Patent Publication Number: US-9900359-B2

Title: System and method for supporting video processing load balancing for user account management in a computing environment

Description:
CLAIM OF PRIORITY 
     This application is a continuation of U.S. patent application Ser. No. 14/494,738, filed Sep. 24, 2014, entitled “SYSTEM AND METHOD FOR SUPPORTING VIDEO PROCESSING LOAD BALANCING FOR USER ACCOUNT MANAGEMENT IN A COMPUTING ENVIRONMENT”, now U.S. Pat. No. 9,148,454, which application is incorporated herein by reference in its entirety. All of which applications are incorporated herein by reference in their entireties. 
     CROSS REFERENCE TO RELATED APPLICATIONS 
     The present application is related to the following patents and patent applications which are incorporated herein by reference in their entireties: 
     U.S. patent application Ser. No. 14/494,728, filed Sep. 24, 2014 entitled “SYSTEM AND METHOD FOR OPTIMIZING VISUAL SESSION RECORDING FOR USER ACCOUNT MANAGEMENT IN A COMPUTING ENVIRONMENT”, now U.S. Pat. No. 9,185,175; 
     U.S. patent application Ser. No. 14/494,732, filed Sep. 24, 2014 entitled “SYSTEM AND METHOD FOR USING POLICIES TO SUPPORT SESSION RECORDING FOR USER ACCOUNT MANAGEMENT IN A COMPUTING ENVIRONMENT”, now U.S. Pat. No. 9,167,047; and 
     U.S. patent application Ser. No. 14/494,737, field Sep. 24, 2014, entitled “SYSTEM AND METHOD FOR SUPPORTING DYNAMIC OFFLOADING OF VIDEO PROCESSING FOR USER ACCOUNT MANAGEMENT IN A COMPUTING ENVIRONMENT”, now U.S. Pat. No. 9,166,897. 
    
    
     COPYRIGHT NOTICE 
     A portion of the disclosure of this patent document contains material which is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction by anyone of the patent document or the patent disclosure, as it appears in the Patent and Trademark Office patent file or records, but otherwise reserves all copyright rights whatsoever. 
     FIELD OF INVENTION 
     The present invention is generally related to computer systems, and is particularly related to user account management in a computing environment. 
     BACKGROUND 
     As the enterprise/cloud applications and systems become more complex, the task of preventing inappropriate access to various user accounts and the task of detecting unauthorized activities by many different users become extremely challenging. This is the general area that embodiments of the invention are intended to address. 
     SUMMARY 
     Described herein are systems and methods that can support user account management in a computing environment. The computing environment can include a video encoding pool to support load balancing and a managing server, such as a privileged account manager server. The video encoding pool includes a set of nodes that are able to perform one or more video processing tasks for another node. Furthermore, the managing server can receive a request from a managed node in the computing environment for delegating a video processing task, and can select one or more nodes from the video encoding pool to load balance and to perform the video processing task. 
    
    
     
       BRIEF DESCRIPTION OF THE FIGURES 
         FIG. 1  shows an illustration of an account management system in a computing environment, in accordance with an embodiment of the invention. 
         FIG. 2  shows an illustration of supporting user session monitoring in a computing environment, in accordance with an embodiment of the invention. 
         FIG. 3  shows an illustration of supporting visual session recording in a computing environment, in accordance with an embodiment of the invention. 
         FIG. 4  shows an illustration of dynamically offloading a video processing task in a computing environment, in accordance with an embodiment of the invention. 
         FIG. 5  illustrates an exemplary flow chart for dynamically offloading a video processing task in a computing environment, in accordance with an embodiment of the invention. 
         FIG. 6  shows an illustration of using a video processing pool to support load-balancing in a computing environment, in accordance with an embodiment of the invention. 
         FIG. 7  shows an illustration of supporting load balancing via a hub in a computing environment, in accordance with an embodiment of the invention. 
         FIG. 8  shows an illustration of supporting load balancing with direct inter-node communication in a computing environment, in accordance with an embodiment of the invention. 
         FIG. 9  shows an illustration of using a hybrid model to perform a video processing task in a computing environment, in accordance with an embodiment of the invention. 
         FIG. 10  illustrates an exemplary flow chart for using a video processing pool to support load-balancing in a computing environment. 
     
    
    
     DETAILED DESCRIPTION 
     The invention is illustrated, by way of example and not by way of limitation, in the figures of the accompanying drawings in which like references indicate similar elements. It should be noted that references to “an” or “one” or “some” embodiment(s) in this disclosure are not necessarily to the same embodiment, and such references mean at least one. 
     The description of the invention as following uses the Oracle Privileged Account Manager (OPAM) system as an example for a user account management system. It will be apparent to those skilled in the art that other types of user account management system can be used without limitation. 
     Described herein are systems and methods that can support user account management in a computing environment. 
     Privileged Account Manager 
       FIG. 1  shows an illustration of an account management system in a computing environment, in accordance with an embodiment of the invention. As shown in  FIG. 1 , an account manager, such as a privileged account manager  101 , can monitor and record user sessions (e.g. by users  131 - 132 ) on one or more target systems  111 - 112  in a computing environment  100 . 
     The privileged account manager  101 , e.g. an Oracle Privileged Account Manager (OPAM), is a server that is capable of managing privileged accounts and user sessions on the target systems  111 - 112 . The privileged account, such as a root account in a UNIX system or a system account in a database system, can be shared by multiple users  131 - 132  and can also be role-based. 
     The target systems  111 - 112  are the remote targets, which have privileged accounts managed by the privileged account manager  101 . The privileged account manager  101  can manage different types of user sessions on the target systems  111 - 112 . For example, these user sessions can include Microsoft Windows sessions, Linux X11 sessions, virtual network computing (VNC) sessions, and Mac OS X remote desktop sessions. 
     As shown in  FIG. 1 , an agent  121  can be deployed on a target system  111  for monitoring one or more user sessions on the target system  111 . The agent  121  can record user activities within a user session and communicates with the privileged account manager  101  (e.g. for obtaining screen comparison rules and sending back recorded data). 
     In accordance with an embodiment of the invention, the agent  121  can be physically deployed on the target system  111 . The agent  121  can subscribe to a graphical user interface (GUI) rendering system, such as the windowing system, on the target system  111  to obtain various application GUI state information, such as the title of the window for the active application in the foreground. Furthermore, the agent  121  can communicate with the privileged account manager  101  using a secure channel  120 , e.g. based on the secure shell (SSH)/transport layer security (TLS) protocols. 
     Alternatively, the privileged account manager  101  can take advantage of a proxy server  110 , which can monitor and record user sessions on the target systems  111 - 112 . For example, the proxy server  110  can be used to collect session information on the different target systems  111 - 112 , such as textual information (e.g. the commands and key strokes) and visual information (e.g. the graphical display and windows). 
     In accordance with an embodiment of the invention, the use of the proxy server  110  can be beneficial, in terms of alleviating the life-cycle burden in maintaining different versions of the same software on a large number of servers, devices, and platforms, since the proxy server  110  does not rely on the agent  121  that is deployed physically on a target system  111 . 
     On the other hand, the agent  121  and the proxy server  110  can monitor said one or more user sessions on the target system simultaneously. As shown in  FIG. 1 , the agent  121  can be deployed on a sensitive system (e.g. the target system  111 ), which is also monitored by the proxy server  110 . Since the agent  121  is physically deployed on the target system  111 , the agent  121  can closely monitor the different user actives and collect more information than the proxy server  110 . 
     Then, an administrator  130  can connect to the privileged account manager  101  and perform various management tasks, such as view, search and audit the recorded sessions, in order to prevent inappropriate access to various account and to detect unauthorized activities. 
       FIG. 2  shows an illustration of supporting user session monitoring in a computing environment, in accordance with an embodiment of the invention. As shown in  FIG. 2 , a privileged account manager  201 , e.g. an Oracle the Oracle Privileged Account Manager (OPAM), can be used for monitoring user sessions on a target system  202 . 
     At step  1 , a user  212  can connect to the privileged account manager  201  (i.e. the server) and can send a request to the privileged account manager  201  for obtaining an access to a privileged account on the target system  202 . 
     Upon receiving a request for accessing a privileged account from the user  201 , the privileged account manager  201  can provide the user  212  with a password or a session. Then, the user  212  can access the privileged account based on the received one-time passwords or direct sessions. For example, the user  212  can obtain a session with graphical interface. 
     At step  2 , the user  212  can connect to the target system  202  to establish a session after obtaining access to the privileged account. A user session may start as soon as a user  212  logs into the privileged account on the target system  202 , using the password or session provided by the privileged account manager  201 . 
     Additionally, the access to the privileged account may not be available after the user  212  logs out from the privileged account on the target system  202 . The user session may end as soon as the user  212  logs out from the privileged account, at which time the user  212  relinquish its right to access the privileged account and another user is allowed to log in the privileged account. 
     At step  3 , the agent  203  running on the target system  202 , after detecting the establishment of a user session, can communicate with privileged account manager  201  to obtain different policies or configurations, such as the screen comparison rules. 
     The agent  203  can capture and record various screens on the target system  202  based on the screen comparison rules. 
     At step  4 , the agent  203  can send the recorded data back to the privileged account manager  201  for storage. 
     At step  5 , the privileged account manager  201  can store the recorded data in a database  210 . For example, the database  210  can be an OPAM Database, which can be used for storing target information, user grants, policies and session recording data. 
     At step  6 , the administrator  211  can connect to the privileged account manager  201  in order to view the recorded and/or ongoing sessions. The administrator  211  can review the recorded sessions, which are the completed user sessions after the user has already logged off. Also, the administrator  211  can review an ongoing session when a user is still using the session. In the case of reviewing an ongoing session, the administrator  211  may view the recording (in real time) as the session is ongoing in a fashion similar to a live record-replay (a.k.a. over the shoulder monitoring). 
     Visual Session Recording 
       FIG. 3  shows an illustration of supporting visual session recording in a computing environment, in accordance with an embodiment of the invention. As shown in  FIG. 3 , an account management system  300  can capture a number of screen captures  301  (e.g. screen shots or snapshots) on a target system, e.g. using an agent on the target system or a proxy server, during a user session. 
     In accordance with an embodiment of the invention, the account management system  300  can record a subset of the screen captures  301 , which includes only screen captures  302  that represent significant changes during the user session, discarding the screen captures  304  that are captured when the target system is considered idle. 
     Thus, the account management system  300  can optimize the usage of processors, storage and network bandwidth. 
     Furthermore, the account management system  300  can encode the screen captures  302 , which are recorded and uncompressed images, into a video  303  and stores the video  303  in a database, such as the OPAM database. The video  303  can be played back later in a fashion similar to a DVR. 
     Additionally, searchable textual metadata  305 , which includes information about the activities, can also be recorded and provided along with the video  303 . Thus, an administrator of the account management system  300  can search through the collection of recordings (e.g. the video  303 ) to look for activities, such as sessions which ran Internet Explorer, Control Panel etc. This provides means to monitor, audit and perform forensic analysis on the target system. 
     Dynamically Offloading a Video Processing Task 
       FIG. 4  shows an illustration of dynamically offloading a video processing task in a computing environment, in accordance with an embodiment of the invention. As shown in  FIG. 4 , a managing server, e.g. a privileged account manager server  401 , can use an agent  403  for managing a target system  402  in a computing environment  400 . 
     In accordance with an embodiment of the invention, the agent  403  (such as an OPAM agent) running on the target system  402  can record various actions in a user session  410  (e.g. a user logon-session). As shown in  FIG. 4 , the agent  403  can periodically capture and record a number of screen captures, such as the recorded and uncompressed images  404 . 
     Furthermore, the user session recording mechanism, such as the OPAM windows session recording system, involves processing the recorded and uncompressed images  404  and creating (or encoding) a video  406  for DVR like play back. 
     As shown in  FIG. 4 , the agent  403  can initiate a video processing task  405  (such as a video encoding task using a suitable video codec) on the target system  402 , which encodes the recorded and uncompressed images  404  into a video  406  (using a suitable video codec). Additionally, the video  406  can be augmented with textual (and other forms of) metadata, which can be used for searching specific patterns in the video  406  and for combining various video segments. 
     After creating the video  406 , the agent  403  can transmit the video  406  to the privileged account manager server  401  (such as an OPAM Server). Then, the privileged account manager server  401  can store the video  406  in a database  409  for distribution (e.g. allows an administrator  411  to review the user session  410  in a DVR like fashion). 
     The video processing task  405  on the target system  402  can be a processor intensive operation that places a heavy load on the CPU and the GPU (if available). Furthermore, the video encoding task  405  may consume a large amount of the memory, such as a random access memory (RAM), on the target system  402 . Thus, the video encoding task  405  may potentially downgrade the system performance of the target system  402  in a resource-constrained environment, where the video encoding  405  task competes with other processes for resources, such as the CPU and the memory. 
     In accordance with an embodiment of the invention, the video processing task  405  can be offloaded to the privileged account manager server  401  (e.g. the OPAM server system), instead of being performed on the target system  402  (e.g. the windows session being recorded). 
     By delegating the video processing task  405  to the privileged account manager server  401 , the target system  402  can reduce the resource usage for performing the video processing task  405  on the target system  402 . On the other hand, the target system  402  may need to transmit the recorded and uncompressed images  404  to the privileged account manager server  401 , which may potentially increase the consumption of the network bandwidth. 
     In accordance with an embodiment of the invention, in order to optimize the system performance, the dynamic offloading of the video processing task  405  from the target system  402  to the privileged account manager server  401  can be based on configurable thresholds, which controls the resource usage on the target system  402 . 
     For example, the video processing task  405  can be dynamic offloaded from the target system  402  to the privileged account manager server  401 , if the video processing  405  on the target system  402  exceeds a pre-defined CPU and memory usage threshold over a duration (or a period). Such scenario may happen during peak periods, when a large number of windows activities are performed (which leads to a significant increase in video processing load). 
     In accordance with an embodiment of the invention, there are different approaches for estimating and modeling the video processing  405  load. For example, an OPAM Agent process on the managed end system (i.e. a node) can track the CPU and memory utilization by maintaining a continuous moving average window. 
     Additionally, the thresholds and durations can be defined for controlling the resource usage on the target system  402 . For example, the thresholds (or limits) for the CPU and memory usage, which are unique to each node, can be pre-calculated according to the hardware capability of the underlying node, during the system boot-up. Thus, the target system  402  can decide whether to offload the encoding task elsewhere at runtime. 
     Furthermore, the privileged account manager server  401  can resume the performing of the video processing task  407  and create the video  408 , after the recorded and uncompressed images  404  are transmitted over the network to the privileged account manager server  401 . Then, the privileged account manager server  401  can store the video  408  in a database  409  for distribution (e.g. allows an administrator  411  to review the user session  410  in a DVR like fashion along with the video  406 ). 
     In accordance with an embodiment of the invention, the video processing task  407  can be switched back to the target system  402 , when the volume of the receiving data (including the recorded and uncompressed images  404  transmitted from the target system  402 ) is observed being reduced to a low level (e.g. a level lower than the level when the offloading starts). 
     For example, the switch back of the video processing task  407  can happen after the peak period has passed, and the session recording can be resumed with lower CPU usage on the target system  402 . 
       FIG. 5  illustrates an exemplary flow chart for dynamically offloading a video processing task in a computing environment, in accordance with an embodiment of the invention. As shown in  FIG. 5 , at step  501 , an agent on a target system can initiate a video processing task based on a plurality of user session screens recorded on the target system, wherein the video processing task encodes the plurality of user session screens into a video. Furthermore, at step  502 , the agent can determine whether a resource usage for performing the video processing task on the target system exceeds a threshold. Then, at step  503 , the agent can dynamically offload the video processing task to a managing server that operates to manage the target system, if the resource usage for performing the video processing task on the target system exceeds the threshold. 
     Intelligent Load-Balancing Using a Video Encoding Pool 
       FIG. 6  shows an illustration of using a video processing pool to support load-balancing in a computing environment, in accordance with an embodiment of the invention. As shown in  FIG. 6 , a managing server  601 , e.g. a privileged account manager server under the control of an administrator  611 , can manage one or more nodes, such as the nodes  602 - 605  in a computing environment  600 . 
     In accordance with an embodiment of the invention, the managing server  601  can intelligently balance the load for performing the video processing tasks (e.g. the video encoding tasks), by distributing the video encoding tasks among the managing server  601  and the managed nodes  602 - 605 . 
     As shown in  FIG. 6 , the managing server  601  can take advantage of a video encoding pool  640 . The video encoding pool  640  contains a set of nodes  603 - 605 , each of which can be delegated by the managing server  601  to perform the video encoding tasks for another node (e.g. the node  602 ). 
     Furthermore, the dynamically-managed video encoding pool  640  can be configurable. For example, an administrator  611  can configure the nodes  603 - 605  to be eligible for the video encoding pool  640 . 
     Additionally, the nodes  603 - 605  in the video encoding pool  640  can possess hardware capability beneficial to video encoding. For example, the nodes  603 - 605  in the video encoding pool  640  may have an on-board graphics processing unit (GPU) and/or a high clock-speed CPU, and may have a large capacity RAM with L2/L3 caches. 
     On the other hand, critical nodes (such as databases and web-servers), which perform critical tasks, may be excluded from the video encoding pool  640 . Thus, the system can prevent these critical nodes from becoming resource constrained when the video encoding tasks are performed. 
     In accordance with an embodiment of the invention, different approaches can be used for estimating and modeling the load on a node. For example, an OPAM Agent process on the managed end system can track the CPU and memory utilization by maintaining a continuous moving average. A threshold (or a limit) can be used by the node to decide whether to offload the encoding task to another node in the managed system. Additionally, the thresholds for the CPU and memory usage, which are unique to each node, can be pre-calculated during the system boot-up, according to the hardware capability of the node. 
     Furthermore, a multi-level model can be used to characterize the load on each node. For example, a three-level model can be employed to include a high load state, a normal load state and a below-normal load state (e.g. based on the run-time CPU and memory usage estimations). Also, the run-time CPU and memory usage can be estimated using a confidence interval. For example, the three-level model can be based on a confidence interval, which is constructed using a specific confidence level, such as a pre-configured value (e.g. at 95% accuracy). 
     In accordance with an embodiment of the invention, when the estimated load on the node  602  is in the high load state, the node  602  may decide to offload the video encoding task elsewhere. On the other hand, a node in the video encoding pool  640  may be able to accept a task from another node, only when the load on the node is in the below-normal state. 
     In accordance with an embodiment of the invention, the managing server  601  can take advantage of an intelligent load-balancing algorithm, which supports a centralized dynamic load balancing scheme. 
     As shown in  FIG. 6 , the managing server  601 , which acts as the master node, can perform various pool management tasks, such as keeping track of the node resources (i.e. CPU and memory utilization), providing admission control of the nodes to the pool, performing the allocation of encoding tasks to specific nodes, tracking the encoding tasks on the nodes and handling node failures. Thus, the managing server  601  can optimize the resource usage, including the usage of CPU, memory and network bandwidth. 
     Additionally, the managing server  601  can be enabled with the high availability (HA)/replication features, which may serve as a guard against the single point of failure that affects the centrally managed load balancing scheme. 
     In accordance with an embodiment of the invention, each of the nodes  603 - 605  in the video encoding pool  640  can monitor their CPU and memory usage and periodically estimates the corresponding values (e.g. based on the confidence interval). Furthermore, the nodes  603 - 605  in the encoding pool  640  can send information about their resource utilization (such as the CPU, GPU and memory usage) to the managing server  601 . In order to reduce the state-exchange overhead, such information can be sent only when a state change (with regard to the resource utilization) occurs in the node. 
     Additionally, the managing server  601  can maintain a record for each node, which indicates its resource usage. Also, the managing server  601  can maintain the topology information for the geographic distribution of the nodes  602 - 605 . 
     As shown in  FIG. 6 , when a managed node  602  (i.e. a targeted system) becomes resource constrained (e.g. when the node  602  is in a high load state), the managed node  602  may decide to offload the encoding task. In such a case, the managed node  602  can send a message to the managing server  601 , requesting for delegating the video encoding task to other available node(s). 
     The managing server  601  can select a set of nodes, which are the most appropriate candidates for performing the encoding task, from the video encoding pool  640 . This algorithm can be based on different load-transfer policies, such as a threshold-based policy or a shortest route/time policy. Additionally, the selected node set can be optimized based on the geographic distribution of the nodes such that the node set is selected to be as locally as possible. 
     In accordance with an embodiment of the invention, the task scheduling algorithm may prefer to move the video encoding tasks away from the managing server  601 . For example, in OPAM, the managed nodes  603 - 605  may be given a higher priority, over the managing server  601 , for accepting tasks that are delegated to run on the OPAM Server. 
     The intelligent load balancing algorithm can be beneficial for efficiently performing various video processing tasks, when there are actually nodes in the video encoding pool  640 . Otherwise, the video encoding tasks may be executed only on the respective managed nodes or the managing server  601 , when there are no suitable nodes in the video encoding pool  640 . 
     For example, if the managing server  601  cannot find any suitable node from the video encoding pool  640 , the managing server  601  can become the encoding node itself (until it finds a proxy node). In such a case, the source node  602  can send the recorded and uncompressed images  620  in a user session  610  to the managing server  601  and expects to receive an ACK message for every N frames of recorded and uncompressed images  620  being sent. The source node  602  may also maintain the N frames of recorded and uncompressed images  620  in a local cache, which is cleared upon receiving the ACK from the managing server  601 . 
     The managing server  601  can re-initiate the search for a proxy node periodically (or upon receiving the state-change messages from the pool), so that it can offload the video encoding to the video encoding pool  640 . It continues offloading the encoding task until no new node can be found. 
     Furthermore, the originating source node  602 , which may act as the encoding node, can move into a high load state. During a search, the managing server  601  may be able to find a number (M) of suitable proxy nodes in the video encoding pool  640 . Thus, the recorded and uncompressed images  620  may be distributed to different numbers (e.g. [1 . . . M]) of proxy nodes, depending on the input frame rate, K. For example, if the input frame rate, K, is larger than or equal to the number of available suitable proxy nodes, M, (i.e. K&gt;=M), then the resource constrained node may not split the load further and can send the load to one of the new proxy nodes. Otherwise, if the input frame rate, K, is less than the number of available suitable proxy nodes, M, (i.e. K&lt;M), the load can be split among the M nodes. 
     In accordance with an embodiment of the invention, the managing server  601  can stitch the sequence of video segments together. In OPAM, the proxy nodes  603 - 605  can send metadata information, which may be used by the OPAM Server to construct the final video  630 , along with the encoded video segments. 
     Additionally, the managing server  601  can handle node and link failures, such as when the proxy encoding node fails, or when the link between the source node and any proxy node or the link between the managing server  601  and a proxy node fails. 
       FIG. 7  shows an illustration of supporting load balancing via a hub in a computing environment, in accordance with an embodiment of the invention. As shown in  FIG. 7 , a managing server  701 , e.g. a privileged account manager server, can manage one or more nodes, such as the nodes  702 - 705  of a video encoding pool  740  in a computing environment  700 . 
     In accordance with an embodiment of the invention, the managing server  701  can act as a hub for content traffic, when a security policy in the computing environment  700  prevents the managed nodes  702 - 705  from communicating directly with each other. 
     As shown in  FIG. 7 , the source node  702  can communicate with the managing server  701  and delegates the video encoding task to the managing server  701 . Then, the source node  702  can stop performing the video encoding task and starts sending the recorded and uncompressed images  720  (i.e. the un-encoded screen captures in a user session  710 ) to the managing server  701 . 
     In accordance with an embodiment of the invention, the managing server  701  can select one or more nodes  703 - 705  from the video encoding pool  740  as proxies for performing the video encoding task. 
     For example, if the managing server  701  finds a number (e.g. M) of proxy nodes in the video encoding pool  740 , the managing server  701  can split the incoming stream from the originating node  702  and can send the recorded and uncompressed images  720  to these (M) proxy nodes, in a static round-robin load balancing fashion. Thus, each of the M proxy nodes may receive a frame every M time units, periodically (with each time unit separates two consecutive incoming frames). 
     Furthermore, the proxy nodes  703 - 705  can send an acknowledgment (ACK) to the managing server  701  for confirming the receiving of the set of images. The managing server  701  can maintain, in a local cache, copies of the recorded and uncompressed images  720  that are sent to the proxy nodes  703 - 705 . Then, the local cache on the managing server  701  can be cleared upon receiving the ACK message from the respective proxy encoding nodes  703 - 705 . 
     Thus, each proxy node can progressively encode the received images into a sequence of video segments, which are sent back to the managing server  701  separately. Then, the managing server  701  can construct the full-video  730  by concatenating the video segments sequence together using the video metadata information. 
     Additionally, when the managing server  701  acts as a hub, the managing server  701  can detect the failure of a node or a link by monitoring the timeout of the ACK that should be received from the different participant proxy nodes. 
     When a failure happens, the managing server  701  can send a message to the source node  702  to inspect if the source node  702  can perform the sub-task for the failed proxy node. If the source node  702  cannot perform the (sub-)task for the failed proxy node, the source node  702  sends a message to the managing server  701  requesting for another proxy. Then, the managing server  701  can repeat the above process until a new proxy node is found. 
       FIG. 8  shows an illustration of supporting load balancing with direct inter-node communication in a computing environment, in accordance with an embodiment of the invention. As shown in  FIG. 8 , a managing server  801 , e.g. a privileged account manager server, can manage one or more managed nodes, such as the nodes  802 - 805  of a video encoding pool  840  in a computing environment  800 . 
     In accordance with an embodiment of the invention, the managing server  801  can coordinate the distributing of the video encoding load, when the security policy allows direct inter-node communication between the various managed nodes  802 - 805 . For example, the managing server  801  can send a message, which indicates the selected proxy nodes  803 - 804  in the video encoding pool  820 , to the originating node  802 . 
     Then, the originating node  802  can send the recorded and uncompressed images  820  in a user session  810  to the proxy nodes  803 - 804  directly, using a static round-robin load balancing fashion. Thus, each selected proxy node  803 - 804  can receive a frame from the originating node  802  periodically (e.g. one frame every M time units when there are totally M selected proxy nodes). 
     Furthermore, each proxy nodes  803 - 804  can send an acknowledgement (ACK) message to the originating source node  802 , for confirming the receipt of the set of images. Additionally, the source node  802  can maintain, in a local cache, copies of the images that are sent to the proxy nodes  803 - 804 . Accordingly, the cache can be cleared upon receiving the ACK message from the respective proxy encoding nodes  803 - 804 . 
     Then, each selected proxy node  803 - 804  can progressively encode the received images into a sequence of video segments, which are sent to the managing server  801  directly. Then, the managing server  801  can construct the full-video  830  by concatenating this video sequence together. 
     Additionally, the source node  802  can detect a failure on a node (or a link) by monitoring the timeout of the ACK that should be received from the proxy encoding nodes  803 - 804 . 
     The source node  802  can inspect its own resource usage to determine whether it can perform the video processing task for a failed proxy node, since the source node  802  can communicate directly with the proxy nodes  803 - 804 . If the source node  802  cannot perform the sub-task from the failed proxy node, the source node  802  can send a message to the managing server  801 , requesting for another proxy node. The managing server  801  can repeat the process until it successfully finds a proxy node (e.g. node  805 ). 
       FIG. 9  shows an illustration of using a hybrid model to perform a video processing task in a computing environment, in accordance with an embodiment of the invention. As shown in  FIG. 9 , a managing server  901 , e.g. a privileged account manager server, can manage one or more nodes, such as the nodes  902 - 905  in a computing environment  900 . 
     In accordance with an embodiment of the invention, a hybrid approach can be used for performing the video processing task, when a security policy in the computing environment  900  allows only partial communication between the various managed nodes  902 - 905 . 
     For example, if the originating source node  902  is allowed to communicate with a number (L) of nodes out of the number (M) of nodes, the originating source node  902  can send the frames directly to each of the number (L) of nodes in the round-robin fashion. Additionally, the originating source node  902  can send the remaining traffic to the number (M-L) of nodes via the managing server  901 , which acts as the hub. 
     As shown in  FIG. 9 , if the originating source node  902  is allowed to communicate with the nodes  903 - 904 , the originating source node  902  can send the frames directly to the nodes  903 - 904  in the round-robin fashion. Additionally, the originating source node  902  can send the remaining traffic to the node  905  through the managing server  901 , which acts as the hub. 
     Furthermore, each proxy node  903 - 905  can progressively encode the received images into a sequence of video segments, which are sent back to the managing server  901  separately. Then, the managing server  901  can construct the full-video  930  by concatenating the video sequence together. 
     Additionally, the source node  902  can detect a failure on a node or a link by monitoring the timeout of the ACK that should be received from each proxy node. For example, the source node  902  can receive an ACK message directly from the nodes  903 - 904 , and can receive an ACK message from the node  905  via the managing server  901 . 
       FIG. 10  illustrates an exemplary flow chart for using a video processing pool to support load-balancing in a computing environment. As shown in  FIG. 10 , at step  1001 , the system can provide a video encoding pool in the computing environment, wherein the video encoding pool includes a set of nodes that are able to perform one or more video processing tasks for another node. Furthermore, at step  1002 , a managing server in the computing environment can receive a request for delegating a video processing task from a managed node. Then, at step  1003 , the managing server can select one or more nodes from the video encoding pool to perform the video processing task. 
     The present invention may be conveniently implemented using one or more conventional general purpose or specialized digital computer, computing device, machine, or microprocessor, including one or more processors, memory and/or computer readable storage media programmed according to the teachings of the present disclosure. Appropriate software coding can readily be prepared by skilled programmers based on the teachings of the present disclosure, as will be apparent to those skilled in the software art. 
     In some embodiments, the present invention includes a computer program product which is a storage medium or computer readable medium (media) having instructions stored thereon/in which can be used to program a computer to perform any of the processes of the present invention. The storage medium can include, but is not limited to, any type of disk including floppy disks, optical discs, DVD, CD-ROMs, microdrive, and magneto-optical disks, ROMs, RAMs, EPROMs, EEPROMs, DRAMs, VRAMs, flash memory devices, magnetic or optical cards, nanosystems (including molecular memory ICs), or any type of media or device suitable for storing instructions and/or data. 
     The foregoing description of the present invention has been provided for the purposes of illustration and description. It is not intended to be exhaustive or to limit the invention to the precise forms disclosed. Many modifications and variations will be apparent to the practitioner skilled in the art. The modifications and variations include any relevant combination of the disclosed features. The embodiments were chosen and described in order to best explain the principles of the invention and its practical application, thereby enabling others skilled in the art to understand the invention for various embodiments and with various modifications that are suited to the particular use contemplated. It is intended that the scope of the invention be defined by the following claims and their equivalence.