POLICY ENGINE FOR CLOUD PLATFORM

• US 20140052867A1
• Filed: 10/28/2013
• Published: 02/20/2014
• Est. Priority Date: 04/26/2010
• Status: Active Grant

• Current Assignee: Pivotal Software, Inc. (Broadcom, Inc.)
• Original Assignee: VMware, Inc. (Broadcom, Inc.)
• Inventors: CHEN, Gerald C., LADDAD, Ramnivas, LUCOVSKY, Mark, COLLISON, Derek, SPIVAK, Vadim
• Granted Patent: US 9,071,522 B2
• Time in Patent Office: Days
• US Class Current: 709/226
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A policy engine is situated within the communications path of a cloud computing environment and a user of the cloud computing environment to comply with an organization'"'"'s policies for deploying web applications in the cloud computing environment. The policy engine intercepts communications packets to the cloud computing environment from a user, such as a web application developer, for example, in preparation for deploying a web application in the cloud computing environment. The policy engine identifies commands corresponding to the communications packets and directs the communications packets to appropriate rules engines corresponding to such commands in order to execute rules to comply with an organization'"'"'s policies. Upon completion of execution of the rules, the communications packets are forwarded to the cloud computing environment if they comply with the policies.

Claims

1. A method for setting organizational policies for web applications deployed in a cloud computing environment, the method comprising the steps of:

intercepting a communications packet intended for the cloud computing environment, such that the intercepted communications packet is delayed with respect to intended arrival within the cloud computing environment;

identifying a command relating to management of web applications in the intercepted communications packet;

dispatching the communications packet to a rules engine corresponding to the identified command;

executing a set of rules in the rules engine that implements a policy set by an organization desiring to deploy web applications in the cloud computing environment; and

forwarding the intercepted communications packet to the cloud computing environment if completion of execution of the set of rules indicates compliance of the intercepted communications packet with the policy.

2. The method of claim 1, wherein the executing step further comprises editing payload data in the intercepted communications packet to comply with the policy.

3. The method of claim 1, wherein the executing step further comprises accessing a networked service to confirm compliance with the policy.

4. The method of claim 1, wherein the executing step further comprises redirecting a transmitter of the intercepted communications packet to interact with a networked service to comply with the policy.

5. The method of claim 1, further comprising the steps of:

receiving a response to the intercepted communications packet from the cloud computing environment;

dispatching the response to a response rules engine related to the identified command; and

forwarding the response to a transmitter of the intercepted communications packet when completion of execution of a set of rules in the response rules engine indicates compliance of the response with the policy.

6. The method of claim 1, implemented as a process in a proxy server at the organization.

7. The method of claim 1, further comprising the step of rejecting the intercepted communications packet when completion of execution of the set of rules indicates non-compliance of the communications packet with the policy.

8. The method of claim 1, further comprising the steps of:

receiving authentication credentials of a transmitter of the intercepted communications packet;

authenticating the transmitter;

identifying a federated token corresponding to the transmitter; and

transmitting the federated token to the cloud computing environment in relation to the intercepted communications packet.

9. A non-transitory computer-readable storage medium including instructions that, when executed on a computer processor, causes the computer processor to set organizational policies for web applications deployed in a cloud computing environment, by performing the steps of:

intercepting a communications packet intended for the cloud computing environment, such that the intercepted communications packet is delayed with respect to intended arrival within the cloud computing environment;

identifying a command relating to management of web applications in the intercepted communications packet;

dispatching the communications packet to a rules engine corresponding to the identified command;

executing a set of rules in the rules engine that implements a policy set by an organization desiring to deploy web applications in the cloud computing environment; and

forwarding the intercepted communications packet to the cloud computing environment if completion of execution of the set of rules indicates compliance of the intercepted communications packet with the policy.

10. The non-transitory computer-readable storage medium of claim 9, wherein the executing step further comprises editing payload data in the intercepted communications packet to comply with the policy.

11. The non-transitory computer-readable storage medium of claim 9, wherein the executing step further comprises accessing a networked service to confirm compliance with the policy.

12. The non-transitory computer-readable storage medium of claim 9, wherein the executing step further comprises redirecting a transmitter of the intercepted communications packet to interact with a networked service to comply with the policy.

13. The non-transitory computer-readable storage medium of claim 9, further comprising instructions to perform the steps of:

receiving a response to the intercepted communications packet from the cloud computing environment;

dispatching the response to a response rules engine related to the identified command; and

forwarding the response to a transmitter of the intercepted communications packet when completion of execution of a set of rules in the response rules engine indicates compliance of the response with the policy.

14. The non-transitory computer-readable storage medium of claim 9, further comprising instructions to perform the step of rejecting the intercepted communications packet when completion of execution of the set of rules indicates non-compliance of the intercepted communications packet with the policy.

15. The non-transitory computer-readable storage medium of claim 9, further comprising instructions to perform the steps of:

receiving authentication credentials of a transmitter of the intercepted communications packet;

authenticating the transmitter;

identifying a federated token corresponding to the transmitter; and

transmitting the federated token to the cloud computing environment in relation to the intercepted communications packet.

16. A proxy server for setting organizational policies for web applications deployed in a cloud computing environment, the server comprising a processor configured to perform the steps of:

intercepting a communications packet intended for the cloud computing environment, such that the intercepted communications packet is delayed with respect to intended arrival within the cloud computing environment;

identifying a command relating to management of web applications in the intercepted communications packet;

dispatching the communications packet to a rules engine corresponding to the identified command;

executing, by the processor, a set of rules in the rules engine that implements a policy set by an organization desiring to deploy web applications in the cloud computing environment; and

forwarding the intercepted communications packet to the cloud computing environment if completion of execution of the set of rules indicates compliance of the intercepted communications packet with the policy.

17. The proxy server of claim 16, wherein the executing step further comprises editing payload data in the intercepted communications packet to comply with the policy.

18. The proxy server of claim 16, wherein the executing step further comprises accessing a networked service to confirm compliance with the policy.

19. The proxy server of claim 16, wherein the executing step further comprises redirecting a transmitter of the intercepted communications packet to interact with a networked service to comply with the policy.

20. The proxy server of claim 16, wherein the processor is further configured to perform the steps of:

receiving a response to the intercepted communications packet from the cloud computing environment;

dispatching the response to a response rules engine related to the identified command; and

forwarding the response to a transmitter of the intercepted communications packet when completion of execution of a set of rules in the response rules engine indicates compliance of the response with the policy.