SYSTEM AND METHOD FOR PROVIDING TRANSMISSION OF COMPLIANCE REQUIREMENTS FOR CLOUD-BASED APPLICATIONS

• US 20180034703A1
• Filed: 07/26/2016
• Published: 02/01/2018
• Est. Priority Date: 07/26/2016
• Status: Abandoned Application

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Anholt, Paul, Salgueiro, Gonzalo, Jeuk, Sebastian
• Application Number:
  US15/219,428
• Publication Number:
  US 20180034703A1
• Time in Patent Office: Days
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/20 Network management software packages
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 43/20 the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 69/40 for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06

Abstract

Disclosed is a system and method for managing regulatory compliance. The method includes receiving, at a network controller, a compliance regulatory requirement associated with a virtual network function via a network service header field, the virtual network function being part of a service function chain, and receiving, at the network controller, a compliance regulatory status associated with the virtual network function. Based on the compliance regulatory requirement and compliance regulatory status, the method includes determining, at the network controller, that a remedy is required for the virtual network function to comply with the compliance regulatory requirement to yield a determination. When the determination indicates that the remedy is required, the method includes implementing, via the network controller, a compliance regulator action associated with the virtual network function as the remedy.

Claims

1. A method comprising:

receiving, at a network controller, a compliance regulatory requirement associated with a virtual network function via a network service header field, the virtual network function being part of a service function chain;

receiving, at the network controller, a compliance regulatory status associated with the virtual network function;

based on the compliance regulatory requirement and compliance regulatory status, determining, at the network controller, that a remedy is required for the virtual network function to comply with the compliance regulatory requirement to yield a determination; and

when the determination indicates that the remedy is required, implementing, via the network controller, a compliance regulator action associated with the virtual network function as the remedy.

2. The method of claim 1, further comprising:

receiving additional data comprising one of (1) a geo-location associated with the compliance regulatory requirement, (2) a cloud-identifier, (3) a workload-identifier and (4) a tenant identifier.

3. The method of claim 2, wherein the additional data is correlated with the compliance regulatory requirement and the compliance regulatory status to determine the remedy.

4. The method of claim 2, wherein the additional data comprises the geo-location and wherein the remedy comprises maintaining application data within a country boundary.

5. The method of claim 1, wherein the compliance regulatory requirement comprises a length of time data is to be maintained prior to being deleted.

6. The method of claim 1, wherein the compliance regulatory requirement comprises providing an audit trail of all access and activity to certain information.

7. The method of claim 1, wherein the network service header field comprises a type 1 or type 2 metadata.

8. The method of claim 1, wherein the network controller comprises a software defined network controller in a software-defined network, the software defined network controller having a policy that governs generating the remedy.

9. The method of claim 1, wherein the compliance regulatory action comprises one of (1) preventing data from flowing to a virtual network function not in compliance with the compliance regulatory requirement;

and (2) implementing the remedy.

10. The method of claim 1, wherein the compliance regulatory action comprises implementing a data traffic routing policy.

11. The method of claim 1, wherein the compliance regulatory requirement is applied to a creation of the service function chain.

12. The method of claim 11, wherein the compliance regulatory requirement is associated with a cloud provider.

13. The method of claim 1, wherein the compliance regulatory requirement applies on a per-flow or a per-hop basis between virtual network functions within a service function chain.

14. The method of claim 1, further comprising:

analyzing a traffic flow associated with a virtual network function to yield an analysis; and

classifying a regulatory compliance requirement based on the analysis.

15. A system comprising:

one or more processors; and

a computer-readable storage device storing instruction which, when executed by the one or more processors, cause the one or more processors to perform operations comprising;

receiving, at a network controller, a compliance regulatory requirement associated with a virtual network function via a network service header field, the virtual network function being part of a service function chain;

receiving, at the network controller, a compliance regulatory status associated with the virtual network function;

based on the compliance regulatory requirement and compliance regulatory status, determining, at the network controller, that a remedy is required for the virtual network function to comply with the compliance regulatory requirement to yield a determination; and

when the determination indicates that the remedy is required, then implementing, via the network controller, a compliance regulator action associated with the virtual network function as the remedy.

16. The system of claim 15, the computer-readable medium storing additional instructions which, when executed by the one or more processors, performs operations further comprising:

receiving additional data comprising one of (1) a geo-location associated with the compliance regulatory requirement, (2) a cloud-identifier, (3) a workload-identifier and (4) a tenant identifier.

17. The system of claim 16, wherein the additional data is correlated with the compliance regulatory requirement and the compliance regulatory status to determine the remedy.

18. The system of claim 16, wherein the additional data comprises the geo-location and wherein the remedy comprises maintaining application data within a country boundary.

19. The system of claim 15, wherein the compliance regulatory requirement comprises one of (1) a length of time data is to be maintained prior to being deleted and (2) providing an audit trail of all access and activity to certain information.

20. A computer-readable storage device storing instruction which, when executed by one or more processors, causes the one or more processors to perform operations comprising:

receiving, at a network controller, a compliance regulatory requirement associated with a virtual network function via a network service header field, the virtual network function being part of a service function chain;

receiving, at the network controller, a compliance regulatory status associated with the virtual network function;

based on the compliance regulatory requirement and compliance regulatory status, determining, at the network controller, that a remedy is required for the virtual network function to comply with the compliance regulatory requirement to yield a determination; and

when the determination indicates that the remedy is required, then implementing, via the network controller, a compliance regulator action associated with the virtual network function as the remedy.