Computing system and method

Abstract

The invention relates to a computing system and method. This disclosure describes techniques for managing and / or regulating access to network resources operating external to a cloud environment through an application executing in the cloud environment. In one example, the disclosure describes: receiving, from a first application executing in a cloud environment, a first request to be communicated to an off-cloud network resource; receiving, from a second application executing in the cloud environment, a second request to be transmitted to the out-of-cloud network resource; and managing transmission of the first request and the second request to the out-of-cloud network resource based on the policy.

Description

[0001] Related Applications

[0002] This application claims the benefit of U.S. Patent Application No. 18 / 464,083, filed on September 8, 2023, the entire contents of which are incorporated herein by reference. Technical Field

[0003] The present disclosure relates to cloud computing systems, and more particularly, to techniques for managing computing resources inside and outside a cloud network. Background Art

[0004] Forms of resource reservation are often used to manage shared resource pools between multiple workloads in a network. Such techniques may involve rate limiting, buffering, and policing of shared usage policies. These techniques can also be applied in cloud networking environments to prevent resource contention, service level agreement (SLA) violations, unpredictable performance, and security risks. Summary of the invention

[0005] This disclosure describes techniques for managing and / or regulating access to network resources operating outside of a cloud environment by applications executing in a cloud environment. Specifically, the techniques described herein can help ensure that applications executing in a cloud network do not negatively impact network resources operating in an environment outside of the cloud. Such outside-cloud network resources can be, for example, networking facilities deployed in a local network used by an organization or enterprise.

[0006] Applications executing in a cloud environment may perform occasional, regular, or frequent collection of data from resources in an off-cloud network for a variety of purposes. Such purposes may include providing support services for those off-cloud resources or managing services executed on those off-cloud resources. The techniques described herein may minimize contention between multiple cloud-based applications accessing the same off-cloud resources. Correspondingly, such techniques may also minimize cloud infrastructure costs incurred by cloud-based applications executing in a cloud environment.

[0007] In some examples, the disclosure describes operations performed by a computing system according to one or more aspects of the disclosure. In one specific example, the disclosure describes a method, including: receiving, by a network management system and from a first application executing in a cloud environment, a first request to be transmitted to a network resource outside the cloud; receiving, by the network management system and from a second application executing in the cloud environment, a second request to be transmitted to the network resource outside the cloud; and managing, by the network management system and based on a policy, the transmission of the first request and the second request to the network resource outside the cloud.

[0008] In another example, the disclosure describes a system including a storage system and a processing circuit having access to the storage system, wherein the processing circuit is configured to perform the operations described herein. In yet another example, the disclosure describes a computer-readable storage medium including instructions that, when executed, configure the processing circuit of the computing system to perform the operations described herein.

[0009] The details of one or more examples of the disclosure are set forth in the accompanying drawings and the description herein. Other features, objects, and advantages will be apparent from the description and drawings, and from the claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1A is a conceptual diagram illustrating interactions between resources across multiple computer networks in accordance with one or more aspects of the present disclosure.

[0011] Figure 1B is a conceptual diagram of applying usage constraints to interactions between resources across multiple computer networks in accordance with one or more aspects of the present disclosure.

[0012] Figure 2 is a block diagram illustrating an exemplary system for applying usage constraints to interactions between resources across multiple computer networks in accordance with one or more aspects of the present disclosure.

[0013] Figure 3A is a conceptual diagram illustrating an example process for implementing a policy for constraining shared usage of limited resources outside a cloud network in accordance with one or more aspects of the present disclosure.

[0014] Figure 3B is a conceptual diagram illustrating a process for implementing a policy for constraining shared usage of a limited resource across multiple applications in accordance with one or more aspects of the present disclosure.

[0015] Figure 3C is a conceptual diagram illustrating a process for deactivating an application according to one or more aspects of the present disclosure.

[0016] Figure 4A is a conceptual diagram illustrating a shaping process applied to usage of a shared network resource to ensure that such usage complies with a policy associated with the shared network resource in accordance with one or more aspects of the present disclosure.

[0017] Figure 4B is a conceptual diagram illustrating a queuing process applied to usage of a shared network resource to ensure that such usage complies with a policy associated with the shared network resource in accordance with one or more aspects of the present disclosure.

[0018] Figure 4Cis a conceptual diagram illustrating a regulatory process applied to the use of a shared network resource to ensure that such use complies with policies associated with the shared network resource in accordance with one or more aspects of the present disclosure.

[0019] Figure 5 is a flow diagram illustrating operations performed by an exemplary computing system in accordance with one or more aspects of the present disclosure. DETAILED DESCRIPTION

[0020] Figure 1A is a conceptual diagram illustrating interactions between resources across multiple computer networks according to one or more aspects of the present disclosure. Figure 1A Within the system 100A are a cloud network 150 and an out-of-cloud network 102. The cloud network 150 and the out-of-cloud network 102 can communicate with each other via a network 105.

[0021] Cloud network 150 may be a public or private cloud network that hosts physical and / or virtual computing systems. Figure 1A As shown, applications 110A to 110N (“applications 110”, representing any number of applications) are deployed within cloud network 150. Cloud controller 151 is also deployed within cloud network 150, which can manage and / or administer various aspects of cloud network 150 and can be responsible for providing, scaling, or otherwise adjusting the infrastructure available to each of applications 110 within cloud network 150. Figure 1A 1 is shown as a single network, but cloud network 150 may represent multiple cloud networks 150. In such examples, each of the cloud networks may be managed by a different entity and / or controller.

[0022] Applications 110 within cloud network 150 may perform operations and / or services on behalf of users or other systems located inside or outside of cloud network 150. Typically, cloud-based applications are implemented through a collection of microservices. Thus, application 110A may be implemented through a single microservice, while other applications 110 may be implemented through multiple microservices. For example, Figure 1A Applications 110B and 110N in FIG. 1 are shown as being composed of multiple microservices (ie, each layer of applications 110B and 110N is intended to represent a separate microservice).

[0023] The cloud-outside network 102 may be any public or private network that may be considered different from the cloud network 150. The cloud-outside network 102 may be a network maintained locally by an organization or enterprise. Figure 1AAs shown, the cloud-outside network 102 includes network resources 101A to 101M ("network resources 101" represents any number of network resources). In some cases, the cloud-outside network 102 may be a local network implemented using network hardware from a network hardware vendor, wherein some or all of the network resources 101 represent physical network devices (e.g., routers, switches, firewall devices, endpoints, nodes, or other network devices) manufactured by and / or derived from the network hardware vendor. In other cases, the cloud-outside network 102 may be a local network implemented using a virtual execution element that is instantiated using software provided by a network software vendor and executed on a physical computing device that may be manufactured by and / or derived from the network software vendor. In some cases, the cloud-outside network 102 may be a local network implemented using a combination of such network hardware and virtualized network elements / devices, which may be provided by a public network vendor. In such an example, the cloud-outside network 102 is constructed by a network device obtained by a customer of a network hardware vendor or a network software vendor, and in this sense, the cloud-outside network 102 may be described as a "customer network." In general, however, as described herein, network resource 101 may be any suitable network-enabled system, device, application, or other entity suitable for performing the techniques described herein.

[0024] Applications 110 executing within the cloud network 150 may communicate with network resources 101 operating within the off-cloud network 102 for various purposes. For example, one or more of the applications 110 may perform operations related to maintaining, monitoring, or otherwise managing network resources 101 within the off-cloud network 102. For example, in an example where the off-cloud network 102 has been assembled from network hardware and / or software from a particular vendor, the vendor may manage its network devices operating within the off-cloud network 102 or otherwise interact with it through one or more applications 110 executing within the cloud network 150. As another example, the application 110 may be used for services provided by a third-party entity that is not related to the vendor or customer. In general, the communication between the application 110 and the network resource 101 is primarily described herein as being used for the application 110 to manage, monitor, or maintain various aspects of the network resource 101, such as launching the application 110 to provide services that are available from the cloud network 150 and commissioned by the customer. However, there are other purposes for which systems and / or applications within cloud network 150 may communicate with systems or applications within external-cloud network 102 , and such purposes are intended to be encompassed by the present disclosure.

[0025] Communication between application 110 and network resources 101 may be conducted over network 105. Network 105 may be or may represent any suitable communication infrastructure or platform over which cloud network 150 may communicate with off-cloud network 102. Thus, network 105 may be or may include or represent any public or private communication network or other network including the Internet. In some examples, cloud network 150 may be directly connected to off-cloud network 102, which may make network 105 unnecessary.

[0026] In operation, one or more of the applications 110 executing within the cloud network 150 may request information from the network resources 101 operating within the external cloud network 102. Figure 1A In an example described in the context of , application 110A outputs request 111A over network 105. When network resource 101A receives request 111A, the request may be passed to a first software agent executing on network resource 101A responsible for servicing such request, for example, where a first software agent was previously installed on network resource 101A and associated with application 110A. In one example, network resource 101A receives request 111A over network 105 and determines that it corresponds to a request to stream telemetry data from network resource 101A to application 110A over network 105. In response, network resource 101A begins streaming telemetry data by periodically collecting the requested information and outputting the data (as a series of responses 121A) to application 110A over network 105. Application 110A receives the stream of responses 121A over network 105 and processes the telemetry data included within responses 121A. In some examples, the telemetry data may include metrics, information to initiate support services, information to initiate services to manage network resources executing within network 102, and / or information about internal resource utilization (such as CPU utilization) of network resource 101A.

[0027] Other applications 110 may also request information from network resource 101A. Figure 1A , application 110B outputs request 111B over network 105, and network 105 forwards request 111B to network resource 101A. Network resource 101A receives request 111B and responds with response 121B (e.g., via the same software agent or via a second software agent executing on network resource 101A that is responsible for servicing requests from application 110B). Similarly, and generally, application 110N may output request ( Figure 1A ), and network resource 101A may receive the request and respond appropriately.

[0028] In the depicted example, multiple applications 110 executing within cloud network 150 may request information from or otherwise make demands on one or more specific network resources 101 within off-cloud network 102. In some cases, the requests made by applications 110 may become too heavy for network resource 101A. For example, if application 110B issues a large number of requests 111B to network resource 101A, network resource 101A may need to devote a large amount of computing resources to process all requests 111B. If there are too many requests 111B, network resource 101A may begin to experience high utilization, which may affect its ability to continue streaming telemetry data to application 110A in a timely manner.

[0029] In general, if applications 110 executing within cloud network 150 are allowed to request or otherwise interact with network resources 101 operating within off-cloud network 102 without constraints, a number of negative effects may result. For example, if application 110 is competing for responses from the same resource (e.g., any of network resources 101) of off-cloud network 102, resource contention and potential bottlenecks may result in off-cloud network 102, cloud network 150, or others. In addition, the performance of network resources 101 operating within off-cloud network 102 may become unpredictable, resulting in degradation of performance and potential downtime of applications. In the case where service level agreements are established for various resources within system 100, violations of such service level agreements may occur if the resources cannot provide expected levels of performance and availability. In addition, unrestricted access to network resources 101 by application 110 may pose security risks because such unfettered access may allow or enable unauthorized access to sensitive data and resources. Additionally, without proper resource management and optimization, there may be unnecessary resource usage and costs (including usage of cloud resources), resulting in increased expenses for organizations managing off-cloud network 102 or contracting for services provided by cloud network 150 .

[0030] One way to prevent these negative effects is to restrict the use of shared resources that exist outside of the cloud network 150. Such constraints may help ensure optimal performance, reliability, and security of resources and better adhere to quality of service requirements and service level agreements. Specifically, usage constraints may be applied to applications 110 executing within the cloud network 150 to regulate, coordinate, and / or manage the use of network resources 101 by applications 110 operating within the external cloud network 102. In addition, as combined Figure 2 As described, shared resource usage constraints may be applied to systems and / or applications within the cloud network 150 and the external-cloud network 102 .

[0031] Figure 1Bis a conceptual diagram in which usage constraints are applied to interactions between resources across multiple computer networks in accordance with one or more aspects of the present disclosure. Figure 1B The system 100B includes a combination of Figure 1A The system 100A described above has many of the same elements, and Figure 1B The elements shown in may correspond to those in Figure 1A Previously described elements are identified by like numbered reference numerals.

[0032] One way in which system 100B differs from system 100A is that system 100B includes a management system 180 that can be used to manage interactions between applications 110 executing within cloud network 150 and network resources 101 operating within off-cloud network 102. In some examples, management system 180 serves as a policy enforcement point that ensures that data flows across the boundary between cloud network 150 and off-cloud network 102 are consistent with the policies and / or expectations of network participants, systems, owners, or other stakeholders.

[0033] Management system 180 may be implemented in any suitable manner, including by a library implemented in another service or loaded into an existing software function, as a microservice included within another application (including one of applications 110), by a separate microservice, or otherwise. For example, management system 180 may be implemented by a service that manages connections from cloud network 150 to network resources 101 via a protocol such as NETCONF. However, in general, management system 180 may be implemented by any suitable computing system including one or more server computers, workstations, mainframes, appliances, cloud computing systems, and / or other computing devices that may be capable of performing the operations and / or functions described in accordance with one or more aspects of the present disclosure. Management system 180 may represent a cloud computing system, a server farm, and / or a server cluster (or a portion thereof) that provides services to client devices and other devices or systems. Although in Figure 1B 1 is shown as a single system, the management system 180 may be implemented by multiple devices or systems and may be implemented across multiple environments. Figure 1B 1 as being located within or part of cloud network 150 , but management system 180 may be implemented external to cloud network 150 (or otherwise not being part of the cloud network).

[0034] In operation, management system 180 may determine an appropriate manner to allocate access to network resources 101 among applications 110. For example, in conjunction with Figure 1BIn the described example, the management system 180 collects information about how each of the expected applications 110 uses the network resources 101 operating in the cloud-outside network 102. In some examples, the management system 180 collects this information from an administrator of the cloud network 150, or from the developer, owner, or operator of each application 110. The management system 180 determines, for each network resource 101 within the cloud-outside network 102, a policy for regulating and / or managing the interactions between the network resources 101. The management system 180 may determine the policy in consideration of expected usage and traffic patterns, and in consideration of any quality of service requirements and / or service level agreements that exist or are established for any application and / or resource of the cloud network 150 and / or the cloud-outside network 102. The policy may employ resource allocation and scheduling techniques that prioritize critical applications 110 and allocate access based on the needs of those applications 110. For example, network resources 101 may be dynamically allocated to different applications 110 based on usage patterns and quality of service requirements, thereby helping to ensure that critical applications receive the necessary access to the network resources 101 while preventing over-provisioning and wasting resources.

[0035] Management system 180 can evaluate request 111 sent by application 110 to out-of-cloud network 102. For example, referring again to Figure 1B , application 110A outputs request 111A. Management system 180 receives the request and determines that it is a request intended for network resource 101A. Management system 180 evaluates request 111A and determines that request 111A complies with the policy for network resource 101A, and outputs request 111A over network 105. Network resource 101A receives request 111A over network 105 and determines that it corresponds to a request to stream telemetry data from network resource 101A to application 110A over network 105. Network resource 101A begins streaming telemetry data over network 105 as a series of responses 121A at the requested rate. Application 110A receives the stream of responses 121A over network 105 (e.g., by management system 180). Application 110A processes the telemetry data included in responses 121A.

[0036] The management system 180 can also start the application 110B to send a request to the network resource 101A. Figure 1B , application 110B outputs request 111B. Management system 180 receives request 111B and determines that it is a request intended for network resource 101A. Management system 180 evaluates request 111B and determines that it complies with the policy for network resource 101A. Management system 180 outputs request 111B over network 105. Network resource 101A processes the request and responds with response 121B.

[0037] Management system 180 may ultimately constrain the use of network resources 101A by application 110B. Figure 1B , application 110B outputs additional requests 111B. Management system 180 receives additional requests 111B (e.g., as a series of requests 111B) and determines that each is a request intended for network resource 101A. Management system 180 evaluates whether the series of requests 111B will negatively impact the operation of network resource 101A, or will be inconsistent with a policy for using network resource 101A. If management system 180 determines that the series of requests 111B will negatively impact the operation of network resource 101A (or violate a policy), management system 180 may constrain the use of network resource 101A by application 110B (or application 110A). Management system 180 may do this by controlling the rate at which requests 111B are transmitted from application 110B in cloud network 150 to network resource 101A using data shaping or rate limiting techniques. Management system 180 may also use queuing techniques to store (e.g., temporarily hold) at least some of requests 111B from application 110B, particularly where transmitting all requests 111B would overburden network resource 101A, or would cause congestion, delays, and / or result in dropped requests. Management system 180 may ultimately police requests 111B sent by application 110B by controlling the rate at which requests are sent to network resource 101A, which may involve dropping requests 111B that exceed a rate specified by a policy applied to network resource 101A. Through data shaping, queuing, and / or policing applied to requests 111 (i.e., requests 111A or 111B), management system 180 may be able to prevent resource contention and ensure that network resource 101A operates consistently and efficiently.

[0038] Therefore, the technology described herein can provide certain technical advantages. For example, by limiting the shared use of cloud resources, instances of resource competition and potential bottlenecks in the system or network can be reduced. In addition, such constraints can prevent unpredictable performance that can be caused by the unconstrained use of network resources 101. In the absence of constraints on applications 110, network resources 101 may also experience degraded performance, downtime, and potential security risks. By constraining in place, better compliance with quality of service guarantees and service level agreements may be caused. Applying constraints to the shared use of resources can also reduce instances of unnecessary resource use and costs. In addition, compared with the alternative of applying constraints to the use requests received by network resources 101, it may be advantageous to centrally and preemptively manage the use constraints by the system within the cloud network. Although the use constraints can be managed by resources within the cloud network 102, such methods may not be as efficient as other methods described herein. For example, in the case where the network resources 101 in the network 102 are overburdened by interactions originating from the application 110, it may be difficult to find and / or adopt additional resources within the cloud network 102 to manage the use of those use constraints.

[0039] Figure 2 is a block diagram illustrating an exemplary system in which usage constraints are applied to interactions between resources across multiple computer networks in accordance with one or more aspects of the present disclosure. Figure 2 The system 200 includes a combination of Figure 1A and Figure 1B Many of the same elements of systems 100A and 100B are described. Figure 2 Elements shown in may correspond to previously described elements sharing the same reference numerals.

[0040] Figure 2 Also shown is a computing system 280, which can be considered as Figure 1B Example or alternative implementations of management system 180. Figure 2 Computing system 280 is shown in FIG. 2 to facilitate describing certain components, modules, and other aspects of a computing system that may implement a network management system, such as management system 180 . Figure 2 Computing system 280 is also shown in FIG. 2 to facilitate describing how such a computing system may operate in accordance with the techniques described herein.

[0041] For ease of explanation, the computing system 280 Figure 2280 as a single computing system. However, in other examples, computing system 280 may be implemented by multiple devices or computing systems distributed across a data center, multiple data centers, or multiple cloud networks. For example, a separate computing system may implement the functions described herein as performed by each of policy module 291, access module 292, or cache module 293 of computing system 280. Alternatively or additionally, Figure 2 The modules shown as included within computing system 280 may be implemented by distributed virtualized computing instances or virtual execution elements (e.g., virtual machines, container pools, containers) of a data center, cloud computing system, server farm, and / or server cluster. Although shown operating within a single cloud network 150, computing system 280 may operate outside of cloud network 150 and may operate to manage and / or regulate communications between resources of multiple cloud networks 150 and external cloud networks 102.

[0042] exist Figure 2 , computing system 280 is shown having underlying physical hardware including a power supply 289, one or more processors 283, one or more communication units 285, one or more input devices 286, one or more output devices 287, and one or more storage devices 290. Storage device 290 may include a policy module 291, an access module 292, and a cache module 293. One or more of the devices, modules, storage areas, or other components of computing system 280 may be interconnected to enable inter-component communication (physically, communicatively, and / or operationally). In some examples, such connection may be provided via a communication channel, which may include a system bus (e.g., communication channel 282), a network connection, an inter-process communication data structure, or any other method for transmitting data. Although Figure 2 The computing system 280 of may be considered an exemplary implementation of the management system 180 , but other implementations are possible.

[0043] The power supply 289 of the computing system 280 can provide power to one or more components of the computing system 280. The power supply 289 can receive power from a main alternating current (AC) power source in a building, data center, or other location. In some examples, the power supply 289 can include a battery or device that supplies direct current (DC). The power supply 289 can have intelligent power management or consumption capabilities, and such features can be controlled, accessed, or adjusted by the processor 283 to intelligently consume, distribute, supply, or otherwise manage power.

[0044] The one or more processors 283 of the computing system 280 may implement functions and / or execute instructions associated with the computing system 280 or associated with one or more modules shown and / or described herein. The one or more processors 283 may be a processing circuit that performs operations according to one or more aspects of the present disclosure, may be a part of the processing circuit, and / or may include the processing circuit.

[0045] The one or more communication units 285 of the computing system 280 can communicate with devices external to the computing system 280 by transmitting and / or receiving data, and in some aspects can operate as both an input device and an output device. In some or all cases, the communication unit 285 can communicate with other devices or computing systems over a network.

[0046] The one or more input devices 286 may represent any input device of the computing system 280, and the one or more output devices 287 may represent any output device of the computing system 280. The input device 286 and / or the output device 287 may generate, receive, and / or process output from any type of device capable of outputting information to a human or a machine. For example, the one or more input devices 286 may generate, receive, and / or process input in the form of electrical, physical, audio, image, and / or visual input (e.g., peripheral devices, keyboards, microphones, cameras). Correspondingly, the one or more output devices 287 may generate, receive, and / or process output in the form of electrical and / or physical output (e.g., peripheral devices, actuators).

[0047] One or more storage devices 290 within the computing system 280 may store information for processing during operation of the computing system 280. The storage device 290 may store program instructions and / or data associated with one or more of the modules described according to one or more aspects of the present disclosure. One or more processors 283 and one or more storage devices 290 may provide an operating environment or platform for such modules, which may be implemented as software, but may include any combination of hardware, firmware, and software in some examples. One or more processors 283 may execute instructions, and one or more storage devices 290 may store instructions and / or data for one or more modules. The combination of the processor 283 and the storage device 290 may retrieve, store, and / or execute instructions and / or data for one or more applications, modules, or software. The processor 283 and / or the storage device 290 may also be operably coupled to one or more other software and / or hardware components, including but not limited to one or more of the components of the computing system 280 and / or one or more devices or systems shown or described as being connected to the computing system 280.

[0048] Policy module 291 may perform functions related to generating, managing, modifying, and storing various policies associated with managing data flows between cloud network 150 and off-cloud network 102. In some examples, policy module 291 manages and stores various policies 295 (as well as "north-to-south" policies 297) in storage 290 and / or data storage 299. In some examples, policy module 291 may create and / or register various policies based on information about expected use of any of network resources 101 by applications 110. Correspondingly, policy module 291 may create and / or register various policies based on information about expected amounts of data expected to be sent by network resources 101 to any of applications 110 or other resources in cloud network 150.

[0049] In general, policies refer to rules and guidelines that govern how shared resources are allocated and managed to meet quality of service (QoS) requirements and ensure optimal resource usage in a cloud environment. Policies can define specific constraints and requirements for using network resources and shared resources in a cloud environment. In some cases, they specify how different applications should be granted access to these resources, how resources should be prioritized, and how resource usage should be monitored and controlled to prevent overload and potential bottlenecks. Policies can be implemented at various points in the system 200, such as at a policy enforcement point (e.g., computing system 280) responsible for enforcing policies to ensure compliance. Such policy enforcement points can be used to monitor and control the use of resources and perform access control based on application-specific rules and policies. Policies can ensure that network and shared resources are used effectively and efficiently, thereby avoiding contention and providing reliable and predictable performance to meet service level agreements.

[0050] In some cases, policies may define and be used to enforce a maximum number of requests per minute sent by an application 110 (or by a computing system 280) to a given network resource 101. Policies may also define what functions are enabled on a given network resource 101, or the amount of data that may be collected from that network resource 101. Some types of policies may define generally how the cloud network 150 should interact with network resources 101, and other policies may define how a specific application 110 should interact with a specific network resource 101.

[0051] The access module 292 can perform functions related to applying usage restrictions to shared resources. In some examples, the access module 292 implements the policies described in the previous paragraphs. Specifically, the access module 292 can enforce restrictions on how the application 110 uses or consumes resources of various network resources 101 operating in the cloud-external network 102.

[0052] The cache module 293 may perform functions related to caching data received from one or more off-cloud network resources for later use. The cache module 293 may store data associated with off-cloud network resources and use the data in response to a request 111 issued by any application 110 within the cloud network 150 without actually relaying the request to the off-cloud network resource. In some cases, a request 111 issued by a given application 110 executing within the cloud network 150 may be partially or completely served from a cache memory (e.g., located within the storage device 290 and managed by the cache module 293).

[0053] Caching can reduce response time because by caching responses to frequently requested requests, subsequent requests for the same data can be served directly from the cache. This eliminates the need for the shared resource to receive and process the request again, resulting in reduced response time. Reduced response time helps adhere to SLAs by ensuring that the application receives a response within specified time constraints and that the shared resource can process additional requests within specified time constraints.

[0054] Caching can also reduce the workload on network resources 101 by offloading (or "in-sourcing") repeated or redundant requests, thereby minimizing resource utilization. When a cached response is served, the need for network resources 101 to perform precise calculations or fetch data again is avoided. This helps optimize resource utilization and ensures that shared resources can efficiently handle other requests, thereby reducing the risk of resource contention and potential performance issues.

[0055] Caching can also enhance the scalability of network resources 101. As the number of requests increases, caching enables shared resources to handle more requests without being overwhelmed. By providing cached responses, shared resources can efficiently execute more requests, thereby reducing the likelihood of violating SLAs due to resource overload.

[0056] In addition, caching can improve the availability of shared resources by reducing their dependency on the availability of the actual resources. For example, if a given network resource 101 experiences temporary unavailability or performance issues, cached responses can still be provided, thereby ensuring uninterrupted application service. This helps prevent downtime and helps meet SLAs that specify certain availability levels. For example, to ensure that the cache effectively supports SLA implementation, specific cache management processes can be adopted, including: cache invalidation processes that avoid using state data, cache size and replacement policies that ensure that sufficient capacity is available to store frequently accessed data, and cache consistency policies that ensure that data received from the cache is consistent with data originally received from the original source.

[0057] The data store 299 of the computing system 280 may represent any suitable data structure or storage medium for storing information related to policies, efforts to execute policies, or other information. The information stored in the data store 299 may be searchable and / or categorized so that one or more modules within the computing system 280 may provide input requesting information from the data store 299 and, in response to the input, receive information stored in the data store 299. The data store 299 may be primarily maintained by the policy module 291.

[0058] In operation, computing system 280 may receive information about one or more applications 110. For example, in Figure 2 In the examples described in the context of , communication unit 285 of computing system 280 detects input and outputs information about the input to policy module 291. Policy module 291 determines that the input corresponds to information about application 110A. In some examples, the information about application 110A identifies one or more network resources 101 that application 110A uses, monitors, or otherwise interacts with to perform an operation or function. The source of the input can be an administrator, an application owner (e.g., an “owner” of application 110A), or another source, such as a data store available to computing system 280. In the described examples, the information about application 110A identifies network resource 101A as a network resource that application 110A uses, monitors, or otherwise interacts with when application 110A executes within cloud network 150. The information about application 110A also specifies its requirements for network resources 101A, which may detail how application 110A is expected to interact with network resources 101A, the amount of data it will require from network resources 101A, the frequency with which such data will be required, which features of network resources 101A will be used and / or should be enabled, minimum requirements for latency, and / or other information. In some examples, policy module 291 of computing system 280 may interact with cloud controller 151 to provide and / or extend infrastructure within cloud network 150 to enable application 110A to operate efficiently based on the operations expected to be performed by application 110A.

[0059] Computing system 280 can establish a policy for network resource 101A. For example, continuing with Figure 2In the example described, the policy module 291 uses information about the application 110A to determine a service level agreement for the application 110A, which may take the form of a contract between the cloud network 150, the computing system 280, and the owner / administrator of the application 110A. The service level agreement may define the expected performance characteristics and accessibility of the network resources 101A to be launched and / or managed by the computing system 280. Such characteristics and accessibility information may specify, for example, the responsiveness of the network resources 101A to requests of the application 110A, the refresh rate of data to be sent to the application 110A by the network resources 101A, the maximum payload size, the characteristics of the network resources 101A that can be used to launch and / or launch the application 110A, and how management techniques (such as shaping, caching, and fallback protection) may be used to execute the requests made by the application 110A. Based on the service level agreement for the application 110A, the policy module 291 generates a policy 295A. The policy 295A reflects how the requirements made by one or more applications 110 (e.g., the application 110A) on the network resources 101A will be managed. In the depicted example, policy 295A will ultimately be executed by access module 292 of computing system 280. Access module 292 uses policy 295A to ensure that applications 110 within cloud network 150 do not frequently interact with network resources 101A, thereby compromising the ability of network resources 101A to operate efficiently. Policy module 291 stores and / or registers policy 295A within data storage 299.

[0060] When initiating communication between application 110A and network resource 101A, computing system 280 may apply policy 295A. Figure 2 In the example described in the context of , the communication unit 285 of the computing system 280 detects an input and outputs information about the input to the access module 292. The access module 292 determines that the input corresponds to a request 111A received from the application 110A. The access module 292 further determines that the request 111A is or includes a request by the application 110A to interact with the network resource 101A. In some examples, the request 111A may represent a request by the application 110A to receive construction or telemetry information from the network resource 101A, or the request 111A may represent a request for other information. The access module 292 accesses the policy 295A, which governs various aspects of how the application 110A can interact with the network resource 101A. The access module 292 determines that the request 111A complies with the policy 295A. Therefore, the access module 292 causes the communication unit 285 to transmit the request 111A to the network resource 101A through the network 105. The network resource 101A responds to the request by outputting a response 121A through the network 105. Communication unit 285 of computing system 280 receives response 121A and forwards response 121A to application 110A.

[0061] The computing system 280 may apply the policy 295A to a series of requests 111A. For example, continuing again with the described example, the communication unit 285 of the computing system 280 detects an input and outputs information about the input to the access module 292. The access module 292 determines that the input corresponds to a series of requests 111A received from the application 110A. The access module 292 applies the policy 295A to determine how to process each request 111A in the series and ensure that each request 111A in the series is processed in a manner consistent with the policy 295A. In some examples, the access module 292A may use data shaping or rate limiting techniques to control the rate at which the requests 111A are transmitted from the cloud network 150 to the network resource 101A. The access module 292A may use such shaping techniques to smooth out bursts of requests and ensure that the rate of requests from the application 110A complies with the policy 295A for the network resource 101A. Alternatively or additionally, the access module 292A may use queuing techniques to store requests 111A from the application 110A, particularly in situations where transmitting all of the requests 111A would overburden the network resource 101A, or would cause congestion, delays, and / or result in dropped requests. If the application 110A issues requests 111A to the network resource 101A too frequently, the access module 292 may regulate the requests by controlling the rate at which requests are sent to the network resource 101A in accordance with the policy 295A. In some cases, the access module 292 may control the rate at which requests 111A are sent to the network resource 101A by dropping requests that exceed the rate specified by the policy 295A and / or that exceed the available network capacity at a given time.

[0062] The computing system 280 may receive information about additional applications 110 that may use the network resource 101A. For example, still referring to Figure 2 , communication unit 285 of computing system 280 detects input determined by policy module 291 to correspond to information about application 110B. The source of the input may be an administrator, an “owner” of application 110B, or another source. Policy module 291 further determines that the information identifies network resource 101A as a network resource that application 110B is expected to use, monitor, or otherwise interact with when executing within cloud network 150. Policy module 291 uses this information to determine parameters for how application 110B is expected to use network resource 101A, and such parameters may be used to generate a service level agreement for application 110B, which may be in the form of a contract between cloud network 150, computing system 280, and application 110B. Policy module 291 may interact with cloud controller 151 to provide a cloud infrastructure for application 110B that is consistent with the service level agreement.

[0063] Computing system 280 may update policy 295A to account for the use of network resource 101A by application 110B. Figure 2 , based on information about application 110B, policy module 291 determines whether any changes need to be made to policy 295A given the additional demands that application 110B may place on network resource 101A and the obligations that network resource 101 has already assumed according to policy 295A. Policy module 291 makes any appropriate changes to policy 295A and stores and / or registers the updated policy 295A in data storage 299. Policy module 291 may determine that the additional demands of application 110B may negatively impact network resource 101A by slowing down network resource 101A or making network resource 101B less responsive or effective. In such a case, policy module 291 may adjust policy 295A to ensure that network resource 101A can still operate effectively in the case where both application 110A and application 110B place demands on network resource 101A. Such modifications may be made before application 110B is put into production in cloud network 150. In other examples, policy 295A may be modified dynamically (after application 110B has been put into production) based on observations of how network resource 101A performs in response to interactions with applications 110A and 110B. In either case, policy module 291 may adjust policy 295A by making it more or less restrictive relative to the service requirements of application 110.

[0064] In some cases, computing system 280 may consolidate aspects of how it controls and / or manages access to network resource 101A. In other words, policy module 291 may determine that there is some overlap in the needs and / or requirements of application 110A and application 110B. As an example, assume that policy module 291 determines that application 110A plays music and requests telemetry data from network resource 101A every minute (i.e., network resource 101B responds to request 111A with response 121A every minute), while application 110B is expected to request the same telemetry data from network resource 101A every three minutes (i.e., network resource 101A responds to request 111B with response 121B every three minutes). In such an example, policy module 291 may determine that requests by both application 110A and application 110B may be consolidated so that less frequent requests by application 110B may be serviced by using data derived from response 121A generated by request 111A. In some cases, policy module 291 may determine that some of requests 111A and / or 111B may be serviced using data expected to be stored within a cache managed by cache module 293 of computing system 280. In such examples, some requests may be serviced by computing system 280 through data previously stored within a cache or data store 299 of computing system 280 without interacting with network resource 101A. Thus, when updating or otherwise modifying policy 295A, policy module 291 may consider the impact of the expected availability of cached data on requests made by applications 110A and 110B.

[0065] Computing system 280 may apply updated policy 295A. For example, referring again to Figure 2 , a communication unit 285 of the computing system 280 receives a series of requests 111A from the application 110A and a series of requests 111B from the application 110B. For each such request 111, the communication unit 285 outputs information about the request to the access module 292. The access module 292 determines that each request 111 represents a request destined for the network resource 101A. The access module 292 applies a policy 295A to manage the flow of requests 111 sent to the network resource 101A over the network 105. In doing so, the access module 292 determines whether and how to apply data shaping, queuing, or policing operations to the requests 111. For some or all of the requests 111, the access module 292 can cause the cache module 293 to determine whether the cached data is stored in the data store 299, which enables the request to be satisfied without interacting with the network resource 101A over the network 105. As a result of the data management operations performed by access module 292, network resource 101A may operate efficiently without being negatively impacted by the volume of requests 111 or other obligations imposed by application 110A or application 110B.

[0066] The computing system 280 may establish policies for other network resources 101 within the cloud network 150 and outside the cloud network 102 that are used by the applications 110. For example, the policy module 291 of the computing system 280 may receive information about other applications 110 within the cloud network 150 that will interact with various network resources 101 within the cloud network 102. For each such network resource 101, an appropriate policy 295 may be established by the policy module 291 that governs access to each particular network resource 101 by the applications 110 executing the cloud network 150. For example, the policy module 291 may follow a process similar to that previously described with respect to the network resource 101A to establish a policy 295B for the network resource 101B. In such an example, the policy 295B may be used to govern access to the network resource 101B by the applications 110 within the cloud network 150. And in general, policy module 291 may follow a similar process to establish policy 295M to manage and / or regulate access to network resources 101M by applications 110 within cloud network 150. Each such policy 295 (i.e., policies 295A through 295M) may be executed by access module 292 of computing system 280. Thus, computing system 280 may act as a policy enforcement point through which each request 111 and other traffic flows from application 110 executing cloud network 150 to network resources 101 operating in out-of-cloud network 102.

[0067] When multiple applications 110 have potentially overlapping QoS requirements, the policies associated with each application 110 may be merged to ensure that the computing system 280 can provide the required QoS levels for all applications 110. This may be accomplished by defining a set of rules that govern how the QoS policies for each application 110 should be combined. For example, if two applications 110 require their requests to have high priority, the QoS policy for the resources shared by the applications 110 should be set to prioritize requests through the two applications 110. If one application 110 requires high priority and the other requires medium priority, the computing system 280 should prioritize the high priority requests and ensure that the medium priority requests are not blocked entirely.

[0068] The merged policy may combine the required QoS or, depending on how the merged policy is constructed, determine a high denominator between the policies. For example, if two applications 110 define policies that require a function to be executed after a given network resource 101 is restarted, the policies may be merged to execute the function once on behalf of both applications 110. A high denominator example may include a policy from application 110A that requires a function to be run once every 30 seconds, while application 110B defines a policy for the same function that requires execution once every 1 minute. The merged policy will run the function once every 30 seconds to satisfy both application 110A and application 110B.

[0069] For individual shared resources or other off-cloud network resources, a default set of policies may be available and enabled and may also be appropriate. These default policies can help ensure that shared resources are used efficiently and effectively without specific policies for individual applications 110 and / or network resources 101. Default policies may include request limits, priority rules, and security measures to protect shared resources from access or abuse. Cloud controller 151, an administrator of cloud network 150, or another system or stakeholder may also customize default policies for individual shared resources to better match specific requirements and optimize resource utilization. For example, a system may require a minimum set of functions that translate into a minimum QoS for a given shared resource. This may include running certain functions or specific functions for a given network resource 101 during a limited time period. Default policies can ensure that this is consistently supported, regardless of whether the requirements of the application supersede these requirements or whether the application provides any requirements.

[0070] Various schema languages ​​may be employed to define the policies applied by the access module 292 of the computing system 280. Such languages ​​may include user-defined domain specific languages ​​(DSLs) using JSON, XML, or YAML formats. And schemas for related domains, such as XACML (Extensible Access Control Markup Language), may be reused to achieve this goal.

[0071] In order to effectively define and enforce policies within a policy enforcement point, a policy architecture may need to be able to define concepts such as rules, policies, policy sets, and targets. Specifically, "rules" define conditions or actions that must be met or taken to comply with a policy. A "policy" is a set of rules that enforces a specific goal or requirement. A "policy set" is used to group related policies together, providing a way to manage policies at a higher level of abstraction. And a "target" is a criterion that defines the context in which a policy or policy set should be applied. Targets can include information such as the identity of the application, the type of resource requested, or the time when the request was made (this list is not exhaustive).

[0072] In addition to these basic concepts, the strategy pattern may also need to support other features, such as the ability to define obligations and recommendations or reference external information sources, such as public service endpoints or web services. For example, an exemplary document illustrating one possible format can be represented as follows:

[0073]

[0074]

[0075]

[0076] References in this article Figure 2 In various examples described, policies 295 are used to manage access by applications 110 executing within the cloud network 150 to network resources 101 operating within the out-of-cloud network 102. In such examples, the access module 292 manages such access by applying shaping, queuing, policing, and other network management techniques to requests 111 sent by the application 110 to a given network resource 101 in the out-of-cloud network 102. These examples are "north-to-south" management of application data flows, at least in the sense that requests originating from the cloud network 150 are managed and / or regulated when transmitted to the out-of-cloud network 102. At least one purpose of such management is to ensure that applications 110 (or a subset of applications 110) executing within the cloud network 150 do not over-consume resources of a particular network resource 101 operating in the out-of-cloud network 102. Policies 295 are described as a way to ensure that the performance of each network resource 101 is not degraded or otherwise negatively impacted by the application 110.

[0077] However, similar techniques can also be applied to manage data flows "from south to north". Figure 2 In another example described in the context of , each of network resources 101A to 101M can stream or otherwise transmit a large amount of data to a specific application 110 (such as application 110N) executing within cloud network 150 for consumption and processing by the application. In one example, network resource 101A can be configured to stream data (e.g., Figure 2 Similarly, other network resources 101B to 101M may also be configured to send data to application 110N. If the amount of data received by application 110N from various network resources 101 is large enough, application 110N may experience high utilization and may have difficulty processing all data sent by the collection of network resources 101 within the off-cloud network 102.

[0078] Thus, the policy module 291 of the computing system 280 may be adapted to establish appropriate north-south policies 297 for each of the applications 110 to manage the flow of data sent by the network resources 101 in the off-cloud network 102 to a given application 110 executing in the cloud network 150. In such an example, the access module 292 may not only regulate the north-south flow of data according to the policies 295, but the access module 292 may also regulate the north-south flow of data according to the south-south policies 297. For example, the policy module 291 of the computing system 280 may establish a south-south policy 297A that the access module 292 uses to regulate access to (or data sent to) the application 110A by the network resources 101A to 101M of the off-cloud network 102. Similarly, the policy module 291 may establish a south-south policy 297B that the access module 292 uses to regulate access to the application 110B by the network resources 101A to 101M. And generally, the policy module 291 may establish a south-to-north policy 297N to regulate access of network resources 101A to 101M to the application 110N.

[0079] In some aspects, the purpose of the north-south management of data flows (via policies 295) is to minimize the impact that applications 110 executing within the cloud network 150 may have on network resources 101 operating within the off-cloud network 102. Correspondingly, the purpose of the south-to-north management of data flows (via south-to-north policies 297) is to minimize the impact that network resources 101 operating within the off-cloud network 102 may have on applications 110 executing within the cloud network 150. In some cases, avoiding impact on network resources 101 may be considered a higher priority than avoiding impact on applications 110, particularly where the off-cloud network 102 represents an enterprise network, a local network, and / or a customer network that is not easily scalable. On the other hand, it can be expected that the cloud network 150 can efficiently and dynamically scale infrastructure so that applications 110 can recruit additional infrastructure on an as-needed basis as the demand for such applications 110 grows. However, scaling applications 110 still requires additional resources and comes with corresponding costs for those additional resources, so even in a scalable cloud environment, management of the demand for applications 110 remains important to manage and regulate. Therefore, at least one purpose of north-south management of data flows is to minimize the costs incurred by the use of cloud network 150 .

[0080] Figure 2The modules shown in (e.g., policy module 291, access module 292, cache module 293) and / or modules shown or described elsewhere in this disclosure can use software, hardware, firmware, or a combination of hardware, software, and firmware resident in and / or executed at one or more computing devices to perform the described operations. For example, a computing device can utilize multiple processors or multiple devices to execute one or more of such modules. A computing device can execute one or more such modules, such as a virtual machine executed on underlying hardware. One or more such modules can be executed as one or more services of an operating system or computing platform. One or more such modules can be executed as one or more executable programs at the application layer of a computing platform. In other examples, the functions provided by the modules can be implemented by dedicated hardware devices.

[0081] Although some modules, data storage devices, components, programs, executable programs, data items, functional units and / or other items included in one or more storage devices can be shown separately, one or more of such items can be combined and operated as a single module, component, program, executable program, data item or functional unit. For example, one or more modules or data storage devices can be combined or partially combined so that they operate or provide functions as a single module. In addition, one or more modules can interact and / or cooperate with each other so that, for example, a module serves as a service or extension of another module. In addition, each module, data storage device, component, program, executable program, data item, functional unit or other item shown in the storage device can include multiple components, subcomponents, modules, submodules, data storage devices and / or other components or modules or data storage devices not shown.

[0082] In addition, each module, data storage, component, program, executable program, data item, functional unit or other item shown in the storage device can be implemented in various ways. For example, each module, data storage, component, program, executable program, data item, functional unit or other item shown in the storage device can be implemented as a downloadable or pre-installed application or "app". In other examples, each module, data storage, component, program, executable program, data item, functional unit or other item shown in the storage device can be implemented as part of an operating system executed on a computing device.

[0083] Figure 3A is a conceptual diagram illustrating an example process for implementing a policy for constraining shared usage of limited resources outside a cloud network in accordance with one or more aspects of the present disclosure. Figure 3ASeveral steps are shown, each of which can be performed by any of several participants, including the network resource owner (NRO), application owner (AO), cloud administrator (CA), and shared resource owner (SRO). These participants are Figure 3A Although described in terms of human participants, at least some of these participants may be implemented by a computing system.

[0084] The Network Resource Owner (NRO) can manage specific network resources shared by multiple applications. Such management can include connections to the cloud, access levels provided to the CA, etc. The NRO can work closely with the AO to ensure that network resources are used effectively and efficiently, and can also work with the CA to define policies and QoS requirements for shared resources.

[0085] An application owner (AO) manages one or more applications 110 running on a cloud infrastructure (eg, cloud network 150). An application owner may be responsible for defining QoS requirements and SLAs for its applications, and monitoring application performance and resource utilization.

[0086] A cloud administrator (CA) manages the cloud infrastructure and ensures that shared resources are allocated efficiently and effectively. A cloud administrator may oversee tasks such as provisioning and deprovisioning network resources, managing access controls, and monitoring performance metrics to ensure that SLAs are met.

[0087] A shared resource owner (SRO) develops, provides, or is otherwise responsible for a particular shared resource (eg, network resource 101) utilized by one or more applications. The SRO will typically manage the deployment of shared resources in conjunction with the CA.

[0088] By working together, these participants can help ensure that network resources are used effectively and efficiently while meeting the needs of all stakeholders. The CA can provide the necessary infrastructure and work with the SRO to provide shared resources, while the AO and NRO can help define requirements and ensure that resources are used according to those requirements. This collaborative approach can maximize the value of network resources and improve the overall performance of cloud-based applications.

[0089] Reference now Figure 3A, the AO describes the QoS requirements during the application development phase and the CA and SRO work to define the policy in the PEP and extend the Infra (Infrastructure) as needed. This process prepares the cloud network for the first connection of the network resources (NR) using the application. During the NRO connection phase, the NRO registers the network resources (NR) with the cloud infrastructure. The AO describes its Quality of Service (QoS) requirements for the NR, which may include aspects such as the features to be started, the frequency of tasks to be run, the minimum requirements for latency, performance, etc. The cloud administrator (CA) agrees to the SLA (application development phase) and defines the QoS policy that reflects the requirements of the AO.

[0090] The CA registers the policy with the Policy Enforcement Point (PEP), which is responsible for enforcing the policy on the Shared Resource (SR). Figure 1B Management system 180 or Figure 2 The PEP implemented by the computing system 280 uses techniques such as shaping, policing, queuing, and prioritization to enforce policies and ensure that applications use NRs according to SLAs. Throughout the process, analysis is performed to understand the current state of the resources and identify potential sources of any congestion. Overall, the solution involves a combination of QoS mechanisms and policies to ensure that shared resources are used fairly and efficiently while meeting the needs of the different applications that rely on it.

[0091] Figure 3B is similar to Figure 3A However, a conceptual diagram of a process for implementing a policy for constraining shared use of limited resources across multiple applications is shown in accordance with one or more aspects of the present disclosure. Figure 3B In the example, application owners 1 and 2 follow the same Figure 3A A similar process is used for QoS and SLA definition of network resources. Figure 3B In , PEP manages these two sets of constraints through an update policy for network resources, where multiple applications are using the same network resources.

[0092] If shared resource usage constraints are not implemented, problems may arise. These problems may involve resource contention (e.g., applications may compete for the same resources, resulting in resource contention and performance degradation for one or more applications), inefficient resource usage (e.g., without appropriate constraints, one or more applications may use more than their fair share of resources, resulting in inefficient resource usage), and / or SLA violations (e.g., if the QoS and SLA requirements of all applications are not properly considered and enforced, SLA violations may result for one or more applications). By implementing shared network resource usage constraints, PEP can ensure that all applications can share resources fairly and that the QoS and SLA requirements of all applications are properly considered and enforced, thereby avoiding the above situations.

[0093] Figure 3C is a conceptual diagram illustrating a process that may be followed when deactivating an application in accordance with one or more aspects of the present disclosure. When an application is deactivated, the resources used by the application should be released and made available to other applications. This includes releasing any network resources allocated to the application to ensure that network resources are not over-provisioned or under-utilized. Such application lifecycle management practices may be in place to ensure that resources used by applications are released quickly and efficiently. For example, if a new merge policy defines a lower set of features installed on the NR once an application is deactivated, the SR should ensure that any features that are no longer required are uninstalled. Similarly, the periodic function executed by the SR should reflect the new highest denominator of the merge policy.

[0094] Figure 4A is a conceptual diagram illustrating a process in which shaping techniques are applied to the use of a shared network resource to ensure that such use complies with a policy associated with the shared network resource in accordance with one or more aspects of the present disclosure. In the context of network resource management, shaping refers to the process of controlling the rate at which requests are transmitted from the SR to the NR. Shaping is used to smooth bursts of requests and ensure that the request rate complies with a predetermined profile or policy. Shaping works by delaying requests so that they are transmitted at a rate that complies with the shaping policy. When the rate of incoming requests exceeds the allowed rate, requests can be stored in a buffer until the allowed rate is available. Shaping may delay request transmissions, but it helps prevent congestion and ensures efficient use of available capacity.

[0095] Figure 4B is a conceptual diagram illustrating a process in which queuing techniques are applied to the use of a shared network resource to ensure that such use complies with policies associated with the shared network resource in accordance with one or more aspects of the present disclosure. In network resource management, queuing refers to the storage of shared resource requests in a buffer (queue) when the SR cannot transmit them immediately. Queuing may be necessary because a shared resource may receive requests faster than it can transmit them, which may cause congestion and cause requests to be lost or delayed (or requests to be suppressed). When requests are queued, they are stored in a buffer and prioritized according to their importance or other factors. The queued requests are then transmitted in the order in which they are received and based on their priority, with higher priority requests transmitted before lower priority requests.

[0096] Figure 4Cis a conceptual diagram illustrating a process in which policing techniques are applied to the use of a shared network resource to ensure that such use complies with policies associated with the shared network resource in accordance with one or more aspects of the present disclosure. In network resource management, policing controls the rate of requests originating from a SR by enforcing a maximum allowable request transmission rate. Policing is a form of request regulation that involves monitoring the flow of requests on a network resource and dropping requests that exceed a certain rate or violate certain policies. Policing is often used to control network resource congestion, prevent oversubscription of network resources, and enforce service level agreements between cloud operators and their application owners.

[0097] Figure 5 is a flowchart illustrating operations performed by an exemplary computing system according to one or more aspects of the present disclosure. Figure 2 The computing system 280 is described in the context of Figure 5 In other examples, Figure 5 The operations described in can be performed by one or more other components, modules, systems, or devices. In addition, in other examples, in combination Figure 5 The operations described may be combined, performed in a different order, omitted, or may include additional operations not specifically shown or described.

[0098] exist Figure 5 In the process shown in , and according to one or more aspects of the present disclosure, computing system 280 may receive a first request to be transmitted to an off-cloud network resource from a first application executed in a cloud environment (501). For example, communication unit 285 of computing system 280 detects an input and outputs information about the input to access module 292. Access module 292 determines that the input corresponds to a request received from a specific application (such as application 110A). Access module 292 also determines that the request is directed to network resource 101A of off-cloud network 102.

[0099] Computing system 280 may receive a second request from a second application executing in the cloud environment to be transmitted to an out-of-cloud network resource (502). For example, communication unit 285 of computing system 280 detects that access module 292 determines that the input corresponds to an input of a request received from application 110B. Access module 292 also determines that the request from application 110B is directed to network resource 101A of out-of-cloud network 102.

[0100] The computing system 280 may manage the transmission of the first request and the second request to the network resource outside the cloud based on the policy (503). For example, the access module 292 accesses the policy 295 applied to the network resource 101A from the storage device 290. The access module 292 evaluates the requests from the applications 110A and 110B according to the policy 295. The access module 292 determines whether and how to apply data shaping, queuing, or supervision operations to the requests through the applications 110A and 110B. The access module 292 may cause the communication unit 285 to transmit some or all requests to the network resource 101A through the network 105 for processing by the network resource 101A.

[0101] For the process described in this article, equipment and other examples or diagrams included in any flow chart or process flow diagram, some operations, actions, steps or events included in any technology described in this article can be performed in different orders, can be added, merged or completely ignored (for example, not all described actions or events are necessary for practical technology). In addition, in some examples, operations, actions, steps or events can be performed in parallel, for example, by multithreading, interrupt processing or multiple processors, rather than sequentially. In addition, some operations, actions, steps or events can be performed automatically, even if not specifically identified as automatically performed. In addition, some operations, actions, steps or events described as being performed automatically may be performed alternatively non-automatically, but in some examples, such operations, actions, steps or events may be performed in response to input or another event.

[0102] The disclosures of all publications, patents, and patent applications mentioned herein are incorporated herein by reference. To the extent any such disclosure incorporated by reference conflicts with the present disclosure, the present disclosure controls.

[0103] For ease of explanation, a limited number of devices (e.g., management system 180, computing system 280, cloud controller 151, network resources 101, and other devices) are shown in the drawings and / or other diagrams referenced herein. However, the technology according to one or more aspects of the present disclosure can be performed using more such systems, components, devices, modules, and / or other items, and the collective reference to such systems, components, devices, modules, and / or other items can represent any number of such systems, components, devices, modules, and / or other items.

[0104] The accompanying drawings included herein each illustrate at least one exemplary implementation of aspects of the present disclosure. However, the scope of the present disclosure is not limited to such implementations. Therefore, other examples or alternative implementations (except those shown in the figures) of the systems, methods, or techniques described herein may be suitable for other instances. Such implementations may include a subset of the devices and / or components included in the accompanying drawings and / or may include additional devices and / or components not shown in the accompanying drawings.

[0105] The detailed description set forth above is intended to be a description of various configurations and is not intended to represent the only configuration in which the concepts described herein may be practiced. The detailed description includes specific details for the purpose of providing a thorough understanding of the various concepts. However, these concepts may be practiced without these specific details. In some cases, well-known structures and components are shown in block diagram form in reference figures to avoid blurring such concepts.

[0106] Therefore, although one or more implementations of various systems, devices and / or components may be described with reference to specific figures, such systems, devices and / or components may be implemented in many different ways. For example, one or more devices shown herein as separate devices may be implemented as a single device instead; one or more components shown as separate components may be implemented as a single component instead. In addition, in some examples, one or more devices shown in the figures herein as a single device may be implemented as multiple devices instead; one or more components shown as a single component may be implemented as multiple components instead. Each of such multiple devices and / or components may be directly coupled via wired or wireless communications and / or remotely coupled via one or more networks. In addition, one or more devices or components that may be shown in various figures herein may be implemented as part of another device or component not shown in such figures instead. In this way and in other ways, some of the functions described herein may be performed via distributed processing of two or more devices or components.

[0107] In addition, some operations, techniques, features and / or functions may be described herein as being performed by specific components, devices and / or modules. In other examples, such operations, techniques, features and / or functions may be performed by different components, devices or modules. Therefore, some operations, techniques, features and / or functions that may be described herein as belonging to one or more components, devices or modules may be attributed to other components, devices and / or modules in other examples, even if not specifically described in this manner herein.

[0108] Although specific advantages have been identified in conjunction with the description of some examples, various other examples may include some, all, or none of all the listed advantages. Other technical or other advantages may become apparent to those of ordinary skill in the art in light of this disclosure. Furthermore, although specific examples have been disclosed herein, aspects of the disclosure may be implemented using any number of technologies, whether currently known or not, and therefore, the disclosure is not limited to the examples specifically described and / or shown in this disclosure.

[0109] In one or more examples, the functions described may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functions may be stored on and / or transmitted through a computer-readable medium as one or more instructions or codes, and executed by a hardware-based processing unit. Computer-readable media may include computer-readable storage media corresponding to tangible media such as data storage media, or communication media, including any media that facilitates the transfer of a computer program from one place to another (e.g., according to a communication protocol). In this manner, computer-readable media may generally correspond to: (1) a non-transient tangible computer-readable storage medium; or (2) a communication medium such as a signal or carrier wave. Data storage media may be any available media that can be accessed by one or more computers or one or more processors to retrieve instructions, codes, and / or data structures for implementing the techniques described in the present disclosure. A computer program product may include a computer-readable medium.

[0110] By way of example and not limitation, such computer-readable storage media may include RAM, ROM, EEPROM or optical disk storage devices, disk storage devices, or other magnetic storage devices, flash memory, or any other medium that can be used to store desired program codes in the form of instructions or data structures and can be accessed by a computer. In addition, any connection can be appropriately referred to as a computer-readable medium. For example, if a wired (e.g., coaxial cable, fiber optic cable, twisted pair) or wireless (e.g., infrared, radio, and microwave) connection is used to transmit instructions from a website, server, or other remote source, the wired or wireless connection is included in the definition of the medium. However, it should be understood that computer-readable storage media and data storage media do not include connections, carriers, signals, or other transient media, but rather relate to non-temporary tangible storage media.

[0111] Instructions may be executed by one or more processors, such as one or more digital signal processors (DSPs), general-purpose microprocessors, application-specific integrated circuits (ASICs), field-programmable logic arrays (FPGAs), or other equivalent integrated or discrete logic circuits. Thus, the terms "processor" or "processing circuitry" as used herein may each refer to any of the aforementioned structures or any other structure suitable for implementing the techniques described herein. Additionally, in some examples, the described functionality may be provided within dedicated hardware and / or software modules. Furthermore, the techniques may be fully implemented in one or more circuits or logic elements.

[0112] The technology of the present disclosure can be implemented in a wide variety of devices or equipment, including wireless handsets, mobile or non-mobile computing devices, wearable or non-wearable computing devices, integrated circuits (ICs) or IC sets (e.g., chipsets). Various components, modules, or units are described in this disclosure to emphasize the functional aspects of devices configured to perform the disclosed technology, but do not necessarily need to be implemented by different hardware units. Instead, as described above, the various units can be combined in a hardware unit, or provided by a collection of interoperable hardware units including one or more processors as described above in combination with appropriate software and / or firmware.

Claims

1. A computing system comprising a processing circuit and a storage device, wherein: The processing circuit has access to the storage device and is configured to: receiving a first request from a first application executing in the cloud environment to be transmitted to a network resource outside the cloud; receiving, from a second application executing in the cloud environment, a second request to be transmitted to the off-cloud network resource; as well as Transmission of the first request and the second request to the out-of-cloud network resource is managed based on a policy.

2. The computing system of claim 1, wherein: The processing circuit is further configured to: The policy is generated based on expected usage of the out-of-cloud network resources by the first application and the second application.

3. The computing system of claim 2, wherein: To generate the strategy, the processing circuit is further configured to: establishing a service level agreement for the first application; and A service level agreement is established for the second application.

4. The computing system according to any one of claims 2 to 3, wherein: To generate the strategy, the processing circuit is further configured to: generating an initial policy based on expected usage of the out-of-cloud network resources by the first application; and The initial policy is updated based on expected usage of the out-of-cloud network resources by the second application.

5. The computing system according to any one of claims 1 to 3, wherein: To manage the transmission, the processing circuit is further configured to: One or more network management techniques are applied to the first request and the second request.

6. The computing system of claim 5, wherein: The strategies include: The maximum rate at which requests may be transmitted to network resources outside the cloud.

7. The computing system of claim 6, wherein: To apply the one or more network management techniques, the processing circuit is further configured to: A rate at which requests are transmitted to the off-cloud network resource is controlled to ensure that the rate does not exceed the maximum rate.

8. The computing system of claim 6, wherein: To apply the one or more network management techniques, the processing circuit is further configured to: The second request is queued in a buffer to avoid sending requests to the out-of-cloud network resource at a rate faster than the maximum rate.

9. The computing system of claim 6, wherein: To apply the one or more network management techniques, the processing circuit is further configured to: Requests that would cause the number of requests sent to the out-of-cloud network resource to exceed the maximum rate are discarded.

10. The computing system according to any one of claims 1 to 3, 6 to 9, wherein: The off-cloud network resource is included in a plurality of off-cloud network resources, and wherein the processing circuit is further configured to: A south-to-north policy is generated for data flows from the plurality of off-cloud network resources to the first application.

11. The computing system of claim 11, wherein: To generate the south-to-north policy, the processing circuit is further configured to: The south-to-north policy is generated based on an expected data flow from each of the off-cloud network resources to the first application.

12. The computing system of claim 11, wherein: The processing circuit is further configured to: Data flow to the first application is managed based on the south-to-north policy.

13. The computing system of claim 12, wherein: To manage the data flow to the first application, the processing circuit is further configured to: Apply one or more network management techniques.

14. The computing system of claim 13, wherein: To apply the one or more network management techniques, the processing circuit is further configured to: The data flow is shaped, data from the data flow is queued, and the data flow is supervised.

15. The computing system of claim 12, wherein: In order to manage the data flow, the processing circuit is further configured to: Cloud infrastructure resources of the cloud environment available to the first application are expanded.

16. A method comprising: Receiving, by the network management system and from a first application executing in the cloud environment, a first request to be transmitted to a network resource outside the cloud; receiving, by the network management system and from a second application executing in the cloud environment, a second request to be transmitted to the out-of-cloud network resource; as well as Transmission of the first request and the second request to the out-of-cloud network resources is managed by the network management system and based on policies.

17. The method according to claim 16, further comprising: The policy is generated by the network management system based on expected usage of the out-of-cloud network resources by the first application and the second application.

18. The method according to claim 17, wherein: Generating the strategy includes: establishing a service level agreement for the first application; and A service level agreement is established for the second application.

19. The method according to any one of claims 17 to 18, wherein: Generating the strategy includes: generating an initial policy based on expected usage of the out-of-cloud network resources by the first application; and The initial policy is updated based on expected usage of the out-of-cloud network resources by the second application.

20. A computer readable medium encoded with instructions for causing one or more programmable processors to perform the method of any one of claims 16 to 19.

Images