Network system for implementing a cloud platform

• US 8,935,764 B2
• Filed: 08/31/2012
• Issued: 01/13/2015
• Est. Priority Date: 08/31/2012
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Penkler, David, Bouat, Sebastien, Balacheff, Boris, Cooper, James C
• Primary Examiner(s): PERUNGAVOOR, VENKATANARAY
• Application Number:
  US13/601,050
• Publication Number:
  US 20140068699A1
• Time in Patent Office: 865 Days
• Field of Search: None
• US Class Current: 726/5
• CPC Class Codes: H04L 41/5045 Making service definitions prior to deployment
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A network system for implementing a cloud platform within a network to which a device defining a computing environment for a user has access comprises an application management module, a community management module, and a user enrollment portal. The application management module enables access to an abstract application associated with a concrete application defining an implementation of the abstract application for the computing environment. The community management module manages a community comprised of a user credential and the abstract application, the community defines at least one of: a policy, a management process, and a service, under which the user can access the abstract application. The user enrollment portal supports an enrollment of the user in the community from the device and orchestrates a policy management mechanism to support an enforcement of the policy under which the user has access to the concrete application from the device.

Claims

1. A network system for implementing a cloud platform within a network to which a plurality of client devices, each device defining a computing environment for a user of each client device, have access, said system comprising:

a processor that implements an application management module, a community management module, and a user enrolment portal;

the application management module to enable access to a plurality of abstract applications, each abstract application being associated with a plurality of concrete applications, each concrete application defining an implementation of said associated abstract application for a particular computing environment on a client device;

the community management module to manage a plurality of communities, each community including a user credential and at least one of the abstract applications, wherein each community defines at least one of a policy, a management process, and a service, under which any abstract application included in the community can be accessed by a user via the user'"'"'s client device; and

the user enrolment portal to support an enrolment of each client device user in a given community from the user'"'"'s client device, and to orchestrate a policy management mechanism to support an enforcement of the given community'"'"'s policy under which that particular user has access to a particular concrete application from the user'"'"'s client device, the particular concrete application specified by the policy;

wherein the enrolment portal is to provide a client device access to concrete applications of different abstract applications of different communities in accordance with different policies.

2. The network system according to claim 1, further comprising a policy management module, wherein said user enrolment portal is configured to identify a particular computing environment used by a user to get access to said network system, and said user enrolment portal is further configured to notify said policy management module about said identified computing environment, and said policy management module is configured to map the policy to be enforced on behalf of the community accessed by the user on the identified computing environment of the user'"'"'s client device.

3. The network system according to claim 1, wherein said application management module, said community management module, and said user enrolment portal are implemented on separated computing devices connected by said network or a further network.

4. The network system according to claim 1, wherein said application management module is further configured to enable access to one or more concrete applications including said concrete application and wherein said community management module is further configured to define a plurality of policies including said policy, wherein said one or more policies are fixed for said abstract application, but vary for said one or more concrete applications associated with said abstract application.

5. The network system according to claim 1, wherein said application management module is further configured to enable access to one or more concrete applications including said concrete application and wherein said community management module is further configured to define a plurality of policies including said policy, and further comprising a rules engine configured to manage entitlements to said one or more concrete applications under a predetermined policy according to one of said following:

said user credential, said device and/or said computing environment, and a context of an access request.

6. The network system according to claim 1, further comprising a community administrator portal configured to allow individual community administrators to define said policy and/or to view a community dashboard.

7. The network system according to claim 6, wherein said community management module is configured to manage a plurality of communities and/or said user credentials, and said user enrolment portal is further configured to present said user with a selection of said plurality of communities to be accessed by said user under policies imposed by said community administrator.

8. The network system according to claim 1, wherein the enrolment portal is configured to enforce simultaneously a plurality of policies for multiple communities on a given client device and/or in multiple computing environments.

9. The network system according to claim 1, wherein said user enrolment portal is configured to provide a client device access to a particular concrete application associated with an abstract application based on said computing environment ensuring that said a policy of the community to which the user of the client device has accessed is enforced on the client device'"'"'s computing environment.

10. The network system according to claim 1, wherein each policy of each community comprises at least one of said following:

a managed encryption is turned on, an active intrusion prevention is deployed, allowing to get access to resources on said device, and said enforcement of said policy on said computing environment is operated on behalf of said community.

11. The network system according to claim 1, wherein said user enrolment portal comprises a module to manage each computing environment and to provide at least one of said following:

issue a set of user credentials, manage said set of user credentials, manage profiles of different devices, and register said user.

12. A device comprising a device module being configured to provide a connection to said network system according to claim 1, to get access to a particular concrete application, and to enforce a given policy on said device.

13. A computer-implemented method, comprising:

receiving a request, by a processor, across a network from a client device for access to a particular community of a plurality of communities, each community including an abstract application and a policy corresponding to the abstract application, each abstract application implemented by each of multiple concrete applications, and each policy specifies which concrete application for the abstract application is to be provided to a client device based on a computing environment of each such client device;

identifying, by the processor, a computing environment of the client device;

based on the policy of the particular community, determining which concrete application associated with that community'"'"'s abstract application can be downloaded to the client device;

downloading the determined concrete application to the client device in accordance with the particular community'"'"'s policy; and

downloading to the client device another concrete application of a different abstract application of a different community based on a different policy associated with said different community, the client device thereby provided with a plurality of concrete applications of different communities in accordance with different policies.

14. A non-transitory, computer-readable storage device containing software that, when executed by a processor, causes the processor to:

receive a request across a network from a client device for access to a particular community of a plurality of communities, each community including an abstract application and a policy corresponding to the abstract application, each abstract application implemented by each of multiple concrete applications, and each policy specifies which concrete application for the abstract application is to be provided to a client device based on a computing environment of each such client device;

identify a computing environment of the client device;

based on the policy of the particular community, determine which concrete application associated with that community'"'"'s abstract application can be downloaded to the client device;

download the determined concrete application to the client device in accordance with the particular community'"'"'s policy; and

download to the client device another concrete application of a different abstract application of a different community based on a different policy associated with said different community, the client device thereby provided with a plurality of concrete applications of different communities in accordance with different policies.