METHOD AND SYSTEM FOR APPLYING COMPLIANCE POLICIES ON PRIVATE AND PUBLIC CLOUD

• US 20190312909A1
• Filed: 04/09/2018
• Published: 10/10/2019
• Est. Priority Date: 04/09/2018
• Status: Active Grant

• Current Assignee: Nicira Incorporated (Broadcom, Inc.)
• Original Assignee: Nicira Incorporated (Broadcom, Inc.)
• Inventors: KULKARNI, Vaibhav, GOKHALE, Aditya
• Granted Patent: US 10,887,350 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Syncing compliance policies on a private cloud network and a public cloud network is disclosed. The technology accesses a hybrid cloud environment including: at least one private cloud network and at least one public cloud network. A private policy gateway appliance is coupled with the private cloud network and a public policy gateway appliance, in communication with the private policy gateway appliance, is coupled with the public cloud network. One or more policy rules for the hybrid cloud environment are provided to the private policy gateway appliance which then disseminates the one or more policy rules to the public policy gateway appliance, such that the one or more policy rules are synced for the at least one private cloud network and the at least one public cloud network.

Claims

1. A method for syncing compliance policies on a private cloud network and a public cloud network, the method comprising:

accessing a hybrid cloud environment, the hybrid cloud environment comprising;

at least one private cloud network having a first physical computing system, the first physical computing system hosting a first set of multiple virtual machines (VMs); and

at least one public cloud network having a second physical computing system, the second physical computing system hosting a second set of multiple VMs;

coupling a private policy gateway appliance with the at least one private cloud network;

coupling a public policy gateway appliance with the at least one public cloud network,

the public policy gateway appliance in communication with the private policy gateway appliance;

providing one or more policy rules for the hybrid cloud environment,

the one or more policy rules provided to the private policy gateway appliance; and

disseminating, via the private policy gateway appliance, the one or more policy rules to the public policy gateway appliance, such that the one or more policy rules are synced for the at least one private cloud network and the at least one public cloud network.

2. The method of claim 1, further comprising:

translating the one or more policy rules from a private policy rules format used by the at least one private cloud network into a public policy rules format used by the at least one public cloud network.

3. The method of claim 1, further comprising:

determining that one or more of the one or more policy rules are not applicable to a configuration of the at least one public cloud network; and

modifying the configuration of the at least one public cloud network such that said at least one public cloud network will be able to operate under the one or more policy rules.

4. The method of claim 3, further comprising:

utilizing an architecture within the private policy gateway appliance to modify the configuration of the at least one public cloud network.

5. The method of claim 4, wherein the architecture within the private policy gateway appliance is a VMware cross cloud architecture.

6. The method of claim 1, further comprising:

storing the one or more policy rules at an enterprise policy rule library on the private policy gateway appliance.

7. The method of claim 1, further comprising:

utilizing the private policy gateway appliance as a single pane of access to the hybrid cloud environment; and

generating, via the single pane of access, a single report for one or more compliance policies across the hybrid cloud environment.

8. The method of claim 1, further comprising:

syncing the one or more policy rules when the private policy gateway appliance or the public policy gateway appliance enters a polling mode.

9. The method of claim 1, further comprising:

syncing the one or more policy rules when a change is made to the one or more policy rules on the private policy gateway appliance,

the private policy gateway appliance pushing the change to the public policy gateway appliance.

10. A system for syncing compliance policies on a private cloud network and a public cloud network, the system comprising:

a hybrid cloud environment comprising;

at least one private cloud network having a first physical computing system, the first physical computing system hosting a first set of multiple virtual machines (VMs); and

at least one public cloud network having a second physical computing system, the second physical computing system hosting a second set of multiple VMs;

a private policy gateway appliance coupled with the at least one private cloud network;

a public policy gateway appliance coupled with the at least one public cloud network,

the public policy gateway appliance in communication with the private policy gateway appliance; and

one or more policy rules for the hybrid cloud environment,

the one or more policy rules provided to the private policy gateway appliance, and

the private policy gateway appliance to disseminate the one or more policy rules to the public policy gateway appliance, such that the one or more policy rules are synced for the at least one private cloud network and the at least one public cloud network.

11. The system of claim 10, wherein the private policy gateway appliance further comprises:

a cloud policy translator to translate the one or more policy rules from a private policy rules format used by the at least one private cloud network into a public policy rules format used by the at least one public cloud network.

12. The system of claim 10, wherein the private policy gateway appliance further comprises:

a policy inference engine configured to;

determine one or more of the one or more policy rules that are not applicable to a configuration of the at least one public cloud network; and

modify the configuration of the at least one public cloud network such that said at least one public cloud network will be able to operate under the one or more policy rules.

13. The system of claim 12, wherein the modification of the configuration of the at least one public cloud network is provided by an architecture within the policy inference engine.

14. The system of claim 13, wherein the architecture within the policy inference engine is a VMware cross cloud architecture.

15. The system of claim 10, wherein the private policy gateway appliance further comprises:

an enterprise policy rule library to store the one or more policy rules at the private policy gateway appliance.

16. The system of claim 10, wherein the dissemination of the one or more policy rules from the private policy gateway appliance to the public policy gateway appliance provides a single pane of access to the hybrid cloud environment,

the single pane of access providing a single point report generation of one or more compliance policies across the hybrid cloud environment.

17. The system of claim 10, wherein the one or more policy rules are synced when the private policy gateway appliance or the public policy gateway appliance enters a polling mode.

18. The system of claim 10, wherein the one or more policy rules are synced when a change is made to the one or more policy rules on the private policy gateway appliance and the private policy gateway appliance pushes the change to the public policy gateway appliance.

19. A non-transitory processor readable storage medium having computer readable program code stored thereon for causing a computing system to perform a method comprising:

accessing a hybrid cloud environment, the hybrid cloud environment comprising;

at least one private cloud network having a first physical computing system, the first physical computing system hosting a first set of multiple virtual machines (VMs); and

at least one public cloud network having a second physical computing system, the second physical computing system hosting a second set of multiple VMs;

coupling a private policy gateway appliance with the at least one private cloud network;

coupling a public policy gateway appliance with the at least one public cloud network,

the public policy gateway appliance in communication with the private policy gateway appliance;

providing one or more policy rules for the hybrid cloud environment,

the one or more policy rules provided to the private policy gateway appliance; and

disseminating, via the private policy gateway appliance, the one or more policy rules to the public policy gateway appliance, such that the one or more policy rules are synced for the at least one private cloud network and the at least one public cloud network.

20. The non-transitory processor readable storage medium of claim 19, further comprising:

translating the one or more policy rules from a private policy rules format used by the at least one private cloud network into a public policy rules format used by the at least one public cloud network;

determining that one or more of the one or more policy rules are not applicable to a configuration of the at least one public cloud network; and

modifying the configuration of the at least one public cloud network such that said at least one public cloud network will be able to operate under the one or more policy rules.