Network resource management devices methods and systems
AssigneeRapid7, Inc.
InventorsBrian Johnson, Andrew Mann, Chris Deramus
Life of this patent
Estimating the term…
Abstract
A management process monitors a cloud, such as a hybrid cloud, for utilization policy compliance rather than burdening requesting users. A hybrid cloud system requests an action directly of a cloud interface process that processes the request using a management process or externally, such as directly through a cloud service. Users complying with utilization policies are able directly to implement actions or resource allocations without the burden of policy enforcement processes intervening at a time an action is requested.
Claims20
A method of controlling a configuration of a cloud computing environment that includes a network system and at least one processor to modify the configuration of the cloud computing environment deviating from a utilization policy that specifies at least one security rule for the cloud computing environment, the method comprising:
- receiving a request directly from a user of the cloud computing environment for allocation of an instance of a resource or a modification of an allocated instance of a resource;
- fulfilling the request without intervention for enforcement of the utilization policy in response to the request;
- scheduling a harvest task that obtains on a repeating schedule data that specifies configurations of instances of resources of the network system that is a part of the cloud computing environment;
- receiving first infrastructure status data that specifies configurations of the instances of the resources of the network system in response to an output of the harvest task;
- translating said first infrastructure status data from a first format to a second format that is different from the first format;
- storing the translated first infrastructure status data in the second format in a status database;
- comparing the translated first infrastructure status data stored in said status database with status data in the second format, previously stored in the database;
- detecting a change in the configuration of the network system based on a result of the comparing, the change caused by at least one of the modification of the allocated instance of the network resource and a new instance of a network resource of said network system;
- comparing properties of the at least one of the modified instance of the network resource and said new instance of the network resource against the at least one security rule to detect a deviation from the at least one security rule;
- and
- generating instructions to further modify the at least one of the modified instance of the network resource and the new instance of the network resource so that it satisfies the at least one security rule, or to terminate the at least one of the modified instance of the network resource and the new instance of the network resource responsively to a result of said comparing of the properties.
A non-transitory computer readable medium having stored thereon instructions for a method of controlling a configuration of a cloud computing environment that includes a network system and at least one processor to modify the configuration of the cloud computing environment deviating from a utilization policy that specifies at least one security rule for the cloud computing environment, the method comprising:
- receiving a request directly from a user of the cloud computing environment for allocation of an instance of a resource or a modification of an allocated instance of a resource;
- fulfilling the request without intervention for enforcement of the utilization policy in response to the request;
- scheduling a harvest task that obtains on a repeating schedule for data that specifies configurations of instances of resources of the network system that is a part of the cloud computing environment;
- receiving first infrastructure status data that specifies configurations of the instances of the resources of the network system in response to an output of the harvest task;
- translating said first infrastructure status data from a first format to a second format that is different from the first format;
- storing the translated first infrastructure status data in the second format in a status database;
- comparing the translated first infrastructure status data stored in said status database with status data in the second format, previously stored in the database;
- detecting a change in the configuration of the network system based on a result of the comparing, the change caused by at least one of the modification of the allocated instance of the network resource and a new instance of a network resource of said network system;
- comparing properties of the at least one of the modified instance of the network resource and said new instance of the network resource against the at least one security rule to detect a deviation from the at least one security rule;
- and
- generating instructions to further modify the at least one of the modified instance of the network resource and the new instance of the network resource so that it satisfies the at least one security rule, or to terminate the at least one of the modified instance of the network resource and the new instance of the network resource responsively to a result of said comparing of the properties.
Dependencies are inferred from the claim text.