Automatic software upgrade

• US 10,089,099 B2
• Filed: 05/06/2016
• Issued: 10/02/2018
• Est. Priority Date: 06/05/2015
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Chang, Shih-Chun, Pang, Jackson Ngoc Ki, Malhotra, Varun Sagar, Vu, Hai Trong, Spadaro, Roberto Fernando, Kulshreshtha, Ashutosh, Yadav, Navindra
• Primary Examiner(s): Chen, Qing
• Assistant Examiner(s): Thatcher, Clint A
• Application Number:
  US15/148,185
• Publication Number:
  US 20160357546A1
• Time in Patent Office: 879 Days
• Field of Search: 717170
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

Systems, methods, and computer-readable media are provided for automatically downloading and launching a new version of software package on components in a network environment. In some examples, an upgrade server of a network environment keeps a copy of all versions of software packages running on nodes or sensors of the network environment, identifications of corresponding nodes or sensors, and public keys associated with the software packages. The upgrade server can authenticate a new version of a software package using a two-step process.

Claims

1. A method comprising:

receiving, from a provider, a notification of a new version of a software package;

downloading the new version of the software package;

authenticating the new version of the software package using a first public key assigned by the provider;

in response to determining that the new version of the software package is a valid software packet from the provider, determining a current version of the software package running on a particular node of a network environment, the current version of the software package comprising a software package portion and a specific control engine;

determining that the current version of the software package is older than the new version of the software package;

authenticating the new version of the software package using a second public key assigned by the specific control engine;

determining that the new version of the software package matches an identification of the particular node using the second public key assigned by the specific control engine; and

uploading the new version of the software package onto the particular node.

2. The method of claim 1, further comprising:

collecting, directly from the particular node or a sensor associated with the particular node, process and network data of the particular node; and

determining a status of the new version of the software package running on the particular node by analyzing the process and network data of the particular node.

3. The method of claim 2, further comprising:

determining that the new version of the software package is not running ok on the particular node;

uninstalling the new version of the software package on the particular node; and

causing the current version of the software package to be restored on the particular node.

4. The method of claim 3, further comprising:

rejecting an upgrade request from at least one node of the network environment, the at least one node running under an operating system similar to that of the particular node.

5. The method of claim 2, further comprising:

determining that the new version of the software package is running okay on the particular node over a predetermined period of time; and

causing the new version of the software package to be upgraded to at least one additional node of the network environment, the at least one additional node running under an operating system similar to that of the particular node.

6. The method of claim 1, wherein the authenticating the new version of the software package and the determining the current version of the software package are performed by a sensor associated with the particular node or an upgrade server of the network environment, the upgrade server maintaining a copy of software packages that are currently running on a plurality of nodes or sensors in the network environment, a copy of all prior versions of the software packages, and identifications of the plurality of nodes or sensors together with corresponding software versions that are running on the plurality of nodes or sensors.

7. The method of claim 1, wherein the authenticating the new version of the software package and the determining the current version of the software package are performed by the specific control engine.

8. The method of claim 7, further comprising:

collecting process and network data of the particular node; and

determining a status of the new version of the software package running on the particular node by analyzing the process and network data of the particular node.

9. The method of claim 8, further comprising:

maintaining a copy of the current version of the software package on the particular node;

determining that the new version of the software package has been running okay over a predetermined period of time; and

removing the current version of the software package from the particular node.

10. The method of claim 8, further comprising:

maintaining a copy of the current version of the software package on the particular node;

determining that the new version of the software package is not running okay;

uninstalling the new version of the software package from the particular node; and

reinstalling the current version of the software package on the particular node.

11. A system, comprising:

a processor; and

a computer-readable medium storing instructions that, when executed by the processor, cause the system to perform operations comprising;

receiving, from a provider, a notification of a new version of a software package;

downloading the new version of the software package;

authenticating the new version of the software package using a first public key assigned by the provider;

in response to determining that the new version of the software package is a valid software packet from the provider, determining a current version of the software package running on a particular node of a network environment, the current version of the software package comprising a software package portion and a specific control engine;

determining that the current version of the software package is older than the new version of the software package;

authenticating the new version of the software package using a second public key assigned by the specific control engine;

determining that the new version of the software package matches an identification of the particular node using the second public key assigned by the specific control engine; and

uploading the new version of the software package onto the particular node.

12. The system of claim 11, wherein the instructions, when executed by the processor, cause the system to perform operations further comprising:

collecting, directly from the particular node or a sensor associated with the particular node, process and network data of the particular node; and

determining a status of the new version of the software package running on the particular node by analyzing the process and network data of the particular node.

13. The system of claim 12, wherein the instructions, when executed by the processor, cause the system to perform operations further comprising:

determining that the new version of the software package is not running ok on the particular node;

uninstalling the new version of the software package on the particular node; and

causing the current version of the software package to be restored on the particular node.

14. The system of claim 13, wherein the instructions, when executed by the processor, cause the system to perform operations further comprising:

rejecting an upgrade request from at least one node of the network environment, the at least one node running under an operating system similar to that of the particular node.

15. The system of claim 12, wherein the instructions, when executed by the processor, cause the system to perform operations further comprising:

determining that the new version of the software package is running okay on the particular node over a predetermined period of time; and

causing the new version of the software package to be upgraded to at least one additional node of the network environment, the at least one additional node running under an operating system similar to that of the particular node.

16. The system of claim 11, wherein the authenticating the new version of the software package and the determining the current version of the software package are performed by a sensor associated with the particular node or an upgrade server of the network environment, the upgrade server maintaining a copy of software packages that are currently running on a plurality of nodes or sensors in the network environment, a copy of all prior versions of the software packages, and identifications of the plurality of nodes or sensors together with corresponding software versions that are running on the plurality of nodes or sensors.

17. The system of claim 11, wherein the authenticating the new version of the software package and the determining the current version of the software package are performed by the specific control engine.

18. The system of claim 17, wherein the instructions, when executed by the processor, cause the system to perform operations further comprising:

collecting process and network data of the particular node; and

determining a status of the new version of the software package running on the particular node by analyzing the process and network data of the particular node.

19. The system of claim 18, wherein the instructions, when executed by the processor, cause the system to perform operations further comprising:

maintaining a copy of the current version of the software package on the particular node;

determining that the new version of the software package has been running okay over a predetermined period of time; and

removing the current version of the software package from the particular node.

20. The system of claim 18, wherein the instructions, when executed by the processor, cause the system to perform operations further comprising:

maintaining a copy of the current version of the software package on the particular node;

determining that the new version of the software package is not running okay;

uninstalling the new version of the software package from the particular node; and

reinstalling the current version of the software package on the particular node.