Providing compliance/monitoring service based on content of a service controller

• US 10,033,604 B2
• Filed: 08/05/2015
• Issued: 07/24/2018
• Est. Priority Date: 08/05/2015
• Status: Active Grant

• Current Assignee: SUSE, LLC (SUSE Software Solutions Germany GmbH)
• Original Assignee: SUSE, LLC (SUSE Software Solutions Germany GmbH)
• Inventors: Maes, Stephane Herman, Gupte, Prashant
• Primary Examiner(s): Lazaro, David
• Assistant Examiner(s): Shitayewoldetsadi, Berhanu
• Application Number:
  US14/818,834
• Publication Number:
  US 20170041206A1
• Time in Patent Office: 1,084 Days
• Field of Search: 709204, 709205, 709232, 709224, 709225, 709235
• CPC Class Codes: G06F 2009/45591 Monitoring or debugging support
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5051 Service on demand, e.g. definition and deployment of services in real time
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 43/20 the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

In some examples, a service controller provisions an instance of a cloud service in response to receiving a request, where the service controller is provided with content including a call to be issued by the service controller to a compliance/monitoring service that performs a task selected from among monitoring the provisioned instance and determining compliance of the provisioned instance. The service controller issues the call to the compliance/monitoring service, the call including information regarding the provisioned instance, wherein the information is useable by the compliance/monitoring service in performing the task.

Claims

1. A method comprising:

provisioning, by a service controller, an instance of a cloud service in response to receiving a request, wherein the service controller is provided with a sequence of machine-readable instructions to process represented as content, and the content including a call that is invoked by the service controller when the sequence of machine-readable instructions is processed, causing an invocation of a compliance/monitoring service, wherein the service controller is not designed to use the compliance/monitoring service when processing the call from the sequence of machine-readable instructions, and wherein the compliance/monitoring service when invoked by the service controller performs a task selected from among monitoring the provisioned instance and determining compliance of the provisioned instance; and

issuing, by the service controller, the call to the compliance/monitoring service based on processing the sequence of machine-readable instructions having the call, the call comprising information regarding the provisioned instance, wherein the information is processed by the compliance/monitoring service in performing the task.

2. The method of claim 1, further comprising:

performing, by the service controller, lifecycle management of the instance of the cloud service.

3. The method of claim 1, further comprising:

in response to the issued call, using, by the compliance/monitoring service, the information in performing the task, wherein the task comprises an action selected from among initiating the provisioned instance, interacting with the provisioned instance, updating the provisioned instance, performing remediation with respect to an issue, sending a notification of the issue, and providing a report with respect to the issue.

4. The method of claim 1, wherein the task performed by the compliance/monitoring service in response to the issued call comprises checking whether the provisioned instance is compliant with one of a security profile and a security level, and wherein the information of the call further includes the one of the security profile and security level.

5. The method of claim 1, wherein the task performed by the compliance/monitoring service in response to the issued call comprises monitoring an operation of the provisioned instance.

6. The method of claim 1, further comprising:

in response to detecting an issue, perform at least one of;

remediating the issue by interacting with the provisioned instance,

remediating the issue by invoking a lifecycle management action,

sending a notification of the issue, and

sending a report relating to the issue.

7. The method of claim 1, wherein the information describes a topology of the instance of the cloud service or a node of the instance of the cloud service, and information about relationships between neighboring nodes in the instance of the cloud service.

8. The method of claim 1, wherein the information is selected from among addresses of nodes in the instance of the cloud service, ports of nodes in the instance of the cloud service, a topology of the instance of the cloud service, information relating to an operating system used by the instance of the cloud service, information of a type of node in the instance of the cloud service, information relating to virtual machines of the instance of the cloud service, a security level of the instance of the cloud service, a key used to access data, a tenant identifier and a credential to allow for monitoring and remediation on behalf of a tenant, and a profile specifying a policy or level associated with the task.

9. The method of claim 1, further comprising:

onboarding an individual user or a tenant including users; and

performing sign-on for a given user to allow the given user access to the service controller for provisioning the instance of the cloud service on behalf of the given user and management of the instance of the cloud service, the given user being one of the individual user and a user of the tenant.

10. The method of claim 9, further comprising:

using one of a credential provided by a service provider, a credential of the tenant, and a credential input by the given user at sign-on to provide access to the service controller.

11. A system comprising:

a processor configured to execute instructions representing a service controller, wherein the service controller configured to provision an instance of a cloud service in response to receiving a request;

at least one of;

the processor and a different processor configured to execute service instructions representing a compliance/monitoring service, wherein the compliance/monitoring service configured to perform a task to one or more of;

monitor the provisioned instance, and determine compliance of the provisioned instance; and

a non-transitory computer-readable medium configured to house sequences of machine-readable instructions and information as a service design of the service controller, the sequence of machine-readable instructions including a call that when processed by the service controller invokes the compliance/monitoring service for processing, wherein the service controller is not designed to use the compliance/monitoring service when the service controller processes the call from the sequence of machine-readable instructions,

the service controller further configured to issue the call to the compliance/monitoring service in response to a provisioning of the instance of the cloud service based on the sequences of machine-readable instructions being processed by the service controller, the call comprising at least a portion of the information relating to the provisioned instance of the cloud service, and

the compliance/monitoring service further configured to process the information in performing the task.

12. The system of claim 11, wherein the call was added to the service design to allow the compliance/monitoring service to be invoked by the service controller when the service controller processes the sequences of machine-readable instructions.

13. The system of claim 11, further comprising a portal accessible by a user to cause submission of the request.

14. The system of claim 11, wherein at least one portion of the information comprises a profile to specify a policy or level associated with the task, the profile selected from among:

a profile selected by the user from a plurality of profiles presented to the user,

a profile predefined in the service design,

a profile predefined in a catalog that includes information about cloud services that can be ordered by the user, and

a profile passed with an application programming interface (API) call associated with the provisioning of the cloud service instance.

15. An article comprising at least one non-transitory machine-readable storage medium storing instructions that upon execution cause a system to:

receive selection of a service design, the service design associated with a service controller that performs one of provisioning and lifecycle management of an instance of a cloud service, the service design including a sequence of machine-readable instructions processed by the service controller, and the sequence of machine-readable instructions include a call invoked by the service controller when processing the sequence of machine-readable instructions of the service device and when the call is invoked a compliance/monitoring service is processed that performs a task selected from among monitoring the provisioned instance and determining compliance of the provisioned instance, and wherein the service controller is not designed to use the compliance/monitoring service when processing the call from the sequence of machine-readable instructions; and

issue, by the service controller, the call to the compliance/monitoring service based on processing the sequence of machine-readable instructions of the service design, the call comprising information regarding the provisioned instance, wherein the information is useable by the compliance/monitoring service in performing the task.

16. The article of claim 15, wherein the selection is one of a user selection of the service design from a catalog, and selection using a call to an application programming interface (API).

17. The article of claim 16, wherein the catalog further comprises an item corresponding to the cloud service, and the instructions are executable by the system to:

receive an order from a user for the cloud service based on the catalog.

18. The article of claim 15, wherein the information further comprises an identifier of a tenant.

19. The article of claim 15, wherein the information further comprises a profile specifying one of a policy and level to be used in performing the task.

20. The article of claim 19, wherein the profile is selected from among:

a profile selected by the user from a plurality of profiles presented to the user,

a profile predefined in the service design,

a profile predefined in a catalog that includes information about cloud services that can be ordered by the user, and

a profile passed with an application programming interface (API) call associated with provisioning the cloud service instance.

21. The article of claim 15, wherein the information comprises a profile specifying one of a policy and level to be used in performing the task, and wherein the task is part of developing and releasing an application.