# US 12,182,630 B2 · Policy constraint framework for an SDDC

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,182,630 B2
- Document ID: US12182630B2
- Status: Granted
- Kind: B2
- Application number: 18/227,306
- Filed: 2023-07-28
- Published: 2023-11-16
- Granted: 2024-12-31
- Earliest claimed: 2018-06-15
- Assignees: VMware, Inc.
- Applicants: VMware LLC
- Inventors: Amarnath Palavalli; Sachin Mohan Vaidya; Pavlush Margarian
- Web page: https://patentgrep.com/patent/US12182630B2

## CPC

- G06Q 99/00: Subject matter not provided for in other groups of this subclass
- G06F 9/5011: {the resources being hardware resources other than CPUs, Servers and Terminals}
- G06F 9/5055: {considering software capabilities, i.e. software resources associated or available to the machine}
- G06F 9/5077: {Logical partitioning of resources; Management or configuration of virtualized resources (specific details on emulation or internal functioning of virtual machines G06F9/455)}
- H04L 41/0816: the condition being an adaptation, e.g. in response to network events
- H04L 63/0263: {Rule management}
- H04L 63/101: {Access control lists [ACL]}
- H04L 67/1076: {Resource dissemination mechanisms or network resource keeping policies for optimal resource availability in the overlay network}
- H04L 67/1089: {Hierarchical topologies}
- H04L 67/60: Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources (admission control or resource allocation H04L47/70)
- H04L 67/63: Routing a service request depending on the request content or context
- G06F 21/105: {Arrangements for software license management or administration, e.g. for managing licenses at corporate level}
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- G06F 2209/506: Constraint
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Some embodiments of the invention provide a method for processing requests for performing operations on resources in a software defined datacenter (SDDC). The resources are software-defined (SD) resources in some embodiments. The method initially receives a request to perform an operation with respect to a first resource in the SDDC. The method identifies a policy that matches (i.e., is applicable to) the received request for the first resource by comparing a set of attributes of the request with sets of attributes of a set of policies that place constraints on operations specified for resources. In some embodiments, several sets of attributes for several policies can be expressed for resources at different hierarchal resource levels of the SDDC. The method rejects the received request when the identified policy specifies that the requested operation violates a constraint on operations specified for the first resource.

## Claims

### Claim 1

A method of processing requests for performing an operation on a first resource in a plurality of resources arranged in a particular hierarchy of resources of a datacenter, the method comprising:
receiving a request to perform an operation with respect to the first resource in the plurality of resources arranged in the particular hierarchy of resources of the datacenter, said first resource being a parent resource of a child second resource in the hierarchy;
identifying a policy applicable to the received request by comparing a set of attributes of the request with sets of attributes associated with a set of policies that are stored in a policy storage and that place constraints on operations specified for the plurality of resources, wherein a plurality of sets of attributes associated with a plurality of policies that are stored in the policy storage are attributes of a set of resources at different resource levels in the hierarchy; and
rejecting the received request when the identified policy specifies that the requested operation violates a constraint on operations specified for the first resource.

### Claim 2 (depends on 1)

The method of claim 1, wherein the policies in the set of policies that are stored in a policy storage are defined in a declarative format.

### Claim 3 (depends on 1)

The method of claim 1, wherein the plurality of policies include a first policy stored in the policy storage and defined by reference to a first attribute associated with the first resource and a second policy stored in the policy storage and defined by reference to a second attribute associated with the second resource.

### Claim 4 (depends on 1)

The method of claim 1 further comprising:
receiving a plurality of policies before receiving the request,
each policy comprising:
a target that specifies a set of one or more datacenter resources to which the policy applies, and
an expression that specifies a constraint on operations on the specified resource set; and
storing the received policies in the policy storage that is checked while processing requests for operations associated with the plurality of resources.

### Claim 5 (depends on 4)

The method of claim 4, wherein the target of each policy comprises:
a resource type for the specified resource set, and
a path prefix that identifies the specified resource set in the resource hierarchy of the datacenter.

### Claim 6 (depends on 5)

The method of claim 5, wherein a first path prefix of a first target of a first policy stored in the policy storage is defined for a first parent resource, and specifies an applicability of the first policy to the first parent resource and a first child resource that is a child resource of the first parent resource in the hierarchical resource level.

### Claim 7 (depends on 4)

The method of claim 4, wherein a plurality of expressions for a set of received policies comprises at least one of:
a value constraint that restricts a value of an attribute of a resource that is a target of the policy, and
an entity instance count constraint that restricts number of instances of the target resource.

### Claim 8 (depends on 7)

The method of claim 7, wherein the value constraint includes an operator that is one of an include operator, an exclude operator or an equal operator.

### Claim 9 (depends on 4)

The method of claim 4, wherein a plurality of expressions for a set of received policies comprises:
a value constraint that restricts a value of a first attribute of a resource that is a target of the policy, and
a related attribute constraint that restricts a value of a second attribute of the target resource.

### Claim 10

A non-transitory machine readable medium storing a program for processing requests for performing operations on resources in a datacenter, the program comprising sets of instructions for:
receiving a request to perform an operation with respect to a first resource in a datacenter;
identifying a policy applicable to the received request by comparing a set of attributes of the request with sets of attributes associated with a set of policies that place constraints on operations specified for the resources, wherein a plurality of sets of attributes associated with a plurality of policies are attributes of resources at different hierarchal resource levels in the datacenter, wherein the first resource is a child of a second resource, and the identified policy is specified for the second resource and is identified by matching the set of attributes of the request to a set of attributes associated with the second resource; and
rejecting the received request when the identified policy specifies that the requested operation violates a constraint on operations specified for the second resource.

### Claim 11

A non-transitory machine readable medium storing a program for processing requests for performing operations on resources in a datacenter, the program comprising sets of instructions for:
receiving a request to perform an operation with respect to a first resource in a datacenter;
identifying a policy applicable to the received request by comparing a set of attributes of the request with sets of attributes associated with a set of policies that are stored in a policy storage and that place constraints on operations specified for the resources, wherein a plurality of sets of attributes associated with a plurality of policies are attributes of resources at different hierarchal resource levels in the datacenter; and
rejecting the received request when the identified policy specifies that the requested operation violates a constraint on operations specified for the first resource;
wherein the first resource is a child of a second resource, and the identified policy is specified for the second resource.

### Claim 12 (depends on 11)

The non-transitory machine readable medium of claim 11, wherein the program further comprises sets of instructions for:
receiving a plurality of policies before receiving the request,
each policy comprising:
a target that specifies a set of one or more datacenter resources to which the policy applies, and
an expression that specifies a constraint on operations on the specified resource set; and
storing the received policies in the policy storage that is checked while processing requests for operations associated with the resources.

### Claim 13 (depends on 12)

The non-transitory machine readable medium of claim 12, wherein the target of each policy comprises:
a resource type for the specified resource set, and
a path prefix that identifies the specified resource set in the resource hierarchy of the datacenter.

### Claim 14 (depends on 12)

The non-transitory machine readable medium of claim 12, wherein a plurality of expressions for a set of received policies comprises at least one of:
a value constraint that restricts a value of an attribute of a resource that is a target of the policy, and
an entity instance count constraint that restricts number of instances of the target resource.

### Claim 15 (depends on 12)

The non-transitory machine readable medium of claim 12, wherein a plurality of expressions for a set of received policies comprises:
a value constraint that restricts a value of a first attribute of a resource that is a target of the policy, and
a related attribute constraint that restricts a value of a second attribute of the target resource.

### Claim 16 (depends on 11)

The non-transitory machine readable medium of claim 11, wherein the first resource is at a particular level in the hierarchy, wherein comparing the attribute sets comprises comparing the request's set of attributes with attribute sets of policies specified for resources defined at the particular level in the hierarchy and resources defined at a level higher than the particular level in the resource hierarchy in the datacenter.

### Claim 17 (depends on 11)

The non-transitory machine readable medium of claim 11, wherein the received request is a request to create or modify a forwarding rule for forwarding data messages, a request to create or modify a service rule for performing service operation on a data message, or a request to deploy or modify a machine or network element in the datacenter.

### Claim 18 (depends on 11)

The non-transitory machine readable medium of claim 11, wherein the program is a policy framework,
each policy specifies a resource type that identifies a type of resource to which the policy applies,
an inclusion of the resource type in the policy allowing new resource types to be added to the policy framework without reprogramming the policy framework.

### Claim 19 (depends on 11)

The non-transitory machine readable medium of claim 11, wherein the set of instructions for identifying the policy comprises sets of instructions for:
identifying all policies that are applicable to the received request, and
determining whether the received request satisfies all policies specified in each identified policy,
the program further comprising a set of instructions for rejecting the received request when the request does not satisfy the policy specified by any of the identified policies.