apparatus of claim 17, wherein selecting the best available host from the one or more of the hosts that include existing interface microservices comprises:

determining that the host includes less than a maximum number of interface microservices and that the security microservice to be added to the host can be merged with the existing interface microservices.

22. The apparatus of claim 17, wherein accessing the one or more host records for the one or more hosts comprises:

querying host records in a deployment database.

23. The apparatus of claim 17, wherein the deployment request is received from an existing microservice in the security service.

24. The apparatus of claim 17, wherein the deployment request is received based on an analysis of existing microservices in the security service.