Policy engine for cloud platform

Patent metadata

Field	Value
Publication number	US-9942277-B2
Application number	US-201715419992-A
Country	US
Kind code	B2
Filing date	Jan 30, 2017
Priority date	Apr 26, 2010
Publication date	Apr 10, 2018
Grant date	Apr 10, 2018

Abstract

A policy engine is situated within the communications path of a cloud computing environment and a user of the cloud computing environment to comply with an organization's policies for deploying web applications in the cloud computing environment. The policy engine intercepts communications packets to the cloud computing environment from a user, such as a web application developer, for example, in preparation for deploying a web application in the cloud computing environment. The policy engine identifies commands corresponding to the communications packets and directs the communications packets to appropriate rules engines corresponding to such commands in order to execute rules to comply with an organization's policies. Upon completion of execution of the rules, the communications packets are forwarded to the cloud computing environment if they comply with the policies.

First claim

We claim:

1. A method comprising:
intercepting, by a response dispatcher of a policy engine running on one or more computers of a cloud computing environment, a response to a command, the response being sent by a cloud controller device of the cloud computing environment to a user device that issued the command;
dispatching, by the response dispatcher, the response to a response rules engine corresponding to the command;
executing, by the response rules engine, a set of one or more rules representing a response policy on how to deploy a web application in the cloud computing environment; and
forwarding the response to the user device in response to determining that a result of execution of the set of one or more rules by the response rules engine indicates compliance of the response with the response policy.

2. The method of claim 1 , wherein the policy engine comprises a plurality of response rules engines, each of the response rules engines correspond to a respective command.

3. The method of claim 1 , wherein the command is a command for creating or managing a deployment of the web application in the cloud computing environment through the cloud controller device.

4. The method of claim 3 , wherein command relates to providing configuration information for the web application to a cloud controller in the cloud computing environment, deploying another web application in the cloud computing environment, starting a web application deployed in the cloud computing environment, or stopping a web application executing in the cloud computing environment.

5. The method of claim 1 , wherein each rule of the rules specifies at least one of a permitted accessible service of the web application or a computing resource consumption limitation on the web application.

6. A system comprising:
one or more computers; and
one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:
intercepting, by a response dispatcher of a policy engine running on the one or more computers of a cloud computing environment, a response to a command, the response being sent by a cloud controller device of the cloud computing environment to a user device that issued the command;
dispatching, by the response dispatcher, the response to a response rules engine corresponding to the command;
executing, by the response rules engine, a set of one or more rules representing a response policy on how to deploy a web application in the cloud computing environment; and
forwarding the response to the user device in response to determining that a result of execution of the set of one or more rules by the response rules engine indicates compliance of the response with the response policy.

7. The system of claim 6 , wherein the policy engine comprises a plurality of response rules engines, each of the response rules engines correspond to a respective command.

8. The system of claim 6 , wherein the command is a command for creating or managing a deployment of the web application in the cloud computing environment through the cloud controller device.

9. The system of claim 8 , wherein command relates to providing configuration information for the web application to a cloud controller in the cloud computing environment, deploying another web application in the cloud computing environment, starting a web application deployed in the cloud computing environment, or stopping a web application executing in the cloud computing environment.

10. The system of claim 6 , wherein each rule of the rules specifies at least one of a permitted accessible service of the web application or a computing resource consumption limitation on the web application.

11. A non-transitory computer storage device storing instructions that, when executed by one or more computers, cause the one or more computers to perform operations comprising:
intercepting, by a response dispatcher of a policy engine running on the one or more computers of a cloud computing environment, a response to a command, the response being sent by a cloud controller device of the cloud computing environment to a user device that issued the command;
dispatching, by the response dispatcher, the response to a response rules engine corresponding to the command;
executing, by the response rules engine, a set of one or more rules representing a response policy on how to deploy a web application in the cloud computing environment; and
forwarding the response to the user device in response to determining that a result of execution of the set of one or more rules by the response rules engine indicates compliance of the response with the response policy.

12. The non-transitory computer storage device of claim 11 , wherein the policy engine comprises a plurality of response rules engines, each of the response rules engines correspond to a respective command.

13. The non-transitory computer storage device of claim 11 , wherein the command is a command for creating or managing a deployment of the web application in the cloud computing environment through the cloud controller device.

14. The non-transitory computer storage device of claim 13 , wherein command relates to providing configuration information for the web application to a cloud controller in the cloud computing environment, deploying another web application in the cloud computing environment, starting a web application deployed in the cloud computing environment, or stopping a web application executing in the cloud computing environment.

15. The non-transitory computer storage device of claim 11 , wherein each rule of the rules specifies at least one of a permitted accessible service of the web application or a computing resource consumption limitation on the web application.

Assignees

• Pivotal Software Inc

Inventors

• Lucovsky Mark
• Collison Derek
• Spivak Vadim
• Chen Gerald C
• Laddad Ramnivas

Classifications

• H04L41/0895

  Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements · CPC title

• H04L41/0894

  Policy-based network configuration management · CPC title

• H04L63/0815

  providing single-sign-on or federations · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/0245 Primary

  Filtering by information in the payload · CPC title