# US 10,313,395 B2 · Placement of operators and encryption of communication based on risk in a computer system node > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,313,395 B2 - Document ID: US10313395B2 - Status: Granted - Kind: B2 - Application number: 15/382,897 - Filed: 2016-12-19 - Published: 2018-06-21 - Granted: 2019-06-04 - Earliest claimed: 2016-12-19 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: David M. Koster; Jason A. Nikolai; Adam D. Reznechek; Andrew T. Thorstensen - Web page: https://patentgrep.com/patent/US10313395B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/0457: {wherein the sending and receiving network entities apply dynamic encryption, e.g. stream encryption (cryptographic mechanisms or cryptographic arrangements for stream encryption H04L9/065)} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04W 12/02: Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII] - H04W 12/67: Risk-dependent, e.g. selecting a security level depending on risk profiles - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A streams manager assesses the security risk of streaming communication and dynamically migrates operators of a streaming application based on the security risk. The streams manager may also dynamically change encryption of intranode communication between the operators to increase performance of the computer node. The streams manager includes a stream security module (SSM) with a monitor that monitors risk in the system and changes placement of operators and encryption between operators on a node depending on the risk. The stream security module may use security data and node profile data collected by the monitor or the system to determine the risk. The stream security module may provide recommendations to a customer for the customer to override changes in placement and encryption. ## Claims ### Claim 1 An apparatus comprising: at least one processor; a memory coupled to the at least one processor; a streams manager residing in the memory and executed by the at least one processor that manages a plurality of streaming applications on a plurality of computer nodes, wherein the plurality of streaming applications comprise a plurality of operators that communicate streaming data between the plurality of operators; and a stream security module residing in the memory and executed by the at least one processor, wherein the stream security module monitors changes to the plurality of nodes to determine a security risk of communication between two operators of the plurality of operators on a single node, and when an increase in the security risk is detected, in response to the increase in security risk the stream security module acquires additional resources and dynamically migrates at least one operator from the single node to a different node to reduce the security risk of communication between the two operators. ### Claim 2 (depends on 1) The apparatus of claim 1 wherein the stream security module in response to the reduction in security risk changes a communication link that provides intranode communication between the two operators that was encrypted to be unencrypted. ### Claim 3 (depends on 1) The apparatus of claim 1 wherein the stream security module establishes a security baseline for streaming communication on the plurality of nodes. ### Claim 4 (depends on 1) The apparatus of claim 1 wherein the stream security module applies node profile data and security data to a determined change in the plurality of nodes to determine the security risk and wherein the node profile data comprises virtualization technology, block devices, and user permissions. ### Claim 5 (depends on 4) The apparatus of claim 4 wherein the security data comprises logged in users of each node, currently open devices, process tree hierarchy, applied capabilities, data rates and operating system version. ### Claim 6 (depends on 1) The apparatus of claim 1 wherein the stream security module provides a recommendation to a customer and allows the customer to override encryption of a data communication stream. ### Claim 7 (depends on 1) The apparatus of claim 1 wherein the streams security module encrypts intranode data stream when a usage anomaly of an operator is detected. ### Claim 8 (depends on 7) The apparatus of claim 7 wherein the streams security module sends an alert to a system administrator when the usage anomaly is detected. ### Claim 9 (depends on 1) The apparatus of claim 1 wherein the streams security module further monitors the nodes for decreased risks and changes a communication link that provides intranode communication that has been encrypted to be unencrypted. ### Claim 10 A computer-implemented method executed by at least one processor for managing a streaming application, the method comprising: managing a plurality of streaming applications on a plurality of computer nodes, wherein the plurality of streaming applications comprise a plurality of operators that communicate streaming data between the plurality of operators; monitoring changes to the plurality of nodes to determine a security risk of communication between two operators of the plurality of operators on a single node of the plurality of nodes; in response to an increased security risk, acquiring additional resources; and dynamically migrating at least one operator from the single node to a different node to reduce the security risk of communication between the two operators on the single node. ### Claim 11 (depends on 10) The method of claim 10 further comprising dynamically changing encryption of streaming data between the two operators on the single node of the plurality of nodes based on the security risk. ### Claim 12 (depends on 10) The method of claim 10 further comprising establishing a security baseline for streaming communication on the plurality of nodes. ### Claim 13 (depends on 10) The method of claim 10 further comprising applying node profile data and security data to a determined change in the plurality of nodes to determine the security risk and wherein the node profile data comprises virtualization technology, block devices, and user permissions. ### Claim 14 (depends on 13) The method of claim 13 wherein the security data comprises logged in users of each node, currently open devices, process tree hierarchy, applied capabilities, data rates and operating system version. ### Claim 15 (depends on 10) The method of claim 10 further comprising providing a recommendation to a customer and allowing the customer to override encryption of a data communication stream. ### Claim 16 (depends on 10) The method of claim 10 further comprising encrypting an intranode data stream when a usage anomaly of an operator is detected. ### Claim 17 (depends on 16) The method of claim 16 further comprising sending an alert to a system administrator when the usage anomaly is detected. ### Claim 18 (depends on 10) The method of claim 10 further comprising monitoring the nodes for decreased risks and changing a communication link that provides intranode communication that has been encrypted to use unencrypted communication. ### Claim 19 A computer-implemented method executed by at least one processor for managing a streaming application, the method comprising: managing a plurality of streaming applications on a plurality of computer nodes, wherein the plurality of streaming applications each comprise a plurality of operators that communicate streaming data between the plurality of operators; establishing a security baseline for streaming communication on the plurality of nodes; applying node profile data and security data to a determined change in the plurality of nodes to determine the security risk; monitoring changes to the plurality of nodes to determine a security risk of communication between two operators of the plurality of operators on a single node of the plurality of nodes; in response to an increased security risk, providing a recommendation based on the security risk to a customer and allowing the customer to override encryption of a data communication stream; acquiring additional resources; dynamically migrating at least one operator from the single node to a different node to reduce the security risk of communication between the two operators on the single node; dynamically changing encryption of streaming data between the operators on a node of the plurality of nodes based on the security risk and a customer override from the customer; and monitoring the nodes for decreased risks and changing a communication link that provides intranode communication that has been encrypted to use unencrypted communication. ### Claim 20 (depends on 19) The method of claim 19 further comprising sending an alert to a system administrator when a usage anomaly of an operator is detected.