Policy engine for cloud platform

Patent metadata

Field	Value
Publication number	US-9560079-B1
Application number	US-201514738558-A
Country	US
Kind code	B1
Filing date	Jun 12, 2015
Priority date	Apr 26, 2010
Publication date	Jan 31, 2017
Grant date	Jan 31, 2017

Abstract

A policy engine is situated within the communications path of a cloud computing environment and a user of the cloud computing environment to comply with an organization's policies for deploying web applications in the cloud computing environment. The policy engine intercepts communications packets to the cloud computing environment from a user, such as a web application developer, for example, in preparation for deploying a web application in the cloud computing environment. The policy engine identifies commands corresponding to the communications packets and directs the communications packets to appropriate rules engines corresponding to such commands in order to execute rules to comply with an organization's policies. Upon completion of execution of the rules, the communications packets are forwarded to the cloud computing environment if they comply with the policies.

First claim

We claim:

1. A method comprising:
intercepting, by a policy engine process running on one or more computers associated with an organization, a communications packet that includes a cloud controller command and a command payload for managing a web application belonging to the organization in a cloud computing environment;
determining, by the policy engine process, that a particular set of rules corresponds to the cloud controller command of the intercepted packet and that the intercepted packet does not comply with the particular set of rules, wherein the particular set of rules is one of a plurality of sets of rules, and each set of rules represents a respective policy of the organization and corresponds to a respective cloud controller command;
in response, editing, by the policy engine process, the command payload of the intercepted packet to generate a modified packet that complies with the particular set of rules; and
forwarding, by the policy engine process, the modified packet rather than the intercepted packet to the cloud computing environment.

2. The method of claim 1 , wherein determining that the intercepted packet does not comply with the particular set of rules comprises obtaining policy data from a networked service and determining that the intercepted packet does not comply with the policy data.

3. The method of claim 1 , further comprising:
receiving, by the policy engine process, a response from the cloud computing environment intended for a user device associated with the communications packet;
determining, by the policy engine process, that a second set of rules corresponds to the response received from the cloud computing environment and that the intercepted response complies with the second set of rules, wherein the second set of rules represents a second policy of the organization; and
in response, forwarding, by the policy engine process, the response to the user device.

4. The method of claim 1 , wherein intercepting, by the policy engine process, the communications packet comprises intercepting the communications packet by a policy engine process running on a proxy server at the organization.

5. The method of claim 1 , further comprising:
intercepted, by the policy engine process, a second communications packet that includes a second cloud controller command and a second command payload for managing the web application belonging to the organization in the cloud computing environment;
determining that the second communications packet does not comply with a second set of rules representing a second policy of the organization; and
in response, rejecting the intercepted second communications packet rather than forwarding the second communications packet to the cloud computing environment.

6. The method of claim 1 , wherein the cloud controller command relates to providing configuration information for the web application to a cloud controller in the cloud computing environment, deploying another web application in the cloud computing environment, starting a web application deployed in the cloud computing environment, or stopping a web application executing in the cloud computing environment.

7. The method of claim 1 , further comprising:
receiving authentication credentials for a user on a local authentication system for the organization;
obtaining, by the policy engine process, a federated token for the user; and
including the federal token for the user in the modified packet when forwarding the modified packet to the cloud computing environment.

8. The method of claim 1 , further comprising:
identifying a federated token associated with a user associated with the intercepted communications packet, wherein the determination that the intercepted packet does not comply with the particular set of rules is based on a role of the user associated with the federated token.

9. A system comprising:
one or more computers and one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:
intercepting, by a policy engine process running on one or more computers associated with an organization, a communications packet that includes a cloud controller command and a command payload for managing a web application belonging to the organization in a cloud computing environment;
determining, by the policy engine process, that a particular set of rules corresponds to the cloud controller command of the intercepted packet and that the intercepted packet does not comply with the particular set of rules, wherein the particular set of rules is one of a plurality of sets of rules, and each set of rules represents a respective policy of the organization and corresponds to a respective cloud controller command;
in response, editing, by the policy engine process, the command payload of the intercepted packet to generate a modified packet that complies with the particular set of rules; and
forwarding, by the policy engine process, the modified packet rather than the intercepted packet to the cloud computing environment.

10. The system of claim 9 , wherein determining that the intercepted packet does not comply with the particular set of rules comprises obtaining policy data from a networked service and determining that the intercepted packet does not comply with the policy data.

11. The system of claim 9 , wherein the operations further comprise:
receiving, by the policy engine process, a response from the cloud computing environment intended for a user device associated with the communications packet;
determining, by the policy engine process, that a second set of rules corresponds to the response received from the cloud computing environment and that the intercepted response complies with the second set of rules, wherein the second set of rules represents a second policy of the organization; and
in response, forwarding, by the policy engine process, the response to the user device.

12. The system of claim 9 , wherein intercepting, by the policy engine process, the communications packet comprises intercepting the communications packet by a policy engine process running on a proxy server at the organization.

13. The system of claim 9 , wherein the operations further comprise:
intercepted, by the policy engine process, a second communications packet that includes a second cloud controller command and a second command payload for managing the web application belonging to the organization in the cloud computing environment;
determining that the second communications packet does not comply with a second set of rules representing a second policy of the organization; and
in response, rejecting the intercepted second communications packet rather than forwarding the second communications packet to the cloud computing environment.

14. The system of claim 9 , wherein the cloud controller command relates to providing configuration information for the web application to a cloud controller in the cloud computing environment, deploying another web application in the cloud computing environment, starting a web application deployed in the cloud computing environment, or stopping a web application executing in the cloud computing environment.

15. The system of claim 9 , wherein the operations further comprise:
receiving authentication credentials for a user on a local authentication system for the organization;
obtaining, by the policy engine process, a federated token for the user; and
including the federal token for the user in the modified packet when forwarding the modified packet to the c

Assignees

• Pivotal Software Inc

Inventors

• Lucovsky Mark
• Collison Derek
• Spivak Vadim
• Chen Gerald C
• Laddad Ramnivas

Classifications

• H04L41/0895

  Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements · CPC title

• H04L41/0894

  Policy-based network configuration management · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/0245 Primary

  Filtering by information in the payload · CPC title