Managing pre-provisioning and post-provisioning of resources using bitemporal analysis
Embodiments disclosed are directed to ensuring resource compliance within a cloud-based environment. The embodiments include steps for performing both pre-provisioning and post-provisioning checks of resources, such as network protocols, prior to and after their deployment within the cloud-based environment. These steps include using bitemporal analysis to determine the impact of deploying resources within the environment through the use of multiple execution timelines where the impact of deploying a resource may be evaluated on an alternative timeline that does not change the current resource scope of the cloud-based environment. The analysis may further include tracking the impact of the resource after it has been deployed to ensure resource compliance.
1. A computer-implemented method for improving protocol compliance in a cloud network that includes an immutable database, the method comprising:
maintaining, in a bitemporal ledger of the immutable database, a plurality of states of the cloud network on a current execution timeline, wherein the plurality of states comprises a current state of the cloud network and at least one prior state of the cloud network, wherein the current state reflects a current resource scope of the cloud network, and wherein the current execution timeline comprises at least one resource and at least one protocol currently deployed in the cloud network;
receiving a request to provision a new protocol in the cloud network;
determining whether to provision the new protocol by:
creating, in the bitemporal ledger, an alternate execution timeline separate from the current execution timeline;
duplicating, from the current execution timeline, the at least one resource and the at least one protocol to the alternate execution timeline;
receiving provisioning information associated with provisioning the new protocol in the cloud network, wherein the provisioning information comprises data necessary to provision the new protocol in the cloud network;
deploying, based on the provisioning information, the new protocol in the alternate execution timeline;
receiving a result of deploying the new protocol in the alternate execution timeline, wherein the result includes an alternate impact on the current state of the cloud network; and
determining whether to deploy or prevent deployment of the new protocol in the cloud network based on the result.
2. The computer-implemented method of claim 1 , further comprising deploying the new protocol in the cloud network responsive to the result indicating the new protocol is compliant with the cloud network.
3. The computer-implemented method of claim 2 , wherein the alternate impact reflects an alternate state of the cloud network, the method further comprising:
updating the current state with the alternate state of the cloud network.
4. The computer-implemented method of claim 1 , further comprising preventing deployment of the new protocol in the cloud network responsive to the result indicating that the new protocol is non-compliant with the cloud network.
5. The computer-implemented method of claim 4 , wherein the new protocol is considered non-compliant when deployment of the new protocol would violate a security rule of the cloud network.
6. The computer-implemented method of claim 4 , wherein the new protocol is considered non-compliant when deployment of the new protocol would violate a resource scope of the cloud network.
7. The computer-implemented method of claim 1 , wherein the alternate execution timeline comprises an execution space for testing the new protocol using an alternate history of transactions, wherein testing the new protocol comprises generating the result of deploying the new protocol.
8. The computer-implemented method of claim 1 , wherein the result indicates that the deploying the new protocol is permitted by a plurality of protocol rules associated with enforcement of policies in the cloud network.
9. A compliance system for a cloud network, the compliance system comprising:
an immutable database implementing a bitemporal ledger;
a processor configured to:
maintain, in the bitemporal ledger of the immutable database, a plurality of states of the cloud network on a current execution timeline, wherein the plurality of states comprises a current state of the cloud network and at least one prior state of the cloud network, wherein the current state reflects a current resource scope of the cloud network, and wherein the current execution timeline comprises at least one resource and at least one protocol currently deployed in the cloud network;
receive a request to provision a new protocol in the cloud network;
determine whether to provision the new protocol which comprises:
create, in the bitemporal ledger, an alternate execution timeline separate from the current execution timeline;
duplicate, from the current execution timeline, the at least one resource and the at least one protocol to the alternate execution timeline;
receive provisioning information associated with provisioning the new protocol in the cloud network, wherein the provisioning information comprises data necessary to provision the new protocol in the cloud network;
deploy, based on the provisioning information, the new protocol in the alternate execution timeline;
receive a result of deploying the new protocol in the alternate execution timeline, wherein the result includes an alternate impact on the current state of the cloud network; and
determine whether to deploy or prevent deployment of the new protocol in the cloud network based on the result.
10. The compliance system of claim 9 , further comprising deploying the new protocol in the cloud network responsive to the result indicating the new protocol is compliant with the cloud network.
11. The compliance system of claim 9 , wherein the alternate impact reflects an alternate state of the cloud network, the processor further configured to:
update the current state with the alternate state of the cloud network.
12. The compliance system of claim 9 , further comprising preventing deployment of the new protocol in the cloud network responsive to the result indicating that the new protocol is non-compliant with the cloud network.
13. The compliance system of claim 12 , wherein the new protocol is considered non-compliant when deployment of the new protocol would violate a security rule of the cloud network.
14. The compliance system of claim 12 , wherein the new protocol is considered non-compliant when deployment of the new protocol would violate a resource scope of the cloud network.
15. The compliance system of claim 9 , wherein the alternate execution timeline comprises an execution space for testing the new protocol using an alternate history of transactions, wherein testing the new protocol comprises generating the result of deploying the new protocol.
16. The compliance system of claim 9 , wherein the result indicates that the deploying the new protocol is permitted by a plurality of protocol rules associated with enforcement of policies in the cloud network.
17. A non-transitory computer-readable medium storing instructions, the instructions, when executed by a processor in a compliance system of a cloud network, cause the processor to perform operations comprising:
maintaining, in a bitemporal ledger of an immutable database implemented in the compliance system, a plurality of states of the cloud network on a current execution timeline, wherein the plurality of states comprises a current state of the cloud network and at least one prior state of the cloud network, wherein the current state reflects a current resource scope of the cloud network, and wherein the current execution timeline comprises at least one resource and at least one protocol currently deployed in the cloud network;
receiving a request to provision a new protocol in the cloud network;
determining whether to provision the new protocol by:
creating, in the bitemporal ledger, an alternate execution timeline separate from the current execution timeline;
duplicating, from the current execution timeline, the at least one resource and the at least one protocol to the alternate execution timeline;
receiving provisioning information associated with provisioning the new protocol in the cloud network, wherein the provisioning information comprises data necessary to provision the new protocol in the cloud network;
deploying, based on the provisioning information, the new protocol in the alternate execution timeline;
receiving a result of deploying the new protocol in the alternate execution timeline, wherein the result includes an alternate impact on the current state of the cloud network; and
determining whether to deploy or prevent deployment of the new protocol in the cloud network based on the result.
18. The non-transitory computer-readable medium of claim 17 , further comprising deploying the new protocol in the cloud network responsive to the result indicating the new protocol is compliant with the cloud network.
19. The non-transitory computer-readable medium of claim 17 , further comprising preventing deployment of the new protocol in the cloud network responsive to the result indicating that the new protocol is non-compliant with the cloud network.
20. The non-transitory computer-readable medium of claim 19 , wherein the new protocol is considered non-compliant when deployment of the new protocol would violate a security rule of the cloud network.