Monitoring in distributed computing system
A method is described of monitoring a service performed at a computing node. The computing node is one of a plurality of computing nodes in a distributed computing system. Each computing node is adapted to perform at least one service for clients. A monitoring process is adapted to monitor a service process performing the process. In the method, the monitoring process monitors the service process on performance of the service. The monitoring service then provides monitoring information to a monitoring process for another service process. A suitable computing node for performing the service is described, as is a coordinated monitoring service for supporting multiple monitoring services.
1 . A method of monitoring a first service performed at a computing node, wherein the computing node is one of a plurality of computing nodes in a distributed computing system, wherein each node is adapted to perform at least one service for clients, wherein a first monitoring process is adapted to monitor a first service process performing the first service, the method comprising:
monitoring the first service process for expected use of the first service;
capturing a first execution trace relating to use of the first service for a first transaction, wherein the first execution trace relates to generation of a credential;
storing the first execution trace in a first transaction database associated with the first service;
providing monitoring information between the first monitoring process and a second monitoring process for a second service process, wherein the first service process comprises generation of the credential and the second service process comprises validation of the credential, and wherein the credential includes a transaction-related challenge, a cryptogram, and an identifier for a requesting party; and
determining, based on the transaction-related challenge, whether the credential has been misused;
wherein the monitoring information provided between the first monitoring process and the second monitoring process includes the transaction-related challenge and an indication of credential misuse.
2 . The method of claim 1 , wherein the first execution trace includes the transaction-related challenge and the cryptogram.
3 . The method of claim 2 , further comprising:
checking the first execution trace against any records gathered relating to a particular card/token for the first transaction; and
storing a current generation service execution as a new record if no records relating to the particular card/token for the first transaction are located.
4 . The method of claim 1 , further comprising:
capturing a second execution trace relating to use of a second service for the first transaction, wherein the second execution trace relates to validation of the credential; and
storing the second execution trace in a second transaction database associated with the second service.
5 . The method of claim 4 , wherein the second execution trace includes the transaction-related challenge and the cryptogram.
6 . The method of claim 5 , further comprising:
receiving transaction credentials relating to a second transaction;
detecting a replay attack based on matching the transaction credentials relating to the second transaction with the transaction-related challenge and the cryptogram in the second execution trace.
7 . A computing node to monitor a first service performed in a distributed information security system, the computing node comprising:
a hardware security module (HSM) to store a plurality of keys, wherein the computing node is one of a plurality of computing nodes in a distributed computing system, wherein each node is adapted to perform at least one service for clients, wherein a first monitoring process is adapted to monitor a first service process performing the first service;
wherein the computing node is adapted to:
monitor the first service process for expected use of the first service;
capture a first execution trace relating to use of the first service for a first transaction, wherein the first execution trace relates to generation of a credential;
store the first execution trace in a first transaction database associated with the first service;
provide monitoring information between the first monitoring process and a second monitoring process for a second service process, wherein the first service process comprises generation of the credential and the second service process comprises validation of the credential, and wherein the credential includes a transaction-related challenge, a cryptogram, and an identifier for a requesting party; and
determine, based on the transaction-related challenge, whether the credential has been misused;
wherein the monitoring information provided between the first monitoring process and the second monitoring process includes the transaction-related challenge and an indication of credential misuse.
8 . The computing node of claim 7 , wherein the first execution trace includes the transaction-related challenge and the cryptogram.
9 . The computing node of claim 8 , wherein the computing node is further adapted to:
check the first execution trace against any records gathered relating to a particular card/token for the first transaction; and
store a current generation service execution as a new record if no records relating to the particular card/token for the first transaction are located.
10 . The computing node of claim 8 , wherein the computing node is further adapted to:
capture a second execution trace relating to use of a second service for the first transaction, wherein the second execution trace relates to validation of the credential; and
store the second execution trace in a second transaction database associated with the second service.
11 . The computing node of claim 10 , wherein the second execution trace includes the transaction-related challenge and the cryptogram.
12 . The computing node of claim 11 , wherein the computing node is further adapted to:
receive transaction credentials relating to a second transaction;
detecting a replay attack based on matching the transaction credentials relating to the second transaction with the transaction-related challenge and the cryptogram in the second execution trace.
13 . A computing node to monitor a first service performed in a distributed information security system, the computing node comprising:
a hardware security module (HSM) to store a plurality of keys, wherein the computing node is one of a plurality of computing nodes in a distributed computing system, wherein each node is adapted to perform at least one service for clients, wherein a first monitoring process is adapted to monitor a first service process performing the first service;
wherein the computing node is adapted to:
monitor the first service process for expected use of the first service;
provide monitoring information between the first monitoring process and a second monitoring process for a second service process, wherein the first service process comprises generation of a credential and the second service process comprises validation of the credential, and wherein the credential includes a transaction-related challenge, a cryptogram, and an identifier for a requesting party; and
determine, based on the transaction-related challenge, whether the credential has been misused;
wherein the monitoring information provided between the first monitoring process and the second monitoring process includes the transaction-related challenge and an indication of credential misuse.
14 . The computing node of claim 13 , wherein the computing node is further adapted to implement a remedial action in response to determining, based on use of the transaction-related challenge, that the credential has been misused.
15 . The computing node of claim 14 , wherein the remedial action includes one or more of precluding generation of credentials for transactions involving the requesting party or precluding validation of credentials for transactions involving the requesting party.
16 . The computing node of claim 14 , wherein the transaction-related challenge includes a transaction counter.
17 . The computing node of claim 13 , wherein misuse of the credential is determined to involve a replay attack.
18 . The computing node of claim 13 , wherein the computing node is further adapted to:
receive a second credential, wherein the second credential includes a second transaction-related challenge, a second cryptogram, and an identifier for a second requesting party;
determine that the second credential was not generated by the first service process; and
implement a remedial action in response to determining that the second credential was not generated by the first service process;
wherein the monitoring information provided between the first monitoring process and the second monitoring process includes a validation failure outcome.
19 . The computing node of claim 18 , wherein the remedial action includes precluding generation of credentials for transactions involving the second requesting party.
20 . The computing node of claim 15 , wherein the computing node is further adapted to:
assess statistics relating to generated transaction credentials and validated transaction credentials for a particular card or token during a key list validity period, wherein assessing the statistics includes to:
compare a counter for successful transaction credential generations with a counter for successful transaction credential validations; and
compare lists of validated transaction-related challenges; and
based on assessing the statistics, report disputed transactions via an escalation message to a coordinated monitoring process for implementing a second remedial action,
wherein the coordinated monitoring process is associated with multiple service processes, and wherein the second remedial action includes blocking the particular card or token.