Aggregated computing infrastructure analyzer

Patent metadata

Field	Value
Publication number	US-9900299-B2
Application number	US-201514678434-A
Country	US
Kind code	B2
Filing date	Apr 3, 2015
Priority date	Apr 3, 2015
Publication date	Feb 20, 2018
Grant date	Feb 20, 2018

Abstract

Embodiments of the invention provide techniques for receiving, authenticating, parsing, and storing operational status data (or telemetry data) from one or more hardware and software systems within an aggregated computing infrastructure. Operational status data may be transmitted over secure transmission channels and stored within secure data stores at a computing infrastructure analyzer. Additionally, some embodiments describe techniques for creating, storing, and retrieving operational risk rules that may apply to one or more computing infrastructures. Based on the operational risk rules, one or more determinations may be performed to identify data items for extraction from the received telemetry data of an aggregated computing infrastructure. Using the extracted telemetry data items, one or more operational risk rules may be evaluated with respect to the aggregated computing infrastructure. Based on the evaluation of operational risk rules, one or more operational risk items and/or operational risk values may be determined for the aggregated computing infrastructure.

First claim

What is claimed is:

1. A method comprising:
receiving, at a computing infrastructure analyzer device, a first data bundle from a first computing system operating in an aggregated computing infrastructure, the first data bundle including data representing the operational status of the first computing system within the aggregated computing infrastructure;
receiving, at the computing infrastructure analyzer device, a second data bundle from a second computing system operating in the aggregated computing infrastructure, the second data bundle including data representing the operational status of the second computing system within the aggregated computing infrastructure, wherein the second computing system operates separately and independently from the first computing system;
retrieving, by the computing infrastructure analyzer device, one or more operational risk rules associated with aggregated computing infrastructures, from a data store, each said operational risk rule including a plurality of criteria stored in the data store;
evaluating, by the computing infrastructure analyzer device, a first operational risk rule, by:
determining a set of criteria of the first operational risk rule, the criteria including a plurality of computing system criteria, each of the computing system criteria identifying a specific hardware device model or a specific software application version;
extracting first system data from the first data bundle, the first system data identifying at least one of a first specific hardware device model or a first specific software application version of the first computer system in the aggregated computing infrastructure;
extracting second system data from the second data bundle, the second system data identifying at least one of a second specific hardware device model or a second specific software application version of the second computer system in the aggregated computing infrastructure;
comparing the first system data and the second system data to the plurality of computing system criteria of the first operational risk rule; and
in response to determining that both the first system data and the second system data match the plurality of computing system criteria of the first operational risk rule, calculating and outputting one or more operational risk values for the aggregated computing infrastructure, based on the first operational risk rule.

2. The method of claim 1 , further comprising:
receiving a request for an operational risk report for the aggregated computing infrastructure from a first client device;
authenticating a first authorized user associated with the request from the first client device;
generating an operational risk report for the aggregated computing infrastructure, wherein contents of the operational risk report are based on operational risk data access permissions associated with the first authorized user; and
transmitting the operational risk report for the aggregated computing infrastructure to the first client device.

3. The method of claim 1 , wherein the data store comprises a database configured to store operational risk rules, and wherein each operational risk rule stored in the database comprises one or more criteria for evaluating the operational risk rule, a probability value, and a severity value.

4. The method of claim 3 , wherein evaluating the first operational risk rule comprises:
retrieving the first operational risk rule from the database;
comparing one or more criteria of the first operational risk rule to the data extracted from the received first and second data bundles; and
based on the comparison, determining whether or not the aggregated computing infrastructure satisfies the first operational risk rule.

5. The method of claim 4 , wherein calculating the one or more operational risk values for the aggregated computing infrastructure comprises:
upon determining that the aggregated computing infrastructure satisfies the first operational risk rule, retrieving a probability value and a severity value associated with the first operational risk rule; and
calculating a first operational risk value associated with the first operational risk rule for the aggregated computing infrastructure, using the probability value and the severity value associated with the first operational risk rule.

6. The method of claim 4 , further comprising:
upon determining that the aggregated computing infrastructure satisfies the first operational risk rule, retrieving a set of remedial actions associated with the first operational risk rule;
generating an operational risk report for the aggregated computing infrastructure, the operational risk report including at least the set of remedial actions associated with the first operational risk rule.

7. The method of claim 1 , wherein receiving the first and second data bundles comprises:
determining first decoding and decrypting techniques for the first data bundle based on the first computing system;
receiving a second data bundle from a second component of the aggregated computing infrastructure, the second data bundle encoded and encrypted using second encoding and encrypting techniques different from the first encoding and encrypting techniques; and
determining second decoding and decrypting techniques for the second data bundle based on the second computing system, wherein the second encoding and encrypting techniques used to encode and encrypt the second data bundle are different from the first encoding and encrypting techniques used to encode and encrypt the first data bundle.

8. The method of claim 1 , wherein:
the aggregated computing infrastructure comprises one or more storage devices, one or more computer servers, one or more virtual machine servers, one or more operating systems, one or more database servers, one or more middleware applications, and one or more user software applications, and
receiving the first and second data bundles comprises receiving a data bundle from two or more different components within the aggregated computing infrastructure.

9. The method of claim 1 , wherein the first computing system and the second computing do not communicate directly within the aggregated computing infrastructure.

10. The method of claim 1 , wherein calculating and outputting the operational risk values based on the first operational risk rule comprises determining an operational risk affecting the first computing system but not the second computing system.

11. The method of claim 1 , wherein calculating and outputting the operational risk values based on the first operational risk rule comprises determining an operational risk affecting a third computing system within the aggregated computing infrastructure, but not affecting either of the first computing system or the second computing system.

12. The method of claim 1 , further comprising:
receiving an updated first operational risk rule from the data store;
in response to receiving the updated first operational risk rule from the data store:
initiating a first request to the first computing system for an updated first data bundle including data representing an updated operational status of the first computing system within the aggregated computing infrastructure; and
initiating a second request to the second computing system for an updated second data bundle including data representing an updated operational status of the second computing system within the aggregated computing infrastructure.

13. A system comprising:
a processing unit comprising one or more processors; and
memory coupled with and readable by the processing unit and storing therein a set of instructions whi

Assignees

• Oracle Int Corp

Inventors

• Oppenheim Jr Andrew Balt
• Melville Charles Stephen
• Patel Nayan

Classifications

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• G06F16/282

  Hierarchical databases, e.g. IMS, LDAP data stores or Lotus Notes · CPC title

• G06F16/2455

  Query execution · CPC title