PERFORMANCE MODELING FOR SOA SECURITY APPLIANCE

• US 20090106012A1
• Filed: 10/19/2007
• Published: 04/23/2009
• Est. Priority Date: 10/19/2007
• Status: Active Grant

• Current Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Liu, Lei
• Granted Patent: US 8,886,779 B2
• Time in Patent Office: Days
• US Class Current: 703/21
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A device, system, and method are directed towards optimizing a security apparatus within a Service-Oriented Architecture (SOA). Performance data is gathered for the SOA. A plurality of queuing performance models are generated based on a plurality of components comprising a user land, a kernel, and a Central Processing Unit (CPU). The generation may be based on an incremental online training based on the gathered data, on a simulation based on the gathered data, on a probability distribution function, on an operational law, or the like. Derivative points are determined based on the plurality of queuing performance models. The derivative points are maximized by tuning at least one parameter of the user land, at least one parameter of the kernel, and/or at least one parameter of the CPU within at least another simulation and/or increment of the online training. The security apparatus is optimized based on the at least one parameters.

Claims

1. A method for optimizing a security apparatus within a service oriented architecture (SOA), comprising:

generate a plurality of queuing performance models for a plurality of components comprising a user land, a kernel, and a Central Processing Unit (CPU) of the SOA performing a plurality of security operations;

determining a plurality of derivative points based on the plurality of queuing performance models;

maximizing the plurality of derivative points by tuning at least one parameter of the user land, at least one parameter of the kernel, or at least one parameter of the CPU; and

optimizing a configuration of the security apparatus based on the at least one parameter of the user land, the at least one parameter of the kernel, or the at least one parameter of the CPU associated with the maximized plurality of derivative points.

2. The method of claim 1, wherein generating the plurality of queuing performance models comprises:

performing an incremental online training of the queuing performance models based on the plurality of components.

3. The method of claim 1, wherein generating the plurality of queuing performance models comprises:

simulating for the user land, a plurality of user land parameters comprising a plurality of input packets, an arrival rate, and a schedule of use of the user land, to generate a plurality of user land operations per time, wherein the user land characterizes a usage by at least one user of the SOA;

performing a user land queuing model analysis on the user land operations per time to generate a user land performance model;

simulating for the kernel, a plurality of kernel parameters comprising a memory usage, a schedule and policy of use of the kernel, and a CPU allocation, to generate a plurality of kernel operations per time, wherein the kernel characterizes a kernel of the computing environment;

performing a kernel queuing model analysis on the kernel operations per time to generate a kernel performance model;

simulating for the CPU, a plurality of CPU parameters comprising a an instruction set, an execution request, and an allocated percentage of CPU usage for an application executing on the CPU, to generate a plurality of CPU operations per time, wherein the CPU characterizes a processor of the computing environment; and

performing a CPU queuing model analysis on the CPU operations per time to generate a CPU performance model.

4. The method of claim 1, wherein the plurality of queuing performance models is based on a Quality of Service (QoS) factor of at least one of the plurality of components.

5. The method of claim 1, further comprising:

gathering performance data for an SOA apparatus, wherein generating the plurality of queuing performance models is based on the gathered performance data.

6. The method of claim 1, wherein determining the plurality of derivative points comprises taking a partial derivative of at least one curve of at least one model, wherein the curve is of two or more dimensions.

7. The method of claim 1, wherein the plurality of security operations comprises encrypting, decrypting, forwarding, transforming, signing, or enforcing a policy.

8. The method of claim 1, wherein an output of the at least one of the plurality of components is an input to at least another one of the plurality of components.

9. The method of claim 1, wherein the plurality of components is interconnected in a recurrent network.

10. The method of claim 1, wherein maximizing the plurality of derivative points comprises determining a local maximum for at least one model.

11. An apparatus for optimizing a security apparatus within a service oriented architecture (SOA), comprising:

an interface for receiving data for a plurality of components comprising a user land, a kernel, and a Central Processing Unit (CPU) of the SOA performing a plurality of security operations; and

a processor configured to perform operations comprising;

generating a plurality of queuing performance models based on the data for the user land, the kernel, or the CPU;

determining a plurality of derivative points based on the plurality of queuing performance models;

maximizing the plurality of derivative points by tuning at least one parameter of the user land, at least one parameter of the kernel, or at least one parameter of the CPU; and

providing an optimized configuration of the SOA based on the at least one parameter of the user land, the at least one parameter of the kernel, or the at least one parameter of the CPU associated with the maximized plurality of derivative points.

12. The apparatus of claim 11, wherein generating the plurality of queuing performance models comprises:

incrementally training the queuing performance models based on the received data.

13. The apparatus of claim 11, wherein generating the plurality of queuing performance models comprises:

simulating for the user land, a plurality of user land parameters comprising a workload intensity, to generate a plurality of user land operations per time, wherein the user land characterizes a usage by at least one user of the SOA;

performing a user land queuing model analysis on the user land operations per time to generate a use land performance model;

simulating for the kernel, a plurality of kernel parameters comprising a memory usage, a schedule and policy of use of the kernel, and a CPU allocation, to generate a plurality of kernel operations per time, wherein the kernel characterizes a kernel of the computing environment;

performing a kernel queuing model analysis on the kernel operations per time to generate a kernel performance model;

simulating for the CPU, a plurality of CPU land parameters comprising a an instruction set, an execution request, and an allocated percentage of CPU usage for an application executing on the CPU, to generate a plurality of CPU land operations per time, wherein the CPU characterizes a processor of the computing environment; and

performing a CPU land queuing model analysis on the CPU land operations per time to generate a kernel performance model.

14. The apparatus of claim 11, wherein the at least one parameter comprises a virtualization of a percentage of usage of a resource by an application.

15. The apparatus of claim 11, wherein tuning at least one parameter comprises performing a dynamic programming operation or an automatic programming operation.

16. The apparatus of claim 11, wherein generating the plurality of queuing performance models comprises:

training a neural network on a training set of inputs and outputs for a component of the SOA.

17. The apparatus of claim 11, wherein determining the plurality of derivative points comprises taking a partial derivative of at least one curve of at least one model, wherein the at least one curve is of two or more dimensions.

18. The apparatus of claim 11, wherein the plurality of security operations comprises encrypting, decrypting, forwarding, transforming, signing, or enforcing a policy.

19. The apparatus of claim 11, wherein an output of the at least one of the plurality of components is an input to at least another one of the plurality of components.

20. A processor readable medium for optimizing a security apparatus within a service oriented architecture (SOA), comprising instructions when executed by a processor performs operations comprising:

generate a plurality of queuing performance models a plurality of components of the SOA performing a plurality of security operations;

determining a plurality of derivative points based on the plurality of queuing performance models;

maximizing the plurality of derivative points by tuning at least one parameter of the user land, at least one parameter of the components; and

optimizing a configuration of the security apparatus based on the components associated with the maximized plurality of derivative points.