Network evaluation grid techniques

• US 8,166,138 B2
• Filed: 06/29/2007
• Issued: 04/24/2012
• Est. Priority Date: 06/29/2007
• Status: Expired due to Fees

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Carter, Stephen R.
• Primary Examiner(s): STRANGE, AARON N
• Application Number:
  US11/771,709
• Publication Number:
  US 20090006592A1
• Time in Patent Office: 1,761 Days
• Field of Search: 709/220, 709/202, 709/208, 709/226, 709/224, 713/185, 370/392, 705/7, 705/26, 718/102
• US Class Current: 709/220
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/5058 Service discovery by the service manager

Abstract

Network evaluation grid techniques are presented. Local specifications for traffic patterns are evaluated for local traffic on local grids of a grid computing environment and reported out. The local traffic reported out is then evaluated in response to global traffic pattern specifications and a global traffic policy in order to identify one or more remedial actions to take or to recommend in response to that evaluation.

Claims

1. A method implemented in a non-transitory machine readable medium and for executing on a machine, comprising:

identifying grid services that are distributed over a network for processing on a plurality of devices, the plurality of devices combine to form a grid computing environment and selective collections of the devices combine to form a particular grid of the grid computing environment, and each grid represents a particular local area network (LAN) of the grid computing environment as a whole, each grid service monitors data packets that emanate for that grid service'"'"'s LAN by listening for the data packets on network interface cards of the LAN;

obtaining traffic pattern specifications for the following;

a particular one of the grid services, selective groupings of the grid services, the particular grid, selective groupings of the grids, and the grid computing environment as a whole; and

configuring and distributing a watch grid service with each grid of the grid computing environment, and when initiated on a particular device of the particular grid, a particular watch grid service listens for and reports on traffic in response to enforcement of particular ones of the traffic pattern specifications, the particular watch grid service monitors all traffic on the particular grid to which it is configured to monitor, and when the particular watch grid service is loaded and cannot capture all the traffic another watch grid service cooperates to capture packets associated with the traffic that was missed, and each traffic pattern specification identifies a particular grid member and that grid member'"'"'s subnet permitting traffic emanating from that grid member to be monitored independent of resources producing that traffic.

2. The method of claim 1 further comprising:

determining traffic pattern policies for one or more of the following;

selective groupings of the traffic pattern specifications and the grid computing environment as a whole; and

configuring and distributing with each watch grid service the traffic pattern policies, wherein the particular watch grid service enforces particular ones of the traffic pattern policies to correlate multiple traffic pattern specifications with one another.

3. The method of claim 1, wherein identifying further includes acquiring a unique grid service identity for each of the grid services from an identity service and using each unique grid service identity to obtain specific ones of the traffic pattern specifications.

4. The method of claim 1, wherein obtaining further includes acquiring each of the traffic pattern specifications in response to one or more of the following:

an identity associated with a particular grid service, an identity associated with the particular grid, an identity associated with the grid computing environment, and an active access role assigned to a particular identity.

5. The method of claim 1 further comprising:

configuring multiple ones of the watch grid services to coordinate with one another; and

using a global traffic pattern policy known to the multiple watch grid services to evaluate cross traffic from the multiple watch grid services.

6. The method of claim 1, wherein configuring and distributing further includes configuring each watch grid service to report information to one or more of the following:

an evaluation grid service, an administrator email account, an administrator instant message or text message account, and a website.

7. The method of claim 1, wherein configuring and distributing further includes configuring each watch grid service to report information to one or more resources, wherein a number of the resources for a number of the watch grid services is different from other resources used by other watch grid services and wherein the configuring of reporting to the resources is driven by a unique profile or policy associated with each watch grid service.

8. A non-transitory machine-implemented method to execute on a processing device, comprising:

receiving, by the processing device, messages from multiple watch grid services, each watch grid service monitors all network traffic and reports the network traffic occurring on grid members associated with a grid computing environment in response to local traffic pattern specifications and local traffic pattern policies, each watch grid service monitors packets emanating from network interface cards associated with devices that that watch grid service monitors and when a particular watch grid cannot handle all the traffic another watch grid service cooperates to pick up any missed traffic;

using, by the processing device, global traffic pattern specifications to detect selective traffic being reported, the global traffic pattern specifications tie the messages on the network traffic occurring from the grid members together, each of the global traffic pattern specifications identifies a particular grid member and that grid member'"'"'s subnet permitting traffic emanating from that grid member to be monitored independent of resources producing that traffic;

enforcing, by the processing device, a global traffic policy to correlate the selective traffic; and

identifying, by the processing device, actions to take in response to enforcement of the global traffic policy.

9. The method of claim 8, wherein receiving further includes receiving each message as a signed message that each watch grid service digitally signs before reporting.

10. The method of claim 8, wherein using further includes generating system events for the detected selective traffic and raising the events within one or more selective processing environments over a network, wherein the events being raised trigger other services to take other actions within those selective processing environments.

11. The method of claim 10 further comprising, digitally signing, by the processing device, at least one of the events and sending to a remediation manager service for subsequent enforcement of remediation policies by the remediation manager service.

12. The method of claim 8 further comprising, automatically processing, by the processing device, at least one action.

13. The method of claim 8, wherein automatically processing further includes, dynamically processing the at least one action in real-time to remediate a threat situation and improve traffic throughput associated with one or more of the following:

the grid computing environment, a particular grid, and a particular grid member.

14. The method of claim 8 further comprising, supplying, by the processing device, the global traffic patterns and the global traffic policy to a global grid manager on request.

15. A system, comprising:

a global grid manager service implemented in a non-transitory machine-readable medium and to process on a machine within a network;

watch grid services implemented in a non-transitory machine readable medium, each grid service processes on a different machine of the network; and

an evaluation grid service implemented in a non-transitory machine-readable medium and to process on a machine different from those machines used by the watch grid services,

the global grid manager service is to configure each of the watch grid services with local traffic pattern specifications and local traffic pattern policies for detecting local traffic on local machines or local processing environments of the watch grid services, each watch grid service is to monitor all traffic on the local machines that each watch grid service is configured to handle, and each watch grid service configured to monitor packets emanating from network interface cards of the local machines and when a particular watch grid service is unable to handle all the traffic another watch grid service cooperates to capture any missed traffic, and each watch grid service is to report the detected traffic to the evaluation grid service, and the evaluation grid service is to use global traffic pattern specifications and enforce a global traffic pattern policy to correlate the detected traffic and take one or more actions in response to the correlated traffic, each global traffic pattern specification identifies a particular grid member and that grid member'"'"'s subnet permitting traffic emanating from that grid member to be monitored independent of resources producing that traffic.

16. The system of claim 15 further comprising, an identity service implemented in a machine-accessible medium and to process on a machine within the network, wherein the identity service supplies authentication mechanisms and identity information for each of the watch grid services, the global grid manager service, and the evaluation grid manager service.

17. The system of claim 16, wherein the identity service is to securely distribute the local traffic pattern specifications and policies in response to the identity information to the global grid manager service.

18. The system of claim 15 further comprising, a remediation manager service implemented in a machine-readable medium and to process on a machine of the network, wherein the actions taken by the evaluation grid service alerts the remediation manager service to take measures on the network to deal with a threat situation or to improve traffic throughput processing.

19. The system of claim 15, wherein the watch grid services report to the evaluation grid service via digitally signed messages.

20. The system of claim 15, wherein at least two of the watch grid services are configured to coordinate reporting and traffic watching with one another.