Abstract: A system comprises data processing hardware and memory hardware. The memory hardware is in communication with the data processing hardware, and stores instructions that, when executed on the data processing hardware, cause the data processing hardware to perform a plurality of operations. In some examples, one of the operations may include receiving instance management configuration data for a single-tenant software-as-a-service (SaaS) application. Another operation may include further include receiving an image of the single-tenant SaaS application. Yet another operation can include generating, by the control plane manager, a control plane based on the instance management configuration data. The control plane is configured to create multiple instances of the single-tenant SaaS application based on the received image, and to manage the instances of the single-tenant SaaS application based on the received instance management configuration data.

Abstract: A system comprises data processing hardware and memory hardware. The memory hardware is in communication with the data processing hardware, and stores instructions that, when executed on the data processing hardware, cause the data processing hardware to perform a plurality of operations. In some examples, one of the operations may include receiving instance management configuration data for a single-tenant software-as-a-service (SaaS) application. Another operation may include further include receiving an image of the single-tenant SaaS application. Yet another operation can include generating, by the control plane manager, a control plane based on the instance management configuration data. The control plane is configured to create multiple instances of the single-tenant SaaS application based on the received image, and to manage the instances of the single-tenant SaaS application based on the received instance management configuration data.

Abstract: A system comprises data processing hardware and memory hardware. The memory hardware is in communication with the data processing hardware, and stores instructions that, when executed on the data processing hardware, cause the data processing hardware to perform a plurality of operations. In some examples, one of the operations may include receiving instance management configuration data for a single-tenant software-as-a-service (SaaS) application. Another operation may include further include receiving an image of the single-tenant SaaS application. Yet another operation can include generating, by the control plane manager, a control plane based on the instance management configuration data. The control plane is configured to create multiple instances of the single-tenant SaaS application based on the received image, and to manage the instances of the single-tenant SaaS application based on the received instance management configuration data.

Abstract: A system comprises data processing hardware and memory hardware. The memory hardware is in communication with the data processing hardware, and stores instructions that, when executed on the data processing hardware, cause the data processing hardware to perform a plurality of operations. In some examples, one of the operations may include receiving instance management configuration data for a single-tenant software-as-a-service (SaaS) application. Another operation may include further include receiving an image of the single-tenant SaaS application. Yet another operation can include generating, by the control plane manager, a control plane based on the instance management configuration data. The control plane is configured to create multiple instances of the single-tenant SaaS application based on the received image, and to manage the instances of the single-tenant SaaS application based on the received instance management configuration data.

Abstract: A system comprises data processing hardware and memory hardware. The memory hardware is in communication with the data processing hardware, and stores instructions that, when executed on the data processing hardware, cause the data processing hardware to perform a plurality of operations. In some examples, one of the operations may include receiving instance management configuration data for a single-tenant software-as-a-service (SaaS) application. Another operation may include further include receiving an image of the single-tenant SaaS application. Yet another operation can include generating, by the control plane manager, a control plane based on the instance management configuration data. The control plane is configured to create multiple instances of the single-tenant SaaS application based on the received image, and to manage the instances of the single-tenant SaaS application based on the received instance management configuration data.

Abstract: A system comprises data processing hardware and memory hardware. The memory hardware is in communication with the data processing hardware, and stores instructions that, when executed on the data processing hardware, cause the data processing hardware to perform a plurality of operations. In some examples, one of the operations may include receiving instance management configuration data for a single-tenant software-as-a-service (SaaS) application. Another operation may include further include receiving an image of the single-tenant SaaS application. Yet another operation can include generating, by the control plane manager, a control plane based on the instance management configuration data. The control plane is configured to create multiple instances of the single-tenant SaaS application based on the received image, and to manage the instances of the single-tenant SaaS application based on the received instance management configuration data.

Abstract: Systems and methods according to various embodiments disclose a worker process manager adapted to spawn one or more worker processes on a server and to load an application on each of the worker processes. The worker process manager is adapted to isolate the one or more worker processes from each other and to control resource usage by the worker processes. A resource manager is adapted to detect applications that overuse system resources. The worker process manager is adapted to isolate worker processes and to control resource usage using one or more of the following techniques: least-privilege execution, messaging isolation, credentials isolation, data isolation, network isolation, fair share resource usage, and managed runtime security. Heuristic algorithms are used to detect applications that frequently overuse system resources that are unchargeable and that cause system unresponsiveness.

Abstract: A system comprises data processing hardware and memory hardware. The memory hardware is in communication with the data processing hardware, and stores instructions that, when executed on the data processing hardware, cause the data processing hardware to perform a plurality of operations. In some examples, one of the operations may include receiving instance management configuration data for a single-tenant software-as-a-service (SaaS) application. Another operation may include further include receiving an image of the single-tenant SaaS application. Yet another operation can include generating, by the control plane manager, a control plane based on the instance management configuration data. The control plane is configured to create multiple instances of the single-tenant SaaS application based on the received image, and to manage the instances of the single-tenant SaaS application based on the received instance management configuration data.

Abstract: An automated, policy-based system and method provides information security at various levels in the network, including at the baseline inventory, device, network frame, and command level. This approach improves over the conventional distributed security model by centralizing security in one multi-level management structure. Embodiments of the present invention may also provide a scheme for mapping vendor-unique opcodes to access rights.

Abstract: A system and method are provided for securely sharing storage resources in a storage network. One or more organizations are modeled in a structure where each organization includes one or more units. Users are assigned to a unit and are also assigned a command access level. The command access level grants access to certain management commands that may be performed on storage resources. Storage resources are then bound to units in the organization and may be accessed by users in the unit. Once command access levels are assigned and storage resources are bound, access for a user in the unit is restricted to the command access level assigned to the user and the storage resources bound to the user's unit. When a command from a user is received, the command access level of the user and the bound storage resources for the unit of the user is determined. Then, a management command is performed using the bound storage for the user's unit if the command is available for the command access level.

Abstract: Systems and methods according to various embodiments disclose a worker process manager adapted to spawn one or more worker processes on a server and to load an application on each of the worker processes. The worker process manager is adapted to isolate the one or more worker processes from each other and to control resource usage by the worker processes. A resource manager is adapted to detect applications that overuse system resources. The worker process manager is adapted to isolate worker processes and to control resource usage using one or more of the following techniques: least-privilege execution, messaging isolation, credentials isolation, data isolation, network isolation, fair share resource usage, and managed runtime security. Heuristic algorithms are used to detect applications that frequently overuse system resources that are unchargeable and that cause system unresponsiveness.

Abstract: A container service is capable of hosting large numbers of middleware components for multiple tenants. A central container manager controls a plurality of compute nodes. The central container manager receives middleware components from external devices or services and assigns the components to containers on one or more designated compute nodes. Each compute node has a container management agent and one or more containers. The container management agents activate and manage the appropriate number of containers to run the assigned middleware components. The container management agent assigns each container on its compute node a limited set of privileges to control access to shared resources. The central container manager and each node's container management agent monitor container load levels and dynamically adjust the placement of the middleware components to maintain balanced operation. The compute nodes are grouped into clusters based upon the type of middleware components hosted on each compute node.

Abstract: A container service is capable of hosting large numbers of middleware components for multiple tenants. A central container manager controls a plurality of compute nodes. The central container manager receives middleware components from external devices or services and assigns the components to containers on one or more designated compute nodes. Each compute node has a container management agent and one or more containers. The container management agents activate and manage the appropriate number of containers to run the assigned middleware components. The container management agent assigns each container on its compute node a limited set of privileges to control access to shared resources. The central container manager and each node's container management agent monitor container load levels and dynamically adjust the placement of the middleware components to maintain balanced operation. The compute nodes are grouped into clusters based upon the type of middleware components hosted on each compute node.

Abstract: In a storage server on a storage area network, a media unit manager manages disk space in a manner transparent to the host computers. The media unit manager uses media units corresponding to the physical storage devices on the storage area network to build higher-level media units. The higher level media units can have the attributes of being sliced, concatenated, mirrored, striped, etc. Thus, the host computers need not be aware of the specific physical storage devices themselves, reducing the management and reconfiguration burden on the host computers when storage devices are added to or removed from the storage area network.

Abstract: A method and system for provisioning storage from a storage area network is provided. The provisioning includes receiving a request for a storage size and storage configuration from a storage area network according to a storage profile, identifying a storage device pool of storage devices according to a storage device candidate strategy, selecting a media unit provisioning strategy based upon the type of storage configuration specified in the storage request, generating media unit solutions using the media unit provisioning strategy and sequence of storage devices in the storage pool, determining if the media unit provisioning strategy produced a solution for the requested storage configuration and provisioning a media unit solution in response to the determination.

Abstract: An automated, policy-based system and method provides information security at various levels in the network, including at the baseline inventory, device, network frame, and command level. This approach improves over the conventional distributed security model by centralizing security in one multi-level management structure. Embodiments of the present invention may also provide a scheme for mapping vendor-unique opcodes to access rights.

Abstract: A method and system for provisioning storage from a storage area network is provided. The provisioning includes receiving a request for a storage size and storage configuration from a storage area network according to a storage profile, identifying a storage device pool of storage devices according to a storage device candidate strategy, selecting a media unit provisioning strategy based upon the type of storage configuration specified in the storage request, generating media unit solutions using the media unit provisioning strategy and sequence of storage devices in the storage pool, determining if the media unit provisioning strategy produced a solution for the requested storage configuration and provisioning a media unit solution in response to the determination.

Abstract: A method and system for provisioning storage from a storage area network is provided. The provisioning includes receiving a request for a storage size and storage configuration from a storage area network according to a storage profile, identifying a storage device pool of storage devices according to a storage device candidate strategy, selecting a media unit provisioning strategy based upon the type of storage configuration specified in the storage request, generating media unit solutions using the media unit provisioning strategy and sequence of storage devices in the storage pool, determining if the media unit provisioning strategy produced a solution for the requested storage configuration and provisioning a media unit solution in response to the determination.

Abstract: A storage provisioning policy is created by specifying storage heuristics for storage attributes using storage heuristic metadata. Storage attributes characterize a storage device and storage heuristic metadata describe how to specify a storage heuristic. Using the storage heuristic metadata, storage heuristics are defined to express a rule or constraint as a function of a storage attribute. In addition, the storage provisioning policy may also specify mapping rules for exporting the storage to a consumer of the storage, such as the server or server cluster.

Abstract: A method and system for provisioning storage from a storage area network is provided. The provisioning includes receiving a request for a storage size and storage configuration from a storage area network according to a storage profile, identifying a storage device pool of storage devices according to a storage device candidate strategy, selecting a media unit provisioning strategy based upon the type of storage configuration specified in the storage request, generating media unit solutions using the media unit provisioning strategy and sequence of storage devices in the storage pool, determining if the media unit provisioning strategy produced a solution for the requested storage configuration and provisioning a media unit solution in response to the determination.