Method and system for improving security and reliability in a networked application environment
원문보기
IPC분류정보
국가/구분
United States(US) Patent
등록
국제특허분류(IPC7판)
H04L-029/06
G06F-021/60
H04L-012/26
G06F-017/30
출원번호
US-0703862
(2015-05-04)
등록번호
US-9953173
(2018-04-24)
발명자
/ 주소
Tseitlin, Ariel
Rapoport, Roy
Chan, Jason
출원인 / 주소
NETFLIX, INC.
대리인 / 주소
Artegis Law Group, LLP
인용정보
피인용 횟수 :
0인용 특허 :
41
초록▼
A security application manages security and reliability of networked applications executing collection of interacting computing elements within a distributed computing architecture. The security application monitors various classes of resources utilized by the collection of nodes within the distribu
A security application manages security and reliability of networked applications executing collection of interacting computing elements within a distributed computing architecture. The security application monitors various classes of resources utilized by the collection of nodes within the distributed computing architecture and determine whether utilization of a class of resources is approaching a pre-determined maximum limit. The security application performs a vulnerability scan of a networked application to determine whether the networked application is prone to a risk of intentional or inadvertent breach by an external application. The security application scans a distributed computing architecture for the existence of access control lists (ACLs), and stores ACL configurations and configuration changes in a database. The security application scans a distributed computing architecture for the existence of security certificates, places newly discovered security certificates in a database, and deletes outdated security certificates. Advantageously, security and reliability are improved in a distributed computing architecture.
대표청구항▼
1. A computer-implemented method, comprising: discovering, via an administrative server coupled to a distributed computing architecture, a resource associated with a distributed application, wherein the distributed application executes on a plurality of compute nodes, and the resource is discovered
1. A computer-implemented method, comprising: discovering, via an administrative server coupled to a distributed computing architecture, a resource associated with a distributed application, wherein the distributed application executes on a plurality of compute nodes, and the resource is discovered and monitored within the distributed computing architecture;determining a classification for the resource based on one or more classification criteria;determining whether the classification corresponds to a record within a database, wherein the record includes a counter of a quantity of the resource deployed in the distributed computing architecture;if the classification corresponds to a record within the database, then: incrementing the counter associated with the record; orif the classification does not correspond to a record within the database, then: initializing another record within the database that corresponds to the classification, andinitializing another counter associated with the another record; andpublishing a notification when the counter indicates that a utilization associated with the classification exceeds a pre-determined limit. 2. The method of claim 1, wherein the resource comprises an instance of a software application executing within the distributed computing architecture. 3. The method of claim 1, further comprising generating a notification when the classification does not correspond to a record within the database. 4. The method of claim 1, further comprising retrieving a first threshold value associated with the record, and generating a notification when the counter exceeds the first threshold value. 5. The method of claim 4, wherein generating the notification comprises publishing a message to a publication/subscription system indicating that the counter exceeds the first threshold value. 6. The method of claim 1, further comprising retrieving a second threshold value associated with the record, and generating a second notification when the counter exceeds the second threshold value. 7. The method of claim 6, wherein at least one of the first threshold value and the second threshold value comprises a percentage of a maximum limit. 8. A non-transitory computer-readable storage medium including instructions that, when executed by a processor, cause the processor to perform the steps of: scanning a distributed application that is executing on a plurality of compute nodes to detect a first security vulnerability, wherein the distributed application is stored within at least one memory element included in a distributed computing architecture;comparing the first security vulnerability against a database that includes a listing of previously-discovered security vulnerabilities; andif the first security vulnerability is not listed within the database, then: initializing a record within the database that corresponds to the first security vulnerability; orif the first security vulnerability is listed within the database, then:updating a record within the database that corresponds to the first security vulnerability to indicate that the first security vulnerability was detected;determining that the first security vulnerability is marked as being resolved; andgenerating a notification that the first security vulnerability was resolved. 9. The non-transitory computer-readable storage medium of claim 8, wherein the database includes an issue tracking system that is configured to track whether one or more security vulnerabilities have been resolved. 10. The non-transitory computer-readable storage medium of claim 8, wherein the operation further comprises generating a notification when the record corresponding to the first security vulnerability is initialized. 11. The non-transitory computer-readable storage medium of claim 8, wherein scanning the networked application further comprises generating a notification that the distributed computing architecture is being scanned for security vulnerabilities. 12. The non-transitory computer-readable storage medium of claim 11, wherein generating the notification comprises publishing a message to a publication/subscription system indicating that the distributed computing architecture is being scanned for security vulnerabilities. 13. The non-transitory computer-readable storage medium of claim 11, wherein generating a notification comprises generating an automatic email indicating that the distributed computing architecture is being scanned for security vulnerabilities. 14. An administration server, comprising: a memory storing a security application; anda processor coupled to the memory, wherein, when executed by the processor, the security application configures the processor to: discover an access control list (ACL) associated with a distributed application executing on a plurality of compute nodes, wherein the ACL is stored within at least one memory element included in a distributed computing architecture;determine whether the ACL corresponds to a first record within a database; andif the ACL corresponds to a first record within the database, then determine that a configuration of the ACL differs from a configuration of the first record; andinitialize a second record within the database that corresponds to the first record and has the configuration of the ACL; orif the ACL does not correspond to a first record within the database, then initialize a second record within the database that corresponds to the ACL and has the configuration of the ACL. 15. The system of claim 14, wherein the ACL comprises a security group that includes one or more source objects, one or more ports, and one or more destination objects. 16. The system of claim 15, wherein the one or more source objects are identifiable via an internet protocol (IP) address. 17. The system of claim 15, wherein the one or more source objects are identifiable based on the one or more source objects included in the security group. 18. The system of claim 15, wherein the processor is further configured to compute an exposure metric for the security group based on at least one of the number of source objects included in the security group, the number of ports included in the security group, and the number of destination objects included in the security group. 19. The system of claim 14, wherein the processor is further configured to analyze the ACL to determine whether the ACL is associated with a permission setting that permits the security group to access all routable addresses on the Internet. 20. The system of claim 14, wherein the processor is further configured to compute the number of instances of a software application that execute within the ACL.
연구과제 타임라인
LOADING...
LOADING...
LOADING...
LOADING...
LOADING...
이 특허에 인용된 특허 (41)
Massoudi, Arash, Accounting for usage and usage-based pricing of runtime engine.
Zobel,Robert David; Dodd,Timothy David; Millar,Sharon A.; Nesfeder, Jr.,David Gerald; Singer,Christopher S., Method and system for configuring and scheduling security audits of a computer network.
Toudeh-Fallah, Farzam; Mize, Eric Kenneth; Delamatre, Timothy J., Method and system for implementing a network analysis tool for endpoints deployments.
Bass Brian Mitchell ; Siegel Michael Steven ; Strole Norman Clark, Methods, systems and computer program products for suppressing multiple destination traffic in a computer network.
Bass, Brian Mitchell; Siegel, Michael Steven; Strole, Norman Clark, Methods, systems and computer program products for suppressing multiple destination traffic in a computer network.
Rhodes, Christina L.; Yalovsky, Mark; Ebeling, Rolf A.; Morgan, John Corey; Woods, Shawn M.; Hurst, Ryan M.; Au, Jonathan M.; Ponomarev, Peter Seraphim; Hendrickson, Jason C.; Alla, Hemchand; Chin, Yau N.; Sechrest, Stuart; Iyigun, Mehmet; Bak, Yevgeniy; Ismail, Ishfaq M.; Fuller, Jeffrey C.; Ratanchandani, Prashant, Process management views.
Johnson, Eric Wendell; Lamoreaux, Richard J.; Dinsel, Jeremy; Gummadi, Ajay K., System and method for managing the application of access control lists on network devices.
Andres, Steven G.; Cole, David M.; Cummings, Thomas Gregory; Garcia, Roberto Ramon; Kenyon, Brian Michael; Kurtz, George R.; McClure, Stuart Cartier; Moore, Christopher William; O'Dea, Michael J.; Saruwatari, Ken D., System and method of managing network security risks.
Schultz, Matthew G.; Eskin, Eleazar; Zadok, Erez; Bhattacharyya, Manasi; Salvatore J., Stolfo, Systems and methods for detection of new malicious executables.
Eicken, Thorsten von; Gonzalez, Jose Maria Blanquer; Simon, Raphael George Jacques, Systems and methods for establishing cloud-based instances with independent permissions.
Kennedy, Scott Cruickshanks; Ayers, II, Carleton Royse; Godinez, Javier; Banks, Susan Fichera; Spencer, Myoki Elizabeth, Systems and methods for implementing and scoring computer network defense exercises.
Williams, Michael W.; Dodd, James M.; Pollard, II, Lloyd L; Gupte, Nitin B, Weighted throttling mechanism with rank based throttling for a memory system.
※ AI-Helper는 부적절한 답변을 할 수 있습니다.