Patent Description:
<CIT> and <CIT> are considered prior art. Generally, cloud service providers offering hybrid and or multi-cloud services to major corporation has the challenge of providing orchestration of a vast number of legacy infrastructures of multiple customers and multi-cloud environments (Private / Public / Various brands GCP, AWS, Azure, VMware, OracleVM).

Virtualization of computing infrastructures is a fundamental process that powers cloud computing in order to provide services to customers requesting services on a cloud platform through a portal. However, when the features of the virtualization software are not well integrated with a services management unit of the cloud platform, the customers may not be able to access certain functionalities of the cloud platform, which can have a negative impact on the quality of service provided by said cloud platform.

For example, customers using the ServiceNow (a cloud service orchestration/processing module) cloud management portal (CMP) are not able to leverage said ServiceNow cloud management portal (CMP) to provision services via a Cloud Automation Service (CAS). Only basic integration with vSphere, a virtualization software, is present. This only includes provisioning and powers state changes services. The very basic integration does not allow to manage vSphere Virtual Machines (VMs) using the cloud management portal.

The implication is that customers using ServiceNow (SNOW) Cloud management portal (CMP) are not able to get fully featured vSphere capabilities. The current vCenter implementation is limited in scope and lacking flexibility for extension and innovation around the Vmware environment.

Therefore, there is a need for a system that solves this typical problem.

The present invention therefore has the object to obviate certain drawback of the prior art by proposing a computing infrastructure for providing cloud services to customers.

This goal is achieved by a system for managing security on a cloud management platform portal (CMPP), the system comprising a set of routines (scripts) which are executed on a computing device or processor allowing the cloud management platform portal to contact a cloud automation service (CAS) by using a REST API (Representational State Transfer Application Programing Interface) to access and configure a set of functionalities of the CAS of the platform hosting services in a portal so as to provision services to a customer, and a ServiceNow (SNOW) application comprising at least one set of herebelow routines comprising at least one of the following:.

According to another feature, the system comprises a set of routines the execution of which on a processor provides to the CMPP a set of functionalities and applications comprising at least:.

According to another feature, the set of functionalities and applications also comprises:.

Another goal of the invention also concerns a method for providing cloud services to customers.

This goal is achieved by a process for managing a security group on a cloud management platform portal by means of a system for managing security as described in the invention, the system comprising a set of software codes executed on a processor of the platform to implement the process for managing a security group, said process being characterized in that it comprises at least one of the following:.

According to another feature, a set of software codes is executed on the platform for creating a security group (SG), said creation of a security group process comprising:.

According to another feature, a set of software codes is executed on the platform for modifying an existing security group, said modification of an existing security group process comprising the following steps:.

According to another feature, a set of software codes is executed on the platform for deleting a security group, said deletion of a security group process comprising the following steps:.

According to another feature, a set of software codes is executed on the platform for configuring a SDN security group rule, said configuration of a SDN security group rule process comprising at least one of the sub-steps:.

According to another feature, a set of software codes is executed on the platform for creating a SDN security group rule, said creation of a SDN security group rule process, comprising:.

According to another feature, a set of software codes is executed on the platform for modifying a SDN security group rule, said modification of a SDN security group rule process comprising the following steps:.

According to another feature, a set of software codes is executed on the platform for deleting a SDN security group rule, said deletion of a SDN security group rule process comprising the following steps.

According to another feature, the system for managing security, according the invention, is used in a server for managed PaaS (Platform as a service) comprising, in a container-based architecture, at least a processor and memories to save data and executable softwares so as to embed a cloud application software into a fully managed PaaS stack, abstracting complex hybrid Infrastructure as a Service (IaaS) away, said server being characterized in that the SNOW application of the system for managing security represents a first layer of said server, executed on at least a processor and is configured to:.

According to another feature, the SNOW application is executed on the server for managed PaaS and displayed on a console adapted to the cloud application integrated software by integrating a specific API configured to interface the SNOW (ServiceNow) application language and command to the language and command of the cloud Application integrated software.

According to another feature, the system for managing security according to the invention, is used in an orchestrate Hybrid cloud system wherein a SAP (Systems, Applications and Products for data processing) administration is supported by said security management system for security audit and backup monitoring purpose and provisioning by:.

According to another feature, the SNOW application execution, on a processor of a computing device of the Orchestrated Hybrid cloud, provides an interface for enabling a user to determine any of the following parameters:.

Other features, details and advantages of the invention will become apparent upon reading the description which follows with reference to the appended figures, which illustrate:.

The present invention concerns a system for managing security on a cloud management platform portal (CMPP (<NUM>)).

Many combinations may be contemplated without departing from the scope of the invention; one skilled in the art will select either one depending on economical, ergonomical, dimensional constraints or others which he/she will have to observe.

In some embodiments, the system , as illustrated for example in <FIG>, comprises a set of routines (scripts) which are executed on a computing device or processor allowing the cloud management platform portal to contact a cloud automation service (CAS (<NUM>)) by using a REST API (<NUM>) (Representational State Transfer Application Programing Interface) to access and configure a set of functionalities of the CAS (<NUM>) of the platform hosting services in a portal so as to provision services to a customer, and a ServiceNow (<NUM>) (SNOW (<NUM>)) application comprising at least one the set of herebelow routines comprising at least one of the following:.

In some embodiments, the ServiceNow (<NUM>) application may also comprises at least one the set of herebelow routines comprising at least one of the following.

A security group is a container for security group rules. Security groups and security group rules may allow administrators/manager to specify the type of traffic that is allowed to pass through a port. When a virtual machine (VM) is created in a virtual network (VN), a security group can be associated with the VM when it is launched.

The SDN is an approach to networking that separates a control plane from a forwarding plane to support virtualization of computing infrastructures or systems. The ServiceNow (<NUM>) (SNOW) application is a Cloud service processing/orchestration module or program or code.

In some embodiments, the system for managing security on a cloud management platform portal (CMPP (<NUM>)) comprises a set of routines which execution on a processor provides to the CMPP (<NUM>) a set of functionalities and applications comprising at least:.

A Disaster Recovery Pod is an additional infrastructure that may be used to host the workloads after disaster occurs in a primary site.

In some embodiments, the set of applications provided to the CMPP (<NUM>) by the execution of the set of routines included in the system for managing security on a cloud management platform portal may comprise a vRA (vRealize Automation) application for automation of cloud services.

In some embodiments, the set of functionalities and applications, provided to the CMPP (<NUM>) by the system the system for managing security on a cloud management platform portal (CMPP (<NUM>)) through the execution of a set of routines on a processor, may also comprise:.

A distributed firewall is a hypervisor kernel-embedded firewall that provides visibility and control for virtualized workloads and networks. The NSX (<NUM>) Distributed firewall is a stateful firewall, meaning it monitors the state of active connections and uses this information to determine which network packets to allow through the firewall. A flow is identified by the following:.

Distributed firewall can help in creating identity-based rules as well. Administrators can enforce access control based on the user's group membership as defined in the enterprise Active Directory. For example, and without limitation, some scenarios where identity-based firewall rules can be used are:.

Edge Firewall monitors the North-South traffic to provide perimeter security functionality including firewall, Network Address Translation (NAT), and site-to-site IPSec and SSL VPN functionality. This solution is available in the virtual machine form factor and can be deployed in a High Availability mode.

The invention also concerns a method for managing security group on a cloud management platform portal.

In some embodiments, the process for managing a security group on a cloud management platform portal, as described above, the system comprising a set of software codes executed on a processor the platform to implement the process for managing a security group, said process being characterized in that it comprises at least one of the following:.

In some embodiments, a set of software codes is executed on the platform for creating a security group (SG), said creating a security group process comprising, as illustrated on <FIG>:.

In some embodiments, a set of software codes is executed on the platform for modifying an existing security group, said modifying an existing security group process comprising, as illustrated on <FIG>:.

In some embodiments, a set of software codes is executed on the platform for deleting a security group, said deleting a security group process comprising as illustrated on <FIG>:.

In some embodiments, a set of software codes is executed on the platform for adding server to a security group (not illustrated in the present invention), said adding server to a security group process comprising:.

In some embodiments, a set of software codes is executed on the platform for removing a virtual server to a security group (not illustrated in the present invention) and, said removing a virtual server to a security group comprising for the following steps:.

In some embodiments, a set of software codes is executed on the platform for configuring a SDN security group rule, said configuring a SDN security group rule process comprising at least one of the sub-steps:.

In some embodiments, a set of software codes is executed on the platform for creating a SDN security group rule, said creating a SDN security group rule comprising, as illustrated on <FIG>:.

In some embodiments, a set of software codes is executed on the platform for modifying a SDN security group rule, said modifying a SDN security group rule process comprising, as illustrated on <FIG>:.

In some embodiments, a set of software codes is executed on the platform for deleting SDN security group rule, said deleting SDN security group rule process comprising, as illustrated on <FIG>:.

In some embodiments, the system for managing security, as described in the present application, may be used in a server for managed PaaS (Platform as a service) comprising, in a container-based architecture, at least a processor and memories to save data and executable softwares so as to embed a cloud application software into a fully managed PaaS stack, abstracting complex hybrid Infrastructure as a Service (IaaS) away. The SNOW application of the system for managing security may represent a first layer of said server for managed PaaS, executed on at least a processor and configured to:.

In some embodiments, the SNOW application is executed on the server for managed PaaS and displayed on a console adapted to the cloud application integrated software (Apprenda) by integrating a specific API configured to interface the SNOW (ServiceNow (<NUM>)) application language and command to the language and command of the cloud Application integrated software (Apprenda).

In some embodiments, the system for managing security, as described in the present application, may be used in an orchestrate Hybrid cloud system wherein a SAP (Systems, Applications and Products for data processing) administration is supported by said security management system for security audit and backup monitoring purpose and provisioning by:.

In some embodiments, the SNOW application execution, of the system for managing security used in the Orchestrated Hybrid Cloud system, on a processor of a computing device of the Orchestrated Hybrid cloud system, provides an interface for enabling a user to determine any of the following parameters:.

It should be understood that the enumeration of the steps of any process described in the present application does not represent the sequential order of the steps in which the process should be executed but could be modified by executing a step before others. The sequential order could be modified by the man skilled in the art.

It will be easily understood upon reading the present application that the particularities of the present invention, as generally described and illustrated in the figures, may be arranged and designed according to a great variety of different configurations. Thus, the description of the present invention and the related figures are not provided for limiting the scope of the invention but simply illustrating selected embodiments.

One skilled in the art will understand that the technical features of a given embodiment may in fact be combined with features of another embodiment unless the opposite is explicitly mentioned or if it is obvious that these features are incompatible. Further, the technical features described in a given embodiment may be isolated from the other features of this embodiment unless the opposite is explicitly mentioned.

Claim 1:
A system for managing security on a cloud management platform portal (CMPP (<NUM>)), the system comprising:
a computing device or processor
a set of routines executed on the computing device or processor and which makes the cloud management platform portal able to contact a cloud automation service (CAS (<NUM>)) by using a Representational State Transfer Application Programing Interface (REST API (<NUM>)) to access and configure a set of functionalities of the CAS (<NUM>) of the platform hosting services in a portal, and
a ServiceNow (<NUM>) (SNOW) application comprising at least one the set of herebelow routines comprising at least one of the following:
• a network Standard Service Request (SSR (<NUM>)) to delete a security group (SG)
• a network SSR (<NUM>) to create a new Security group
• a network SSR (<NUM>) to modify an existing Security group
• a network activity SSR (<NUM>) to delete a Software-Defined Networking (SDN) Security group rule on hyper-converged platforms
• a network activity SSR (<NUM>) to create a new SDN Security group rule on hyper-converged platforms
• a network activity SSR (<NUM>) to modify an existing SDN (Software defined Networking) Security group rule on hyper-converged platforms said security groups configurations authorizing traffics so as to provision services to a customer via the CAS (<NUM>), and
the system further comprising a set of routines which execution on a processor provides to the CMPP (<NUM>) a set of functionalities and applications comprising at least:
• the ServiceNow (<NUM>) (SNOW) application comprising the above set of SSRs (<NUM>) for delivering a set of services and comprising a Master Snow Workflow Dispatcher (<NUM>) (MSWD)
• the REST API (<NUM>) (Representational State Transfer Application Programing Interface)
• a MID (MID Server (<NUM>) is a Java application that runs on a server on your local network) server for allowing communication and movement of data between the platform and external applications, data sources, and services or for passing a call to a Master vRO (<NUM>) dispatcher
• A Master vRO (<NUM>) (vRealize Orchestrator) for automation of workflow processes
• A slave vRo (<NUM>) for automation of workflow processes
• A set of Security Group Applications (SGA (11B)) for implementing processes related to security group set up
• A Disaster recovery (DR) Pod application for hosting workloads after disaster occurs in the primary site
• a cloud Management database (CMDB (<NUM>)).