Multi-Tenant Network Log Aggregation via Intermediary Logging Entity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In large distributed computing systems, identifying and securing vulnerabilities is challenging due to complexity and distribution, making it difficult to collect and analyze log information, and conventional systems rely on manual mitigation.
Innovation Solution
A computing resource service provider collects, packages, and provides network and computer log information to customers, enabling intrusion detection and mitigation services to analyze and update security settings, with a logging entity obtaining information from firewalls and persistently storing it for visualization and alert generation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual mitigation of vulnerabilities is used in distributed computing systems, then system security can be maintained with simple tools, but the complexity and distribution of computing resources make it difficult to collect and analyze log information efficiently
Solution Approach 1:
The system segments log collection by implementing separate logging entities for different computing resources (physical and virtual machines). Each logging entity independently collects log information from its assigned resources, and logs are organized by resource identifiers. This segmentation allows parallel collection and analysis of logs from distributed resources without overwhelming a single analysis system.
Solution Approach 2:
The patent introduces an intermediary logging entity that acts as a bridge between distributed computing resources and the analysis system. The logging entity collects logs from multiple resources, packages them with resource identification information, and forwards them to the analysis system. This intermediary handles the complexity of log aggregation, allowing the analysis system to focus on security threat detection without dealing with the complexity of distributed log collection.
2Loss of information
If comprehensive log information is collected from all computing resources, then vulnerability identification and security analysis are improved, but the volume and distribution of logs make analysis difficult and time-consuming
Solution Approach 1:
The system performs preliminary actions by collecting and packaging log information continuously in the background before security analysis is needed. Logging entities monitor computing resources and accumulate log data with resource identifiers pre-attached. This preliminary collection ensures that when security analysis is initiated, comprehensive log information is already available and organized, eliminating the need for time-consuming log gathering during incident response.
Solution Approach 2:
The patent adds a new dimension to log organization by incorporating resource identifiers as a sorting and filtering key. Logs are not only organized chronologically but also by the computing resource they originate from. This dimensional organization allows the analysis system to efficiently filter and analyze logs from specific resources or aggregate patterns across multiple resources, significantly reducing analysis time while maintaining completeness.
3Productivity
If automated log collection and analysis systems are implemented, then vulnerability identification speed and security response are improved, but the system complexity and resource requirements increase
Solution Approach 1:
The logging entity is designed as a universal component that can collect logs from multiple types of computing resources (physical machines, virtual machines) using a standardized interface. The same logging entity structure and log packaging mechanism work across different resource types, reducing the need for specialized collection mechanisms for each resource type and simplifying the overall system architecture while maintaining high productivity.
Data Source
AI summary
Computing resource service providers may provide computing resources to customers in a multi-tenant environment. These computing resources may be behind a firewall or other security device such that certain information does not reach the computing resources provided to the customer. A logging entity may be implemented on computer server operated by the computing resource service provider. The logging entity may obtain log information from the firewall or other security device and store the log information such that it is accessible to the customer. Additionally, the log information may be provided to other services such as a metrics service or intrusion detection service.