Method for managing services on a network

• US 9,781,017 B2
• Filed: 12/21/2011
• Issued: 10/03/2017
• Est. Priority Date: 12/21/2010
• Status: Expired due to Fees

• Current Assignee: Thales Communication & Security S.A.S. (Thales SA), Thales SA
• Original Assignee: Thales SA
• Inventors: Leleu, Philippe Gerard Augustin, Chazal, Florian
• Primary Examiner(s): Wang, Liangche A
• Assistant Examiner(s): Woldemariam, Ayele
• Application Number:
  US13/993,770
• Publication Number:
  US 20130268648A1
• Time in Patent Office: 2,113 Days
• CPC Class Codes: G06F 9/4856 resumption being on a different machine, e.g. task migration, virtual machine migration G06F9/5088 takes precedence
• CPC Class Codes: G06F 9/5044 considering hardware capabilities
• CPC Class Codes: G06F 9/505 considering the load
• CPC Class Codes: G06F 9/5055 considering software capabilities, i.e. software resources associated or available to the machine
• CPC Class Codes: H04L 41/5077 wherein the managed service relates to simple transport services, i.e. providing only network infrastructure
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/62 Establishing a time schedule for servicing the requests
• CPC Class Codes: H04L 69/28 Timers or timing mechanisms used in protocols
• CPC Class Codes: H04L 69/40 for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06

Abstract

The invention relates to a method for managing services on a network, comprising: at least two interconnected computer sites, each of which is capable of implementing at least one service that can be accessed from the network; at least one service implemented on a network site; a capability for transferring a service from an initial site to a separate destination site. Each is associated with security attributes and the method includes transferring at least one service from an initial site to a destination site of the network following a predetermined transfer sequence which depends on the security attributes.

Claims

1. A method for managing services on a network, including

at least two interconnected computer sites, each of which is capable of implementing at least one service accessible from the network;

and

a capability configured to transfer a service from an initial site to a separate destination site,

wherein each of the computer sites includes a server farm including a plurality of servers, each of the servers hosting a plurality of virtual machines,

wherein each of the virtual machines is configured to implement a single specific service,

wherein each of the computer sites includes a site manager specific to the computer site, each of the site managers being configured to;

manage the corresponding server farm, and create and use the virtual machines that are hosted on the corresponding server farm,

wherein each of the computer sites is associated with security characteristics,

wherein the method comprises;

choosing potential destination sites as a function of the security characteristics of the computer sites making up the network;

choosing the destination site among the potential destination sites as a function of a predefined rule, wherein the choosing the destination site includes a phase of randomly choosing among the network sites; and

transferring at least one service from the initial site to the destination site of the network according to a predetermined transfer sequence, the predetermined transfer sequence depending on security attributes and being independent of a sole responsibility of each of the computer sites,

wherein the security attributes include one or more parameters among a criticality level of the service, a minimum transfer frequency, a maximum transfer frequency, an acceptable risk level, and a transfer time range, and

wherein the security characteristics include one or more of the characteristics among the available resources of the site, the physical and logic risk level of the site, and the quality of the network for accessing the site.

2. The method according to claim 1, wherein the transfer sequence depends on the security characteristics of the site on which the service is implemented.

3. A network including:

at least two interconnected computer sites each capable of implementing a service accessible from the network,

wherein each of the computer sites includes a server farm including a plurality of servers, each of the servers hosting a plurality of virtual machines,

wherein each of the virtual machines is configured to implement a single specific service,

wherein each of the computer sites includes a site manager specific to the computer site, each of the site managers being configured to;

manage the corresponding server farm, create and use the virtual machines that are hosted on the corresponding server farm, and transfer a service from an initial site to a separate destination site,

wherein each of the computer sites is associated with security characteristics,

wherein each service is associated with security attributes, and

wherein the site manager is capable of performing the transfer following a predetermined transfer sequence by implementing a service management method, the predetermined transfer sequence depending on the security attributes and being independent of a sole responsibility of each of the computer sites,

wherein the service management method comprises;

choosing potential destination sites as a function of the security characteristics of the computer sites making up the network;

choosing the destination site among the potential destination sites as a function of a predefined rule, wherein the choosing the destination site includes a phase of randomly choosing among the network sites; and

transferring at least one service from the initial site to the destination site of the network according to a predetermined transfer sequence, the predetermined transfer sequence depending on security attributes and being independent of a sole responsibility of each of the computer sites,

wherein the security attributes include one or more parameters among a criticality level of the service, a minimum transfer frequency, a maximum transfer frequency, an acceptable risk level, and a transfer time range, and

wherein the security characteristics include one or more of the characteristics among the available resources of the site, the physical and logic risk level of the site, and the quality of the network for accessing the site.