Systems and methods for adding microservices into existing system environments

• US 10,642,982 B2
• Filed: 07/02/2018
• Issued: 05/05/2020
• Est. Priority Date: 12/30/2016
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: ShieldX Networks, Inc. (Fortinet Inc.)
• Inventors: Ahuja, Ratinder Paul Singh, Nedbal, Manuel, Hillel, Meni, Guzik, John Richard
• Primary Examiner(s): Lanier, Benjamin E
• Application Number:
  US16/025,411
• Publication Number:
  US 20190138728A1
• Time in Patent Office: 673 Days
• Field of Search: None
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06F 9/50 Allocation of resources, e.g. of the central processing unit [CPU]
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/1008 based on parameters of servers, e.g. available memory or workload monitoring of computer activity G06F11/30

Abstract

Systems and methods are disclosed that relate to network security within a virtual network, and how to add microservices in a scalable virtual network. For example, one embodiment discloses a method of receiving a deployment request to deploy a security microservice in a security service, the deployment request including a deployment specification. The method further includes determining whether an interface microservice is available on one or more hosts by accessing one or more host records for the one or more hosts, and selecting a host on which to deploy the security microservice utilizing the deployment specification. When the interface microservice does not exist on the selected host, the method further includes initializing the interface microservice on the selected host, attaching the interface microservice to a hypervisor of the selected host, connecting the security microservice to the interface microservice of the selected host, and deploying the security microservice on the selected host.

Claims

1. A computer-implemented method, comprising:

receiving a deployment request to deploy a security microservice in a security service, the deployment request including a deployment specification;

determining that one or more hosts are available;

accessing one or more host records for the one or more available hosts;

selecting an available host on which to deploy the security microservice utilizing the deployment specification and the one or more host records for the one or more available hosts;

determining whether an interface microservice is available on the selected available host based on a host record for the selected available host;

when the selected available host does not include existing interface microservices,

initializing the interface microservice on the selected available host, and

attaching the interface microservice to a hypervisor of the selected available host;

initializing the security microservice on the selected available host;

connecting the security microservice to the interface microservice of the selected available host; and

executing the security microservice.

2. The method of claim 1, further comprising:

retrieving a utilization history from one or more hosts in the security service; and

updating the deployment specification based on an analysis of the retrieved utilization history.

3. The method of claim 2, wherein the utilization history is one or more of a compute utilization history, a memory utilization history, a storage utilization history, and a network utilization history.

4. The method of claim 1, wherein determining whether the interface microservice is available on the selected available host based on the host record for the selected available host comprises:

analyzing the host record of the selected available host to determine characteristics of the selected available host, the characteristics for the selected available host including a compute specification, a memory specification, and a storage specification; and

determining that the selected available host has characteristics that satisfy the deployment specification of the deployment request.

5. The method of claim 4, wherein determining that the selected available host has characteristics that satisfy the deployment specification of the deployment request comprises:

determining that the selected available host includes less than a maximum number of interface microservices and that the security microservice to be added to the selected available host can be merged with the existing interface microservices.

6. The method of claim 1, wherein accessing the one or more host records for the one or more available hosts comprises:

querying host records in a deployment database.

7. The method of claim 1, wherein the deployment request is received from an existing microservice in the security service.

8. The method of claim 1, wherein the deployment request is received based on an analysis of existing microservices in the security service.

9. One or more non-transitory computer-readable storage media storing instructions which, when executed by one or more hardware processors, cause performance of:

receiving a deployment request to deploy a security microservice in a security service, the deployment request including a deployment specification;

determining that one or more hosts are available;

accessing one or more host records for the one or more available hosts;

selecting an available host on which to deploy the security microservice utilizing the deployment specification and the one or more host records for the one or more available hosts;

determining whether an interface microservice is available on the selected available host based on a host record for the selected available host;

when the selected available host does not include existing interface microservices,

initializing the interface microservice on the selected available host, and

attaching the interface microservice to a hypervisor of the selected available host;

initializing the security microservice on the selected available host;

connecting the security microservice to the interface microservice of the selected available host; and

executing the security microservice.

10. The one or more non-transitory computer-readable storage media of claim 9, wherein the instructions which, when executed by the one or more computing devices, further cause performance of:

retrieving a utilization history from one or more hosts in the security service; and

updating the deployment specification based on an analysis of the retrieved utilization history.

11. The one or more non-transitory computer-readable storage media of claim 10, wherein the utilization history is one or more of a compute utilization history, a memory utilization history, a storage utilization history, and a network utilization history.

12. The one or more non-transitory computer-readable storage media of claim 9,

wherein determining whether the interface microservice is available on the selected available host based on the host record for the selected available host comprises:

analyzing the host record of the selected available host to determine characteristics of the selected available host, the characteristics for the selected available host including a compute specification, a memory specification, and a storage specification; and

determining that the selected available host has characteristics that satisfy the deployment specification of the deployment request.

13. The one or more non-transitory computer-readable storage media of claim 12,

wherein determining that the selected available host has characteristics that satisfy the deployment specification of the deployment request comprises:

determining that the selected available host includes less than a maximum number of interface microservices and that the security microservice to be added to the selected available host can be merged with the existing interface microservices.

14. The one or more non-transitory computer-readable storage media of claim 9, wherein accessing the one or more host records for the one or more available hosts comprises:

querying host records in a deployment database.

15. The one or more non-transitory computer-readable storage media of claim 9, wherein the deployment request is received from an existing microservice in the security service.

16. The one or more non-transitory computer-readable storage media of claim 9, wherein the deployment request is received based on an analysis of existing microservices in the security service.

17. An apparatus, comprising:

one or more hardware processors;

memory coupled to the one or more hardware processors, the memory storing instructions which, when executed by the one or more hardware processors, causes the apparatus to;

receive a deployment request to deploy a security microservice in a security service, the deployment request including a deployment specification;

determine that one or more hosts are available;

access one or more host records for the one or more available hosts;

select an available host on which to deploy the security microservice utilizing the deployment specification and the one or more host records for the one or more available hosts;

determine whether an interface microservice is available on the selected available host based on a host record for the selected available host;

when the selected available host does not include existing interface microservices,

initialize the interface microservice on the selected available host, and

attach the interface microservice to a hypervisor of the selected available host;

initialize the security microservice on the selected available host;

connect the security microservice to the interface microservice of the selected available host; and

execute the security microservice.

18. The apparatus of claim 17, wherein the instructions which, when executed by the one or more hardware processors, further causes the apparatus to:

retrieve a utilization history from one or more hosts in the security service; and

update the deployment specification based on an analysis of the retrieved utilization history.

19. The apparatus of claim 17, wherein determining whether the interface microservice is available on the selected available host based on the host record for the selected available host comprises:

analyzing the host record of the selected available host to determine characteristics of the selected available host, the characteristics for the selected available host including a compute specification, a memory specification, and a storage specification; and

determining that the selected available host has characteristics that satisfy the deployment specification of the deployment request.

20. The apparatus of claim 19, wherein determining that the selected available host has characteristics that satisfy the deployment specification of the deployment request comprises:

determining that the selected available host includes less than a maximum number of interface microservices and that the security microservice to be added to the selected available host can be merged with the existing interface microservices.