Application centric compliance management system and method for a multi-level computing environment

Patent metadata

Field	Value
Publication number	US-9854002-B1
Application number	US-201414580574-A
Country	US
Kind code	B1
Filing date	Dec 23, 2014
Priority date	Dec 23, 2014
Publication date	Dec 26, 2017
Grant date	Dec 26, 2017

Abstract

An application centric compliance management system includes a computing system that executes a tool to identify a subset of a the resources of a multi-tier computing environment that are used to execute an application, and for each identified resource, obtain one or more application-based compliance policies associated with the application. The tool may then determine whether the resource meets each application-based compliance policy, and when the resource does not meet the application-based compliance policy, generate an alarm that includes information associated with the one unmet application-based compliance policy.

First claim

What is claimed is:

1. An application centric compliance management method comprising:
receiving, using instructions stored in a non-transitory computer-readable medium and executed on at least one processor, a notification message indicating that one or more of a plurality of resources of a multi-tier computing environment has changed, wherein the plurality of resources are being used to execute an application;
for each of the plurality of resources, obtaining, using the instructions that are executed by the at least one processor, a service chain policy associated with the application, the service chain policy specifying that a first of the o plurality of resources is restricted to interaction with a second of the o plurality of resources in a second tier of the multi-tier computing environment, the first resource configured in a first tier of the multi-tier computing environment;
determining, using the instructions that are executed by the at least one processor, whether the first resource meets the service chain policy, wherein the determination is performed each time the notification message is received; and
when the first resource does not meet the service chain policy, performing, using the instructions that are executed by the at least one processor, one or more remedial actions to make the first resource compliant with the unmet service chain policy.

2. The application centric compliance management method of claim 1 , wherein the remedial actions comprising at least one of generating a report of a status of the first resource, closing an unauthorized port, opening an authorized port, breaking a communication link that is restricted between the first resource and a second resource, and establishing a communication link between the first and second resources that are supposed to be connected.

3. The application centric compliance management method of claim 1 , further comprising identifying the one or more resources using an operations management application.

4. The application centric compliance management method of claim 1 , further comprising determining whether the one or more resources meet the application-based compliance policies using a compliance checking tool.

5. The application centric compliance management method of claim 1 , further comprising obtaining the service chain policy in a compliance verification file, the compliance verification file conforming to an extensible configuration checklist description format (XCCDF) specification.

6. The application centric compliance management method of claim 5 , further comprising updating the compliance verification file each time the first resource associated with the application changes in real-time.

7. The application centric compliance management method of claim 5 , further comprising updating the compliance verification file at a request of at least one of a human operator or another compute process.

8. The application centric compliance management method of claim 1 , further comprising obtaining the service chain policy from an application definition file stored in the non-transitory computer-readable medium, the application definition file uniquely associated with the application.

9. The application centric compliance management method of claim 1 , further comprising obtaining one or more application-based compliance policies comprising at least one of a service that is expected to be running, a service that is not expected to be running, ports that are expected to be open in the first resource, ports that are expected to be closed in the first resource, acceptable end-points for each network interface of the first resource, an affinity for each resource, and a business continuity and disaster recovery (BCDR) policy for each data store attached to the first resource.

10. An application centric compliance management system comprising:
a computing system comprising at least one processor and at least one memory to store instructions that are executed by the at least one processor to:
receive a notification message indicating that one or more of a plurality of resources of a multi-tier computing environment has changed, wherein the plurality of resources are being used to execute an application;
for each of the plurality of resources, obtain a service chain policy associated with the application, the service chain policy specifying that a first of the plurality of resources is restricted to interaction with a second of the plurality of resources in a second tier of the multi-tier computing environment, the first resource configured in a first tier of the multi-tier computing environment;
determine whether the first resource meets the service chain policy, wherein the determination is performed each time the notification message is received; and
when the first resource does not meet the service chain policy, perform one or more remedial actions to make the first resource compliant with the unmet service chain policy.

11. The application centric compliance management system of claim 10 ,
the remedial actions comprising at least one of generating a report of a status of the first resource, closing an unauthorized port, opening an authorized port, breaking a communication link that is restricted between the first resource and a second resource, and establishing a communication link between the first and second resources that are supposed to be connected.

12. The application centric compliance management system of claim 10 , wherein the tool identifies the one or more resources using an operations management application.

13. The application centric compliance management system of claim 10 , wherein the tool determines whether the first resource meets the application-based compliance policies using a compliance checking tool.

14. The application centric compliance management system of claim 13 , wherein the tool stores the obtained service chain policy in a compliance verification file, the compliance verification file conforming to an extensible configuration checklist description format (XCCDF) specification.

15. The application centric compliance management system of claim 13 , wherein the tool monitors the multi-tier computing environment and updates the compliance verification file each time the first resource associated with the application changes in real-time.

16. The application centric compliance management system of claim 10 , wherein the tool updates the compliance verification file at periodic intervals.

17. The application centric compliance management system of claim 10 , wherein the tool obtains the service chain policy from an application definition file stored in the memory, the application definition file uniquely associated with the application.

18. The application centric compliance management system of claim 10 , further comprising obtaining one or more application-based compliance policies comprising at least one of a service that is expected to be running, a service that is not expected to be running, ports that are expected to be open in the first resource, ports that are expected to be closed in the first resource, acceptable end-points for each network interface of the first resource, an affinity for each resource, and a business continuity and disaster recovery (BCDR) policy for each data store attached to the first resource.

19. Code implemented in a non-transitory, computer readable medium that when executed by at least one processor, is operable to perform at least the following:
receiving a notification message indicating that one or more of a plura

Assignees

• Vce Co Llc
• VCE Holding Company LLC

Inventors

• Streete Jonathan P
• Hansen Nicholas A
• Dolinsky Todd
• Davis Christopher M

Classifications

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title