Dynamic allocation of network security credentials for alert notification recipients

• US 8,793,783 B2
• Filed: 12/20/2011
• Issued: 07/29/2014
• Est. Priority Date: 12/20/2011
• Status: Active Grant

• Current Assignee: Lenovo International Limited (Lenovo Group Ltd.)
• Original Assignee: International Business Machines Corporation
• Inventors: Bennah, Albert D., Rudda, David J. Jr.
• Primary Examiner(s): McNally, Michael S
• Application Number:
  US13/331,374
• Publication Number:
  US 20130159763A1
• Time in Patent Office: 952 Days
• Field of Search: 726/15, 714/57
• US Class Current: 726/15
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0748 in a remote unit communicating with a single-box computer node experiencing an error/fault remote testing G06F11/2294
• CPC Class Codes: G06F 11/0766 Error or fault reporting or storing
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: G06F 11/327 Alarm or error message display
• CPC Class Codes: H04L 41/0627 by acting on the notification or alarm source
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 69/40 for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06

Abstract

Methods, apparatuses, and computer program products for dynamic allocation of network security credentials for alert notification recipients are provided. Embodiments include receiving from a managed system, by an alert management system, an alert indicating one of a failure in the managed system and a pending failure in the managed system; selecting, by the alert management system, a remote device from a plurality of remote devices registered for remote access with the alert management system; preapproving, by the alert management system, network security clearance of the selected remote device, the network security clearance for remote access to the management system via a virtual private network (VPN) interface; and transmitting to the selected remote device, by the alert management system, an alert notification that includes an internet address corresponding to the VPN interface.

Claims

1. An apparatus for dynamic allocation of network security credentials for alert notification recipients, the apparatus comprising a computer processor, a computer memory operatively coupled to the computer processor, the computer memory having disposed within it computer program instructions that when executed by the computer processor cause the apparatus to carry out the steps of:

receiving from a managed system, by an alert management system, an alert indicating one of a failure in the managed system and a pending failure in the managed system;

selecting, by the alert management system, a remote device from a plurality of remote devices registered for remote access with the alert management system;

preapproving, by the alert management system, virtual private network security clearance of the selected remote device, the virtual private network security clearance granting remote access to the managed system via a virtual private network (VPN) interface; and

transmitting to the selected remote device, by the alert management system, an alert notification that includes an internet address corresponding to the VPN interface.

2. The apparatus of claim 1 further comprising computer program instructions that when executed by the computer processor cause the apparatus to carry out the steps of:

receiving from a particular remote device, by the alert management system, a VPN connection request that includes the internet address corresponding to the VPN interface;

determining, by the alert management system, whether the particular remote device is the selected remote device preapproved for remote access to the managed system via the VPN interface at the internet address;

if the particular remote device is the selected remote device, establishing via the VPN interface, by the alert management system, a VPN connection between the particular remote device and the managed system based on the preapproval of the network security clearance of the selected remote device; and

if the particular remote device is not the selected remote device, preventing, by the alert management system, a VPN connection between the particular remote device and the managed system.

3. The apparatus of claim 1 further comprising computer program instructions that when executed by the computer processor cause the apparatus to carry out the steps of specifying, by the alert management system, a duration between preapproval of the network security clearance for remote access at the VPN interface and receipt of a request for a VPN connection.

4. The apparatus of claim 1 further comprising computer program instructions that when executed by the computer processor cause the apparatus to carry out the steps of registering, by the alert management system, one or more remote devices for remote access to the managed system.

5. The apparatus of claim 1 further comprising computer program instructions that when executed by the computer processor cause the apparatus to carry out the steps of identifying, by the alert management system, one or more user-configurable policies corresponding to the received alert, the user-configurable policies indicating notification procedures.

6. The apparatus of claim 1 wherein the alert notification is transmitted via a SMS message to the selected remote device.

7. A computer program product for dynamic allocation of network security credentials for alert notification recipients, the computer program product disposed upon a non-transitory computer readable medium, the computer program product comprising computer program instructions capable, when executed, of causing a computer to carry out the steps of:

receiving from a managed system, by an alert management system, an alert indicating one of a failure in the managed system and a pending failure in the managed system;

selecting, by the alert management system, a remote device from a plurality of remote devices registered for remote access with the alert management system;

preapproving, by the alert management system, virtual private network security clearance of the selected remote device, the virtual private network security clearance granting remote access to the managed system via a virtual private network (VPN) interface; and

transmitting to the selected remote device, by the alert management system, an alert notification that includes an internet address corresponding to the VPN interface.

8. The computer program product of claim 7 further comprising computer program instructions capable, when executed, of causing a computer to carry out the steps of:

receiving from a particular remote device, by the alert management system, a VPN connection request that includes the internet address corresponding to the VPN interface;

determining, by the alert management system, whether the particular remote device is the selected remote device preapproved for remote access to the managed system via the VPN interface at the internet address;

if the particular remote device is the selected remote device, establishing via the VPN interface, by the alert management system, a VPN connection between the particular remote device and the managed system based on the preapproval of the network security clearance of the selected remote device; and

if the particular remote device is not the selected remote device, preventing, by the alert management system, a VPN connection between the particular remote device and the managed system.

9. The computer program product of claim 7 further comprising computer program instructions capable, when executed, of causing a computer to carry out the steps of specifying, by the alert management system, a duration between preapproval of the network security clearance for remote access at the VPN interface and receipt of a request for a VPN connection.

10. The computer program product of claim 7 further comprising computer program instructions capable, when executed, of causing a computer to carry out the steps of registering, by the alert management system, one or more remote devices for remote access to the managed system.

11. The computer program product of claim 7 further comprising computer program instructions capable, when executed, of causing a computer to carry out the steps of identifying, by the alert management system, one or more user-configurable policies corresponding to the received alert, the user-configurable policies indicating notification procedures.

12. The computer program product of claim 7 wherein the alert notification is transmitted via a SMS message to the selected remote device.

13. The computer program product of claim 7 wherein the computer readable medium further comprises a computer readable signal medium.

14. The computer program product of claim 7 wherein the computer readable medium further comprises a computer readable storage medium.