Method and system for improving security and reliability in a networked application environment

• US 9,027,141 B2
• Filed: 04/12/2012
• Issued: 05/05/2015
• Est. Priority Date: 04/12/2012
• Status: Active Grant

• Current Assignee: Netflix, Inc.
• Original Assignee: Netflix, Inc.
• Inventors: Tseitlin, Ariel, Rapoport, Roy, Chan, Jason
• Primary Examiner(s): CERVETTI, DAVID GARCIA
• Application Number:
  US13/445,872
• Publication Number:
  US 20130276089A1
• Time in Patent Office: 1,118 Days
• Field of Search: 726/10, 726/25
• US Class Current: 726/25
• CPC Class Codes: G06F 11/302 where the computing system component is a software system
• CPC Class Codes: G06F 11/3051 Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs verification or detection of system hardware configuration G06F11/2247
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 2209/504 Resource capping
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 9/50 Allocation of resources, e.g. of the central processing unit [CPU]
• CPC Class Codes: H04L 2463/121 Timestamp
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: Y02D 10/00 : Energy efficient computing, e.g. low power processors, power management or thermal management

Abstract

A security application manages security and reliability of networked applications executing collection of interacting computing elements within a distributed computing architecture. The security application monitors various classes of resources utilized by the collection of nodes within the distributed computing architecture and determine whether utilization of a class of resources is approaching a pre-determined maximum limit. The security application performs a vulnerability scan of a networked application to determine whether the networked application is prone to a risk of intentional or inadvertent breach by an external application. The security application scans a distributed computing architecture for the existence of access control lists (ACLs), and stores ACL configurations and configuration changes in a database. The security application scans a distributed computing architecture for the existence of security certificates, places newly discovered security certificates in a database, and deletes outdated security certificates. Advantageously, security and reliability are improved in a distributed computing architecture.

Claims

1. A computer-implemented method for managing a distributed computing architecture, the method comprising:

discovering, via a processor, a first security certificate stored within at least one memory element included in the distributed computing architecture that includes a first identifying label and an expiration date by accessing one or more network addresses that are associated with an elastic load balancing system configured to distribute network traffic related to a software application across multiple instances of the software application;

comparing the first security certificate with a plurality of security certificates that resides within a storage repository;

determining that the first security certificate corresponds to a second security certificate that resides within the storage repository;

deleting the second security certificate from the storage repository; and

storing the first security certificate within the storage repository.

2. The method of claim 1, wherein the first security certificate complies with a secure sockets layer (SSL) cryptographic protocol.

3. The method of claim 1, wherein determining that the first security certificate corresponds to a second security certificate comprises determining that an identifying label associated with the first security certificate is equivalent to an identifying label associated with the second security certificate.

4. The method of claim 1, wherein the one or more network addresses are associated with a port utilizing hypertext transfer protocol secure (HTTPS), and wherein discovering a first security certificate further comprises receiving a security certificate from the network address.

5. The method of claim 1, wherein discovering a first security certificate comprises scanning a file folder including one or more security certificates, and wherein the one or more security certificates are associated with one or more versions of a software application within a source code control system.

6. The method of claim 1, wherein discovering a first security certificate comprises scanning the contents of one or more web pages, and wherein a security certificate a corresponding to the one or more web pages is received from a server.

7. The method of claim 1, further comprising scanning the plurality of security certificates residing within the storage repository, and notifying a system administrator with respect to each security certificate that has an expiration date on or before a threshold date.

8. The method of claim 1, further comprising scanning the plurality of security certificates residing within the storage repository, and deleting any security certificate that has not been updated within a predetermined amount of time.