Enterprise Technology: Peer-to-Peer Gets Down to Business

Napster put peer-based networking on the evening news. Now businesses are using similar technology to collaborate, share data, and more.

Have you been wondering what to do with all the processing power, surplus hard disk space, and high-speed Internet connections you've built up over the past few years? Take a clue from Napster. The renegade MP3-swapping site may be on the ropes, but the technology it uses--peer-to-peer networking--is all the rage.

In a peer-to-peer network, powerful client PCs take on the role of servers, enabling direct communication among systems that stands to lower IT costs and raise corporate productivity. In this month's Enterprise Technology, we explore nascent peer-to-peer solutions for corporate networks. Are they any better than current client/server applications?

If you think Napster has been a boon only to music buffs and copyright lawyers, think again. Sure, the rise and fall of the MP3-sharing Web site spotlighted important issues of intellectual property and copyright law. But it also demonstrated the power of peer-to-peer networking, an architecture that could transform enterprise computing and help your company lower costs and improve productivity.

If that sounds far-fetched, consider the problem that Shawn Fanning faced when, as a music-starved college student, he sat down to create Napster. Fanning knew that millions of people scattered around the world had MP3 files sitting on their hard disks. He wanted to help them share that music, but he knew it would be impractical to collect all the MP3s on a central server. Never mind the cost and the copyright obstacles; the sheer size of all those files--and the constant demand for uploads and downloads--made physical centralizing impossible.

Instead, Fanning turned to peer-to-peer networking. The files stay where they are--on individual hard drives. Napster simply maintains a central list of who has what and, when a user requests a song, puts the user in touch with the source to exchange the MP3 directly.

Scratch out "MP3" and substitute "corporate data," and you begin to see why peer-to-peer networking has suddenly become one of the hottest topics in enterprise computing.

"There is a lot of hype surrounding peer-to-peer computing that may overstate its importance," says Tim O'Reilly, president of O'Reilly & Associates, a Sebastapol, California-based research and publishing firm that has been examining leading-edge technology since 1978. "But that doesn't change the fact that every business will be using a form of peer-to-peer computing at some point. The only questions are, how soon and how extensively?"

Clearly, peer-to-peer networking has the potential to lower costs and raise productivity by redefining traditional network structures. But to change the way corporations do business, peer-to-peer solutions must demonstrate a clear advantage over traditional solutions, which only a few have managed to do so far.

Getting Here From There

Despite all the recent attention, peer-to-peer technology is nothing new. Network architectures of this type have been around for at least 30 years. And Microsoft Windows operating systems have included primitive peer-to-peer file- and printer-sharing capabilities since the advent of Windows for Workgroups.

Nevertheless, three recent advances have permitted serious peer-to-peer development: higher bandwidth, cheap storage, and powerful desktop processors. As decentralized companies adopted high-bandwidth Internet connections and high-powered PCs, it was just a matter of time before software developers figured out how to leverage those resources.

Moreover, the benefits of such networking can apply to companies of all sizes. "Because peer-to-peer is so flexible and potentially inexpensive, it's enticing for small companies that can't afford something like Lotus Notes," says Kevin Werbach, editor of Esther Dyson's Release 1.0 technology newsletter. "Yet many peer-to-peer applications focus on the hard problems of large businesses that client/server solutions failed to solve, such as knowledge management."

At their heart, all peer-to-peer technologies share data and resources among clients. What the sharing accomplishes for companies distinguishes one solution from another. For our purposes, peer-to-peer applications fall into three groups important to enterprise computing: online collaboration, file sharing and management, and distributed computing.

Online Collaboration

Peer-to-peer solutions that enable workers to interact in real time are an obvious way to use a network to facilitate direct communication between workstations. Various flavors of collaboration programs have existed for a long time--from client/server groupware like Lotus Notes and ERoom, to Web-based services like the well-regarded but now-defunct HotOffice (see "When Your ASP Goes Under").

In the past, collaboration was unwieldy to manage and widely underutilized. Workers often preferred phone conferences and e-mail to online threaded discussions and shared folders. But with the growth of products like Microsoft NetMeeting and instant messaging (IM)--both of which are peer-to-peer applications at heart--businesses are starting to take a second look at online collaboration.

"People are seeing instant messaging as an enterprise application platform, with telephony and other collaboration tools as part of the solution," says O'Reilly.

Get Into the Groove

One notable new peer-to-peer product comes from Groove Networks, founded by Ray Ozzie, the creator of Lotus Notes. Groove, which was still in preview mode at press time, offers downloadable client software that lets users create "shared spaces" with others on the network.

A user running Groove invites participants into a shared space using e-mail or IM. When they accept, the space appears on each participant's screen.

The group can then use IM, threaded discussions, and shared whiteboards to communicate. If a participant drops a Word file into the shared desktop space, for example, Groove launches the same file on other users' systems. The software encrypts all communication--including the initial request for a meeting--to make the space secure.

Sound familiar? Functionally speaking, it is. But a peer-to-peer solution like Groove doesn't require central administration or server resources. Groove's shared spaces are dynamic and vanish when users decide they don't need them. Unlike both client/server- and Web-based solutions, Groove isn't built around fixed interfaces, and it uses XML to display information and to transmit just the changes from the group's collaboration.

Groove's advantages have already won some converts, one of whom is John Sequeira of ECratchit, a bookkeeping and accounting application service provider.

Sequeira began testing Groove last year in collaboration with a team of about 15 developers. "We use people from outside the company, and we needed to be able to collaborate with them in real time without our IT guys giving them access to our network or worrying about security," he says.

While actual code remains safely sequestered at ECratchit headquarters in Braintree, Massachusetts, Sequeira and his group use Groove to track open issues like bugs. "It's better and more secure than e-mail," he says. For now, though, Groove runs only on Windows--so if your company has a heterogeneous network, some people will be left out of the loop.

File Sharing and Management

Though file sharing may be part of a collaboration platform such as Groove, it's more recognizable as a stand-alone solution that doesn't entail interaction among people at their desktops. Perhaps the most obvious example is Napster.

Most public peer-to-peer schemes are relatively unstructured, untamed territory, however. In an enterprise, file sharing is more likely to take the form of knowledge or document management.

"People create knowledge and they store it on their desktop," says Andrew Mahon, director of strategic marketing for Groove Networks. "It would be nice if they would publish it to a central location, the way client/server knowledge management tools are supposed to work, but people are lazy. Peer-to-peer solutions allow people to look around and find the knowledge."

One company working on controlled methods of sharing files is Roku, of Chantilly, Virginia. Its Roku Share program allows users to drag documents into local, shared folders where workgroups can access them. All Roku connections are encrypted using secure socket layer; packets going over wires are encrypted, too.

Other companies are adapting peer-to-peer techniques to solve nagging corporate problems such as virus protection. Last May, DPR Construction of Redwood City, California, began using an antivirus program from an ASP called MyCIO.com to protect its 1400 desktop computers. At press time, MyCIO changed its name to McAfee ASaP. The program--VirusScan ASaP--uses peer-to-peer technology to check whether systems have the latest virus protection.

Why did DPR make the move? "We got caught by the Love Bug virus," says DPR's network manager, Lee Rocklage. "We have over a thousand machines, but only a couple hundred had updated virus profiles. People simply hadn't downloaded them."

With VirusScan ASaP, which costs DPR just $1600 a month for all 1400 of the company's terminals, the first five workstations that log on to the Internet each day get the latest virus patches from the McAfee ASaP Web site. Those workstations then pass along the updates to the company's other systems, including computers at remote sites that tap into the network through a virtual private network.

"This ensures that all our workstations get the latest virus updates as soon as they log on," says Rocklage. "It happens behind the scenes, and it means not everyone needs to log on to the [McAfee ASaP] site to get the patch, which helps keep the load on our Internet connection under control."

Distributed Computing

It's still a niche technology, but distributed computing is the most innovative use of peer-to-peer technology--and may offer corporations the greatest benefit.

Under distributed computing, a network of end-user systems pools its spare processing power to perform enormous computations. One familiar example is the SETI@home project, managed by a group of researchers at the Space Sciences Laboratory of the University of California, Berkeley. SETI stands for Search for ExtraTerrestrial Intelligence.

SETI's analysis requires processing power that large systems can't supply economically. So with SETI@home, volunteers who use the Internet download a screen saver that grabs instructions from SETI and performs calculations when a connected computer isn't otherwise in use.

Other businesses--such as Juno Online Services--are attempting to resell subscribers' idle computer resources to companies that need the extra power.

Systems such as these cross firewalls and don't lend themselves to central control. Businesses tend to prefer solutions that run on their own networks, like the one JP Morgan Chase uses to analyze financial products. Since 1998, the company has employed pools of 200 PCs to crunch complex models for products such as derivative contracts. "It is a huge cost savings over a traditional supercomputer," says Steve Neiman, head of high-performance computing at the company. "We're talking 85 to 90 percent savings."

Peter Lee, CEO of DataSynapse, which sells distributed computing solutions to companies in the financial and energy industries, claims that nearly every company has untapped power at its disposal.

"Even on the capital markets floors, where things always seem very busy, they have systems with idle capacity in excess of 60 percent," says Lee. "We have one customer that had a one-hour bottleneck in processing portfolio options. Now it takes that bottleneck and distributes it over 100 machines, and the same process gets done in a minute."

Stumbling Blocks

With results like that, you might expect peer-to-peer solutions to gain acceptance rapidly. But IT departments, in particular, remain suspicious. "On the surface, peer-to-peer is bad news for IT," explains Mahon of Groove Networks. "They don't see a big upside--maybe some cost savings or network utilization savings, but nothing big. What they see are bandwidth and maintenance issues. But the reason they see that is Napster. Napster caused bandwidth problems and hurt network performance. But that's not what peer-to-peer is about for businesses."

Still, peer-to-peer tools may bog down a network infrastructure that's too weak to handle them--especially when called upon to move and manipulate large files. Groove, for example, uses an algorithm that takes into account the size of a piece of data and the number of people it needs to reach. If a network bottleneck seems likely to occur, Groove sends the data to a relay server that fans it out to participants.

In addition, peer-to-peer networks risk major security breaches when data travels around corporate servers and outside firewalls. And if files never cross a centrally managed server, how can networked systems protect themselves from viruses?

Proponents of peer-to-peer tools argue that these drawbacks are not fatal. "It's not much harder to address security in a peer-to-peer environment than it is in a client/server environment," says Werbach. "But any company looking at a peer-to-peer network must make sure it comes with a security solution."

"In the end," adds O'Reilly, "companies may not necessarily go out looking for peer-to-peer solutions. Peer-to-peer will be built into the products they already use. For instance, a new Oracle database may be able to spread itself over 200 systems." If that happens, peer-to-peer networking will have sneaked into the enterprise the way many other significant advances did--through the back door.

Have comments on this Enterprise Technology section? E-mail suggestions and feedback.

Peer-to-Peer vs. Client/Server

Peer-to-peer solutions come in various shapes and sizes. One particularly effective use of peer-to-peer technology is McAfee ASaP's VirusScan ASaP, which uses the application service provider's Rumor technology to distribute virus updates from PC to PC within an organization. It is more effective than client/server-type solutions because it ensures that virus protection is up-to-date, and it relieves the network of excess traffic.

Peer-to-Peer Solutions: Automate Business Processes

Sharing documents and collaborating in real time are fairly straightforward tasks. But in today's world of electronic commerce, collaboration goes well beyond simple online discussions. A new solution from Consilient--a start-up based in Berkeley, California--brings additional intelligence to peer-to-peer networks in order to streamline entire business processes.

Handling electronic procurement, supply-chain management, and other processes entails bringing together different departments, resources, and business systems. Sophisticated solutions from companies such as Ariba attempt to integrate these parts, but they can do only so much--especially when it comes to connecting third-party systems.

Consilient wants to automate business processes that span large, diverse groups without necessarily integrating existing systems (a big hassle when many companies are involved). Its peer-to-peer solution relies on something the company calls Sitelets to pull together needed information.

"This technology lets companies span the many barriers in how people work," says Erik Freed, chief technology officer for Consilient. "Sitelets provide a framework for unifying systems and applications within a virtual peer-to-peer process. Enterprises benefit from seamless unification and collaboration between business units, customers, and suppliers. Ultimately, there's less friction between business units, which increases productivity and opens the door to newer, more efficient business models."

Sitelets themselves are software agents written in XML code that include the vital characteristics of a virtual business process. These XML documents can be delivered over the Web, through e-mail, or even via a PDA; all parties involved in the business process add information along the way. As Sitelets pass from person to person in a business process, they keep track of who added what information and report back to the company, telling it where the Sitelet is in the process.

For example, if your company needs to automate the task of budgeting, you likely require endless approval loops, proposals, and data from various departments and business partners. With Consilient, you design a Sitelet that describes the budgeting process (routing, data, reports, visual layout, and so on) and collects the necessary information and approvals. The Sitelet becomes an organized container for all the data.

Consilient previewed its solution last fall and was preparing to sell it (at as-yet-undetermined prices) to enterprises shortly after we went to press. Freed says it will be available primarily through system integrators.

Peer-to-Peer Resources: Who's Who in Peer-to-Peer Development

Here's a sampling of the hundreds of peer-to-peer companies, initiatives, and analysts. These sites and solutions aren't necessarily better than others. With peer-to-peer systems in their infancy, test various free downloads to determine what works best for your business.

Resources

OpenP2P.com: A comprehensive site from O'Reilly & Associates, OpenP2P.com has wide-ranging information on peer-to-peer networking, including in-depth analysis and information on solutions.

P2Ptracker.com: This site provides news and data on peer-to-peer computing, including solution details and simple reviews.

Peer-to-Peer Working Group: Get information on peer-to-peer standards-in-progress from a consortium that includes Fujitsu PC, HP, Intel, and others.

Collaboration Tools

Groove Networks: Built by some of the engineers who created Lotus Notes, Groove offers instant messaging, threaded discussions, a whiteboard tool, and more.

Ikimbo: Ikimbo offers various collaboration tools for controlling and managing communication, including plug-ins for things like digital-rights management, virus scanning, and file compression.

EZmeeting: This site provides real-time chat and whiteboard tools, as well as document management.

File Sharing and Management

Roku: Roku Access and Roku Share enable you to work with and share key files on your PC from either a browser or a Web-enabled phone.

NextPage: The NextPage site treats servers as peers. Consequently, managed content looks as though it's stored locally, no matter where you are at the time that you access it.

McAfee ASaP: Formerly known as MyCIO.com, this ASP division of Network Associates features VirusScan ASaP, which manages and distributes virus patches over a peer-to-peer network.

Distributed Computing

DataSynapse: This company maintains a network of broadband-only members. It resells its members' idle PC capacity, but it also has a platform for corporate infrastructures. The service targets energy and financial industries.

Entropia: Entropia resembles DataSynapse, but most PC resources go to research projects. Members choose the projects to support, such as AIDS research.

SETI@home: Purely a research effort, SETI@home uses members' spare system resources to search radio signals from space for signs of extraterrestrial life.

United Devices: This site resells members' processing power and offers a corporate platform. It can harness power from PCs, from Macs, and from Linux-based systems.

When Your ASP Goes Under

As an early customer of HotOffice, John Simmons thought he had a good relationship with the application service provider. Senior vice president at The Greeson Company, a wholesale food broker in Grand Rapids, Michigan, Simmons had hired HotOffice to allow some 80 employees to share applications and documents over the Internet. And he enjoyed frequent personal contact with Hot- Office's support staff and management.

So it came as a shock when he logged on to HotOffice last December and read that the company was folding.

Just six days earlier, Simmons had talked with an upper-level manager about problems with the service. "He assured me that they had received additional funding and would soon be upgrading their reliability and speed," he recalls.

Instead, The Greeson Company--like many other firms--found itself in the crosshairs of the consolidating ASP market. In April 2000, The Gartner Group market research firm projected that the ASP business would balloon to more than $25.3 billion annually by 2004, up from a figure of just $1 billion in 1999. Yet today, Rita Terdiman, vice president of market research for Gartner, says she expects most ASPs either to go out of business or to be acquired by then. "By 2003 or so, there will probably be only 20 or 40 large ASPs left," she says.

An ASP Meltdown

Recent high-profile failures include Red Gorilla, HotOffice, and Pandesic, the joint venture formed by Intel and German enterprise software vendor SAP. In February, Agilera completed its acquisition of Applicast, and enterprise software maker J.D. Edwards abandoned efforts to host its own software less than a year after stepping into the ASP business.

The move toward consolidation reflects market fundamentals, says Stacie Kilgore, senior analyst at Forrester Research. "First, there were just way too many companies chasing this market. Second, there were a lot of business models that just didn't make sense," she says.

So how can a company that does business with an ASP protect itself? "Five Steps to Survival," below, lays out detailed advice, but in general the idea is to research prospective service partners thoroughly and try to build protections against failure into the agreement you make. "There are two things I always hear," says Eric Murphy, executive vice president of business development for Agilera. "The first is financial stability. The second is ability to scale."

Customers must also understand how they fit into the ASP's strategy. "They should question the level of focus on the specific applications and services pertinent to them," says Murphy.

Of course, John Simmons had done exactly that--and still wound up having only two weeks to migrate his data to another provider. "The first week was shot trying to get our bearings," says Simmons. "[After we decided what to do], we had less than a week to train our team."

Things turned out okay. HotOffice not only arranged for clients to switch to Intranets.com, a competitor, but also published guides on how to do so. Still, Simmons remains adamant that relationships are critical to protecting the business.

"You want to bring focus to your issues so you're not dealing with a different tech support person each time," Simmons recommends. "That's one thing that you can't be bashful about when you're working with an ASP."

Five Steps to Survival

1. Research: Check the financial health and backing of the ASP. Find out what firms it is partnering with in areas such as server hosting, Internet access, and software integration. In hard times, the player with the deepest pockets is the most likely to survive.
2. Negotiate: Extend the service-level agreement to include a commitment by the ASP to protect your data and applications in case the service finds itself in distress. Specify how the transfer of data and applications should occur, including channels to the ASP's key partners.
3. Engage: Work actively with the ASP to identify and resolve issues. Form personal relationships with key people in its organization, and leverage those relationships to smooth the transition if the ASP fails.
4. Challenge: If your ASP is being acquired, challenge the existing and incoming management to show why the merger makes sense to you as a customer. Be alert for signs that the new company may move away from services that are critical to your business.
5. Simplify: Before you customize any applications, consider the impact on future transitions. If you need to get your data out of that ASP, will you be able to use it elsewhere without months of development?

--Michael Desmond

Secure Networks on the Cheap and Easy

There's no denying that virtual private networks make a ton of sense for companies that need to connect remote offices. Rather than leasing expensive, dedicated, high-speed lines, VPNs allow you to establish a secure network connection over the free, public Internet.

But building your own VPN requires a large up-front investment in hardware and software, as well as lengthy setup and ongoing maintenance. And if you outsource your VPN services, you can get roped into expensive, custom solutions.

Those options weren't appealing to Harvey Golomb, chairman of Falls Church, Virginia-based Netscan IPublishing. Netscan provides online state legislative and regulatory information. The company had long used e-mail and FTP to communicate among its offices in Virginia, Pennsylvania, and Florida but decided it needed something better.

"We needed a secure wide-area network, but we didn't want to buy or install any expensive hardware," says Golomb.

Netscan adopted a solution from OpenReach, one of a new breed of providers of software-based VPNs. Customers register at the OpenReach site, install OpenReach Gateway software, download their VPN settings to a floppy disk, and boot it up on a dedicated PC with high-speed Internet access. This system becomes their VPN gateway. They repeat the process for each office they wish to connect and end up with a secure VPN, complete with firewall protection, 168-bit encryption, and more.

OpenReach monitors the VPN, but the customers manage it. "Occasionally they'll call and say, 'Hey, did you know your Florida site is down?'" says Golomb.

The software can run on anything from a 200-MHz Pentium II to the latest PCs. Golomb says his VPN is running on "old, used PCs that were just lying around." Moreover, the solution works with any existing network hardware and can connect hybrid LANs consisting of servers, printers, Macs, and Unix workstations.

OpenReach charges a monthly fee per location ($99 and up). Ultimately a company can reap big savings--up to 70 percent over ATM and frame-relay VPNs--and suffer fewer networking headaches as a result.

--Brad Grimes

Balancing Act: Manage Your Growing Traffic

The NASDAQ may have spent the winter in the doldrums, but Web traffic keeps going up. Those site visits and the resulting transactions are great, but who has the money to perform a major server upgrade, never mind the cost of disrupting operations?

TicketMaster Corporation knew that it didn't. Back when the company was preparing to merge with Web-based entertainment service CitySearch, the staff had a sudden, chilling insight.

"The existing server farm was not able to handle the load we were expecting to generate from the combined company," says Mike Batchelor, lead Internet systems engineer for the Los Angeles-based company. "At the time, we couldn't modify the application very much, since it was already generating revenue. So we decided to go with the existing service and duplicate it in multiple locations."

Today, a pair of load-balancing devices sits in front of each of TicketMaster's five server clusters, parceling out traffic to the most available systems. Batchelor says that the new hardware allowed TicketMaster to build on its existing servers, rather than requiring it to scrap the previous system altogether.

Load-balancing devices also keep transactions humming when a server in a cluster fails--and that can happen under the intense load generated by ticket sales for a Britney Spears concert, says Batchelor. Load balancers react to the situation by spreading traffic among the remaining servers.

Batchelor's team opted for powerful Alteon ACEdirector 3 load balancers from Nortel Networks, but small businesses can find more affordable options. The slim and trim $3495 SonicWall Load Balancer-Internet Appliance (888/557-6642) provides four 10- and 100-mbps ethernet ports and can support small clusters of up to 20 servers. The devices can be paired so that a backup load balancer is ready to step in if the primary unit fails.

Growing businesses may opt for more capacity and features. Nortel's $14,995 Alteon ACEswitch 180 (888/258-3661) links to networks via 10-, 100-, or 1000-mbps ethernet connections to provide traffic-management functions. The unit can route traffic based on criteria such as data type and content, making it easy to send secure transactions to one set of servers while Web page requests go to another.

--Michael Desmond