DEVICES, SYSTEMS, AND METHODS FOR ENABLING RECONFIGURATION OF SERVICES SUPPORTED BY A NETWORK OF DEVICES

• US 20120203877A1
• Filed: 07/22/2011
• Published: 08/09/2012
• Est. Priority Date: 07/14/2010
• Status: Active Grant

• Current Assignee: DomaniCom Corp.
• Original Assignee: DomaniCom Corp.
• Inventors: Bartholomay, William G., Chang, Sin-Min, Das, Santanu, Sengupta, Arun, Mukhopadhyay, Suvhasis
• Granted Patent: US 8,572,677 B2
• Time in Patent Office: Days
• US Class Current: 709/221
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 41/0813 characterised by the conditions triggering a change of settings
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 69/32 Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level

Abstract

Systems, devices, and methods are disclosed for enabling the reconfiguration of services supported by a network of devices. Such reconfiguration can be realized dynamically and in real time without compromising the security of the overall system from external threats or internal malfunctions. These systems, devices and methods may provide a first functional stack supporting a previous version of a specific service and the provisioning of a second functional stack dynamically and in real-time that supports an updated version of the specific service. In addition, an administration function may be included in the embodiment such that the administration function manages and controls the functional stacks and network operations. Using these mechanisms, an existing service can be changed dynamically or a new service can be added dynamically in a secure manner without interruption of other existing services.

Claims

1. A system for enabling reconfiguration of one or more services supported by a network of one or more devices, the system comprising:

(a) a communication network;

(b) a set of one or more devices coupled to the communication network wherein a primary server and each of a set of one or more secondary servers, a set of one or more secure access nodes, and a set of one or more service multiplexers is a device from the set of one or more devices;

(c) each of the devices having;

(i) one or more communication interfaces that includes an administrative user interface wherein at least one of the one or more communication interfaces is coupled to the communication network;

(ii) one or more processors;

(iii) one or more storage devices coupled to the one or more processors;

(iv) one or more software applications stored in the one or more storage devices and executed by the one or more processors;

(v) one or more virtual machines generated and configured by one or more software applications executed by the one or more processors and stored in the one or more storage devices, each virtual machine implementing a functional stack with a corresponding operating system, the functional stack supporting one or more services and capable of being reconfigured dynamically in real-time;

(vi) a common layer generated and configured by one or more software applications executed by the one or more processors and stored in the one or more storage devices, the common layer having a common operating system and common security functions that segregate services supported by each functional stack on each virtual machine and minimize cross-service interference between services supported by each functional stack on each virtual machine during the reconfiguration of one or more functional stacks wherein the common operating system includes a common kernel that receives instructions from one or more software functions on the device and controls hardware resources, wherein the hardware resources include the one or more processors, the one or more storage devices, one or more input/output resources, and one or more display components.

2. The system of claim 1, wherein each device includes a gateway virtual machine having a gateway functional stack providing basic network interface functions for the device that includes a gateway operating system, gateway security functions, gateway data mining functions, and set of gateway software applications that support gateway and basic services.

3. The system of claim 1, wherein each device includes an administration function that manages and controls the functional stacks and network operations, and receives and replies to messages from an administration function of other devices through the one or more communication interfaces.

4. The system of claim 1, wherein each device includes

(a) a first virtual machine generated and configured by one or more software applications executed by the one or more processors and stored in the one or more storage devices, a first virtual machine supporting a first functional stack, the first functional stack having a first service operating system and set of previous version software applications that support a previous version of a first service;

(b) a second virtual machine generated and configured dynamically in real-time by one or more software applications executed by the one or more processors and stored in the one or more storage devices on the device, the second virtual machine supporting a second functional stack, the second functional stack having a second service operating system, and a set of updated version software applications that support an updated version of the first service;

5. The system of claim 4, wherein each device includes a common security layer generated and implemented by the common layer, the common security layer including virtual machine monitoring functions, common security functions, fuzzy logic security functions, and an inter-virtual machine communication integrity checking function to segregate services among the one or more functional stacks on the devices and to minimize cross-service interference among services supported by the one or more functional stacks.

6. The system of claim 4, wherein the first functional stack includes a first set of security functions and a first set of data mining functions and the second functional stack includes a second set of security functions and a second set of data mining functions.

7. The system of claim 5, wherein the common layer further implements a virtualizer function that manages one or more privilege descriptors and a state of a privilege status of each privilege descriptor, each privilege descriptor and privilege status corresponding to a functional stack wherein one of the one or more privilege descriptors is a first privilege descriptor corresponding to a first privilege status of the first functional stack and one of the one or more privilege descriptors is a second privilege descriptor corresponding to a second privilege status of the second functional stack;

wherein the first privilege status is in an active state and the second privilege status is in an inactive state.

8. The system of claim 7, wherein the administration function implemented by the device receives and replies to a first set of test messages from the one or more communication interfaces and the administration function sends a first set of instructions to the virtualizer to modify the first privilege status to an inactive state and the second privilege status to an active state to update the first service based on successful execution of the first set of test messages.

9. The system of claim 8, wherein the administration function receives and replies to a second set of test messages from the one or more communication interfaces, the administration function sends a second set of instructions to the virtualizer to remove the first functional stack from the device by changing the first privilege status to a null state and returning resources used by the first functional stack to a common pool using the common operating system based on successful execution of the second set of test messages validating the second functional stack.

10. The system of claim 5, wherein the common security functions and the fuzzy logic security functions are modified based on the set of updated version software applications that support an update version of the service to provide an updated version of cross-functional security between the updated service and other services supported by the device.

11. The system of claim 1, wherein the device includes:

(a) a newly introduced hardware module;

(b) a newly provisioned virtual machine generated and configured dynamically in real-time by one or more software applications executed by the one or more processors and stored in the one or more storage devices on the device, the newly provisioned virtual machine supporting a newly provisioned functional stack, the newly provisioned functional stack having a newly provisioned service operating system, and a set of newly provisioned software applications that support a newly provisioned service;

(c) wherein the newly provisioned functional stack has a corresponding third privilege descriptor and a third privilege status initially being in an inactive state.

12. The system of claim 11, wherein newly provisioned functional stack includes the a third set of security functions and a third set of data mining functions.

13. The system of claim 11, wherein the administration function implemented by the device receives and replies to a third set of test messages from the one or more communication interfaces, the administration function sends a third set of instructions to the virtualizer to modify the third privilege status to an active state based on successful execution of the third set of test messages.