Mobile Client Devices in Edge Computing

Abstract

Techniques are disclosed for dynamically transitioning a mobile client device from one location to another within edge computing. The techniques include locating near edge and far edge locations and collecting one or more security compliance center (SCC) rules. The techniques include identifying edge accesses from one or more client devices and determining a mobility pattern associated with the edge accesses. The techniques include determining an edge recommendation based on the mobility pattern and applying the edge recommendation.

Description

[Technical field]

[0001] The present invention relates generally to the field of computing, and more particularly to edge computing. [Background technology]

[0002] The recent trend of edge computing extends cloud computing and the Internet of Things (IoT) to the edge of the network. Edge computing moves more computing power and resources closer to the end user by increasing the number of endpoints and locating them closer to the consumer, whether that be a user or a device. Essentially, edge computing architectures build on existing technologies and established paradigms for distributed systems, which means there are many well-understood components available to generate the most effective architecture for building and distributing edge use cases.

[0003] The collector is an agent that will be installed at the edge to collect compliance and security posture. Summary of the Invention

[0004] Aspects of the present invention disclose computer-implemented methods, computer systems, and computer program products for dynamically migrating mobile client devices in edge computing. The computer-implemented methods may be implemented by one or more computer processors and may include locating near edge and far edge locations, identifying edge accesses from client devices, determining mobility patterns associated with the edge accesses, and applying security compliance center (SCC) rules to the edge accesses.

[0005] According to another aspect of the present invention, there is provided a computer system including a processing unit and a memory coupled to the processing unit for storing instructions that, when executed by the processing unit, perform operations of a method according to an embodiment of the present invention.

[0006] According to another aspect of the present invention, there is provided a computer program product tangibly stored on a non-transitory machine-readable medium and including machine-executable instructions that, when executed on a device, cause the device to perform operations of a method according to an embodiment of the present invention.

[0007] Preferred embodiments of the invention will now be described, by way of example only, with reference to the following drawings, in which: [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 is a functional block diagram illustrating an edge environment, designated 100, in accordance with an embodiment of the present invention. [Figure 2A] 1 is a functional block diagram illustrating connectivity between a near-edge collector, a cloud SCC, a stationary far-edge device, and a mobile far-edge device in accordance with an embodiment of the present invention. [Figure 2B] FIG. 2 is a functional block diagram illustrating process flow / interactions between a cloud SCC, a mobile edge device, and a collector according to an embodiment of the present invention. [Diagram 3] 3 is a high level flow chart illustrating operation of edge component 111, designated 300, in accordance with another embodiment of the present invention. [Figure 4] 4 is a block diagram, designated 400, of components of a server computer capable of executing edge component 111 within edge environment 100, in accordance with an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] The current state of the art as it pertains to edge computing, especially with security and compliance with edge devices on the cloud, can present several challenges. One challenge is, for example, the scenario where a mobile far edge is moving from point 1 to point 2 - based on the geographic location between point 1 and point 2, the compliance and security requirements change. Therefore, this makes it difficult to find a robust solution to the compliance requirements of the moving edge.

[0010] The present invention embodiments recognize deficiencies in the current state of the art with respect to providing compliance and security for edge computing and provide approaches. One approach includes a dedicated collector and / or scanner. This approach allows for collection of the location (e.g., from origin to destination) of moving edge devices and dynamically meets security and compliance requirements while the edge device location changes. For example, there is a collector / scanner that is handed (a) what goals / policies to scan and (b) what targets to scan. This disclosure then describes how this can be intelligently handled in the mobile edge case.

[0011] Some embodiments of the present invention provide approaches that provide systems and methods for smart collectors at the mobile edge powered by an intelligent handshake with a cloud security and compliance center.

[0012] Some embodiments of the present invention provide an approach that provides a step for location to SCC mapping, where security and compliance at the edge requires a collector / agent that can collect / scan the security and compliance posture and send it to a cloud server for analysis. Another step provided by this approach is that the system has a mapping between location / region vs. compliance & security requirements. Based on this mapping collector (or it may simply be a change of rules or policies to run) each location can be made available.

[0013] Some embodiments of the present invention provide an approach that provides a step for dynamic location based collector (diff & download) where when the location of an edge changes from location 1 to location 2, the system checks if there are any changes in the collector or rules based on the location to SCC mapping.

[0014] Some embodiments of the invention provide a step where, in some cases, new rules or goals need to be added. In some cases, some rules have to be deactivated. In such cases, the cloud SCC sends the delta (addition or deletion) to the collector already running on the edge.

[0015] Some embodiments of the invention provide a method for the step where, in some cases, the collector type itself changes: the system handshakes with the edge, downloads the latest collector, and allows the previous collector to be deactivated.

[0016] Some embodiments of the present invention provide an approach that provides steps for predictive route-based collector updates, where the system keeps track of the mobility patterns of the mobile edges. Based on this, if the system finds that the edge is going to cross the location to SCC mapping in 2 hours and it will require a significant amount of download (collectors or rules), the system will start sending this data to the edge while it is still on the route. A new collector will not be installed until the edge crosses the SCC boundary. As soon as the edge crosses the boundary, a new installation will occur or a new rule will be activated or an inactive rule will be deactivated.

[0017] Some embodiments of the present invention provide approaches that disclose steps for intelligent pre-determination of an irrelevant collection process in cases where Edge 1 may be in transit while a collection process is initiating based on SCC rules or goals at Location 1. If the system determines based on previous scan history at Location 1 that a scan typically takes 30 minutes to complete and transportation occurs 15 minutes later, the system may decide to pre-terminate the collection process since the results will be irrelevant by the time they are available.

[0018] Some embodiments of the present invention provide an approach that discloses steps for recommending route adjustments based on resources required for compliance and security scanning in cases where location 1 may have a large amount of SCC requirements and therefore the resources required to run a collector may be substantial. The system may detect this based on Edge 1 and Edge 2 being in the same location. Now, based on the mobility pattern of Edge 3, it may be seen that Edge 3 is moving towards Location 1 and further based on the historical analysis system, it may be seen that Edge 3 may not have sufficient resources to provide to run an SCC collector at Location 1. In such cases, intelligent location adjustment advice may be sent to the edges to reduce the resource requirements.

[0019] References herein to "one embodiment," "an embodiment," "an exemplary embodiment," and the like indicate that the embodiment being described may include a particular feature, structure, or characteristic, but each embodiment may not necessarily include the particular feature, structure, or characteristic. Moreover, such phrases do not necessarily refer to the same embodiment. Moreover, when a particular feature, structure, or characteristic is described in connection with one embodiment, it is believed to be within the knowledge of one of ordinary skill in the art to affect such feature, structure, or characteristic in connection with other embodiments, whether or not explicitly described.

[0020] It should be understood that the figures are only schematic and are not drawn to scale, and that the same reference numbers have been used throughout the figures to denote the same or similar parts.

[0021] 1 is a functional block diagram illustrating an edge environment, designated 100, in accordance with an embodiment of the present invention. FIG. 1 is merely provided as an illustration of one implementation and is not intended to suggest any limitations with regard to the environments in which different embodiments may be implemented. Many modifications to the illustrated environment may be made by one of ordinary skill in the art without departing from the scope of the present invention as set forth in the claims.

[0022] The edge environment 100 includes a network 101, a cloud SCC 102, a collector 103, and a client device 104.

[0023] The network 101 may be, for example, a telecommunications network, a local area network (LAN), a wide area network (WAN) such as the Internet, or a combination of the three, and may include wired, wireless, or fiber optic connections. The network 101 may include one or more wired and / or wireless networks capable of receiving and transmitting data signals, voice signals, and / or video signals, including multimedia signals including voice, data, and video information. In general, the network 101 may be any combination of connections and protocols capable of supporting communication between the server 110, the cloud SCC 102, the collector 103, the client device 104, and other computing devices (not shown) in the edge environment 100. It should be noted that the other computing devices may include, but are not limited to, the client device 104, and any electromechanical device capable of executing a sequence of computing instructions.

[0024] The Cloud SCC (Security Compliance Center) 102 is a system (or subsystem) that enables management (e.g., security, compliance, etc.) of edge devices to an edge computing infrastructure. This may include enabling secure connectivity of edge devices to an edge computing infrastructure including resources in the cloud. Other features may include, but are not limited to, (i) automating security and compliance posture, (ii) enabling configuration governance, and (iii) vulnerability and threat detection.

[0025] The collector 103 is one or more agents that will be installed at the edge to collect compliance and security posture.

[0026] The client devices 104 are electronic computing devices used by consumers in their daily lives, such as smartphones, wearable smart devices, smart vehicles, IoT (Internet of Things) devices, smart sensors, and tablets.

[0027] Server 110 may be a standalone computing device, an administration server, a web server, a mobile computing device, or any other electronic device or computing system capable of receiving, transmitting, and processing data. In other embodiments, server 110 may represent a server computing system utilizing multiple computers as a server system, such as in a cloud computing environment. In another embodiment, server 110 may be a laptop computer, a tablet computer, a netbook computer, a personal computer (PC), a desktop computer, a personal digital assistant (PDA), a smartphone, or any other programmable electronic device capable of communicating with other computing devices (not shown) in edge environment 100 via network 101. In another embodiment, server 110 represents a computing system utilizing clustered computers and components (e.g., database server computers, application server computers, etc.) that act as a single pool of seamless resources when accessed within edge environment 100.

[0028] An embodiment of the present invention may reside on a server 110 or a cloud SCC 102. The server 110 includes an edge component 111 and a database 116.

[0029] The Edge component 111 provides capabilities to manage smart collectors at the mobile edge by providing an intelligent handshake with the cloud security and compliance center. Other capabilities of the Edge component 111 include, but are not limited to, (i) managing compliance and / or security rules or objectives (deactivating old rules, generating new rules, modifying existing rules, etc.), (ii) managing the location of all edge and / or client devices requesting access to the edge infrastructure, and (iii) predicting the route / mapping of client devices as they move from one location to another.

[0030] The edge component 111 may include the following subcomponents: an SCC component 121, an edge device 122, a location component 123, and an AI component 124.

[0031] The SCC component 121 has the capability of managing (e.g., security, compliance, etc.) edge devices to the edge computing infrastructure. This can include enabling secure connectivity of edge devices to the edge computing infrastructure including resources in the cloud. Additionally, the SCC component 121 provides the capability to interface to a security compliance center (SCC) in the cloud.

[0032] The edge device 122 provides the capability to track all edge devices within the edge computing infrastructure and all client devices (i.e., client device 104) that utilize the edge computing resources.

[0033] The location component 123 provides the capability to track the location of a client device as it moves from one location to another within the edge computing infrastructure.

[0034] One feature of the location component 123 includes "location to SCC (Security and Compliance Center in the Cloud) mapping," which includes the properties that (i) security and compliance at the edge requires a collector / agent that can collect / scan security and compliance posture and send it to a cloud server for analysis, and (ii) the system has a mapping between location / region vs. compliance & security requirements. Based on this mapping collector (or it may simply be a change of rules or policies to run), each location can be made available.

[0035] One feature of the location component 123 includes "Dynamic Location Based Collector (Diff & Download)". This includes the following properties: (i) when the location of an edge changes from location 1 to location 2, the system checks if there are any changes in the collectors or rules based on the location to SCC mapping; (ii) in some cases, new rules or goals need to be added. In some cases, some rules have to be deactivated. In such cases, the cloud SCC sends a diff (add or remove) to the collectors already running on the edge; and (iii) in some cases, the collector type itself changes. The system handshakes with the edge, downloads the latest collector, and allows the previous collector to be deactivated.

[0036] The AI ​​component 124 provides the capability to manage and enforce security and compliance rules based on different scenarios / requirements from the client devices. One feature of the AI ​​component 124 includes predicting / forecasting, “predictive route based collector updates”. This feature includes the following properties: (i) the system keeps track of the mobility patterns of the mobile edge. Based on this, if the system finds that the edge is going to cross the location to SCC mapping in 2 hours and it will require a significant amount of downloads (collectors or rules), the system starts sending this data to the edge while it is still on the route. New collectors are not installed until the edge crosses the SCC boundary. As soon as the edge crosses the boundary, new installations occur or new rules are activated or invalid rules are deactivated.

[0037] The AI ​​component 124 includes pre-determining the collection process, "intelligent pre-determination of irrelevant collection process," which includes the property that (i) in some cases, edge 1 may be in transit while a collection process is starting based on SCC rules or goals at location 1. If the system sees based on previous scan history at location 1 that a scan typically takes 30 minutes to complete and transportation occurs 15 minutes later, the system may decide to pre-terminate the collection process since the results will be irrelevant by the time they are available.

[0038] The AI ​​component 124 includes route adjustment, "recommending route adjustments based on resources required for compliance and security scanning." This feature includes the characteristic that (i) in some cases, location 1 may have a large amount of SCC requirements, and therefore the resources required to run a collector may be substantial. The system may detect this based on edge 1 and edge 2 that were in the same location. Now, based on the mobility pattern of edge 3, it may be seen that edge 3 is moving towards location 1, and further based on the historical analysis system, it may be seen that edge 3 may not have enough resources to provide to run an SCC collector at location 1. In such a case, intelligent location adjustment advice may be sent to the edge to reduce the resource requirements.

[0039] The database 116 is a repository for data used by the edge component 111. The database 116 may be implemented using any type of storage device capable of storing data and configuration files that can be accessed and utilized by the server 110, such as a database server, hard disk drive, or flash memory. The database 116 stores information using one or more of a number of techniques known in the art. In the illustrated embodiment, the database 116 resides on the server 110. In another embodiment, the database 116 may reside elsewhere in the edge environment 100, provided that the edge component 111 has access to the database 116. The database 116 may store information associated with, but not limited to, a knowledge corpus, patient medical history, IoT devices, smart bed profiles and settings, patient modeling, patient activities, and home automation routines.

[0040] FIG. 2A is a functional block diagram illustrating connectivity between a near-edge collector, a cloud SCC, a stationary far-edge device, and a mobile far-edge device in accordance with an embodiment of the present invention.

[0041] FIG. 2B is a functional block diagram illustrating the process flow / interaction between a cloud SCC, a mobile edge device, and a collector in accordance with an embodiment of the present invention.

[0042] FIG. 3 is a high level flow chart illustrating operation of edge component 111, designated 300, in accordance with an embodiment of the present invention.

[0043] The edge component 111 searches for locations (step 302). In an embodiment, the edge component 111 searches for near edge and far edge locations through the location component 123. The edge component 111 is aware of all edge components / devices in the edge computing infrastructure, including the state of operational devices, the load, and the capacity of all resources in the edge computing infrastructure.

[0044] Additionally, the edge component 111 collects security rules for various locations for analysis (step 304). Thus, the edge component 111 has a mapping between locations / regions vs. compliance & security requirements. Based on this mapping collector (or it may simply change the rules or policies to implement), each location can be made available whenever the client device moves between locations.

[0045] As an example, a user case scenario is used to illustrate the high level steps. Client Device 1 is a smartphone belonging to User 1. User 1 is traveling from Miami, FL to Los Angeles, CA. Client Device 1 is logging into an application related to the user's enterprise (i.e. confidential records preparing for a meeting). There are multiple collectors in the edge computing infrastructure.

[0046] The edge component 111 identifies edge access (step 306). In an embodiment, the edge component 111 identifies edge access from a client device through the SCC component 121, the edge device 122, and the location component 123. Continuing with the previous user case scenario, the edge component 111 detects that the client device 1 is accessing a resource in Miami, Florida.

[0047] The edge component 111 determines a mobility pattern (step 308). In an embodiment, the edge component 111, through the AI ​​component 124, determines a mobility pattern associated with an edge access. The edge component 111 may attempt to predict / project the “route” and resources (e.g., required software, data / network access, etc.) that the client device will require as the client device moves from one location to another.

[0048] Further, based on mobility patterns, the edge component 111 can check for location-based rules that have an impact between locations (e.g., Miami to Los Angeles). When the edge location changes from location 1 to location 2, the system checks for changes in collectors or rules based on location to SCC mapping. In some cases, new rules or targets need to be added. In some cases, some rules have to be deactivated. In such cases, the cloud SCC sends the delta (addition or deletion) to the collectors already running on the edge.

[0049] Continuing with the previous user case scenario, the edge component 111 may predict based on the travel patterns of user 1 that user 1 is on his way to his headquarters in Los Angeles for a meeting, and therefore, the edge component 111 may predict possible resources that client device 1 may have available while traveling.

[0050] The edge component 111 determines an edge recommendation (step 310). In an embodiment, the edge component 111, through the AI ​​component 124, determines the edge recommendation based on the SCC rules associated with the mobility pattern. In general, the edge component 111 may determine that there is a large SCC requirement (i.e., the resources required to run a collector may be substantial) based on detection. The edge component 111 may detect this based on edge 1 and edge 2 that were in the same location. Now, based on the mobility pattern of edge 3, it may be seen that edge 3 is moving towards location 1, and further based on the historical analysis, the system may see that edge 3 may not have enough resources to provide to run an SCC collector at location 1. In such a case, the intelligent location adjustment suggests one or more edge recommendations. One of the edge recommendations may include sending additional resources to the edge to reduce the resource requirement.

[0051] In other embodiments, the edge component 111 may suggest an edge recommendation based on whether the first collector is able to complete execution of one or more SCC rules before the client device moves to the second location.

[0052] The edge component 111 applies the edge recommendation (step 312). In an embodiment, the edge component 111 executes one or more edge recommendations for edge access through the AI ​​component 124 and the SCC component 121. A system administrator may select one solution to apply from among many recommendations. Note that the AI ​​component 124 may select and apply a solution without user interaction.

[0053] Continuing with the previous user case scenario, the edge component 111 may determine that User 1 is going to cross the location to SCC mapping in 2 hours and that it will require a significant amount of download (collectors or rules), after which the edge component 111 will start sending this data to other edges while still on route. New collectors will not be installed until the edge crosses the SCC boundary. As soon as the edge crosses the boundary, new installations will occur or new rules will be activated or inactive rules will be deactivated. Thus, when the user arrives in Los Angeles for a meeting (while working on a presentation by accessing sensitive corporate data along the way), it will be a seamless transition / transparent to the user.

[0054] FIGURE 4 illustrates a block diagram of components of an application of the edge component 111, designated 400, in accordance with an exemplary embodiment of the invention. It should be appreciated that FIGURE 4 is merely provided as an illustration of one implementation and is not intended to suggest any limitation with respect to the environments in which different embodiments may be implemented. Many modifications to the depicted environment may be made.

[0055] 4 includes a processor 401, a cache 403, a memory 402, a persistent storage 405, a communication unit 407, an input / output (input / output) interface 406, and a communication fabric 404. The communication fabric 404 provides communication between the cache 403, the memory 402, the persistent storage 405, the communication unit 407, and the input / output (input / output) interface 406. The communication fabric 404 may be implemented using any architecture designed to pass data and / or control information between a processor (such as a microprocessor, a communication and network processor, etc.), system memory, peripheral devices, and any other hardware components in the system. For example, the communication fabric 404 may be implemented using one or more buses or crossbar switches.

[0056] Memory 402 and persistent storage 405 are computer-readable storage media. In this embodiment, memory 402 includes random access memory (RAM). In general, memory 402 may include any suitable volatile or non-volatile computer-readable storage medium. Cache 403 is a high-speed memory that improves the performance of processor 401 by holding recently accessed and near recently accessed data from memory 402.

[0057] Program instructions and data (e.g., software and data x10) used to practice embodiments of the present invention may be stored in persistent storage 405 and memory 402 for execution by one or more of the respective processors 401 via cache 403. In an embodiment, persistent storage 405 includes a magnetic hard disk drive. As an alternative to, or in addition to, a magnetic hard disk drive, persistent storage 405 may include a solid state hard drive, a semiconductor storage device, a read only memory (ROM), an erasable programmable read only memory (EPROM), a flash memory, or any other computer-readable storage medium capable of storing program instructions or digital information.

[0058] The media used by persistent storage 405 may also be removable. For example, a removable hard drive may be used for persistent storage 405. Other examples include optical and magnetic disks, thumb drives, and smart cards that are inserted into a drive for transfer to another computer-readable storage medium that is also part of persistent storage 405. Edge components 111 may be stored in persistent storage 405 for access and / or execution by one or more of the respective processors 401 via cache 403.

[0059] The communications unit 407, in these examples, provides for communication with other data processing systems or devices. In these examples, the communications unit 407 includes one or more network interface cards. The communications unit 407 may provide for communication by using either or both physical and wireless communications links. Program instructions and data used to practice embodiments of the present invention (e.g., edge component 111) may be downloaded to persistent storage 405 via the communications unit 407.

[0060] The input / output interface 406 allows for the input and output of data with other devices that may be connected to each computer system. For example, the input / output interface 406 may provide a connection to an external device 408, such as a keyboard, a keypad, a touch screen, or any other suitable input device or combination thereof. The external device 408 may also include a portable computer-readable storage medium, such as, for example, a thumb drive, a portable optical or magnetic disk, and a memory card. Program instructions and data used to practice embodiments of the present invention (e.g., edge component 111) may be stored on such a portable computer-readable storage medium and loaded into the persistent storage 405 via the input / output interface 406. The input / output interface 406 also connects to a display 409.

[0061] Display 409 provides a mechanism for displaying data to a user and may be, for example, a computer monitor.

[0062] The programs described herein are identified based on the application for which they are implemented in a particular embodiment of the invention, however, it should be understood that the nomenclature of specific programs herein is used merely for convenience, and thus the invention should not be limited to use only with the particular application identified and / or implied by such nomenclature.

[0063] The present invention may be a system, method, and / or computer program product integrated at any possible level of technical detail. The computer program product may include a computer readable storage medium (or multiple computer readable storage media) having computer readable program instructions for causing a processor to implement aspects of the present invention.

[0064] A computer readable storage medium may be a tangible device capable of holding and storing instructions for use by an instruction execution device. A computer readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. A non-exhaustive list of more specific examples of computer readable storage media includes: portable computer diskettes, hard disks, random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read only memory (CD-ROM), digital versatile disk (DVD), memory sticks, floppy disks, mechanically encoded devices such as punch cards or grooved structures having instructions recorded thereon, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium should not be construed as a transitory signal itself, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses passing through a fiber optic cable), or electrical signals transmitted over electrical wires.

[0065] The computer readable program instructions described herein may be downloaded from a computer readable storage medium to the respective computing / processing device or to an external computer or storage device via a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may include copper transmission cables, optical transmission fiber, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer readable program instructions from the network and forwards the computer readable program instructions to a computer readable storage medium within the respective computing / processing device for storage.

[0066] The computer readable program instructions for carrying out the operations of the present invention may be either assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state setting data, configuration data for an integrated circuit, or source or object code written in any combination of one or more programming languages, including object oriented programming languages ​​such as Smalltalk®, C++, and procedural programming languages ​​such as the “C” programming language or similar programming languages. The computer readable program instructions may be executed entirely on the user's computer as a standalone software package, partially on the user's computer, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (e.g., via the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) can execute computer readable program instructions to individualize the electronic circuitry by utilizing state information of the computer readable program instructions to perform aspects of the invention.

[0067] Aspects of the present invention are described herein with reference to flowchart and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart and / or block diagrams, and combinations of blocks in the flowchart and / or block diagrams, can be implemented by computer readable program instructions.

[0068] These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, executed by the processor of the computer or other programmable data processing apparatus, produce means for performing the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams. These computer readable program instructions may also be stored on a computer readable medium, such that the computer readable storage medium on which the instructions are stored comprises an article of manufacture including instructions implementing aspects of the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams, and can direct a computer, programmable data processing apparatus, or other device, or combination thereof, to function in a particular manner.

[0069] The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause the computer, other programmable apparatus, or other device to perform a series of operable steps to create a computer-implemented process such that the instructions, which execute on the computer, other programmable apparatus, or other device, implement the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0070] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block of the flowcharts or block diagrams may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing the specified logical function. In some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may in fact be executed substantially simultaneously, or the blocks may possibly be executed in the reverse order, depending on the functionality involved. It should also be noted that each block of the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented by a dedicated hardware-based system that performs the specified functions or actions, or a combination of dedicated hardware and computer instructions.

[0071] Although the description of various embodiments of the present invention has been presented for illustrative purposes, the description is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the present invention. The terms used in this specification are selected to best explain the principles of the embodiments, practical applications, or technical improvements beyond the technology found in the market, or to enable those skilled in the art to understand the embodiments disclosed herein.

[0072] The corresponding structures, materials, acts, and equivalents of all means-plus-function or step-plus-function elements within the scope of the appended claims are intended to include any structures, materials, or acts for performing a function in combination with other claim elements as specifically claimed. The description of the present invention has been presented for purposes of illustration and description, but is not intended to be exhaustive or to limit the invention to the disclosed form. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the invention. The embodiments have been selected and described in order to best explain the principles and practical applications of the invention and to enable those skilled in the art to understand the invention in various embodiments with various modifications as suited to the particular uses contemplated.

[0073] Finally, the proposed concepts may be briefly summarized in the following sections. 1. The system may be implemented by extending traditional cloud-centric edge computing architectures. 2. The system continues to identify far edge and near edge based on edge gateway network capabilities. 1. Reachability 2.Availability 3. Upload and Download Capabilities 4. Locality 5. Mobility 3. Each gateway or edge computing environment has a classification (far or near), which may change. The cloud service keeps track of these parameters. 4. Each edge can join a cloud-based Edge Security and Compliance Center (ESCC). 5. In the centralized ESCC, administrators can select security control rules (e.g., dynamic scan rules and scan types) and compliance objectives. 6. Cloud services continue to identify far-edge mobility patterns. 7. The system also has a mapping of the SCC locations and the required collectors and security rules and scans. 8. In case of mobile edge, the system has a mapping of geographical locations (MAP points) where the location of the SCC may change. 9. If the location of the Mobile Edge SCC is swapped, the system initiates a handshake between the Cloud SCC and the Mobile Edge. 10. Cloud SCC calculates the difference. 1. New security rules sent to the edge 2. Rules that need to be deactivated 3. New collector sent 4. Deactivated Collectors 11. Based on this list, the Cloud SCC starts forwarding collectors and rules. 12.SCC is a security and compliance center for enterprise cloud management systems that receives details from agents or collectors that may be installed on target systems. 13.SCC also starts deactivating disabled rules and collectors. 14. Based on mobility patterns, the system can predict the list (described in step 10) in advance. 15. In such cases, the cloud SCC proactively sends these to the edge. 16. Activation and deactivation only begins when the position is actually crossed. 17. In some cases, transport time through a location will be small compared to the overall scan and acquisition time. 18. In such cases, the SCC pre-terminates the scan because the results become irrelevant once the boundary is crossed. 19. The Cloud SCC keeps track of the resources required to perform the scanning and collection process. 20. This can be done through historical analysis of all edge resource utilization etc. 21. If the Cloud SCC discovers that collection and security scanning reveals an Edge attempting to reach a location that actually requires more resources than the Edge can provide, the system may suggest to the Edge to change its route or mobility pattern. 22. If the Edge is unable to accept the request, the Cloud SCC may send a warning to the Edge administrator since the Edge SCC results may not be comprehensive and therefore visibility into the actual security and compliance posture may be minimal. 23. In such cases, the Administrator may reduce the time required to be spent in such a position of questionable compliance. 24. The method includes having location to SCC mapping, where security and compliance at the edge requires a collector / agent that can collect / scan the security and compliance posture and send it to a cloud server for analysis. 25. The method includes a step where the system has a mapping of locations / areas vs. compliance & security requirements. Based on this mapping collector (or it may simply be a change of rules or policies to implement) each location can be made available. 26. The method includes steps for dynamic location based collector (diff & download), where when the location of an edge changes from location 1 to location 2, the system checks if there is a change in collector or rules based on location to SCC mapping. 27. The method includes a step where, in some cases, new rules or goals need to be added. In some cases, some rules have to be deactivated. In such cases, the cloud SCC sends the delta (addition or deletion) to the collector already running at the edge. 28. The method may optionally include changing the collector type itself, allowing the system to handshake with the edge, download the latest collector, and deactivate the previous collector. 29. The method includes steps for predictive route based collector updates, where the system keeps track of the mobility patterns of the mobile edges. Based on this, if the system finds that the edge is going to cross the location to SCC mapping in 2 hours and it will require a significant amount of download (collectors or rules), the system starts sending this data to the edge while it is still on route. A new collector is not installed until the edge crosses the SCC boundary. As soon as the edge crosses the boundary, a new installation occurs or a new rule is activated or an inactive rule is deactivated. 30. The method optionally includes a step for intelligent pre-determination of an irrelevant collection process when Edge 1 may be in transit while a collection process is initiating based on SCC rules or goals at Location 1. If the system determines based on previous scan history at Location 1 that a scan typically takes 30 minutes to complete and transportation occurs 15 minutes later, the system may determine to pre-terminate the collection process since the results will be irrelevant by the time they are available. 31. The method may include a step for recommending route adjustments based on resources required for compliance and security scanning where, in some cases, location 1 may have a large amount of SCC requirements and therefore the resources required to run the collector may be substantial. The system may detect this based on Edge 1 and Edge 2 being in the same location. Now, based on the mobility pattern of Edge 3, it may be seen that Edge 3 is moving towards Location 1 and further based on the historical analysis system, it may be seen that Edge 3 may not have enough. 32. Another embodiment of the high level process flow may include the system continuing to identify far edge and near edge based on edge gateway network capabilities: a) reachability, b) availability, c) upload and download capabilities, d) locality, and e) mobility.

Claims

1. 1. A computer-implemented method for dynamically migrating moving client devices in an edge computing infrastructure, comprising: locating near and far edge locations; Collecting one or more SCC rules; Identifying edge access from one or more client devices; determining a mobility pattern associated with the edge access; edge recommendation based on the mobility pattern; and applying the edge recommendations.

2. Finding the location of the near edge and the far edge The computer-implemented method of claim 1 , further comprising generating one or more mapping locations associated with the near and far edges and one or more collectors.

3. Identifying edge access from a client device 10. The computer-implemented method of claim 1, further comprising detecting access to the edge computing infrastructure from the one or more client devices.

4. Determining a mobility pattern associated with the edge access, determining, by a first collector, a first location of the one or more client devices based on a first time interval; determining the one or more SCC rules associated with the first location; predicting a second location of the one or more client devices based on client historical analysis and patterns; The computer-implemented method of claim 1 , further comprising: determining the one or more SCC rules associated with the second location.

5. determining the edge recommendation based on the mobility pattern; 5. The computer-implemented method of claim 4, further comprising determining whether the first collector is able to complete execution of the one or more SCC rules for the one or more client devices before the one or more client devices move to the second location.

6. applying the edge recommendation, 6. The computer-implemented method of claim 5, further comprising, in response to the first collector being unable to complete the execution of the one or more SCC rules, requesting the second location to complete the execution of the one or more SCC rules.

7. 2. The computer-implemented method of claim 1, wherein the one or more SCC rules further include security control rules, adding / removing collectors running on the edge, and security scanning.

8. 2. The computer-implemented method of claim 1, wherein the edge recommendations further include new security rules sent to the edge, rules that need to be deactivated, new collectors sent and collectors to be deactivated, initiating transfer of collectors and rules, ending a scan time when the client device crosses a different edge, suggesting a security scan at another location, and warning that security and compliance posture may be marginal for the edge.

9. 1. A security edge system, comprising: A security compliance center (SCC) in the cloud associated with the edge computing architecture; One or more collectors associated with the SCC cloud and the edge computing architecture; a security coordinator disposed in the SCC cloud, the security coordinator being configured to manage the one or more collectors and the one or more client devices based on one or more security rules; one or more client devices utilizing the edge computing architecture; one or more computer readable storage media; and program instructions stored on the one or more computer readable storage media for execution by the security coordinator.

10. The program instructions include: program instructions for locating near and far edges; program instructions for collecting one or more SCC rules; program instructions for identifying edge access from one or more client devices; program instructions for determining a mobility pattern associated with the edge access; program instructions for determining edge recommendations based on the mobility patterns; and program instructions for applying the edge recommendations.

11. 10. The security edge system of claim 9, wherein the one or more security rules further include security control rules, adding / removing collectors running on the edge, and security scanning.

12. The program for locating near and far edge locations comprises:

10. The security edge system of claim 9, further comprising program instructions for generating one or more mapping locations associated with the near edge and the far edge and one or more collectors.

13. program instructions for identifying edge access from a client device, 10. The security edge system of claim 9, further comprising program instructions for detecting access to the edge computing infrastructure from the one or more client devices.

14. program instructions for determining a mobility pattern associated with the edge access, program instructions for determining a first location of the one or more client devices based on a first time interval; program instructions for determining the one or more SCC rules associated with the first location; program instructions for predicting a second location of the one or more client devices based on client historical analysis and patterns; and program instructions for determining the one or more SCC rules associated with the second location.

15. program instructions for determining the edge recommendation based on the mobility pattern, 15. The security edge system of claim 14, further comprising program instructions for determining whether the first collector is able to complete execution of the one or more SCC rules for the one or more client devices before the one or more client devices move to the second location.

16. program instructions for applying the edge recommendation, 16. The security edge system of claim 15, further comprising program instructions for, in response to the first collector being unable to complete the execution of the one or more SCC rules, requesting the second location to complete the execution of the one or more SCC rules.

17. 1. A computer program product for dynamically migrating moving client devices in an edge computing infrastructure, comprising: program instructions for locating near and far edges; program instructions for collecting one or more SCC rules; program instructions for identifying edge access from one or more client devices; program instructions for determining a mobility pattern associated with the edge access; program instructions for determining edge recommendations based on the mobility patterns; and program instructions for applying said edge recommendations.

18. program instructions for determining a mobility pattern associated with the edge access, program instructions for determining, by a first collector, a first location of the one or more client devices based on a first time interval; program instructions for determining the one or more SCC rules associated with the first location; program instructions for predicting a second location of the one or more client devices based on client historical analysis and patterns; 20. The computer program product of claim 17, further comprising: program instructions for determining the one or more SCC rules associated with the second location.

19. program instructions for determining the edge recommendation based on the mobility pattern, 20. The computer program product of claim 18, further comprising program instructions for determining whether the first collector can complete execution of the one or more SCC rules for the one or more client devices before the one or more client devices move to the second location.

20. applying the edge recommendation, 20. The computer program product of claim 19, further comprising program instructions for, in response to the first collector being unable to complete the execution of the one or more SCC rules, requesting the second location to complete the execution of the one or more SCC rules.

Images