Enforcing runtime policies in a networked computing environment

Patent metadata

Field	Value
Publication number	US-9973539-B2
Application number	US-201615241226-A
Country	US
Kind code	B2
Filing date	Aug 19, 2016
Priority date	Jul 3, 2013
Publication date	May 15, 2018
Grant date	May 15, 2018

Abstract

Embodiments of the present invention provide approaches for enforcing runtime policies in a networked computing environment (e.g., a cloud computing environment). Specifically, in a typical embodiment, computer code and data of an application is annotated with metadata defining a set of runtime policies for executing the computer code and data. Once a request is received to run the application, a set of parameters (e.g., geographic location) corresponding to the execution of the computer code and data of the application is dynamically determined, and compared to the runtime policies. The runtime policies for executing the computer code and data are then enforced at runtime. This includes either running the application, or preventing the running of the application in the case that the set of parameters corresponding to the execution of the computer code and data of the application do not satisfy the runtime policies.

First claim

What is claimed is:

1. A computer-implemented method for enforcing runtime policies relating to execution of computer code and data of an application, in a networked computing environment, comprising:
applying a first annotation to a first portion of computer code, the first annotation being attached during development to the first portion of computer code and comprising metadata defining a set of runtime policies for executing the first portion of computer code and associated data, wherein the runtime policies of the first annotation comprise a geographic location restriction for performing execution of the first portion of the computer code;
applying a second annotation to a second portion of computer code, the second annotation being attached during development to the second portion of computer code and comprising metadata defining a set of runtime policies for executing the second portion of computer code and associated data, wherein the runtime policies of the second annotation comprise a different geographic location restriction for performing execution of the second portion of the computer code;
receiving a request to run an application;
dynamically determining whether a set of parameters satisfy a set of conditions precedent defined in the sets of runtime policies for execution of the computer code and the data of the application; and
enforcing, at a runtime of the application, the set of runtime policies for executing the computer code by running the first portion of the computer code without running the second portion of the computer code based on satisfaction of the first geographic location restriction and non-satisfaction of the second geographic location restriction of the set of conditions precedent.

2. The computer-implemented method of claim 1 , further comprising dynamically determining a set of parameters corresponding to the execution of the computer code and the data of the application.

3. The computer-implemented method of claim 2 , further comprising comparing the set of parameters corresponding to the execution of the computer code and the data of the application with the set of runtime policies.

4. The computer-implemented method of claim 3 , wherein the enforcing is performed based on the comparing.

5. The computer-implemented method of claim 4 , the set of parameters corresponding to the execution of the computer code and data of the application comprising at least one of: time, industry regulations, government regulations, and financial limits on computing power.

6. The computer-implemented method of claim 1 , the networked computing environment comprising a cloud computing environment.

7. The computer-implemented method of claim 1 , further comprising receiving a set of annotations from an annotation library, each annotation of the library capable of operating in the cloud computing environment.

8. A system for enforcing runtime policies relating to execution of computer code and data of an application, in a networked computing environment, comprising:
a memory medium comprising instructions;
a bus coupled to the memory medium; and
a processor coupled to the bus that when executing the instructions causes the system to:
apply a first annotation to a first portion of computer code, the first annotation being attached during development to the first portion of computer code and comprising metadata defining a set of runtime policies for executing the first portion of computer code and associated data, wherein the runtime policies of the first annotation comprise a geographic location restriction for performing execution of the first portion of the computer code;
apply a second annotation to a second portion of computer code, the second annotation being attached during development to the second portion of computer code and comprising metadata defining a set of runtime policies for executing the second portion of computer code and associated data, wherein the runtime policies of the second annotation comprise a different geographic location restriction for performing execution of the second portion of the computer code;
receive a request to run an application;
dynamically determine whether a set of parameters satisfy a set of conditions precedent defined in the sets of runtime policies for execution of the computer code and the data of the application; and
enforce, at a runtime of the application, the set of runtime policies for executing the computer code by running the first portion of the computer code without running the second portion of the computer code based on satisfaction of the first geographic location restriction and non-satisfaction of the second geographic location restriction of the set of conditions precedent.

9. The system of claim 8 , the instructions further causing the system to dynamically determine a set of parameters corresponding to the execution of the computer code and the data of the application.

10. The system of claim 9 , the instructions further causing the system to dynamically compare the set of parameters corresponding to the execution of the computer code and the data of the application with the set of runtime policies.

11. The system of claim 10 , wherein the enforcing is performed based on the comparing.

12. The system of claim 8 , the set of parameters corresponding to the execution of the computer code and data of the application further comprising at least one of: time, industry regulations, government regulations, and financial limits on computing power.

13. The system of claim 8 , the networked computing environment comprising a cloud computing environment.

14. The system of claim 13 , the instructions further causing the system to receive a set of annotations from an annotation library, each annotation of the library capable of operating in the cloud computing environment.

15. A computer program product for enforcing runtime policies relating to execution of computer code and data of an application, in a networked computing environment, the computer program product comprising a computer readable hardware storage device, and program instructions stored on the computer readable hardware storage device, to:
apply a first annotation to a first portion of computer code, the first annotation being attached during development to the first portion of computer code and comprising metadata defining a set of runtime policies for executing the first portion of computer code and associated data, wherein the runtime policies of the first annotation comprise a geographic location restriction for performing execution of the first portion of the computer code;
apply a second annotation to a second portion of computer code, the second annotation being attached during development to the second portion of computer code and comprising metadata defining a set of runtime policies for executing the second portion of computer code and associated data, wherein the runtime policies of the second annotation comprise a different geographic location restriction for performing execution of the second portion of the computer code;
receive a request to run an application;
dynamically determine whether a set of parameters satisfy a set of conditions precedent defined in the sets of runtime policies for execution of the computer code and the data of the application; and
enforce, at a runtime of the application, the set of runtime policies for executing the computer code by running the first portion of the computer code without running the second portion of the computer code based on satisfaction of the first geographic location restriction and non-satisfaction of the second geogr

Assignees

• IBM

Inventors

• Abuelsaad Kelly
• Deluca Lisa Seacat
• Jang Soobaek
• Krook Daniel C

Classifications

• H04L41/5096

  wherein the managed service relates to distributed or central networked applications · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• H04L41/0893

  Assignment of logical groups to network elements · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04W12/08

  Access security · CPC title