Hybrid cloud applications

As disclosed herein a method, executed by a computer, for enabling a hybrid cloud environment includes receiving, on a cloud environment, a hybrid cloud application package comprising a deployable cloud package and a deployable on-premise package, and deploying the deployable cloud package in a container on the cloud environment, providing a cloud application. The method further includes establishing a secure bi-directional communication tunnel between the cloud environment and an on-premise environment, thereby masking network connection information, and sending, with the secure bi-directional messaging framework, the deployable on-premise package to an on-premise server in the on-premise environment. The method further includes sending a message, with the secure bi-directional messaging framework, requesting services from an on-premise application, and receiving a response from the on-premise application. A computer program product corresponding to the above method is also disclosed herein.

BACKGROUND

The present invention relates to cloud applications, and more particularly to hybrid cloud applications.

A hybrid cloud environment is a cloud computing environment that may use a mix of on-premise (e.g., private cloud) services and public cloud services. The hybrid cloud may allow workload execution to move between private and public clouds as required by computing needs. For applications to successfully execute in the hybrid cloud environment, there must be an orchestration between the two platforms. By allowing workloads to move between private and public clouds as computing needs and costs change, hybrid cloud gives businesses greater flexibility and more data deployment options. Hybrid cloud is particularly valuable for dynamic or highly changeable workloads.

Services in a hybrid cloud environment may consist of a portion of an application specifically developed for and deployed in a public cloud environment. Additionally, there may be a portion of the application that is developed for and deployed on a specific on-premise environment. Once deployed, the cloud and on-premise services may communicate and work seamlessly together.

SUMMARY

As disclosed herein a method, executed by a computer, for enabling a hybrid cloud environment includes receiving, on a cloud environment, a hybrid cloud application package comprising a deployable cloud package and a deployable on-premise package, and deploying the deployable cloud package in a container on the cloud environment, providing a cloud application. The method further includes establishing a secure bi-directional communication tunnel between the cloud environment and an on-premise environment, thereby masking network connection information, and sending, with the secure bi-directional messaging framework, the deployable on-premise package to an on-premise server in the on-premise environment. The method further includes sending a message, with the secure bi-directional messaging framework, requesting services from an on-premise application, and receiving a response from the on-premise application.

As disclosed herein a method, executed by a computer, for enabling a hybrid cloud environment includes receiving, with a secure bi-directional messaging framework, a deployable on-premise package corresponding to a hybrid cloud application, deploying, in a container, on an on-premise server, the deployable on-premise package, providing an on-premise application, and using a secure bi-directional communication tunnel between the cloud environment and an on-premise environment to establish a messaging framework. The method further includes running the on-premise application on a restricted container environment, receiving, from a cloud application, with the secure bi-directional messaging framework, a message comprising requested services, and sending, with the secure bi-directional messaging framework, a response corresponding to the requested services.

As disclosed herein a computer program product, for enabling a hybrid cloud environment. The computer program product includes one or more computer readable storage media and program instructions stored on the one or more computer readable storage media. The program instructions include instructions for receiving, on a cloud environment, a hybrid cloud application package comprising a deployable cloud package and a deployable on-premise package, and deploying the deployable cloud package in a container on the cloud environment, providing a cloud application. The program instruction further include instructions for establishing a secure bi-directional communication tunnel between the cloud environment and an on-premise environment, thereby masking network connection information, and sending, with the secure bi-directional messaging framework, the deployable on-premise package to an on-premise server in the on-premise environment. The program instruction further include instructions for sending a message, with the secure bi-directional messaging framework, requesting services from an on-premise application, and receiving a response from the on-premise application.

DETAILED DESCRIPTION

In today's highly computerized world, the daily operation of corporations, as well as the activities of individuals are highly dependent on computers. Corporations rely on computers and computer applications to operate their business and to provide services to their customers. Many corporations use cloud computing practices to offer online services to their customers. The cloud may be a network of remote servers accessible via the internet (as opposed to a local, corporate owned resources) to store, manage, and process data

Use of the cloud offers many advantages, such as streamlined and improved accessibility, as well as reduced capital and infrastructure costs. Even though a corporation may offer services via the cloud, the corporation may prefer to keep its confidential data on-premise due to security and privacy concerns. This may be especially true for companies, such as banking and insurance companies, that treat the customer's data as highly confidential.

Companies that offer services (e.g., web services) via the cloud and maintain data on-premise may encounter the need for the cloud services and on-premise services to communicate and work together. A cloud computing environment which uses a mix of cloud services and on-premise services is known as a hybrid cloud. The hybrid cloud architecture is an environment enabling applications deployed on the cloud to work seamlessly with applications deployed on an on-premise system. In a hybrid cloud environment, there is a need to have a secure, bi-directional connection between the cloud and the on-premise network enabling protected communication.

In addition to networking concerns, developers of hybrid applications (i.e., applications running in a hybrid environment) must also be conscious of programming model and security concerns. In many instances, the cloud application and the on-premise application are developed by different developers, resulting in programming, security, and installation differences. The embodiments disclosed herein generally address the above-described problems.

The present invention will now be described in detail with reference to the Figures.FIG. 1is a functional block diagram depicting a hybrid cloud environment100, in accordance with an embodiment of the present invention. Hybrid cloud environment100includes cloud platform110, on-premise platform160, and client180. Cloud platform110, on-premise platform160, and client180can include smart phones, tablets, desktop computers, laptop computers, specialized computer servers, or any other computer systems, known in the art, capable of communicating over network190. In general, cloud platform110, on-premise platform160, and client180are representative of any electronic devices, or combination of electronic devices, capable of executing machine-readable program instructions, as described in greater detail with regard toFIG. 4.

Cloud platform110may be a public cloud environment capable of hosting web applications and providing services for users, such as client180. As depicted, cloud platform110includes a connectivity service112, persistent storage118, a hybrid cloud application package120, and a cloud application container130. On-premise platform160may be a private environment (e.g., a private cloud) of a corporation providing web applications on cloud platform110. On-premise platform160includes a cloud gateway162, persistent storage168, and an on-premise application container170.

Hybrid cloud application package120contains two distinct deployable application packages (cloud manifest122and on-premise manifest124) that are to be deployed on cloud platform110and on-premise platform160. Cloud manifest122contains information to properly launch cloud application container130, as well as an application, deployment instructions, and startup parameters for a cloud application that will be deployed on cloud platform110. On-premise manifest124contains information to properly launch on-premise application container170, as well as deployment instructions, startup parameters, and library dependencies of an on-premise application that will be deployed on on-premise platform160.

Hybrid cloud application package120may be loaded to cloud platform110over network190. When the cloud application package120is loaded to cloud platform110, connectivity service112may establish a secure bi-directional communication tunnel150between cloud platform110and on-premise platform160. Secure tunnel150may bridge the communication between cloud platform110and on-premise platform160, enabling an application running in cloud application container130to easily communicate with an application running in on-premise application container170without knowing the IP address of cloud gateway162.

After the cloud application is successfully deployed and running in cloud application container130, on-premise manifest124is transferred to on-premise platform160via secure tunnel150. After being transferred to on-premise platform160, on-premise manifest124launches on-premise application container170, deploys the on-premise application, and starts the application. Part of the deploy operation, each container (e.g., cloud application container130and on-premise application container170) contain a messaging component (e.g., for example message client library132in cloud application container130and message broker172in on-premise application container170). The cloud application executing in cloud application container130and the on-premise application executing in on-premise application container170can communicate with each other using a pub/sub programming model.

Client180may be any client that communicates with cloud platform110and cloud application container130over network190. On-premise platform160may be a web server, an application server, or any computing device capable of receiving traffic over secure tunnel150. Cloud application container130may provide a public online web application (e.g., a banking application, an auction site, a video streaming site, or the like), a corporate internal services (e.g., a billing application, human resources data retention, internal email, and the like), or any other services capable of being run on a computing device. Cloud platform110and on-premise platform160may be of differing hardware architectures. For example, cloud platform110may be hosted on mainframe computers, while on-premise platform160may be hosted on a personal computer.

Persistent storage118and168may be any non-volatile storage media known in the art. For example, persistent storage118and168can be implemented with a tape library, optical library, one or more independent hard disk drives, or multiple hard disk drives in a redundant array of independent disks (RAID). Similarly, data on persistent storage118and168may conform to any suitable storage architecture known in the art, such as a file, a relational database, an object-oriented database, and/or one or more tables.

Cloud platform110, client180, and other electronic devices (not shown) communicate over network190. Network190can be, for example, a local area network (LAN), a wide area network (WAN) such as the Internet, or a combination of the two, and include wired, wireless, or fiber optic connections. In general, network190can be any combination of connections and protocols that will support communications between Cloud platform110and client180, in accordance with an embodiment of the present invention.

FIG. 2is a flowchart depicting a cloud platform method200, in accordance with at least one embodiment of the present invention. As depicted, cloud platform method200includes receiving (210) a hybrid cloud application package, deploying (220) a deployable cloud package in a container, establishing (230) a secure bidirectional communication tunnel, sending (240) a deployable on-premise package to an on-premise server, sending (250) a message requesting services form an on premise application, and receiving (260) a response from the on-premise application. Cloud platform method200enables cloud platform110to deploy the cloud portion of a hybrid cloud application, initiate the deployment of an on-premise portion of the hybrid cloud application, and establish a secure communication tunnel between the cloud and on-premise hybrid cloud applications.

Receiving (210) a hybrid cloud application package may include cloud platform110receiving a single unit (e.g., hybrid cloud application package120) that includes two applications (a cloud application and an on-premise application) to be deployed. The package may have been created using a programming model for hybrid cloud applications that allows a developer to build both a cloud and an on-premise application (using container technology) as a single unit. Each of the two applications contained in hybrid cloud application package120may be defined by a manifest (e.g., cloud manifest122and on-premise manifest124). Each manifest may correspond to a unique deployable package, for example, cloud manifest122may correspond to a deployable cloud package, and on-premise manifest124may correspond to a deployable on-premise package

Deploying (220) a deployable cloud package in a container may include cloud platform110retrieving cloud manifest122from cloud application package120. In some embodiments, cloud manifest122(the deployable cloud package) contains information (e.g., instructions) to properly launch cloud application container130, as well as a cloud application, deployment instructions, startup parameters and library dependencies of the cloud application. Cloud platform110may use the deployment instructions to deploy the deployable cloud package in cloud application container110. In some embodiments the cloud application is included in hybrid cloud application package120. In other embodiments, the cloud application is stored in another location (e.g., on persistent storage118) and is referenced by cloud manifest122.

Establishing (230) a secure bidirectional communication tunnel may include cloud platform110receiving retrieved connectivity information from connectivity service112. The connectivity information may include, among other things, an IP address and a connection port of cloud gateway162corresponding to the on-premise environment (e.g., on-premise platform160). In some embodiments, connectivity service112provides information corresponding to an existing secure bi-directional communication tunnel (e.g., secure tunnel150) to cloud platform110. In other embodiments, connectivity service112sets up a new secure bi-directional communication tunnel (e.g., secure tunnel150) and provides connectivity corresponding to the new secure tunnel to cloud platform110.

Sending (240) a deployable on-premise package to an on-premise server may include cloud platform110retrieving the deployable on-premise package (e.g., on-premise manifest124) from hybrid cloud application package120. The deployable on-premise package may be sent to on-premise platform160over a secure bi-directional communication tunnel (e.g., secure tunnel150). In some embodiments, the deployable on-premise package is sent to on-premise platform160as soon as the deployable cloud package has been successfully deployed. In other embodiments, the deployable on-premise package is sent to on-premise platform160the first time a service corresponding to the deployable on-premise package is requested.

After the on-premise application has been successfully deployed, cloud platform110may initialize a messaging framework over secure tunnel150to enable simplified communication between the containers in which the two deployed applications run (e.g., cloud application container130and on-premise application container170). In some embodiments, message client library132is created to enable the cloud application to send a message to the on-premise application.

Sending (250) a message requesting services form an on premise application may include cloud application container130of cloud platform110using a messaging framework to send a request to on-premise application container170requesting specific services provided by an on-premise application running in on-premise application container170. The message framework may utilize secure tunnel150to move messages between cloud application container130and on-premise application container170. In some embodiments, the messaging framework uses messaging modules (e.g., message client library132and message broker172) to encapsulate messages between different architectures. In one example, cloud application container130may be running a banking application, and the user of the application wishes to electronically transfer money from one account to another. However, cloud application container130does not have access to the actual user accounts, and therefore message client library132sends a message to on-premise application container170over secure tunnel150to request the transfer be processed. Message broker172receives the messages and the application running in on-premise container performs the service.

Receiving (260) a response from the on-premise application may include cloud application container130of cloud platform110receiving a message from on-premise application container172indicating that a service has been performed. In some instances, the response may be a confirmation that the requested service has been performed. In other instances, the response includes information such as requested information (e.g., an existing account balance), or the results of a requested action (e.g., a new account balance after an electronic payment).

FIG. 3is a flowchart depicting an on-premise platform method300, in accordance with at least one embodiment of the present invention. As depicted, on-premise platform method300includes receiving (310) a deployable on-premise package, deploying (320) a deployable on-premise package in a container, establishing (330) a messaging framework, running (340) an on-premise application on a restricted container environment, receiving (350) a request for services, and sending (360) a response corresponding to requested services. On-premise platform method300enables on-premise platform160to initiate the deployment of an on-premise portion of the hybrid cloud application in a restricted container, and securely provide services to a cloud portion of the hybrid cloud application.

Receiving (310) a deployable on-premise package may include on-premise platform160receiving from a cloud platform (e.g., cloud platform110) an on-premise portion of a hybrid cloud application package (e.g., receiving on-premise manifest124from hybrid cloud application package120). The deployable on-premise package may be received over secure tunnel150. In some embodiments, the deployable on-premise package is stored on persistent storage168. In other embodiments, the deployable on-premise package is retained in memory for immediate deployment. The deployable on-premise package may include an on-premise application and deployment instructions for the on-premise application.

Deploying (320) a deployable on-premise package in a container may include on-premise platform160parsing on-premise manifest124to identify what deployment operations are required. In some embodiments, on-premise manifest124contains instructions to launch on-premise application container170. In some embodiments, on-premise manifest124contains instructions to deploy and start the on-premise application. On-premise platform160may use the deployment instructions to deploy the deployable on-premise package in on-premise application container170. The on-premise application container170and on-premise application may be deployed in a perimeter network, also known as a demilitarized zone (DMZ) which may add an additional layer of security between a public cloud (e.g., cloud platform110) and an organization's local area network (LAN). Cloud platform110only has direct access (via tunnel150through cloud gateway162) to resources in the DMZ, rather than any other part of the organization's network. However, the on-premise application can access the on-premise network and therefore is able to provide services that require access to on-premise resources.

Establishing (330) a messaging framework may include on-premise platform160using secure tunnel150and messaging framework technology to provide simplified hybrid cloud communication. In some embodiment, upon successful deployment of the on-premise application, a message broker is automatically deployed to on-premise application container170to facilitate a secure messaging framework. In some embodiments, establishing operation330coincides with similar messaging framework activities on cloud platform110. The message framework may include a message client library132corresponding to cloud application container130and message broker172corresponding to on-premise application container170.

Running (340) an on-premise application on a restricted container environment may include on-premise platform160retrieving, from on-premise manifest124, startup information. Startup information may include required prerequisite dependencies, application startup location, application startup commands, and application startup command parameters. When the on-premise application is fully initialized (e.g., running and ready to accept requests), the application may be prepared to provide one or more services. In some embodiments, after a period of inactivity, the application enters a sleep state and re-activates when a message requesting services is received on a message framework. In other embodiments, the application remains fully active until the application is shut down.

Receiving (350) a request for services may include on-premise platform160using a messaging framework to receive, over secure tunnel150, a message requesting services that may be provided by the on-premise application. Message broker172may translate the messaging from the messaging protocol of the sender to the messaging protocol of on-premise platform160. In some embodiments, message broker172performs additional authentication to confirm the request originated from an authorized requester. The on-premise application, running in on-premise container170may receive the message, determine what services are being requested, and perform the requested services.

Sending (360) a response corresponding to requested services may include on-premise platform160completing a requested service request. Upon completion of the service request, on-premise application container170may respond to a requester (e.g., cloud application container130) indicating that the request has completed. In some embodiments, the response includes results of the requested service. In other embodiments, the response contains an indication of success or failure and a reference (e.g., a pointer, or a url) providing a location to obtain any additional results of the service. In some embodiments, the response contains an indication of success or failure of the request without providing any additional details or data.

FIG. 4depicts a functional block diagram of components of a computer system400, which is an example of systems such as test intruder110and server130within computing environment100ofFIG. 1, in accordance with an embodiment of the present invention. It should be appreciated thatFIG. 4provides only an illustration of one implementation and does not imply any limitations with regard to the environments in which different embodiments can be implemented. Many modifications to the depicted environment can be made.

Intruder110, intrusion analysis system120, and server130include processor(s)404, cache414, memory406, persistent storage408, communications unit410, input/output (I/O) interface(s)412and communications fabric402. Communications fabric402provides communications between cache414, memory406, persistent storage408, communications unit410, and input/output (I/O) interface(s)412. Communications fabric402can be implemented with any architecture designed for passing data and/or control information between processors (such as microprocessors, communications and network processors, etc.), system memory, peripheral devices, and any other hardware components within a system. For example, communications fabric402can be implemented with one or more buses.

Memory406and persistent storage408are computer readable storage media. In this embodiment, memory406includes random access memory (RAM). In general, memory406can include any suitable volatile or non-volatile computer readable storage media. Cache414is a fast memory that enhances the performance of processor(s)404by holding recently accessed data, and data near recently accessed data, from memory406.

Program instructions and data used to practice embodiments of the present invention, e.g., thread-local management method200are stored in persistent storage408for execution and/or access by one or more of the respective processor(s)404via cache414. In this embodiment, persistent storage408includes a magnetic hard disk drive. Alternatively, or in addition to a magnetic hard disk drive, persistent storage408can include a solid-state hard drive, a semiconductor storage device, a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, or any other computer readable storage media that is capable of storing program instructions or digital information.

Communications unit410, in these examples, provides for communications with other data processing systems or devices, including resources of intruder110, intrusion analysis system120, and server130. In these examples, communications unit410includes one or more network interface cards. Communications unit410may provide communications through the use of either or both physical and wireless communications links. Program instructions and data used to practice embodiments of thread-local management method200may be downloaded to persistent storage408through communications unit410.

I/O interface(s)412allows for input and output of data with other devices that may be connected to each computer system. For example, I/O interface(s)412may provide a connection to external device(s)416such as a keyboard, a keypad, a touch screen, a microphone, a digital camera, and/or some other suitable input device. External device(s)416can also include portable computer readable storage media such as, for example, thumb drives, portable optical or magnetic disks, and memory cards. Software and data used to practice embodiments of the present invention can be stored on such portable computer readable storage media and can be loaded onto persistent storage408via I/O interface(s)412. I/O interface(s)412also connect to a display418.

Characteristics are as follows:

Service Models are as follows:

Deployment Models are as follows:

It should be noted that this description is not intended to limit the invention. On the contrary, the embodiments presented are intended to cover some of the alternatives, modifications, and equivalents, which are included in the spirit and scope of the invention as defined by the appended claims. Further, in the detailed description of the disclosed embodiments, numerous specific details are set forth in order to provide a comprehensive understanding of the claimed invention. However, one skilled in the art would understand that various embodiments may be practiced without such specific details.

Although the features and elements of the embodiments disclosed herein are described in particular combinations, each feature or element can be used alone without the other features and elements of the embodiments or in various combinations with or without other features and elements disclosed herein.