Managing change events for devices in an enterprise system

• US 10,129,109 B2
• Filed: 03/31/2017
• Issued: 11/13/2018
• Est. Priority Date: 09/24/2014
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Jayanti Venkata, Bhagavati Kumar, Maheshwari, Harsh, Das, Sidhartha
• Primary Examiner(s): Tang, Karen
• Application Number:
  US15/476,906
• Publication Number:
  US 20170207985A1
• Time in Patent Office: 592 Days
• Field of Search: 709217
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 8/60 Software deployment
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 8/71 Version control security arrangements therefor G06F21/57; Configuration management
• CPC Class Codes: G06F 9/452 Remote windowing, e.g. X-Window System, desktop virtualisation protocols for virtual reality H04L67/131
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 41/20 Network management software packages
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 : for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 : Access control lists [ACL]
• CPC Class Codes: H04L 63/102 : Entity profiles
• CPC Class Codes: H04L 63/104 : Grouping of entities
• CPC Class Codes: H04L 63/105 : Multiple levels of security
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 : involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/02 : based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 : in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/12 : specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/306 : User profiles
• CPC Class Codes: H04L 67/55 : Push-based network services
• CPC Class Codes: H04L 67/75 : Indicating network or usage conditions on the user display
• CPC Class Codes: H04L 9/3268 : using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/33 : using wearable devices, e.g. using a smartwatch or smart-glasses
• CPC Class Codes: H04W 16/06 : Hybrid resource partitioning, e.g. channel borrowing
• CPC Class Codes: H04W 4/08 : User group management
• CPC Class Codes: H04W 4/50 : Service provisioning or reconfiguring
• CPC Class Codes: H04W 4/60 : Subscription-based services using application servers or record carriers, e.g. SIM application toolkits
• CPC Class Codes: H04W 4/70 : Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Abstract

Techniques are disclosed for communicating to remote devices information about change events related to changes in access to an enterprise system. A device access management system may facilitate communication about a change event to the remote devices. Information about a change event may be stored in a change event object based on the type of change event (e.g., a policy change, an application change, and a settings change). A change event queue may persistently store information corresponding to change events. One or more computing nodes may be scheduled to execute an action process for each change event based on the type of the change event. A computing node may communicate information (e.g., an instruction to implement adjust access) about a change event to remote devices. A change event may persist on the queue until all remote devices are notified about the change event.

Claims

1. A method comprising:

determining a type of a change event to be performed on a plurality of remote client devices, the type of the change event corresponding to an access change for the plurality of remote client devices to a computer server system;

generating a first change event entry data structure corresponding to a first change event entry, the first change event entry data structure storing (a) information identifying each of a first subset of remote devices in the plurality of remote client devices, and (b) data identifying the determined type of the change event;

generating a second change event entry data structure corresponding to a second change event entry, the second change event entry data structure storing (a) information identifying each of a second subset of remote devices in the plurality of remote client devices, and (b) data identifying the determined type of the change event, wherein each remote device in the first subset of remote devices is different from each remote device in the second subset of remote devices;

adding, on a queue, the first change event entry, and the second change event entry;

assigning, from the queue to a first computing node, the first change event entry corresponding to the first subset of remote devices;

accessing a software metadata class from a plurality of software metadata classes, based on the determined type of the change event;

instantiating a first metadata object based on the metadata class, storing first metadata identifying each of the first subset of remote devices in the first metadata object;

executing, by the first computing node, the first metadata object wherein executing the first metadata object comprises instructing each of the first subset of remote devices to adjust access to the computing system based on the type of the change event indicated by the first change event entry corresponding to the first metadata object;

assigning, from the queue to a second computing node, the second change event entry corresponding to the second subset of remote devices;

instantiating a second metadata object based on the metadata class storing second metadata identifying each of the second subset of remote devices in the second metadata object; and

executing, by the second computing node, the second metadata object wherein executing the second metadata object comprises instructing each of the second subset of remote devices to adjust access to the computing system based on the type of the change event indicated by the second change event entry corresponding to the second metadata object.

2. The method of claim 1, wherein instantiating the first metadata object is performed on the first computing node, and wherein instantiating the second metadata object is performed on the second computing node.

3. The method of claim 1, further comprising:

selecting the first computing node for executing the first metadata obj ect and selecting the second computing node for executing the second metadata object, wherein the selection is based on a processing load of each of a plurality of computing nodes including the first computing node and the second computing node.

4. The method of claim 3, further comprising:

computing the processing load for each of the plurality of computing nodes, wherein a processing load of a computing node is computed based on a number of actions the computing node has initiated, and wherein the first computing node is selected from the plurality of computing nodes based on an action threshold, and wherein each of the plurality of computing nodes is selected based on the processing load for each of the computing nodes satisfying the action threshold.

5. The method of claim 1, wherein the type of change event includes a policy change, the policy change including a change in a compliance policy, a change in an enrollment policy, a change in a workspace policy, a change in a device policy, or a combination thereof.

6. The method of claim 1, wherein the type of change event includes an application change, the application change including adding an application to a catalog of applications accessible to the plurality of remote devices, removing an application from the catalog of applications, modifying a version of an application in the catalog of applications, or a combination thereof.

7. The method of claim 1, wherein the type of change event includes a change in a synchronization setting related to accessing the computing system.

8. The method of claim 1, further comprising:

determining, based on the type of change event, an action process to perform.

9. The method of claim 1, further comprising executing, by the first computing node, an action to be taken on each of the first subset of remote devices concurrently with executing, by the second computing node, an action to be taken on each of the second subset of remote devices.

10. The method of claim 1, wherein instructing each remote device in the first subset of remote devices to adjust access to the computing system comprises sending a first instruction indicating an action to adjust access to the computing system corresponding to the determined type of the change event, to each of the first subset of remote devices, and wherein instructing each remote device in the second subset of remote devices to adjust access to the computing system comprises sending a second instruction indicating an action to adjust access to the computing system corresponding to the determined type of the change event, to each of the second subset of remote devices.

11. The method of claim 1, further comprising:

removing, from the queue, the first change event entry for the first subset of remote devices upon receiving a response from each of the first subset of remote devices, the response indicating that each of the first subset of remote devices has adjusted access to the computing system based on the information about the change event included in the first change event entry.

12. The method of claim 11, wherein the response is a first response, and wherein the method further comprises:

removing, from the queue, the second change event entry for the second subset of remote devices upon receiving a second response from each of the second subset of remote devices, the second response indicating that each of the second subset of remote devices has adjusted access to the computing system based on the information about the change event included in the second change event entry.

13. The method of claim 1, wherein executing the first metadata object by the first computing node comprises:

transmitting instructions to each of the first subset of remote devices to adjust access to the computing system based on the type of the change event indicated by the first change event entry corresponding to the first metadata object;

determining that responses to the transmitted instructions have been received from some but not all of the first subset of remote devices within a predetermined period of time; and

in response to determining that not all of the first subset of remote devices have responded within the predetermined period of time, periodically re-transmitting the instructions to at least one of the first subset of remote devices that has not responded within the predetermined period of time.

14. The method of claim 1, wherein executing the first metadata object by the first computing node comprises:

using a push notification service to transmit instructions to each of the first subset of remote devices to adjust access to the computing system based on the type of the change event indicated by the first change event entry corresponding to the first metadata object; and

receiving, via the push notification service, a pull request from at least one of the first subset of remote devices, the pull request corresponding to a request for further information related to the instruction to adjust access to the computing system.

15. A system comprising:

one or more processors; and

a memory storing one or more instructions which, upon execution by the one or more processors, causes the one or more processors to;

determine a type of a change event to be performed on a plurality of remote client devices, the type of the change event corresponding to an access change for the plurality of remote client devices to a computer server system;

generate a first change event entry data structure corresponding to a first change event entry, the first change event entry data structure storing (a) information identifying each of a first subset of remote devices in the plurality of remote client devices, and (b) data identifying the determined type of the change event;

generate a second change event entry data structure corresponding to a second change event entry, the second change event entry data structure storing (a) information identifying each of a second subset of remote devices in the plurality of remote client devices, and (b) data identifying the determined type of the change event, wherein each remote device in the first subset of remote devices is different from each remote device in the second subset of remote devices;

add, on a queue, a first change event entry, and the second change event entry;

assign, from the queue to a first computing node, the first change event entry corresponding to the first subset of remote devices;

access a software metadata class from a plurality of software metadata classes, based on the determined type of the change event;

instantiate a first metadata object based on the metadata class, storing first metadata identifying each of the first subset of remote devices in the first metadata object;

execute, by the first computing node, the first metadata object wherein executing the first metadata object comprises instructing each of the first subset of remote devices to adjust access to the computing system based on the type of the change event indicated by the first change event entry corresponding to the first metadata object;

assign, from the queue to a second computing node, the second change event entry corresponding to the second subset of remote devices;

instantiate a second metadata object based on the metadata class storing second metadata identifying each of the second subset of remote devices in the second metadata object; and

execute, by the second computing node, the second metadata object wherein executing the second metadata object comprises instructing each of the second subset of remote devices to adjust access to the computing system based on the type of the change event indicated by the second change event entry corresponding to the second metadata object.

16. The system of claim 15, wherein instructing each remote device in the first subset of remote devices to adjust access to the computing system comprises sending a first instruction indicating an action to adjust access to the computing system corresponding to the determined type of the change event, to each of the first subset of remote devices, and wherein instructing each remote device in the second subset of remote devices to adjust access to the computing system comprises sending a second instruction indicating an action to adjust access to the computing system corresponding to the determined type of the change event, to each of the second subset of remote devices.

17. The system of claim 15, the memory storing further instructions which, upon execution by the one or more processors, causes the one or more processors to:

select the first computing node for executing the first metadata object and selecting the second computing node for executing the second metadata object, wherein the selection is based on a processing load of each of a plurality of computing nodes including the first computing node and the second computing node.

18. A non-transitory computer-readable medium comprising one or more instructions stored thereon, that upon execution by one or more processors, causes the one or more processors to:

determine a type of a change event to be performed on a plurality of remote client devices, the type of the change event corresponding to an access change for the plurality of remote client devices to a computer server system;

generate a first change event entry data structure corresponding to a first change event entry, the first change event entry data structure storing (a) information identifying each of a first subset of remote devices in the plurality of remote client devices, and (b) data identifying the determined type of the change event;

generate a second change event entry data structure corresponding to a second change event entry, the second change event entry data structure storing (a) information identifying each of a second subset of remote devices in the plurality of remote client devices, and (b) data identifying the determined type of the change event, wherein each remote device in the first subset of remote devices is different from each remote device in the second subset of remote devices;

add, on a queue, a first change event entry, and the second change event entry;

assign, from the queue to a first computing node, the first change event entry corresponding to the first subset of remote devices;

access a software metadata class from a plurality of software metadata classes, based on the determined type of the change event;

instantiate a first metadata object based on the metadata class, storing first metadata identifying each of the first subset of remote devices in the first metadata object;

execute, by the first computing node, the first metadata object wherein executing the first metadata object comprises instructing each of the first subset of remote devices to adjust access to the computing system based on the type of the change event indicated by the first change event entry corresponding to the first metadata object;

assign, from the queue to a second computing node, the second change event entry corresponding to the second subset of remote devices;

instantiate a second metadata object based on the metadata class storing second metadata identifying each of the second subset of remote devices in the second metadata object; and

execute, by the second computing node, the second metadata object wherein executing the second metadata object comprises instructing each of the second subset of remote devices to adjust access to the computing system based on the type of the change event indicated by the second change event entry corresponding to the second metadata object.

19. The non-transitory computer-readable medium of claim 18, wherein the one or more instructions, that upon execution by the one or more processors, further causes the one or more processors to:

remove, from the queue, the first change event entry for the first subset of remote devices upon receiving a response from each of the first subset of remote devices, the response indicating that each of the first subset of remote devices has adjusted access to the computing system based on the information about the change event included in the first change event entry; and

remove, from the queue, the second change event entry for the second subset of remote devices upon receiving a second response from each of the second subset of remote devices, the second response indicating that each of the second subset of remote devices has adjusted access to the computing system based on the information about the change event included in the second change event entry.

20. The non-transitory computer-readable medium of claim 18, wherein the one or more instructions, that upon execution by the one or more processors, further causes the one or more processors to:

select the first computing node for executing the first metadata object and selecting the second computing node for executing the second metadata object, wherein the selection is based on a processing load of each of a plurality of computing nodes including the first computing node and the second computing node.