EFFICIENTLY ISOLATING MALICIOUS DATA REQUESTS

• US 20120210017A1
• Filed: 02/11/2011
• Published: 08/16/2012
• Est. Priority Date: 02/11/2011
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Muhunthan, Siva, Wu, Yunxin, Novik, Lev, Paraschiv, Vasile
• Granted Patent: US 9,137,325 B2
• Time in Patent Office: Days
• US Class Current: 709/238
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data

Abstract

Embodiments are directed to efficiently routing data requests from a plurality of tenants and to using smart routing to limit service denials. In an embodiment, a gateway node receives data requests from a tenant subscriber requesting data for an indicated service. The gateway node determines which server node the received data requests are to be routed to. The determination evaluates various criteria associated with the data request. The gateway node queries the determined server node to determine the health of the server nodes and receives a reply from the determined server node indicating the server node'"'"'s current operating status. The gateway node also, based on the determined server node'"'"'s reply, routes the received data requests to the determined server node, according to the evaluated criteria.

Claims

1. At a computer system including at least one processor and a memory, in a computer networking environment including a plurality of computing systems, a computer-implemented method for efficiently routing data requests from a plurality of tenants, the method comprising:

an act of receiving at a gateway node one or more data requests from a tenant subscriber requesting data for an indicated service;

an act of the gateway node determining which server node the received data requests are to be routed to, wherein the determination evaluates one or more criteria associated with the data request; and

an act of the gateway node routing the received data requests to the determined server node, based on the evaluated criteria.

2. The method of claim 1, wherein the gateway node tracks at least one of the following:

which tenants are sending data requests, what services the data requests are for, which data requests have been sent in the past and which data requests have been the source of a problem.

3. The method of claim 1, wherein each tenant is provided an isolated workload, such that one tenant'"'"'s workload does not exceed another tenant'"'"'s workload boundaries.

4. The method of claim 3, wherein each tenant'"'"'s workload is customizable and dynamically adjustable.

5. The method of claim 1, wherein the data requests are received at the gateway node after having been load-balanced at a hardware-based load balancer.

6. The method of claim 1, wherein at least one of the criteria upon which the routing determination is made comprises request type, such that data requests for certain request types are routed to server nodes that are optimally suited to process those data request types.

7. The method of claim 1, wherein at least one of the criteria upon which the routing determination is made comprises requests received from a given tenant, such that data requests received from that tenant are routed to server nodes that are optimally suited to process data requests from that tenant.

8. The method of claim 1, wherein at least one of the criteria upon which the routing determination is made comprises requests processed at a given server node, such that data requests processed by that server node are routed to that server node, wherein the server node to which the requests are routed includes at least a portion of cached data used in processing previous requests.

9. The method of claim 1, wherein the gateway node is configured to test for malicious attacks received from the tenant subscribers.

10. The method of claim 8, further comprising logging data requests for those tenant subscribers that are linked to a malicious attack.

11. The method of claim 8, further comprising blocking requests from those tenant subscribers determined to be executing malicious attacks.

12. The method of claim 1, further comprising adding one or more custom headers to the received data requests to send the data requests to the determined server node.

13. The method of claim 1, further comprising the gateway node querying one or more server nodes to determine the health of the server nodes.

14. The method of claim 1, wherein each tenant subscriber is allotted a certain number server nodes for processing the tenant subscriber'"'"'s data requests.

15. A computer program product for implementing a method for using smart routing to limit service denials, the computer program product comprising one or more computer-readable storage media having stored thereon computer-executable instructions that, when executed by one or more processors of the computing system, cause the computing system to perform the method, the method comprising:

an act of receiving at a gateway node one or more data requests from a tenant subscriber requesting data for an indicated service;

an act of the gateway node determining which server node the received data requests are to be routed to, wherein the determination evaluates one or more criteria associated with the data request;

an act of the gateway node querying the determined server node to determine the health of the server nodes;

an act of the gateway node receiving a reply from the determined server node indicating the server node'"'"'s current operating status; and

based on the determined server node'"'"'s reply, an act of the gateway node routing the received data requests to the determined server node, according to the evaluated criteria.

16. The computer program product of claim 15, wherein upon determining that the determined server node'"'"'s reply indicates that the server node is overloaded, the gateway node logs which tenant subscriber'"'"'s requests the server node was processing.

17. The computer program product of claim 16, wherein upon determining that a given tenant subscriber is associated with one or more overloaded server nodes, the gateway node limits the number of requests received from that tenant.

18. The computer program product of claim 16, wherein one or more tenant subscribers are added to a suspect list for a specified amount of time.

19. The computer program product of claim 18, wherein the degree to which each tenant subscriber on the suspect list is suspected of causing a server node overload is weighted over a period of time.

20. A computer system comprising the following:

one or more processors;

system memory;

one or more computer-readable storage media having stored thereon computer-executable instructions that, when executed by the one or more processors, causes the computing system to perform a method for efficiently routing data requests from a plurality of tenants, the method comprising the following;

an act of receiving at a gateway node one or more data requests from a tenant subscriber requesting data for an indicated service;

an act of the gateway node determining which server node the received data requests are to be routed to, wherein the determination evaluates one or more criteria associated with the data request; and

an act of the gateway node routing the received data requests to the determined server node, based on the evaluated criteria.