Cloud Agnostic Blueprint Network Isolation Strategy

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Cloud automation tools lack flexibility in network isolation strategies, limiting developers' ability to focus on application design and forcing cloud administrators to make decisions based on specific cloud provider constraints, while also restricting resource management.

Innovation Solution

A cloud automation system that separates the network isolation strategy from the blueprint design, allowing cloud administrators to define and apply different network isolation strategies (subnetworks, security groups, or no isolation) based on cloud provider limitations and workload requirements, enabling flexible deployment across various cloud environments.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If cloud automation tools require developers to specify network isolation strategies in blueprint design, then network security is improved, but developer flexibility and ease of application design deteriorate

Engineering Contradiction:

Improvenetwork securityVSAvoidease of application design

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent segments the network isolation strategy specification from the blueprint design process. Developers only define high-level network requirements in the blueprint, while cloud administrators separately configure specific isolation strategies (subnetworks, security groups, or no isolation) based on cloud provider constraints and workload needs. This separation allows developers to focus on application design without being burdened by implementation details.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent extracts the network isolation strategy configuration from the blueprint design itself. The isolation strategy is defined as a separate cloud profile that can be independently configured and applied to multiple blueprints. This extraction enables developers to design applications without worrying about cloud-specific network isolation implementations.

Inventive Principle:

Principle #2Taking out (Extraction)

2Reliability

If cloud automation tools enforce specific cloud provider network isolation constraints, then cloud provider compatibility is improved, but adaptability across different cloud environments deteriorates

Engineering Contradiction:

Improvecloud provider compatibilityVSAvoidadaptability across cloud environments

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent creates a universal cloud profile structure that can accommodate multiple cloud providers and different network isolation strategies. A single blueprint can be deployed across different cloud environments by selecting appropriate cloud profiles that specify provider-specific isolation mechanisms. This multi-functionality allows the same application design to adapt to various cloud providers without modification.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The patent introduces cloud profiles as an intermediary layer between the blueprint and cloud provider-specific implementations. The cloud profile contains provider-specific network isolation configurations (such as AWS security groups, Azure network security groups, or GCP firewall rules) that mediate between the generic blueprint requirements and provider-specific constraints, enabling seamless cross-cloud deployment.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Reliability

If cloud administrators must make network isolation decisions based on cloud provider constraints, then cloud provider compliance is improved, but resource management flexibility deteriorates

Engineering Contradiction:

Improvecloud provider complianceVSAvoidresource management flexibility

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent enables dynamic selection of network isolation strategies through cloud profiles. Cloud administrators can configure different isolation approaches (subnetwork isolation, security group isolation, or no isolation) based on workload requirements, cloud provider constraints, and resource availability. The system dynamically applies the appropriate isolation strategy from the selected cloud profile during deployment, allowing flexible resource management while maintaining compliance.

Inventive Principle:

Principle #15Dynamics

Data Source

PatentUS11249781B2Cloud agnostic blueprint

Publication Date: 2022.02.15 VMWARE INC

AI summary

A method to implement a cloud application includes receiving a blueprint of the cloud application, wherein the blueprint specifies virtual machines and a network connecting the virtual machines and being isolated from traffic external to the virtual machines. The method further includes automatically selecting a cloud profile specifying a cloud provider and a network isolation strategy and deploying the blueprint with the cloud provider by causing the cloud provider to create the virtual machines, create the network with the network isolation strategy, and attach the virtual machines to the network.