Granted Patent B2

US 12,483,601 · App. 17/248,529 · Granted Nov 25, 2025

Inventors: Toan Van Nguyen (Singapore, SG); Qiyuan Zheng (Sammamish, WA); Santhosh Ram Vetrinadar Manohar (San Jose, CA); Varun Kulkarni Somashekhar (Fremont, CA); Prabhat Singh (Sunnyvale, CA)

Assignee: Salesforce, Inc.

H04L63/205

Abstract

Claims (71)

1 . A system comprising:

one or more memory devices; and

a server system comprising one or more processors in communication with the one or more memory devices, the server system configurable to cause:

obtaining a system input comprising:

a first version of a policy output, and

a second version of the policy output,

each version of the policy output comprising a version of a cloud-specific policy set specific to one of a plurality of clouds of different cloud providers;

generating a severity characteristic associated with deployment of the second version of the policy output to one of the plurality of clouds based on one or more differences between the first version of the policy output and the second version of the policy output, wherein the severity characteristic indicates an impact of at least one type of change associated with the one or more differences between the first version of the policy output and the second version of the policy output;

determining that the second version of the policy output is to be deployed without manual review of the second version of the policy output based on a determination that the severity characteristic indicative of the impact of the at least one type of change associated with the one or more differences between the first version and the second version is below a predetermined threshold; and

in response to determining that the second version of the policy output is to be deployed, deploying the second version of the policy output to the one of the plurality of clouds.

2 . The system of claim 1 , the server system further configurable to cause:

generating a report that includes the severity characteristic, wherein the report is generated based on the one or more differences between the first version of the policy output and the second version of the policy output; and

causing the report to be transmitted to a user device.

3 . The system of claim 2 , wherein causing the report to be transmitted to the user device comprises causing the report to be presented in a website that presents a dashboard related to a set of security policies.

4 . The system of claim 1 , the server system further configurable to cause:

designating each of the one or more differences between the first version of the policy output and the second version of the policy output as one of a plurality of types of changes; and

determining, for each of the one or more differences, the severity characteristic based on the type of change associated with the difference.

5 . The system of claim 4 , wherein the severity characteristic is retrieved from a table that associates a severity characteristic with each of the plurality of types of changes.

6 . The system of claim 1 , wherein the server system is further configurable to cause:

obtaining additional system input comprising a third version of the policy output;

generating a second severity characteristic that indicates a severity of deploying the third version of the policy output to the one of the plurality of clouds based on one or more differences between the second version of the policy output and the third version of the policy output;

determining whether to deploy the third version of the policy output based on the second severity characteristic; and

in response to determining that the third version of the policy output is not to be deployed, causing a report that indicates the one or more differences to be transmitted to a user device.

7 . The system of claim 6 , wherein the server system is further configurable to cause:

receiving, from the user device, an instruction to deploy the third version of the policy output; and

deploying the third version of the policy output to the one of the plurality of clouds in response to receiving the instruction from the user device.

8 . A non-transitory computer-readable medium comprising instructions, which, when executed by one or more processors cause performance of:

obtaining a system input comprising:

a first version of a policy output, and

a second version of the policy output,

each version of the policy output comprising a version of a cloud-specific policy set specific to one of a plurality of clouds of different cloud providers;

generating a severity characteristic associated with deployment of the second version of the policy output to one of the plurality of clouds based on one or more differences between the first version of the policy output and the second version of the policy output, wherein the severity characteristic indicates an impact of at least one type of change associated with the one or more differences between the first version of the policy output and the second version of the policy output;

determining that the second version of the policy output is to be deployed without manual review of the second version of the policy output based on a determination that the severity characteristic indicative of the impact of the at least one type of change associated with the one or more differences between the first version and the second version is below a predetermined threshold, wherein the at least one type of change comprises at least one of: an addition of a service, a removal of a service, allowing new traffic to access a provider, blocking one or more ports of traffic, blocking one or more particular communication protocols, or any combination thereof; and

in response to determining that the second version of the policy output is to be deployed, deploying the second version of the policy output to the one of the plurality of clouds.

9 . The non-transitory computer-readable medium of claim 8 , the instructions further configurable to cause:

generating a report that includes the severity characteristic, wherein the report is generated based on the one or more differences between the first version of the policy output and the second version of the policy output; and

causing the report to be transmitted to a user device.

10 . The non-transitory computer-readable medium of claim 9 , wherein causing the report to be transmitted to the user device comprises causing the report to be presented in a website that presents a dashboard related to a set of security policies.

11 . The non-transitory computer-readable medium of claim 8 , the instructions further configurable to cause:

designating each of the one or more differences between the first version of the policy output and the second version of the policy output as one of a plurality of types of changes; and

determining, for each of the one or more differences, the severity characteristic based on the type of change associated with the difference.

12 . The non-transitory computer-readable medium of claim 11 , wherein the severity characteristic is retrieved from a table that associates a severity characteristic with each of the plurality of types of changes.

13 . The non-transitory computer-readable medium of claim 8 , the instructions further configurable to cause:

obtaining additional system input comprising a third version of the policy output;

generating a second severity characteristic that indicates a severity of deploying the third version of the policy output to the one of the plurality of clouds based on one or more differences between the second version of the policy output and the third version of the policy output;

determining whether to deploy the third version of the policy output based on the second severity characteristic; and

in response to determining that the third version of the policy output is not to be deployed, causing a report that indicates the one or more differences to be transmitted to a user device.

14 . The non-transitory computer-readable medium of claim 13 , the instructions further configurable to cause:

receiving, from the user device, an instruction to deploy the third version of the policy output; and

deploying the third version of the policy output to the one of the plurality of clouds in response to receiving the instruction from the user device.

15 . A method comprising:

obtaining a system input comprising:

a first version of a policy output, and

a second version of the policy output,

each version of the policy output comprising a version of a cloud-specific policy set specific to one of a plurality of clouds of different cloud providers;

generating a severity characteristic associated with deployment of the second version of the policy output to one of the plurality of clouds based on one or more differences between the first version of the policy output and the second version of the policy output, wherein the severity characteristic indicates an impact of at least one type of change associated with the one or more differences between the first version of the policy output and the second version of the policy output;

determining that the second version of the policy output is to be deployed without manual review of the second version of the policy output based on a determination that the severity characteristic indicative of the impact of the at least one type of change associated with the one or more differences between the first version and the second version is below a predetermined threshold; and

in response to determining that the second version of the policy output is to be deployed, deploying the second version of the policy output to the one of the plurality of clouds.

16 . The method of claim 15 , further comprising:

generating a report that includes the severity characteristic, wherein the report is generated based on the one or more differences between the first version of the policy output and the second version of the policy output; and

causing the report to be transmitted to a user device.

17 . The method of claim 16 , wherein causing the report to be transmitted to the user device comprises causing the report to be presented in a website that presents a dashboard related to a set of security policies.

18 . The method of claim 15 , further comprising:

designating each of the one or more differences between the first version of the policy output and the second version of the policy output as one of a plurality of types of changes; and

determining, for each of the one or more differences, the severity characteristic based on the type of change associated with the difference.

19 . The method of claim 18 , wherein the severity characteristic is retrieved from a table that associates a severity characteristic with each of the plurality of types of changes.

20 . The method of claim 15 , further comprising:

obtaining additional system input comprising a third version of the policy output;

generating a second severity characteristic that indicates a severity of deploying the third version of the policy output to the one of the plurality of clouds based on one or more differences between the second version of the policy output and the third version of the policy output;

determining whether to deploy the third version of the policy output based on the second severity characteristic; and

in response to determining that the third version of the policy output is not to be deployed, causing a report that indicates the one or more differences to be transmitted to a user device.

Assignments (2)

Continuity (2)

References Cited (241)