METHOD AND SYSTEM FOR SECURE AGENT-LESS ENTERPRISE INFRASTRUCTURE DISCOVERY

• US 20100005516A1
• Filed: 07/01/2008
• Published: 01/07/2010
• Est. Priority Date: 07/01/2008
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Secchi, Marco, Secomandi, Antonio, Alberti, Enrica, Pichetti, Luigi
• Granted Patent: US 8,099,767 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A method and system for securing dynamic discovery of an enterprise computing infrastructure is provided. One implementation involves maintaining enterprise credential information in a secured trust store, receiving an access request through a secure connection for access to a remote infrastructure component, determining the type of the access request, for a root-level type access request, responding to the request via the secure connection with enterprise root credentials from the trust store, and for an unprivileged type access request, responding to the request via the secure connection with unprivileged access enterprise credentials from the trust store.

Claims

1. A method for securing dynamic discovery of an enterprise computing infrastructure, comprising:

maintaining enterprise credential information in a secured trust store;

receiving an access request through a secure connection for access to a remote infrastructure component;

determining the type of the access request;

for a root-level type access request, responding to the request via the secure connection with enterprise root credentials from the trust store; and

for an unprivileged type access request, responding to the request via the secure connection with unprivileged access enterprise credentials from the trust store.

2. The method of claim 1, wherein receiving an access request through a secure connection further comprises receiving an access request through a secure connection from an agent-less discovery engine for access to a remote infrastructure component.

3. The method of claim 2 further comprising:

for an unprivileged type access request, creating credentials if the requested unprivileged access is for query-only access, and responding to the request via the secure connection with the created credentials.

4. The method of claim 2 wherein:

maintaining enterprise credential information further comprises;

an external credential manager maintaining enterprise credential information in a secured trust store;

receiving an access request through a secure connection further comprises;

the external credential manager receiving an access request through a secure connection for access to a remote infrastructure component; and

responding to the request comprises;

the external credential manager responding to the request via the secure connection.

5. The method of claim 4 further including:

the credential manager renewing access credentials based on policies, before credential expiration.

6. The method of claim 2, wherein receiving an access request from an agent-less discovery engine includes receiving an access request through a secure connection from an agent-less discovery engine performing dynamic agent-less discovery, for access to a remote infrastructure component.

7. The method of claim 2 further including:

the agent-less discovery engine using the credentials to access the remote infrastructure component.

8. An apparatus for securing dynamic discovery of an enterprise computing infrastructure, comprising:

a credential administrator configured for maintaining enterprise credential information in a secured trust store;

a request processing module configured for receiving an access request through a secure connection for access to a remote infrastructure component;

a request type identification module configured for determining the type of the access request; and

the request processing module further configured such that;

for a root-level type access request, the request processing module responds to the request via the secure connection with enterprise root credentials from the trust store; and

for an unprivileged type access request, the request processing module responds to the request via the secure connection with unprivileged access enterprise credentials from the trust store.

9. The apparatus of claim 8, wherein the request processing module receives an access request through a secure connection from an agent-less discovery engine for access to a remote infrastructure component.

10. The apparatus of claim 9 further comprising a credential creation module configured for creating credentials, wherein for an unprivileged type access request, credential creation module creates credentials if the requested unprivileged access is for query-only access, and the request processing module responds to the request via the secure connection with the created credentials.

11. The apparatus of claim 10, wherein the credential administrator is further configured for renewing access credentials based on policies, before credential expiration.

12. The apparatus of claim 9, wherein the request processing module receives an access request through a secure connection from an agent-less discovery engine performing dynamic agent-less discovery, for access to a remote infrastructure component.

13. The apparatus of claim 9, wherein the agent-less discovery engine uses the credentials to access the remote infrastructure component.

14. A system for dynamic discovery of an enterprise computing infrastructure, comprising:

an agent-less discovery engine configured for performing dynamic agent-less discovery, for access to a remote infrastructure component;

a credential manager configured for securing dynamic discovery of the enterprise computing infrastructure, the credential manager comprising;

a credential administrator configured for maintaining enterprise credential information in a secured trust store;

a request processing module configured for receiving an access request from the agent-less discovery engine through a secure connection for access to a remote infrastructure component; and

a request type identification module configured for determining the type of the access request;

the request processing module further configured such that;

for a root-level type access request, the request processing module responds to the request via the secure connection with enterprise root credentials from the trust store; and

for an unprivileged type access request, the request processing module responds to the request via the secure connection with unprivileged access enterprise credentials from the trust store.

15. The system of claim 14 further comprising a credential creation module configured for creating credentials, wherein for an unprivileged type access request, credential creation module creates credentials if the requested unprivileged access is for query-only access, and the request processing module responds to the request via the secure connection with the created credentials.

16. The system of claim 15, wherein the credential administrator is further configured for renewing access credentials based on policies, before credential expiration.

17. The system of claim 14, wherein the agent-less discovery engine uses the credentials to access the remote infrastructure component.

18. The system of claim 14 further including agent-full components.

19. The system of claim 14, wherein the credential manager is further configured for shielding the agent-less discovery engine from credential management and allowing the agent-less discovery engine to perform a dynamic agent-less discovery of the enterprise infrastructure.

20. The system of claim 14, wherein the credential manager is an external credential manager.