Standardization of network management across cloud computing environments and data control policies

Patent metadata

Field	Value
Publication number	US-10708136-B2
Application number	US-201715628322-A
Country	US
Kind code	B2
Filing date	Jun 20, 2017
Priority date	Jun 20, 2017
Publication date	Jul 7, 2020
Grant date	Jul 7, 2020

Abstract

Network management of cloud computing environments subject to different data control policies is standardized in a manner that ensures compliance with the data control policies. Executions services and source of truth services are located in a remote cloud computing environment separate from the cloud computing environments being managed. The execution services implement workflows to manage different aspects of the cloud computing environments, including monitoring, incident management, deployment, and buildout. The source of truth services provide network configuration information for the cloud computing environments to allow automated operation of the execution services. The execution services issue requests for management operations to device access services in the cloud computing environments. In response to the requests, the device access services obtain access control data to access the network devices and perform the management operations.

First claim

What is claimed is:

1. A computerized system comprising:
a plurality of cloud computing environments that are each subject to data control policies to maintain control of restricted data in each cloud computing environment, each cloud computing environment including:
a production environment having a plurality of network devices,
an access control data store storing access control data required to access the network devices in the production environment, and
one or more device access services that interact directly with the network devices to collect data and/or issue commands using the access control data from the access control data store; and
a remote cloud computing environment that is remote from each of the cloud computing environments and does not have persistent access to restricted data in each cloud computing environment, the remote cloud computing environment including:
one or more execution services that implement workflows to manage aspects of each cloud computing environment by issuing requests to the one or more device access services to collect data from and/or issue commands to the network devices in each cloud computing environment, and
one or more source of truth services that collect network configuration information for each cloud computing environment and make the network configuration information available to the one or more execution services.

2. The system of claim 1 , wherein the one or more execution services include a monitoring service that employs at least one of the device access services to obtain telemetry data for the plurality of network devices in each of the cloud computing environments.

3. The system of claim 1 , wherein the one or more execution services include a deployment service that employs at least one of the device access services to deploy software to one or more of the network devices in each of the cloud computing environments.

4. The system of claim 1 , wherein the one or more execution services include a buildout service that employs at least one of the device access services to configure one or more new network devices added to each of the cloud computing environments.

5. The system of claim 1 , wherein the source of truth services include a network graph service that builds a network graph from the network configuration information for each cloud computing environment.

6. The system of claim 1 , wherein the source of truth services include a network state service that hosts information regarding a state of network devices in each cloud computing environment.

7. The system of claim 1 , wherein each cloud computing environment further comprises an access control service that controls external access to each cloud computing environment using claims-based access control.

8. The system of claim 1 , wherein the device access services include an SNMP proxy that obtains telemetry data for network devices in each cloud computing environment using access control data to access the network devices.

9. The system of claim 1 , wherein the device access services include a hardware proxy that issues commands to network devices in each cloud computing environment using access control data to access the network devices.

10. The system of claim 1 , wherein the device access services include a UDP proxy that collects telemetry data pushed from network devices to the UDP proxy and pushes a portion of the telemetry data that does not include restricted data to at least one of the one or more execution services.

11. One or more computer storage media storing computer-useable instructions that, when used by one or more computing devices, cause the one or more computing devices to perform operations comprising:
receiving, at a device access service in a second cloud computing environment, a request for a management action to be performed for a network device in the second cloud computing device, the request being received from an execution service in a first cloud computing environment remote from the second cloud computing environment, the execution service not having access to restricted data in the second cloud computing environment including access control data required to access the network device;
obtaining, by the device access service, the access control data required to access the network device from an access control data store maintained in the second cloud computing environment; and
issuing, by the device access service to the network device, one or more commands to perform the requested management action on the network device using the access control data to access the network device.

12. The one or more computer storage media of claim 11 , wherein the request from the execution service received at the device access service is made via an API.

13. The one or more computer storage media of claim 11 , wherein the request from the execution service received at the device access service includes a claim, which is evaluated by an access control service in the second cloud computing environment to validate the claim.

14. The one or more computer storage media of claim 11 , wherein the request comprises a request for telemetry data for the network device and the device access service comprises an SNMP proxy that obtains the telemetry data from the network device.

15. The one or more computer storage media of claim 11 , wherein the device access service comprises a hardware proxy that performs an operation on the network device in response to the request.

16. A computerized system comprising:
a first cloud computing environment subject to a data control policy to maintain control of restricted data in the first cloud computing environment, the first cloud computing environment including at least one device access service that interacts directly with network devices in the first cloud computing environment using access control data required to access the network devices and maintained within the first cloud computing environment; and
a second cloud computing environment that does not have persistent access to restricted data in the first cloud computing environment, the second cloud computing environment including at least one execution service that does not have access to the access control data including the access control data and that issues requests to the at least one device access service to cause the at least one device access service to perform management actions on the network devices in the first cloud computing environment.

17. The system of claim 16 , wherein the at least one execution service includes one or more selected from the following: a monitoring service that employs the at least one device access service to obtain telemetry data for the network devices in the first cloud computing environment; a deployment service that employs the at least one device access service to deploy software to the network devices in the first cloud computing environment; and a buildout service that employs the at least one device access service to configure at least one new network device added to the first cloud computing environment.

18. The system of claim 16 , wherein the at least one device access service includes one or more selected from the following: an SNMP proxy that obtains telemetry data for the network devices in the first cloud computing environment; a hardware proxy that performs operations on the network devices in the first cloud computing environment; and a UDP proxy that collects telemetry data pushed from the network devices to the UDP proxy.

19. The system of claim 16 , wherein the seco

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Anandam Parvez
• Prasad Ramnath
• Nair Pradeep Ayyappan
• Maltz David
• Greenberg Albert
• Keane Thomas

Classifications

• H04L41/0894

  Policy-based network configuration management · CPC title

• H04L41/0893 Primary

  Assignment of logical groups to network elements · CPC title

• H04L41/0843 Primary

  based on generic templates · CPC title

• H04L41/0213

  Standardised network management protocols, e.g. simple network management protocol [SNMP] · CPC title

• H04L63/0884

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title