POLICY IMPLEMENTATION IN A NETWORKED COMPUTING ENVIRONMENT

• US 20130254360A1
• Filed: 03/26/2012
• Published: 09/26/2013
• Est. Priority Date: 03/26/2012
• Status: Active Grant

• Current Assignee: Kyndryl Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Anderson, Jason L., Boss, Gregory J., Coveyduc, Jeffrey L., Murakami, Shaun T., Reif, John, Singh, Animesh
• Granted Patent: US 9,088,570 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Embodiments of the present invention relate to an approach for resolving and/or implementing policies based on layers of a network stack (e.g., cloud computing stack). Specifically, for a given policy that is being resolved, the system first evaluates the applicability of the policy to each layer in the network stack. For a given policy, the system then evaluates the relative effectiveness of applying the policy to achieve the overall goal of the policy. Based on the best fit evaluation of the relative comparison, the system then decides how and where the policy is enacted (e.g., determines a protocol for implementing the policy).

Claims

1. A computer-implemented method for implementing policies in a networked computing environment, comprising:

evaluating an applicability of a policy to a set of layers of a network stack in the networked computing environment, the policy being drawn from a set of policies stored in at least one computer storage device;

determining an effectiveness of the policy as applied to the set of layers; and

determining, based on the effectiveness, a protocol for implementing the policy for at least one of the set of layers.

2. The computer-implemented method of claim 1, the evaluating comprising comparing a function of each of the set of layers to an underlying purpose of the policy.

3. The computer-implemented method of claim 1, the determining comprising determining, for each of the set of layers, whether a set of standards set forth in the policy will be met if the policy is applied.

4. The computer-implemented method of claim 1, further comprising, consolidating the policy with at least one other policy of the set of policies that is also applicable to the at least one layer.

5. The computer-implemented method of claim 4, the consolidating comprising:

generating a rules list from the policy and the at least one other policy;

resolving any conflicts in the rules list; and

generating, responsive to the resolving, a consolidated policy from the rules list.

6. The computer-implemented method of claim 1, the determining of the protocol comprising prioritizing parent policies of the set of policies over child policies of the set of policies.

7. The computer-implemented method of claim 1, the networked computing environment comprising a cloud computing environment, and the network stack comprising a cloud computing stack.

8. A system for implementing policies in a networked computing environment, comprising:

a memory medium comprising instructions;

a bus coupled to the memory medium; and

a processor coupled to the bus that when executing the instructions causes the system to;

evaluate an applicability of a policy to a set of layers of a network stack in the networked computing environment, the policy being drawn from a set of policies stored in at least one computer storage device;

determine an effectiveness of the policy as applied to the set of layers; and

determine, based on the effectiveness, a protocol for implementing the policy for at least one of the set of layers.

9. The system of claim 8, the memory medium further comprising instructions for causing the system to compare a function of each of the set of layers to an underlying purpose of the policy.

10. The system of claim 8, the memory medium further comprising instructions for causing the system to determine, for each of the set of layers, whether a set of standards set forth in the policy will be met if the policy is applied.

11. The system of claim 8, the memory medium further comprising instructions for causing the system to consolidate the policy with at least one other policy of the set of policies that is also applicable to the at least one layer.

12. The system of claim 11, the memory medium further comprising instructions for causing the system to:

generate a rules list from the policy and the at least one other policy;

resolve any conflicts in the rules list; and

generate, responsive to the resolving, a consolidated policy from the rules list.

13. The system of claim 8, the memory medium further comprising instructions for causing the system to prioritize parent policies of the set of policies over child policies of the set of policies.

14. The system of claim 8, the networked computing environment comprising a cloud computing environment, and the network stack comprising a cloud computing stack.

15. A computer program product for implementing policies in a networked computing environment, the computer program product comprising a computer readable storage media, and program instructions stored on the computer readable storage media, to:

evaluate an applicability of a policy to a set of layers of a network stack in the networked computing environment, the policy being drawn from a set of policies stored in at least one computer storage device;

determine an effectiveness of the policy as applied to the set of layers; and

determine, based on the effectiveness, a protocol for implementing the policy for at least one of the set of layers.

16. The computer program product of claim 15, the computer readable storage media further comprising instructions to compare a function of each of the set of layers to an underlying purpose of the policy.

17. The computer program product of claim 15, the computer readable storage media further comprising instructions to determine, for each of the set of layers, whether a set of standards set forth in the policy will be met if the policy is applied.

18. The computer program product of claim 15, the computer readable storage media further comprising instructions to consolidate the policy with at least one other policy of the set of policies that is also applicable to the at least one layer.

19. The computer program product of claim 18, the computer readable storage media further comprising instructions to:

generate a rules list from the policy and the at least one other policy;

resolve any conflicts in the rules list; and

generate, responsive to the resolving, a consolidated policy from the rules list.

20. The computer program product of claim 15, the computer readable storage media further comprising instructions to prioritize parent policies of the set of policies over child policies of the set of policies.

21. The computer program product of claim 15, the networked computing environment comprising a cloud computing environment, and the network stack comprising a cloud computing stack.

22. A method for deploying a system for implementing policies in a networked computing environment, comprising:

providing computer infrastructure being operable to;

evaluate an applicability of a policy to a set of layers of a network stack in the networked computing environment, the policy being drawn from a set of policies stored in at least one computer storage device;

determine an effectiveness of the policy as applied to the set of layers; and

determine, based on the effectiveness, a protocol for implementing the policy for at least one of the set of layers.