Quarantine for cloud-based services

Patent metadata

Field	Value
Publication number	US-12432176-B2
Application number	US-202318297962-A
Country	US
Kind code	B2
Filing date	Apr 10, 2023
Priority date	Dec 6, 2019
Publication date	Sep 30, 2025
Grant date	Sep 30, 2025

Abstract

A quarantine system could be disposed between an outer firewall and an inner firewall. The quarantine system may include persistent storage containing mappings between computing devices disposed within the inner firewall and data sources disposed outside the outer firewall. The quarantine system may include one or more processors configured to perform operations that include requesting and receiving, based on the mappings, a software-related update from a data source, the software-related update being targeted for deployment on the computing devices. The operations may also include assigning the software-related update for review by a group of one or more agents authorized to approve or reject the software-related update. The operations may also receiving an indication that the software-related update has been approved by the one or more agents and, responsive to receiving the indication, transmitting, based on the mappings, the software-related update to a recipient device within the inner firewall.

First claim

What is claimed is:

1. A quarantine system comprising:
one or more processors disposed between an outer firewall and an inner firewall of a same cloud network, wherein the inner firewall is disposed behind the outer firewall; and
a memory storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
requesting a software-related update from a data source disposed outside the outer firewall, wherein the software-related update is targeted for deployment on one or more computing devices disposed behind the outer firewall and the inner firewall;
pulling the software-related update from the data source disposed outside the outer firewall into a quarantine zone of the quarantine system that is positioned behind the outer firewall and outside of the inner firewall; and
assigning the software-related update for review by one or more agents authorized to approve or reject the software-related update, wherein an approval of the software-related update enables the software-related update to be pushed from the quarantine zone disposed behind the outer firewall and outside of the inner firewall through the inner firewall to the one or more computing devices disposed behind the inner firewall.

2. The quarantine system of claim 1 , wherein the outer firewall is configured to restrict one or more updates that have not been requested by the quarantine system from being transmitted through the outer firewall to the quarantine zone of the quarantine system.

3. The quarantine system of claim 1 , wherein the inner firewall is configured to:
restrict one or more first updates that have not been requested by the quarantine system from being transmitted to the one or more computing devices disposed behind the outer firewall and the inner firewall; and
permit one or more second updates that have been requested by the quarantine system and approved by the one or more agents to be transmitted to the one or more computing devices.

4. The quarantine system of claim 1 , wherein the one or more agents are disposed within the quarantine zone positioned between the outer firewall and the inner firewall.

5. The quarantine system of claim 1 , wherein the operations comprise:
storing the software-related update in a queue of the quarantine zone for approval or rejection by the one or more agents, wherein the queue comprises a plurality of software-related updates; and
assigning one or more software-related updates from the queue for approval or rejection by the one or more agents based on a priority order, wherein the priority order is based on a destination of each software-related update of the plurality of software-related updates, a source of each software-related update of the plurality of software-related updates, a type of each software-related update of the plurality of software-related updates, or an urgency of each software-related update of the plurality of software-related updates, or any combination thereof.

6. The quarantine system of claim 1 , wherein the operations comprise:
storing the software-related update in a queue of the quarantine zone for approval or rejection by the one or more agents, wherein the queue comprises a plurality of software-related updates; and
deleting one or more software-related updates from the queue after a pre-determined period of time has elapsed since storing the one or more software-related updates in the queue, wherein the pre-determined period of time is based on a destination of each software-related update of the plurality of software-related updates, a source of each software-related update of the plurality of software-related updates, a type of each software-related update of the plurality of software-related updates, a caching policy of the quarantine system, or receiving a newer version of at least one software-related update of the plurality of software-related updates, or any combination thereof.

7. The quarantine system of claim 1 , wherein the operations comprise:
receiving an indication of a rejection of the software-related update by the one or more agents;
providing a notification indicative of the rejection of the software-related update in response to receiving the indication of the rejection of the software-related update; and
restricting the software-related update from being transmitted through the inner firewall to the one or more computing devices based on the rejection.

8. The quarantine system of claim 1 , wherein the operations comprise:
receiving an indication of a rejection of the software-related update by the one or more agents; and
isolating one or more additional software-related updates associated with the software-related update from being assigned to the one or more agents in response to receiving the indication of the rejection of the software-related update.

9. The quarantine system of claim 1 , wherein the inner firewall is configured to restrict the software-related update that has been pulled through the outer firewall and into the quarantine zone from being pushed across the inner firewall to the one or more computing devices disposed behind the inner firewall until the approval is received.

10. A method, comprising:
requesting, by one or more processors of a quarantine system disposed between an inner firewall and an outer firewall of a same cloud network, a software-related update from a data source disposed outside the outer firewall, wherein the inner firewall is disposed behind the outer firewall, and wherein the software-related update is targeted for deployment on one or more computing resources disposed behind the outer firewall and the inner firewall;
pulling, by the one or more processors of the quarantine system, the software-related update from the data source disposed outside the outer firewall into a quarantine zone of the quarantine system, wherein the quarantine zone is disposed between the outer firewall and the inner firewall; and
assigning, by the one or more processors of the quarantine system, the software-related update for review by one or more agents authorized to approve or reject the software-related update, wherein the inner firewall is configured to restrict the software-related update that has been pulled through the outer firewall from being pushed from the quarantine zone through the inner firewall to the one or more computing resources until an approval of the software-related update is received.

11. The method of claim 10 , comprising providing a representation of a graphical user interface (GUI) configured to provide information associated with the software-related update for viewing by the one or more agents.

12. The method of claim 11 , wherein the GUI is configured to provide a comparison of content of the software-related update and additional content installed on a computing resource of the one or more computing resources, or a dependency tree indicative of connections between the one or more computing resources, or both.

13. The method of claim 10 , comprising:
storing, by the one or more processors of the quarantine system, the software-related update in a queue of the quarantine zone for approval or rejection by the one or more agents, wherein the queue comprises a plurality of software-related updates;
assigning, by the one or more processors of the quarantine system, one or more software-related updates from the queue for approval or rejection by the one or more agents based on a priority order, wherein the priority order is based on a plurality of factors comprising a destination of each software-related update of the plurality of software-related updates, a source of

Assignees

• Servicenow Inc

Inventors

• Chan Antony

Classifications

• H04L41/12

  Discovery or management of network topologies · CPC title

• H04L41/0895

  Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements · CPC title

• H04L41/40

  using virtualisation of network functions or resources, e.g. SDN or NFV entities · CPC title

• H04L67/75

  Indicating network or usage conditions on the user display · CPC title

• H04L41/28

  Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration · CPC title