Policy engine for cloud platform

• US 9,942,277 B2
• Filed: 01/30/2017
• Issued: 04/10/2018
• Est. Priority Date: 04/26/2010
• Status: Active Grant

• Current Assignee: Pivotal Software, Inc. (Broadcom, Inc.)
• Original Assignee: Pivotal Software, Inc. (Broadcom, Inc.)
• Inventors: Lucovsky, Mark, Collison, Derek, Spivak, Vadim, Chen, Gerald C., Laddad, Ramnivas
• Primary Examiner(s): Lee, Jason T
• Application Number:
  US15/419,992
• Publication Number:
  US 20170208096A1
• Time in Patent Office: 435 Days
• Field of Search: 726 7
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A policy engine is situated within the communications path of a cloud computing environment and a user of the cloud computing environment to comply with an organization'"'"'s policies for deploying web applications in the cloud computing environment. The policy engine intercepts communications packets to the cloud computing environment from a user, such as a web application developer, for example, in preparation for deploying a web application in the cloud computing environment. The policy engine identifies commands corresponding to the communications packets and directs the communications packets to appropriate rules engines corresponding to such commands in order to execute rules to comply with an organization'"'"'s policies. Upon completion of execution of the rules, the communications packets are forwarded to the cloud computing environment if they comply with the policies.

Claims

1. A method comprising:

intercepting, by a response dispatcher of a policy engine running on one or more computers of a cloud computing environment, a response to a command, the response being sent by a cloud controller device of the cloud computing environment to a user device that issued the command;

dispatching, by the response dispatcher, the response to a response rules engine corresponding to the command;

executing, by the response rules engine, a set of one or more rules representing a response policy on how to deploy a web application in the cloud computing environment; and

forwarding the response to the user device in response to determining that a result of execution of the set of one or more rules by the response rules engine indicates compliance of the response with the response policy.

2. The method of claim 1, wherein the policy engine comprises a plurality of response rules engines, each of the response rules engines correspond to a respective command.

3. The method of claim 1, wherein the command is a command for creating or managing a deployment of the web application in the cloud computing environment through the cloud controller device.

4. The method of claim 3, wherein command relates to providing configuration information for the web application to a cloud controller in the cloud computing environment, deploying another web application in the cloud computing environment, starting a web application deployed in the cloud computing environment, or stopping a web application executing in the cloud computing environment.

5. The method of claim 1, wherein each rule of the rules specifies at least one of a permitted accessible service of the web application or a computing resource consumption limitation on the web application.

6. A system comprising:

one or more computers; and

one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising;

intercepting, by a response dispatcher of a policy engine running on the one or more computers of a cloud computing environment, a response to a command, the response being sent by a cloud controller device of the cloud computing environment to a user device that issued the command;

dispatching, by the response dispatcher, the response to a response rules engine corresponding to the command;

executing, by the response rules engine, a set of one or more rules representing a response policy on how to deploy a web application in the cloud computing environment; and

forwarding the response to the user device in response to determining that a result of execution of the set of one or more rules by the response rules engine indicates compliance of the response with the response policy.

7. The system of claim 6, wherein the policy engine comprises a plurality of response rules engines, each of the response rules engines correspond to a respective command.

8. The system of claim 6, wherein the command is a command for creating or managing a deployment of the web application in the cloud computing environment through the cloud controller device.

9. The system of claim 8, wherein command relates to providing configuration information for the web application to a cloud controller in the cloud computing environment, deploying another web application in the cloud computing environment, starting a web application deployed in the cloud computing environment, or stopping a web application executing in the cloud computing environment.

10. The system of claim 6, wherein each rule of the rules specifies at least one of a permitted accessible service of the web application or a computing resource consumption limitation on the web application.

11. A non-transitory computer storage device storing instructions that, when executed by one or more computers, cause the one or more computers to perform operations comprising:

intercepting, by a response dispatcher of a policy engine running on the one or more computers of a cloud computing environment, a response to a command, the response being sent by a cloud controller device of the cloud computing environment to a user device that issued the command;

dispatching, by the response dispatcher, the response to a response rules engine corresponding to the command;

executing, by the response rules engine, a set of one or more rules representing a response policy on how to deploy a web application in the cloud computing environment; and

forwarding the response to the user device in response to determining that a result of execution of the set of one or more rules by the response rules engine indicates compliance of the response with the response policy.

12. The non-transitory computer storage device of claim 11, wherein the policy engine comprises a plurality of response rules engines, each of the response rules engines correspond to a respective command.

13. The non-transitory computer storage device of claim 11, wherein the command is a command for creating or managing a deployment of the web application in the cloud computing environment through the cloud controller device.

14. The non-transitory computer storage device of claim 13, wherein command relates to providing configuration information for the web application to a cloud controller in the cloud computing environment, deploying another web application in the cloud computing environment, starting a web application deployed in the cloud computing environment, or stopping a web application executing in the cloud computing environment.

15. The non-transitory computer storage device of claim 11, wherein each rule of the rules specifies at least one of a permitted accessible service of the web application or a computing resource consumption limitation on the web application.