Identity-aware load balancing

• US 9,577,940 B2
• Filed: 02/25/2014
• Issued: 02/21/2017
• Est. Priority Date: 02/25/2014
• Status: Active Grant

• Current Assignee: Kyndryl Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Dods, Craig C., Childress, Rhonda L., Kumhyr, David B.
• Primary Examiner(s): Phillips, Hassan
• Assistant Examiner(s): GEORGE, AYANAH S
• Application Number:
  US14/189,027
• Publication Number:
  US 20150244626A1
• Time in Patent Office: 1,092 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 47/20 Traffic policing
• CPC Class Codes: H04L 47/622 Queue service order
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/1014 based on the content of a request

Abstract

A method, system, and computer program product for identity-aware load balancing are provided in the illustrative embodiments. A sender of a packet is identified using an attribute communicated with the packet. The attribute is sufficient to identify a sender of the packet. The packet is directed to a set of resources managed by a load balancing application. A rule corresponding to the sender is selected. The rule is executed to identify a characteristic of an algorithm usable in a load balancing operation of the load balancing application. The packet and the identified characteristic of the algorithm are communicated to the load balancer. The communicating causes the load balancer to select an algorithm for a load balancing operation with the packet such that the selected algorithm includes the identified characteristic of the algorithm.

Claims

1. A method for identity-aware load balancing, the method comprising:

identifying, using an attribute communicated with a packet, at an application executing in a data processing system, a sender of the packet, wherein the packet is directed to a set of resources managed by a load balancer;

selecting a rule corresponding to the sender;

changing, based on the sender, a manner of queuing the packet at the load balancer prior for a load balancing operation using a subset of resources;

executing, using a processor and a memory, the rule to identify a characteristic of an algorithm, the identified characteristic being usable in the load balancing operation of the load balancer;

communicating the packet and the identified characteristic of the algorithm to the load balancer;

causing, responsive to the communicating, the load balancer to select an algorithm for a load balancing operation with the packet such that the selected algorithm includes the identified characteristic of the algorithm; and

further causing, responsive to the communicating, the load balancing operation to instruct the subset of resources to use a determined type of cryptography with the packet.

2. The method of claim 1, further comprising:

causing the load balancer to switch from a previously selected algorithm for the load balancing operation to the selected algorithm having the identified characteristic of the algorithm, wherein the previously selected algorithm does not include the characteristic of the algorithm.

3. The method of claim 1, wherein the characteristic of the algorithm identifies a specific algorithm.

4. The method of claim 1, wherein the characteristic of the algorithm comprises a type of algorithm.

5. The method of claim 1, wherein each resource in the set of resources is configured to perform at least one operation in a manner similar to another resource in the set of resources, the processing of the packet by any resource in the set of resources comprising the at least one operation, further comprising:

identifying, from executing the rule, a characteristic of a resource for processing the packet; and

selecting, to include in the subset of resources, the resource from the set of resources for the processing of the packet.

6. The method of claim 5, wherein the characteristic of the resource identifies a subset of resources, wherein each resource in the subset includes the characteristic of the resource.

7. The method of claim 5, wherein the characteristic of the resource identifies a capability available at the resource.

8. The method of claim 1, further comprising:

verifying, using an identity verification entity, an identity of the sender from the attribute.

9. The method of claim 8, further comprising:

determining whether the sender is authorized to send the packet.

10. The method of claim 1, further comprising:

receiving the packet; and

receiving the attribute, wherein the attribute identifies a role of the sender.

11. The method of claim 10, wherein the sender is a user, and wherein the role is associated with the user.

12. The method of claim 10, wherein the sender is an application, the application being associated with a user who is distinct from the sender, wherein the role is associated with the user, and wherein the application presents the role in the attribute on behalf of the user.

13. The method of claim 10, wherein the sender comprises a data processing system associated with a user, wherein the role is associated with the user, and wherein the data processing system presents the role in the attribute on behalf of the user.

14. The method of claim 1, wherein the method is embodied in a computer program product comprising one or more computer-readable tangible storage devices and computer-readable program instructions which are stored on the one or more computer-readable tangible storage devices and executed by one or more processors.

15. The method of claim 1, wherein the method is embodied in a computer system comprising one or more processors, one or more computer-readable memories, one or more computer-readable tangible storage devices and program instructions which are stored on the one or more computer-readable tangible storage devices for execution by the one or more processors via the one or more memories and executed by the one or more processors.

16. A computer program product for identity-aware load balancing, the computer program product comprising:

one or more computer-readable tangible storage devices;

program instructions, stored on at least one of the one or more storage devices, to identify, using an attribute communicated with a packet, at an application executing in a data processing system, a sender of the packet, wherein the packet is directed to a set of resources managed by a load balancer;

program instructions, stored on at least one of the one or more storage devices, to select a rule corresponding to the sender;

program instructions, stored on at least one of the one or more storage devices, to change, based on the sender, a manner of queuing the packet at the load balancer prior for a load balancing operation using a subset of resources;

program instructions, stored on at least one of the one or more storage devices, to execute the rule to identify a characteristic of an algorithm, the identified characteristic being usable in the load balancing operation of the load balancer;

program instructions, stored on at least one of the one or more storage devices, to communicate the packet and the identified characteristic of the algorithm to the load balancer;

program instructions, stored on at least one of the one or more storage devices, to cause, responsive to the communicating, the load balancer to select an algorithm for a load balancing operation with the packet such that the selected algorithm includes the identified characteristic of the algorithm; and

program instructions, stored on at least one of the one or more storage devices, to further cause, responsive to the communicating, the load balancing operation to instruct the subset of resources to use a determined type of cryptography with the packet.

17. The computer program product of claim 16, further comprising:

program instructions, stored on at least one of the one or more storage devices, to cause the load balancer to switch from a previously selected algorithm for the load balancing operation to the selected algorithm having the identified characteristic of the algorithm, wherein the previously selected algorithm does not include the characteristic of the algorithm.

18. The computer program product of claim 16, wherein the characteristic of the algorithm identifies a specific algorithm.

19. The computer program product of claim 16, wherein the characteristic of the algorithm comprises a type of algorithm.

20. A computer system for identity-aware load balancing, the computer system comprising:

one or more processors, one or more computer-readable memories and one or more computer-readable tangible storage devices;

program instructions, stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, to identify, using an attribute communicated with a packet, at an application executing in a data processing system, a sender of the packet, wherein the packet is directed to a set of resources managed by a load balancer;

program instructions, stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, to select a rule corresponding to the sender;

program instructions, stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, to change, based on the sender, a manner of queuing the packet at the load balancer prior for a load balancing operation using a subset of resources;

program instructions, stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, to execute the rule to identify a characteristic of an algorithm, the identified characteristic being usable in a load balancing operation of the load balancer;

program instructions, stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, to communicate the packet and the identified characteristic of the algorithm to the load balancer;

program instructions, stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, to cause, responsive to the communicating, the load balancer to select an algorithm for the load balancing operation with the packet such that the selected algorithm includes the identified characteristic of the algorithm; and

program instructions, stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, to further cause, responsive to the communicating, the load balancing operation to instruct the subset of resources to use a determined type of cryptography with the packet.