Web-based security proxy for computing system environment scanning

• US 8,984,598 B2
• Filed: 06/27/2012
• Issued: 03/17/2015
• Est. Priority Date: 06/27/2012
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Branch, Joel W., Nidd, Michael E., Rissmann, Ruediger
• Primary Examiner(s): Mehedi, Morshed
• Assistant Examiner(s): LYNCH, SHARON S
• Application Number:
  US13/534,065
• Publication Number:
  US 20140007203A1
• Time in Patent Office: 993 Days
• US Class Current: 726/5
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0843 based on generic templates
• CPC Class Codes: H04L 41/0853 by actively collecting configuration information or by backing up configuration information
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

Mechanisms are provided for collecting configuration data from components of a managed computing system environment. A portion of code is obtained, in a data processing system, from a data collection system that does not have security credentials to allow the data collection system to directly access to the managed computing system environment. The portion of code is executed by the data processing system using security credentials maintained in the data processing system. Executing the portion of code causes the data processing system to access the managed computing system environment and collect configuration data from the managed computing system environment. The data processing system, via the portion of code, provides the configuration data collected from the managed computing system to the data collection system which stores the collected configuration data in a data storage.

Claims

1. A computer program product comprising a non-transitory computer readable medium having a computer readable program stored therein, wherein the computer readable program, when executed on a data processing system, causes the data processing system to:

obtain, by the data processing system, a portion of code from a data collection system, wherein the data collection system does not have security credentials to allow the data collection system to directly access a managed computing system, distinct from the data processing system, and wherein the data collection system does not receive configuration data directly from the managed computing system;

execute the portion of code in the data processing system using security credentials maintained in the data processing system, where executing the portion of code causes the data processing system to automatically access the managed computing system using the security credentials, and collect configuration data from the managed computing system; and

provide, via the portion of code, the configuration data collected from the managed computing system to the data collection system which stores the collected configuration data in a data storage, wherein;

the portion of code is an applet and wherein the applet is executed in a browser environment on the data processing system without installing the portion of code on the data processing system,

the managed computing system responds to requests in accordance with an established white list data structure specifying identities of devices to which the managed computing system may respond response to requests for configuration information, and

the data collection system is not listed in the white list data structure but the data processing system is listed in the white list data structure.

2. The computer program product of claim 1, wherein the applet is downloaded from the data collection system in response to either a user input initiating the download of the applet or an automated mechanism initiating the download of the applet.

3. The computer program product of claim 1, wherein the computer readable program further causes the data processing system to:

perform at least one management operation on the managed computing system environment based on the collected configuration data stored in the data storage of the data collection system.

4. The computer program product of claim 3, wherein the at least one management operation comprises one or more operations for facilitating a relocation of a data center to another computing system environment.

5. The computer program product of claim 1, wherein the computer readable program further causes the data processing system to:

identify one or more target components of the managed computing system from which to collect configuration data, wherein the portion of code is executed to collect configuration data from the identified one or more target components of the managed computing system.

6. The computer program product of claim 5, wherein the one or more target components are identified automatically using a check list data structure specifying an identity of the one or more target components and corresponding security credential information for the one or more target components.

7. The computer program product of claim 6, wherein the computer readable program further causes the data processing system to:

dynamically update the check list data structure to include an indicator, for each target component in the one or more target components listed in the check list data structure, that indicates either a successful access of configuration information for the target component or the occurrence of an error condition in response to an unsuccessful attempt to access configuration information for the target component.

8. The computer program product of claim 1, wherein the data processing system comprises a management console and wherein one or more target components of the managed computing system are configured to permit the management console to access the one or more target components via corresponding ports of the one or more target components.

9. The computer program product of claim 8, wherein the one or more target components are configured to permit the management console to access the one or more target components via corresponding ports by including an identification of at least one of the management console or the data processing system in a whitelist data structure associated with the one or more target components.

10. The computer program product of claim 8, wherein the one or more target components are configured to block access by the data collection system to the one or more target components.

11. The computer program product of claim 1, wherein the computer readable program further causes the data processing system to provide the configuration data collected from the managed computing system to the data collection system by:

outputting the collected configuration data to a user of the data processing system; and

receiving an input from the user specifying whether transmission of the collected configuration data to the data collection system is authorized or not, wherein the collected configuration data is provided to the data collection system only in response to the input from the user specifying that transmission of the collected configuration data to the data collection system is authorized.

12. The computer program product of claim 1, wherein the computer readable program further causes the data processing system to:

create a connection, via one or more data networks, between a browser environment of the data processing system and a web server of the data collection system, wherein;

obtaining the portion of code comprises downloading the portion of code as a signed applet from the web server of the data collection system;

executing the portion of code in the data processing system using security credentials maintained in the data processing system comprises executing the signed applet in a virtual machine of the browser environment using security credentials stored in a data structure stored local to the data processing system; and

providing the configuration data collected from the managed computing system to the data collection system comprises transmitting the configuration data over the secure connection between the browser environment and the web server.

13. The computer program product of claim 12, wherein the data collection system cannot establish a connection directly with the managed computing system to collect the configuration information.

14. The computer program product of claim 1, wherein the data processing system, executing the computer readable instructions of the computer program product, is not part of the managed computing system and is distinct from the managed computing system.

15. The computer program product of claim 1, wherein:

the security credentials are maintained in a storage device associated with the data processing system and are retrieved from the storage device when executing the portion of code, and the obtaining, executing, and providing operations are performed automatically without user intervention.

16. A data processing system, comprising:

a processor; and

a memory coupled to the processor, wherein the memory comprises instructions which, when executed by the processor, cause the processor to;

obtain a portion of code, from a data collection system, wherein the data collection system does not have security credentials to allow the data collection system to directly access a managed computing system, distinct from the data processing system, and wherein the data collection system does not receive configuration data directly from the managed computing system;

execute the portion of code using security credentials maintained in the data processing system, where executing the portion of code causes the data processing system to automatically access the managed computing system using the security credentials, and collect configuration data from the managed computing system; and

provide the configuration data collected from the managed computing system to the data collection system which stores the collected configuration data in a data storage, wherein;

the portion of code is an applet and wherein the applet is executed in a browser environment on the data processing system without installing the portion of code on the data processing system,

the managed computing system responds to requests in accordance with an established white list data structure specifying identities of devices to which the managed computing system may response in response to requests for configuration information, and

the data collection system is not listed in the white list data structure but the data processing system is listed in the white list data structure.

17. The system of claim 16, wherein the applet is downloaded from the data collection system in response to either a user input initiating the download of the applet or an automated mechanism initiating the download of the applet.

18. The system of claim 16, wherein the instructions further cause the processor to:

perform at least one management operation on the managed computing system based on the collected configuration data stored in the data storage of the data collection system.

19. The system of claim 18, wherein the at least one management operation comprises one or more operations for facilitating a relocation of a data center to another computing system environment.

20. The system of claim 16, wherein the instructions further cause the processor to:

create a connection, via one or more data networks, between a browser environment of the data processing system and a web server of the data collection system, wherein;

obtaining the portion of code comprises downloading the portion of code as a signed applet from the web server of the data collection system;

executing the portion of code in the data processing system using security credentials maintained in the data processing system comprises executing the signed applet in a virtual machine of the browser environment using security credentials stored in a data structure stored local to the data processing system; and

providing the configuration data collected from the managed computing system to the data collection system comprises transmitting the configuration data over the secure connection between the browser environment and the web server.

21. The system of claim 20, wherein the data collection system cannot establish a connection directly with the managed computing system to collect the configuration information.

22. The system of claim 16, wherein the data processing system is not part of the managed computing system and is distinct from the managed computing system.