Contents Huntcliff, Suite 1350, Atlanta, Georgia, 30350, USA

Transcription

1 Sentinet Overview

2 Contents Overview... 3 Architecture... 3 Technology Stack... 4 Features Summary... 6 Repository... 6 Runtime Management... 6 Services Virtualization and Mediation... 9 Communication and Security Mediation... 9 Authorization and Federated Security Routing and Versioning Services Aggregation Monitoring Service Agreements Management Alerting

3 Overview Nevatech Sentinet platform is a unified middleware infrastructure that manages heterogeneous SOA and API enabled solutions in the cloud, on-premises and in hybrid environments. Sentinet is built on a Microsoft platform and most beneficial to organizations that either develop and deploy their SOA solutions on a Microsoft platform, or have a need for integrating Microsoft and non-microsoft technologies as part of their SOA architectures. Sentinet provides organizations with connectivity and integrations across enterprise applications by enriching them with dynamic and remote manageability of security, access control, monitoring, alerting and SLAs management. Sentinet provides a central SOA Repository that governs design-time connections between applications and services, while Sentinet Nodes enable applications and services with run-time enforced manageability. Sentinet is: Powerful provides complete visibility of operations, discovers problems and provides solutions Non-intrusive no code or configuration modifications is required for cloud or on-premises services Platform-independent fully supports Microsoft and UNIX based architectures. Microsoft focused - runs natively on, fully integrates with, and extends Microsoft and Windows Azure platform Versatile can operate in the cloud, on-premises, or in hybrid environments Flexible can be configured to perform a multitude of tasks for each system, service or request Secure supports various security standards and custom authentication/authorization schemes Extensible provides interoperable Web Services-based open API with multiple extensibility points. Can be integrated with third party or custom management tools and products Easy To Use Rich Internet Application graphical user interface is both powerful and intuitive Architecture Sentinet platform consists of four major components: 1. SOA Repository, an on-premises or cloud based MS SQL server database, that provides centralized, hierarchical and secure storage for all SOA managed software assets, such as services, virtual services, security policies, authentication/authorization and access control rules, service agreements, identities and identity systems configurations, monitoring data and auditing trails. Access to SOA Repository is subject to strict security that includes data confidentiality, integrity, authentication and authorization control, and roles-based access. Sentinet Repository is enabled with multi-tenancy that allows partitioning of its content per specific users and user groups. 3

4 2. Sentinet Management Services is a collection of secure SOAP services that have access to SOA Repository. Sentinet Management Services are used to control the content of the SOA Repository and to drive behavior of managed SOA services. 3. Sentinet Nodes are high-performance, low-latency, scalable intermediary brokers that host dynamic virtual services designed and managed by Sentinet administrators using interactive Sentinet Administrative Console. Sentinet Nodes broker communication between service consumers and service providers, and through that brokerage they enable SOA solutions with multi-dimensional management capabilities. Sentinet Nodes make outbound connections to the Sentinet Management Services to dynamically configure themselves via light-weight heartbeat calls. Sentinet Nodes can be deployed in on-premises or in the cloud. Because they create only outbound connections to Management Services, they can be distributed through multiple diverse networks and cloud environments. Sentinet Nodes enable managed SOA services with agility and control of connectivity, security, monitoring and auditing - all in a non-intrusive way. Sentinet virtual services create an SOA services and software reuse environment by aggregating multiple diverse SOA services in a single service with fine-grained control of the aggregate service structure and accessibility. 4. Sentinet Administrative Console is a Microsoft Silverlight, Rich Internet Application that enables Sentinet users and administrators with highly interactive and intuitive control of all the aspects of the SOA solutions management. Technology Stack Figure 1. Architecture overview Even though Sentinet is designed and built to manage heterogeneous services and applications, it is best suited for environments that host Microsoft services, or those that have to integrate with Microsoft platform and technology stacks. Sentinet is built on top of Microsoft technology stacks and highly leverages and extends its capabilities. 4

5 Figure 2. Technology and platform stack 5

6 Features Summary Repository 1. Provides full access to services metadata (not just references to external metadata like UDDI registries, but to the actual metadata). 2. Access to service metadata is secured (only authorized users can access services metadata). 3. Provides full access to services policies (including WS-* interoperable and Microsoft specific). 4. Provides access to service identities (ex: X.509, SPN, and UPN). 5. When Repository elements are changed by administrators, metadata is automatically updated (ex: add new service endpoint, change endpoint policy, change endpoint identity). 6. Changes in Sentinet Repository affect managed services at runtime (Sentinet is an active Repository unlike passive UDDI registries). 7. Sentinet Repository is not just a set of recorded software assets, but a system of runtime information (monitoring, alerting, and SLAs management). 8. Sentinet Repository has built-in X.509 certificates management and private keys infrastructure, so it can be used as a stand-alone Certificate Authority, or it can use industry trusted Certificate Authorities. 9. Provides multitenant and roles based access to Repository Folders. 10. Provides central registration for all software assets associated with services design and run-time management (services, policies, identities, virtual services, access rules, SLAs, monitoring and alerting data, audit trails, tracking trails, reports). 11. Support for services versioning at design and run-time. 12. Support for services life-cycle management. Runtime Management Virtualization and Mediation 1. Virtualizes services using easy to use drag-and-drop interface. 2. Mediates transports, policies, message encodings and protocol versions. 3. Virtualizes all, or only selected service operations. 4. Aggregates multiple services in a single service with fine grained control of the virtual service operations, endpoints and policies. 5. Mediates between interoperable and non-interoperable security and communication protocols. 6. Transforms messages content. Security 1. Supports a variety of industry standard interoperable and Microsoft specific, non-interoperable security models. 2. Supports a variety of industry standard and custom security tokens. 3. Supports security Federation and Single-Sign-On scenarios. 4. Supports industry standard and custom Security Token Services (STS) (ex: Microsoft ADFS 2.0 server, Windows Azure Access Control Service). 5. Fully supports Claims based authentication/authorization and claims aware applications. 6. Supports Identities transformation and Identities pass-through. 7. Sentinet provides flexible and powerful Authorization Engine with access to service authorization at different service scopes (service, interface(s), operation(s), and endpoint). 8. Sentinet provides Access Rules Graphical Designer with extensibility for Custom Access Rules. 6

7 9. Sentinet console can be accessed by users authenticated by username/password, Windows integrated security or X.509 certificates. Routing 1. Routes message to different services, service versions and service endpoints. 2. Built-in load-balancer with fault tolerance. 3. Priority-based routing. 4. Multicast and publish/subscribe routing 5. Custom routing (content, schedule-based, identity-based, etc.). Monitoring 1. Real-time and historical transactions monitoring. 2. Messages recording at different message processing stages (encrypted, decrypted, protocol bridging). 3. Searches for messages by date, time and transaction status. 4. Analyzes services traffic, performance and other execution metrics. 5. Analyzes services by access rules and identities consumption. 6. Service Level Agreements violation monitoring. Service Agreements Management 1. Creates flexible and powerful Service Level Agreements that can cover multiple services, and at multiple services scopes (SLA per service, interface, operation(s), and endpoint). 2. Creates SLA-s evaluated against multiple service execution metrics. 3. Creates SLA-s filtered by access control (SLAs per specific consumer(s) access or scheduled access. Alerting 1. Creates Alerts for expiring certificates. 2. Creates Alerts for SLA violations, service availability and performance degradations. 3. Provides extensibility to handle alerts via custom alert handlers (ex: send alert to Microsoft SCOM, send SMS, other). 4. Defines alert notification targets (user s, or systems). Reporting 1. Provides historical reports for most active, most failed or least performing services within different time intervals. 2. Analyzes and compares services consumption and performance over different time periods. 3. Analyzes and compares services consumption and performance over different service operations. 4. Provides extensibility via Sentinet interoperable Web Services interface. Deployments 1. Deploy Sentinet Agents (Sentinet Nodes) as stand-alone network intermediaries or as the agents running side-by-side with managed services. 2. Deploy Sentinet Nodes in on-premises, cloud or hybrid environment. 3. Extend Windows Azure capabilities with easy and code/configuration non-intrusive access to Widows Azure AppFabric Service Bus. 4. Extend Widows Azure Access Control Service capability with easy to control graphical access rules designer. 5. Sentinet is deployed as IIS server applications (Sentinet Nodes and Sentinet Management Services) Requirements 1. Windows Server 2008 R2 or 2008 (32-bit and 64-bit). Can be installed on Windows 7 (32-bit or 64- bit) for non-production environment. 7

8 2. Microsoft SQL Server 2005 or higher. 3..NET 4.0 Framework 8

9 Services Virtualization and Mediation When physical services are virtualized through Sentinet Nodes they become more accessible to consumer applications. Services can be developed and deployed with the unified and most effective communications and security implementations, while exposed to consumer applications using requirements driven by service external accessibilities. Consumer or Consumer Application 2 Transport, Security, Protocol, etc. Consumer or Consumer Application 3 Transport, Security, Protocol, etc. Sentinet Node 1 Internal Consumer or Consumer Application 4 Transport, Security, Protocol, etc. Service Figure 3 Figure 3 shows a service that is developed, tested and deployed with a unified and optimized communications and security implementation (1). Once a service is virtualized through the Sentinet Node, it can be dynamically exposed to consumer applications using variety of managed communication and security models (2), (3), (4), etc. Consumer applications are decoupled from the service endpoints location and service-specific communication and security requirements. Communication and Security Mediation In this scenario Microsoft WCF service is deployed with performance-optimized net.tcp transport. WCF binary message encoder is used to provide the smallest message sizes during messages transmission, and Windows integrated security is used for optimal performance and strong authentication (1). Both net.tcp transport and binary message encoder are not interoperable and cannot be used by consumer application that can support only http(s) transport with standard text message encoder and interoperable transport level security (2), figure 2. Virtual service hosted on the Sentinet Node enables consumer application with the service accessibility by mediating transport and security requirement. 9

10 Virtual Service hosted on Sentinet Node Consumer or Consumer Application 2 External 1 Internal Service Text encoder Basic Http Transport security net.tcp:// Binary encoder Windows Integrated Security Figure 4 If a new consumer application needs to access the service, and that new consumer application has differently supported transport and security capabilities, then Sentinet Node is dynamically configured with additional virtual service endpoint to mediate new transport and security requirements to the same physical service implementation. Text encoder Basic Http Transport security Consumer or Consumer Application 2 External Virtual Service hosted on Sentinet Node 1 Internal Consumer or Consumer Application 3 External Service net.tcp:// Binary encoder Windows Integrated Security Text encoder Basic Http Message-level security Figure 5 Authorization and Federated Security Service authorization logic is often hardcoded in the service implementation which makes it difficult to scale authorization rules through services, and to promote services through different life cycles and environments. Sentinet provides a highly flexible and interactive Authorization Engine that is executed at the virtual services level. Physical services can delegate ultimate authentication and authorization decisions to Sentinet virtual services, while authenticating and authorizing only trusted Sentinet Nodes. 10

11 Consumer Authentication and Authorization is moved out from the service implementation, and delegated to the virtual service Consumer or Consumer Application Trust Service Virtual Service hosted on the Sentinet Node Figure 6 Sentinet Authorization and Access Control rules are managed declaratively using rich graphical user interface and Access Control Designer. Administrators can control authorized identities, access time schedules, allowed throughput and content-based access rules. Developers can extend Sentinet Authorization Engine with custom Access Control rules and integrate them in the Sentinet Administrative Console application. Figure 7. Graphical Access Rule Designer Sentinet Authorization Engine supports and extends industry standard Security Token Services (STS), including native support and integration with Microsoft Active Directory Federation Services (ADFS) and Windows Azure Access Control Service (ACS). 11

12 Figure 8. Access Control Designer Routing and Versioning Sentinet provides support for messages routing and service versioning. Not only can Sentinet Nodes be clustered and load-balanced, but they can execute as load-balancers by routing messages to clustered physical services deployments. Service messages can be routed based on a variety of routing rules and criteria such as weighted round-robin, fail-over routing, multi-cast, content based and custom routing. Sentinet Nodes can route messages to different service versions using either endpoints mapping or content-based mapping rules. Figure 9. Messages Router Configuration 12

13 Services Aggregation Sentinet allows easy aggregation of multiple physical services within a single virtual service. Services aggregation gives the benefit of the software assets reuse. Services implemented around different APIs, applications, systems and policy requirements, can be provided to consumer applications via unified access and standard policies. Sentinet Virtual Service Designer helps to build aggregated virtual services using drag-and-drop interface and graphical wizards. Figure 10. Virtual Service Designer. Drag-and-drop service versions to construct aggregate virtual service. 13

14 Monitoring Monitoring APIs and services is not a second-level concern. There is no management and cost control without visibility. Sentinet Administrators can see who is using which services, when and how. Sentionet provides extensive individual messages monitoring, tracking and aggregated statistics help to analyze current systems state and trends. Using real-time and historical monitoring users can predict services future use, scalability and performance degradations so that service level agreements are continuously maintained. Figure 11. Real-time monitoring 14

15 Figure 12. Individual Messages Monitoring and Tracking Figure 13. Historical Monitoring and Reporting 15

16 Service Agreements Management Sentinet Service Agreements Management helps organizations and IT operations units to understand and implement best practices for monitoring, diagnostics and reporting in order to maintain reliable and scalable applications. Degradations in IT Service delivery can be costly and damaging to business. Organizations are implementing strict Service Level Agreements to ensure high standards of IT service. Sentinet SLA management infrastructure helps organizations to create, monitor and respond actively and pro-actively on SLA violations in any type of cloud or on-premises environment. Service Agreements can be validated against multiple performance and availability metrics and can cover multiple services at different service scopes filtered by access control rules. Sentinet SLAs manage relationship between service consumers and service providers. SOA administrators can define different SLAs for the same service or group of services, and monitor and alert on SLA violations per individual consumer or group of consumers. Figure 14. Monitoring Service Agreement Violations. 16

17 Alerting Sentinet provides powerful and extendable Alert System that can generate and handle alerts for expiring X.509 certificates and SLA violations. Alerts can be configured against individual SLAs with individual frequency generation and more than one Alert Action. Each Alert Action can handle generated Alerts differently (for example: Send , or Send SMS or Text Message). Sentinet Alert System can be integrated with third party and industry standard Operations and Management Systems (example: Microsoft SCOM). 17