HYBRID CLOUD COMPUTING NETWORK MANAGEMENT

• US 20190327293A1
• Filed: 04/18/2019
• Published: 10/24/2019
• Est. Priority Date: 04/18/2018
• Status: Active Grant

• Current Assignee: iBoss
• Original Assignee: iBoss
• Inventors: Martini, Paul Michael
• Granted Patent: US 11,064,015 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 41/0803 Configuration setting
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes

Abstract

Techniques for delivering a distributed network security service providing isolation of customer data are described. One example method includes configuring a first node to participate in a node cluster, wherein the first node is hosted by a first cloud service provider, and wherein participating in the node cluster includes performing one or more processing actions specific to the node cluster on data received by the node; configuring a second node to participate in the node cluster, the second node hosted by a second cloud service provider; receiving a status indication from the first node over a network; determining a synchronization mechanism for the first node based on a network configuration of the first node, wherein the determined synchronization mechanism is configured to allow the first node to acquire synchronization data from other nodes in the node cluster; and transmitting the synchronization mechanism to the first node over the network.

Claims

1. A computer-implemented method executed by one or more processors comprising:

configuring, by the one or more processors, a first node to participate in a node cluster, wherein the first node is hosted by a first cloud service provider, and wherein participating in the node cluster includes performing one or more processing actions specific to the node cluster on data received by the node;

configuring, by the one or more processors, a second node to participate in the node cluster, wherein the second node is hosted by a second cloud service provider different than the first cloud service provider;

receiving, by the one or more processors, a status indication from the first node over a network;

in response to receiving the status indication, determining, by the one or more processors, a synchronization mechanism for the first node based on a network configuration of the first node, wherein the determined synchronization mechanism is configured to allow the first node to acquire synchronization data from other nodes in the node cluster; and

in response to determining the synchronization mechanism, transmitting, by the one or more processors, the determined synchronization mechanism to the first node over the network.

2. The method of claim 1, wherein the first node is a virtual machine instance, and configuring the first node includes calling an application programming interface (API) provided by the first cloud service provider to create the virtual machine instance.

3. The method of claim 1, wherein the network is a public network, the method further comprising:

configuring, by the one or more processors, a third node to participate in the node cluster, wherein the third node is a physical computing device hosted in a private network.

4. The method of claim 3, further comprising:

receiving, by the one or more processors, a status indication from the third node over the public network;

in response to receiving the status indication, determining a passive synchronization mechanism for the third node based on its location on the private network; and

in response to determining the passive synchronization mechanism, transmitting the passive synchronization mechanism to the first node over the network.

5. The method of claim 4, wherein the passive synchronization mechanism is configured to allow the third node to obtain synchronization information from other nodes in the cluster without accepting inbound connections from the public network.

6. The method of claim 1, wherein the one or more processing actions specific to the node cluster include performing threat analysis and selectively performing corrective action in response to receiving network traffic from a network client.

7. The method of claim 6, wherein the network client is a client of the first cloud service provider, and wherein the first node is configured to perform threat analysis and selectively perform corrective action on network traffic received from the network client.

8. The method of claim 6, wherein the network client is a client of the second cloud service provider, and wherein the second node is configured to perform threat analysis and selectively perform corrective action on network traffic received from the network client.

9. A non-transitory, computer-readable medium storing instructions operable when executed to cause at least one processor to perform operations comprising:

configuring, by the one or more processors, a first node to participate in a node cluster, wherein the first node is hosted by a first cloud service provider, and wherein participating in the node cluster includes performing one or more processing actions specific to the node cluster on data received by the node;

configuring, by the one or more processors, a second node to participate in the node cluster, wherein the second node is hosted by a second cloud service provider different than the first cloud service provider;

receiving, by the one or more processors, a status indication from the first node over a network;

in response to receiving the status indication, determining, by the one or more processors, a synchronization mechanism for the first node based on a network configuration of the first node, wherein the determined synchronization mechanism is configured to allow the first node to acquire synchronization data from other nodes in the node cluster; and

in response to determining the synchronization mechanism, transmitting, by the one or more processors, the determined synchronization mechanism to the first node over the network.

10. The non-transitory, computer-readable medium of claim 9, wherein the first node is a virtual machine instance, and configuring the first node includes calling an application programming interface (API) provided by the first cloud service provider to create the virtual machine instance.

11. The non-transitory, computer-readable medium of claim 9, wherein the network is a public network, the operations further comprising;

configuring, by the one or more processors, a third node to participate in the node cluster, wherein the third node is a physical computing device hosted in a private network.

12. The non-transitory, computer-readable medium of claim 11, the operations further comprising:

receiving, by the one or more processors, a status indication from the third node over the public network;

in response to receiving the status indication, determining a passive synchronization mechanism for the third node based on its location on the private network; and

in response to determining the passive synchronization mechanism, transmitting the passive synchronization mechanism to the first node over the network.

13. The non-transitory, computer-readable medium of claim 12, wherein the passive synchronization mechanism is configured to allow the third node to obtain synchronization information from other nodes in the cluster without accepting inbound connections from the public network.

14. The non-transitory, computer-readable medium of claim 9, wherein the one or more processing actions specific to the node cluster include performing threat analysis and selectively performing corrective action in response to receiving network traffic from a network client.

15. The non-transitory, computer-readable medium of claim 14, wherein the network client is a client of the first cloud service provider, and wherein the first node is configured to perform threat analysis and selectively perform corrective action on network traffic received from the network client.

16. The non-transitory, computer-readable medium of claim 14, wherein the network client is a client of the second cloud service provider, and wherein the second node is configured to perform threat analysis and selectively perform corrective action on network traffic received from the network client.

17. A system comprising:

non-transitory memory for storing data; and

one or more processors operable to perform operations comprising;

configuring, by the one or more processors, a first node to participate in a node cluster, wherein the first node is hosted by a first cloud service provider, and wherein participating in the node cluster includes performing one or more processing actions specific to the node cluster on data received by the node;

configuring, by the one or more processors, a second node to participate in the node cluster, wherein the second node is hosted by a second cloud service provider different than the first cloud service provider;

receiving, by the one or more processors, a status indication from the first node over a network;

in response to receiving the status indication, determining, by the one or more processors, a synchronization mechanism for the first node based on a network configuration of the first node, wherein the determined synchronization mechanism is configured to allow the first node to acquire synchronization data from other nodes in the node cluster; and

in response to determining the synchronization mechanism, transmitting, by the one or more processors, the determined synchronization mechanism to the first node over the network.

18. The system of claim 17, wherein the first node is a virtual machine instance, and configuring the first node includes calling an application programming interface (API) provided by the first cloud service provider to create the virtual machine instance.

19. The system of claim 17, wherein the network is a public network, the operations further comprising:

configuring, by the one or more processors, a third node to participate in the node cluster, wherein the third node is a physical computing device hosted in a private network.

20. The system of claim 19, the operations further comprising:

receiving, by the one or more processors, a status indication from the third node over the public network;

in response to receiving the status indication, determining a passive synchronization mechanism for the third node based on its location on the private network; and

in response to determining the passive synchronization mechanism, transmitting the passive synchronization mechanism to the first node over the network.