SYSTEM AND METHOD FOR A CLOUD COMPUTING ABSTRACTION LAYER WITH SECURITY ZONE FACILITIES

• US 20120185913A1
• Filed: 01/19/2012
• Published: 07/19/2012
• Est. Priority Date: 06/19/2008
• Status: Active Grant

• Current Assignee: VideoLabs, Inc.
• Original Assignee: Servicemesh Incorporated (DXC Technology Company)
• Inventors: Pulier, Eric, Martinez, Frank R.
• Granted Patent: US 9,069,599 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06F 9/5072 Grid computing
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/6418 Hybrid transport
• CPC Class Codes: H04L 12/66 Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services

Abstract

In embodiments of the present invention improved capabilities are described for a virtualization environment adapted for development and deployment of at least one software workload, the virtualization environment having a metamodel framework that allows the association of a policy to the software workload upon development of the workload that is applied upon deployment of the software workload. This allows a developer to define a security zone and to apply at least one type of security policy with respect to the security zone including the type of security zone policy in the metamodel framework such that the type of security zone policy can be associated with the software workload upon development of the software workload, and if the type of security zone policy is associated with the software workload, automatically applying the security policy to the software workload when the software workload is deployed within the security zone.

Claims

1. A method, comprising:

providing a virtualization environment adapted for development and deployment of at least one software workload, the virtualization environment having a metamodel framework that allows the association of a policy to the software workload upon development of the workload that is applied upon deployment of the software workload;

allowing a developer to define a security zone and to apply at least one type of security policy with respect to the security zone;

including the type of security zone policy in the metamodel framework, such that the type of security zone policy can be associated with the software workload upon development of the software workload; and

if the type of security zone policy is associated with the software workload, automatically applying the security policy to the software workload when the software workload is deployed within the security zone.

2. The method of claim 1, wherein the security zone is at least one of a geographic zone, a network zone, an enterprise zone, an operational zone and an organizational zone.

3. The method of claim 1, wherein the security policy is at least one of an access policy, a write-permission policy, a resource utilization policy, and an editing permission policy.

4. The method of claim 1, wherein the security policy determines whether a software workload is allowed to operate in a specified security zone.

5. The method of claim 1, further comprising automatically establishing firewall rules across multiple firewalls in multiple security zones for newly deployed applications by tagging application software workloads that are deployed within the security zones.

6. The method of claim 5, wherein the firewalls are of types provided by different vendors and employ at least one of different operating system, communication protocols, and programming languages.

7. The method of claim 1, further comprising automatically removing firewall rules across multiple firewalls in multiple security zones when the firewall rules do not apply to software workloads within the security zones.

8. The method of claim 7, wherein the firewalls are of types provided by different vendors and employ at least one of different operating system, communication protocols, and programming languages.

9. The method of claim 1, further comprising providing an alert when a software workload is planned to be deployed in a security zone in a manner that is inconsistent with at least one of a security zone policy applicable to the security zone and a security policy associated with the workload.

10. A system, comprising:

a virtualization environment adapted for development and deployment of at least one software workload, the virtualization environment having a metamodel framework that allows the association of a policy to the software workload upon development of the workload that is applied upon deployment of the software workload, which allows a developer to define a security zone and to apply at least one type of security policy with respect to the security zone including the type of security zone policy in the metamodel framework such that the type of security zone policy can be associated with the software workload upon development of the software workload, and if the type of security zone policy is associated with the software workload, automatically applying the security policy to the software workload when the software workload is deployed within the security zone.

11. The system of claim 10, wherein the security zone is at least one of a geographic zone, a network zone, an enterprise zone, an operational zone and an organizational zone.

12. The system of claim 10, wherein the security policy is at least one of an access policy, a write-permission policy, a resource utilization policy, and an editing permission policy.

13. The system of claim 10, wherein the security policy determines whether a software workload is allowed to operate in a specified security zone.

14. The system of claim 10, further comprising automatically establishing firewall rules across multiple firewalls in multiple security zones for newly deployed applications by tagging application software workloads that are deployed within the security zones.

15. The system of claim 14, wherein the firewalls are of types provided by different vendors and employ at least one of different operating system, communication protocols, and programming languages.

16. The system of claim 10, further comprising automatically removing firewall rules across multiple firewalls in multiple security zones when the firewall rules do not apply to software workloads within the security zones.

17. The system of claim 16, wherein the firewalls are of types provided by different vendors and employ at least one of different operating system, communication protocols, and programming languages.

18. The system of claim 10, further comprising providing an alert when a software workload is planned to be deployed in a security zone in a manner that is inconsistent with at least one of a security zone policy applicable to the security zone and a security policy associated with the workload.