Classifications

• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F9/00—Arrangements for program control, e.g. control units
  • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
  • G06F9/46—Multiprogramming arrangements
  • G06F9/52—Program synchronisation; Mutual exclusion, e.g. by means of semaphores
  • G06F9/526—Mutual exclusion algorithms
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
  • G06F16/10—File systems; File servers
  • G06F16/18—File system types
  • G06F16/182—Distributed file systems
  • G06F16/1824—Distributed file systems implemented using Network-attached Storage [NAS] architecture
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
  • G06F16/10—File systems; File servers
  • G06F16/18—File system types
  • G06F16/182—Distributed file systems
  • G06F16/1824—Distributed file systems implemented using Network-attached Storage [NAS] architecture
  • G06F16/1827—Management specifically adapted to NAS
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
  • G06F21/101—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM] by binding digital rights to specific entities
  • G06F21/1011—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM] by binding digital rights to specific entities to devices
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
  • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
  • G06F21/73—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information by creating or determining hardware identification, e.g. serial numbers
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
  • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
  • G06F3/0601—Interfaces specially adapted for storage systems
  • G06F3/0668—Interfaces specially adapted for storage systems adopting a particular infrastructure
  • G06F3/067—Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L67/00—Network arrangements or protocols for supporting network services or applications
  • H04L67/01—Protocols
  • H04L67/10—Protocols in which an application is distributed across nodes in the network
  • H04L67/1097—Protocols in which an application is distributed across nodes in the network for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
  • H04W4/60—Subscription-based services using application servers or record carriers, e.g. SIM application toolkits

Definitions

• Computer systems and related technology affect many aspects of society. Indeed, the computer system's ability to process information has transformed the way we live and work. Computer systems now commonly perform a host of tasks (e.g., word processing, scheduling, accounting, etc.) that prior to the advent of the computer system were performed manually. More recently, computer systems have been coupled to one another and to other electronic devices to form both wired and wireless computer networks over which the computer systems and other electronic devices can transfer electronic data. Accordingly, the performance of many computing tasks is distributed across a number of different computer systems and/or a number of different computing environments.
• tasks e.g., word processing, scheduling, accounting, etc.
• the target license server needs to be identified through a unique ID (e.g., fingerprint).
• the unique ID is formulated distinctive and immutable features of an underlying hardware system, such as, for example, a Media Access Control ("MAC") address of a Network Interface Card (“NIC").
• MAC Media Access Control
• NIC Network Interface Card
• MAC Media Access Control
• NIC Network Interface Card
• a combination of hard and software characters of a target license server can be used to formulate a unique ID.
• the unique ID is provided to application instances so that target license server can be queried.
• the present invention extends to methods, systems, and computer program products for validating license servers in virtualized environments.
• a cloud instance hosts a license server in a cloud computing environment.
• the license server is validated as the target license server for a software license.
• a validation event is detected for the license server.
• the validation event indicates that the license server is to check status as the target license server for the software license.
• the software license is installable at a license server having a unique identifier.
• the unique identifier is based on a unique name associated with a cloud-based object within the cloud computing environment.
• the license server requests to assume exclusive ownership of the cloud-based object in response to the event.
• the cloud-based object has exclusivity of ownership such that a single license server can own the cloud-based object at any time.
• the license server is granted exclusive ownership of the cloud-based object.
• the license server uses the unique name to establish the unique identifier as the identifier for the license server.
• Figure 1 illustrates an example computer architecture that facilitates validating license servers in virtualized environments.
• Figure 2 illustrates a flow chart of an example method for validating license servers in virtualized environments.
• Figure 3 illustrates another example computer architecture that facilitates validating license servers in virtualized environments.
• the present invention extends to methods, systems, and computer program products for validating license servers in virtualized environments.
• a cloud instance hosts a license server in a cloud computing environment.
• the license server is validated as the target license server for a software license.
• a validation event is detected for the license server.
• the validation event indicates that the license server is to check status as the target license server for the software license.
• the software license is installable at a license server having a unique identifier.
• the unique identifier is based on a unique name associated with a cloud-based object within the cloud computing environment.
• the license server requests to assume exclusive ownership of the cloud-based object in response to the event.
• the cloud-based object has exclusivity of ownership such that a single license server can own the cloud-based object at any time.
• the license server is granted exclusive ownership of the cloud-based object.
• the license server uses the unique name to establish the unique identifier as the identifier for the license server.
• Embodiments of the present invention may comprise or utilize a special purpose or general-purpose computer including computer hardware, such as, for example, one or more processors and system memory, as discussed in greater detail below.
• Embodiments within the scope of the present invention also include physical and other computer-readable media for carrying or storing computer-executable instructions and/or data structures.
• Such computer-readable media can be any available media that can be accessed by a general purpose or special purpose computer system.
• Computer-readable media that store computer-executable instructions are computer storage media (devices).
• Computer-readable media that carry computer-executable instructions are transmission media.
• embodiments of the invention can comprise at least two distinctly different kinds of computer-readable media: computer storage media (devices) and transmission media.
• Computer storage media includes RAM, ROM, EEPROM, CD- ROM, solid state drives (“SSDs”) (e.g., based on RAM), Flash memory, phase-change memory (“PCM”), other types of memory, other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store desired program code means in the form of computer-executable instructions or data structures and which can be accessed by a general purpose or special purpose computer.
• SSDs solid state drives
• PCM phase-change memory
• a "network” is defined as one or more data links that enable the transport of electronic data between computer systems and/or modules and/or other electronic devices.
• a network or another communications connection can include a network and/or data links which can be used to carry desired program code means in the form of computer-executable instructions or data structures and which can be accessed by a general purpose or special purpose computer. Combinations of the above should also be included within the scope of computer-readable media.
• program code means in the form of computer-executable instructions or data structures can be transferred automatically from transmission media to computer storage media (devices) (or vice versa).
• computer-executable instructions or data structures received over a network or data link can be buffered in RAM within a network interface module (e.g., a "NIC"), and then eventually transferred to computer system RAM and/or to less volatile computer storage media (devices) at a computer system.
• a network interface module e.g., a "NIC”
• NIC network interface module
• computer storage media (devices) can be included in computer system components that also (or even primarily) utilize transmission media.
• Computer-executable instructions comprise, for example, instructions and data which, when executed at a processor, cause a general purpose computer, special purpose computer, or special purpose processing device to perform a certain function or group of functions.
• the computer executable instructions may be, for example, binaries, intermediate format instructions such as assembly language, or even source code.
• the invention may be practiced in network computing environments with many types of computer system configurations, including, personal computers, desktop computers, laptop computers, message processors, hand-held devices, multi-processor systems, microprocessor-based or programmable consumer electronics, network PCs, minicomputers, mainframe computers, mobile telephones, PDAs, tablets, pagers, routers, switches, and the like.
• the invention may also be practiced in distributed system environments where local and remote computer systems, which are linked (either by hardwired data links, wireless data links, or by a combination of hardwired and wireless data links) through a network, both perform tasks.
• program modules may be located in both local and remote memory storage devices.
• cloud computing is defined as a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.
• a cloud model can be composed of various characteristics (e.g., on-demand self-service, broad network access, resource pooling, rapid elasticity, measured service, etc), service models (e.g., Software as a Service (“SaaS”), Platform as a Service (“PaaS”), Infrastructure as a Service (“IaaS”), and deployment models (e.g., private cloud, community cloud, public cloud, hybrid cloud, etc.).
• FIG. 1 illustrates an example computer architecture 100 that facilitates validating license servers in virtualized environments.
• computer architecture 100 includes cloud instance 101 and object management system 103.
• Cloud instance 101 can be one of number of cloud instances operating within a cloud.
• Cloud instance 101 and object management system 103 can be connected to one another over (or is part of) a network, such as, for example, a Local Area Network ("LAN”), a Wide Area Network (“WAN”), and even the Internet.
• LAN Local Area Network
• WAN Wide Area Network
• cloud instance 101 and object management system 103 can create message related data and exchange message related data (e.g., Internet Protocol (“IP”) datagrams and other higher layer protocols that utilize IP datagrams, such as, Transmission Control Protocol (“TCP”), Hypertext Transfer Protocol (“HTTP”), Simple Mail Transfer Protocol (“SMTP”), etc.) over the network.
• IP Internet Protocol
• TCP Transmission Control Protocol
• HTTP Hypertext Transfer Protocol
• SMTP Simple Mail Transfer Protocol
• cloud instance 101 includes license server 102.
• License server 102 can be a server that responds to license requests (e.g., from applications or other software modules).
• Object management system 103 can manage objects, such as, for example, accounts, files, users, etc, that are accessible from cloud instances (or from a cloud environment in general). Objects managed by object management system 103 can be given unique names. Objects managed by object management system 103 can also be configured for exclusive access (i.e., the objects can be owned by a single could instance at any time).
• Software license 121 can be stored within computer architecture 100.
• Figure 2 illustrates a flow chart of an example method 200 for validating license servers in virtualized environments. Method 200 will be described with respect to the components and data of computer architecture 100.
• Method 200 includes an act of detecting a validation event for a license server, the validation event indicating that the license server is to check status as the target license server for the software license, the software license installable at a license server having a unique identifier, the unique identifier based on a unique name associated with a cloud- based object within the cloud computing environment (act 201).
• validation event 104 can be detected.
• Validation event 104 can indicate that license server 102 is to check status as the target license server for software license 121.
• Software license 121 is installable at a license server having a unique identifier based on name 107 (the name of object 106).
• Object 106 can be an object with an exclusive access right.
• object 106 (and corresponding properties) can be owned by a single license server at any time.
• Detecting a validation event can include detecting that software license 121 was stored in the cloud computing environment.
• Detecting a validation event can include detecting that a specified period of time has expired (e.g., since the status of license server was last checked).
• Method 200 includes an act of license server requesting to assume exclusive ownership of the cloud-based object in response to the validation event, the cloud-based object having exclusivity of ownership such that a single license server can own the cloud- based object at any time (act 202).
• license server 102 can send ownership request 111 to object management system 103 in response to validation event 104.
• Ownership request 111 can be a request to assume ownership of object 106 (a cloud-based object).
• Method 200 includes an act of the license server being granted exclusive ownership of the cloud-based object (act 203).
• object management system 103 can grant ownership of object 106 to license server 102.
• Object management system 103 can formulate ownership grant 112 indicating ownership of object 106.
• Object management system 103 can send ownership grant 112 to license server 102.
• license server 102 can access object 106 and corresponding properties, including name 107.
• Method 200 includes an act of the license server using the unique name to establish the unique identifier as the identifier for the license server (act 204).
• license server 102 can use name 107 to establish identifier 108 as the identifier for license server 102.
• Other components e.g., applications
• license requests corresponding to software license 121 can then direct license requests corresponding to software license 121 to license server 102.
• these other components can verify that license server 102 is in possession of identifier 108 (and is thus the license server for software license 121).
• Embodiments of the invention include using a storage system that supports storage accounts referenced by globally unique account names.
• the storage system is accessible from a cloud environment where the license server is hosted. Inside each storage account, there is an entity whose access right can only be owned by a single license server in the cloud at any time.
• globally unique storage account names with an exclusive access right to the specific unique entity, a unique ID can be created that a single instance in the cloud can possess at any time.
• a software license issued by an Independent Software Vendor can use the unique storage account name to specify where it can be installed.
• the license server in the cloud periodically checks the ownership of the access right to the specific unique entity in that storage account. Checking ownership helps insure that the license server is the only license server bound to the corresponding unique ID. Accordingly, the license cannot be repeatedly deployed on multiple license server instances.
• Ownership of a unique ID can be secured through security mechanisms of the underlying storage system. That is, a license server cannot assume a unique storage account name as its unique ID without access rights to the specific unique entity within this account. Thus, it is possible to leverage reliability features of a cloud environment for hosting a license server. For example, unlike hardware based IDs, storage account based IDs can be easily transferred from one cloud instance to another.
• Some embodiments of the invention are implemented in a Windows AzureTM platform. These embodiments utilize a globally exclusive Azure storage account name with an exclusive mapping of a specific page blob within the storage account as a Windows Azure XDrive.
• a page blob is a collection of (e.g., 512-byte) pages used for random read and write operations.
• An xDrive enables a Windows AzureTM application to use existing Application Program Interfaces ("APIs") to access a durable drive. This allows Windows AzureTM applications to mount a page blob as a drive letter (e.g., "X:").
• the mapping is used to create an ID that one Azure instance can possess at any time.
• An Azure storage account name can be a formal DNS name which is globally unique.
• Windows Azure XDrive permits the lease of a page blob formatted as a single New Technology File System (“NTFS") volume Virtual Hard Drive (“VHD”) for mounting an XDrive to be exclusively owned by a single Azure instance.
• NTFS New Technology File System
• VHD Virtual Hard Drive
• a software license can therefore use an Azure storage account name to identify its installation location.
• the license server periodically checks the validity of the XDrive mapping to make sure that it owns the ID, and terminates itself when it is no longer the owner.
• FIG. 3 illustrates another example computer architecture 300 that facilitates validating license servers in virtualized environments.
• computer architecture 300 includes cloud environment 301 and storage system 311. Cloud environment 301 and storage system 311 can be connected to one another by a network connection.
• Cloud environment 301 includes cloud license service instance 302.
• Cloud license service instance 302 storage account access information 303 and license server 304, which further includes enforcement plug-in 306.
• Storage system 311 includes storage account 312, which further includes unique entity 313.
• cloud license service instance 302 holds storage account access information 303 for storage account 312 (a storage account cloud license service instance 302 is bound to).
• license server 304 through license server ID enforcement plug-in 306, locates unique entity 313 in storage account 312. License server 304 attempts to assume an exclusive access right to unique entity 313. If the attempt fails, cloud license service instance 302 can shut itself down. As indicted by arrow 323, license server 304 periodically checks ownership of the exclusive access right. If ownership is ever lost, cloud license service instance 302 can attempt to recover it. If the attempt fails, cloud license service instance 302 can shut itself down.
• embodiments of the invention leverage a set of features acquired or built in cloud computing environments to facilitate a software based solution providing uniqueness and immutability of a license server hosted in the cloud. Avoiding features of the underlying hardware systems results a much more flexible and reliable platform for hosting license servers.
• Features of a cloud storage service can be used to create a unique ID for a license server. Security and reliability of license servers hosted in a pubic cloud environment is also improved.

Landscapes

• Engineering & Computer Science (AREA)
• Theoretical Computer Science (AREA)
• General Engineering & Computer Science (AREA)
• Physics & Mathematics (AREA)
• General Physics & Mathematics (AREA)
• Computer Hardware Design (AREA)
• Software Systems (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Computer Security & Cryptography (AREA)
• Computing Systems (AREA)
• Databases & Information Systems (AREA)
• Data Mining & Analysis (AREA)
• Mathematical Physics (AREA)
• Human Computer Interaction (AREA)
• Multimedia (AREA)
• Technology Law (AREA)
• Management, Administration, Business Operations System, And Electronic Commerce (AREA)
• Storage Device Security (AREA)

Priority Applications (4)

Applications Claiming Priority (2)

Publications (1)

Family

ID=48983424

Family Applications (1)

Country Status (7)

Families Citing this family (4)

Citations (6)

Family Cites Families (13)

• 2012
  • 2012-02-22 US US13/402,121 patent/US9128780B2/en active Active
• 2013
  • 2013-02-22 EP EP13752082.1A patent/EP2817759B1/en not_active Not-in-force
  • 2013-02-22 WO PCT/US2013/027258 patent/WO2013126651A1/en not_active Ceased
  • 2013-02-22 KR KR1020147023417A patent/KR101980932B1/ko not_active Expired - Fee Related
  • 2013-02-22 CN CN201310057537.7A patent/CN103297414B/zh not_active Expired - Fee Related
  • 2013-02-22 ES ES13752082.1T patent/ES2598052T3/es active Active
  • 2013-02-22 JP JP2014558847A patent/JP6110413B2/ja not_active Expired - Fee Related

Patent Citations (6)

Also Published As

Similar Documents

Legal Events