Diagramming System for a Distributed Data Processing System

• US 20190327151A1
• Filed: 04/19/2018
• Published: 10/24/2019
• Est. Priority Date: 04/19/2018
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Walton, Kaleb, Valdivia, Miguel Angel Beher, Bigwood, George, Wodrich, Aaron T.
• Granted Patent: US 11,095,525 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 30/18 Network design, e.g. design based on topological or interconnect aspects of utility systems, piping, heating ventilation air conditioning [HVAC] or cabling circuit design at the physical level G06F30/39; network planning tools for wireless communication networks H04W16/18
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/0853 by actively collecting configuration information or by backing up configuration information
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 43/50 Testing arrangements
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/12 Transmitting and receiving encryption devices synchronised or initially set up in a particular manner

Abstract

A method, a system, and a computer program product for generating a representation of a distributed data processing system. A computer system instruments a set of elements in the distributed data processing system with a set of recorders. Encryption information is sent by the computer system to the set of recorders in the distributed data processing system, wherein the set of recorders uses the encryption information to decrypt traffic in the distributed data processing system. The computer system then sends a set of test cases into the distributed data processing system. The representation of the distributed data processing system is generated by the computer system using results from sending the set of test cases into the distributed data processing system, reducing a time for the computer system to generate the representation of the distributed data processing system.

Claims

1. A method for generating a representation of a distributed data processing system, the method comprising:

instrumenting, by a computer system, a set of elements in the distributed data processing system with a set of recorders;

sending, by the computer system, encryption information to the set of recorders in the distributed data processing system, wherein the set of recorders uses the encryption information to decrypt traffic in the distributed data processing system;

sending, by the computer system, a set of test cases into the distributed data processing system; and

generating, by the computer system, the representation of the distributed data processing system using results from sending the set of test cases into the distributed data processing system, reducing a time for the computer system to generate the representation of the distributed data processing system.

2. The method of claim 1 further comprising:

displaying, by the computer system, the representation as a diagram on a display system.

3. The method of claim 1 further comprising:

receiving, by the computer system, the results from the set of recorders, wherein the set of recorders records the results from sending the set of test cases into the distributed data processing system.

4. The method of claim 1, wherein the representation of the distributed data processing system includes encrypted data flows and unencrypted data flows between elements in the distributed data processing system.

5. The method of claim 4 further comprising:

identifying, by the computer system, a set of security risks using the encrypted data flows and the unencrypted data flows in the distributed data processing system; and

performing, by the computer system, a security action in response to identifying the set of security risks.

6. The method of claim 1 further comprising:

filtering, by the computer system, the representation to identify a number of elements through which a selected piece of information flows to form a filtered representation of the distributed data processing system, wherein the selected piece of information is selected from the set of test cases; and

displaying, by the computer system, the filtered representation of the distributed data processing system as a filtered diagram on a display system.

7. The method of claim 1, wherein the representation of the distributed data processing system comprises the set of elements in the distributed data processing system and data flow between the set of elements.

8. The method of claim 2, wherein the displaying step comprises:

displaying, by the computer system, the diagram of the representation with a number of annotations in the diagram, wherein the number of annotations identifies a number of elements causing a security risk.

9. The method of claim 1, wherein the set of elements is selected from at least one of a hypervisor, a virtual machine, an operating system kernel, or an application.

10. A diagramming system comprising:

a computer system; and

a representation manager running on the computer system, wherein the representation manager instruments a set of elements in a distributed data processing system with a set of recorders;

sends encryption information to the set of recorders in the distributed data processing system, wherein the set of recorders uses the encryption information to decrypt traffic in the distributed data processing system;

sends a set of test cases into the distributed data processing system; and

generates a representation of the distributed data processing system using results from sending the set of test cases into the distributed data processing system, reducing a time for the computer system to generate the representation of the distributed data processing system.

11. The diagramming system of claim 10, wherein the representation manager receives the results from the set of recorders, wherein the set of recorders records the results from sending the set of test cases into the distributed data processing system.

12. The diagramming system of claim 10, wherein the representation of the distributed data processing system includes encrypted data flows and unencrypted data flows in the distributed data processing system, and wherein the representation manager identifies a set of security risks using the encrypted data flows and the unencrypted data flows in the distributed data processing system, and performs a security action in response to identifying the set of security risks.

13. The diagramming system of claim 10, wherein the representation manager filters the representation to identify a number of elements through which a selected piece of information flows to form a filtered representation of the distributed data processing system, and wherein the selected piece of information is selected from the set of test cases and displays the filtered representation of the distributed data processing system as a filtered diagram on a display system.

14. The diagramming system of claim 10, wherein the representation of the distributed data processing system comprises elements in the distributed data processing system and data flow between the elements.

15. The diagramming system of claim 10, wherein the representation manager displays a diagram of the representation with a number of annotations in the diagram, wherein the number of annotations identifies a number of elements causing a security risk.

16. The diagramming system of claim 10, wherein the set of elements is selected from at least one of a hypervisor, a virtual machine, an operating system kernel, and an application.

17. A computer program product for generating a representation of a distributed data processing system, the computer program product comprising:

a computer-readable storage media;

first program code, stored on the computer-readable storage media, for instrumenting a set of elements in the distributed data processing system with a set of recorders;

second program code, stored on the computer-readable storage media, for sending encryption information to the set of recorders in the distributed data processing system, wherein the set of recorders uses the encryption information to decrypt traffic in the distributed data processing system;

third program code, stored on the computer-readable storage media, for sending a set of test cases into the distributed data processing system; and

fourth program code, stored on the computer-readable storage media, for generating the representation of the distributed data processing system using results from sending the set of test cases into the distributed data processing system, reducing a time for a computer system to generate the representation of the distributed data processing system.

18. The computer program product of claim 17 further comprising:

fifth program code, stored on the computer-readable storage media, for receiving the results from the set of recorders, wherein the set of recorders records the results from sending the set of test cases into the distributed data processing system.

19. The computer program product of claim 17, wherein the representation of the distributed data processing system includes encrypted data flows and unencrypted data flows between elements in the distributed data processing system and further comprising:

fifth program code, stored on the computer-readable storage media, for identifying a set of security risks using the encrypted data flows and the unencrypted data flows in the distributed data processing system; and

sixth program code, stored on the computer-readable storage media, for performing a security action in response to identifying the set of security risks.

20. The computer program product of claim 17 further comprising:

fifth program code, stored on the computer-readable storage media, for filtering the representation to identifying a number of elements through which a selected piece of information flows to form a filtered representation of the distributed data processing system, wherein the selected piece of information is selected from the set of test cases; and

sixth program code, stored on the computer-readable storage media, for displaying the filtered representation of the distributed data processing system on a display system.