Real-time policy distribution

• US 10,148,695 B2
• Filed: 12/19/2013
• Issued: 12/04/2018
• Est. Priority Date: 09/28/2013
• Status: Active Grant

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: McAfee, LLC
• Inventors: Krishnaprasad, Vijayasree
• Primary Examiner(s): Holder, Bradley
• Application Number:
  US14/913,149
• Publication Number:
  US 20160205138A1
• Time in Patent Office: 1,811 Days
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

In an example, there is disclosed a method and system for real-time policy and task distribution to endpoints over a data exchange layer. According to one embodiment, a persistent point-to-point messaging framework is used to distributed configuration policy and tasks to a distributed, disparate set of devices immediately upon policy definition. Advantageously, the data exchange layer may facilitate delivery of messages even to endpoints that sit, for example, behind a firewall or NAT.

Claims

1. One or more non-transitory computer-readable mediums having stored thereon executable instructions for providing a data exchange layer (DXL) broker, the executable instructions when executed instruct a processor to:

communicatively couple to a DXL enterprise service bus (ESB);

provide an application programming interface (API) to authenticate and register DXL endpoints with the DXL broker;

maintain a DXL routing table of registered DXL endpoints for the DXL broker; and

provide real-time context-aware DXL messaging for registered DXL endpoints, wherein providing DXL message routing comprises providing a message queueing telemetry transport (MQTT)-based one-to-one (1;

1) request-response framework on a one-to-many (1;

N, N>

1) publish-subscribe fabric.

2. The one or more non-transitory computer-readable mediums of claim 1, wherein the executable instructions are further to instruct the processor to:

identify a policy update driver;

configure a policy update; and

publish the policy update as a DXL message via the DXL ESB.

3. The one or more non-transitory computer-readable mediums of claim 2, wherein the DXL message is a command-level message.

4. The one or more non-transitory computer-readable mediums of claim 2, wherein the DXL message is targeted to DXL endpoints.

5. The one or more non-transitory computer-readable mediums of claim 2, wherein the instructions are further to instruct the processor to identify a policy update driver and receive a malware threat message from a threat intelligence service.

6. The one or more non-transitory computer-readable mediums of claim 2, wherein the instructions are further to instruct the processor to identify a policy update driver and proactively identify a policy update need.

7. The one or more non-transitory computer-readable mediums of claim 2, wherein the instructions are further to instruct the processor to identify a policy update driver and receive a policy update from an administrator.

8. The one or more non-transitory computer-readable mediums of claim 2, wherein the instructions are further to instruct the processor to configure a policy update and direct DXL endpoints to take an action selected from the group consisting of quarantine, block, delete, sandbox, deny permissions, remedy, prompt, or custom action.

9. A data exchange layer (DXL) broker comprising:

a processor;

a network interface; and

a memory having stored therein executable instructions configured to instruct the processor to;

communicatively couple to a DXL enterprise service bus (ESB) via the network interface;

provide an application programming interface (API) to authenticate and register DXL endpoints with the DXL broker;

maintain a DXL routing table of registered DXL endpoints for the DXL broker; and

provide real-time context-aware DXL messaging for registered DXL endpoints, wherein providing DXL message routing comprises providing a message queueing telemetry transport (MQTT)-based one-to-one (1;

1) request-response framework on a one-to-many (1;

N, N>

1) publish-subscribe fabric.

10. The DXL broker of claim 9, wherein the executable instructions are further configured to instruct the processor to:

identify a policy update driver;

configure a policy update; and

publish the policy update as a DXL message via the DXL ESB.

11. The DXL broker of claim 10, wherein the DXL message is a command-level message.

12. The DXL broker of claim 10, wherein the DXL message is targeted to DXL endpoints.

13. The DXL broker of claim 10, wherein the instructions configured to identify a policy update driver are configured to receive a malware threat message from a threat intelligence service.

14. The DXL broker of claim 10, wherein the instructions configured to identify a policy update driver are configured to proactively identify a policy update need.

15. The DXL broker of claim 10, wherein the instructions configured to identify a policy update driver are configured to receive a policy update from an administrator.

16. The DXL broker of claim 10, wherein the instructions configured to configure a policy update are configured to direct DXL endpoints to take an action selected from the group consisting of quarantine, block, delete, sandbox, deny permissions, remedy, prompt, or custom action.

17. A method of providing data exchange layer (DXL) broker services, comprising:

communicatively coupling a computing apparatus to a DXL enterprise service bus (ESB);

providing an application programming interface (API) to authenticate and register DXL endpoints with the DXL broker;

maintaining a DXL routing table of registered DXL endpoints for the DXL broker; and

providing real-time context-aware DXL messaging for registered DXL endpoints, wherein providing DXL message routing comprises providing a message queueing telemetry transport (MQTT)-based one-to-one (1;

1) request-response framework on a one-to-many (1;

N, N>

1) publish-subscribe fabric.

18. The method of claim 17, further comprising:

identifying a policy update driver;

configuring a policy update; and

publishing the policy update as a DXL message via the DXL ESB.

19. The method of claim 18, wherein the DXL message is a command-level message.

20. The method of claim 18, wherein the DXL message is targeted to DXL endpoints.

21. The method of claim 18, wherein identifying a policy update driver comprises receiving a malware threat message from a threat intelligence service.

22. The method of claim 18, wherein identifying a policy update driver comprises proactively identifying a policy update need.

23. The method of claim 18, wherein identifying a policy update driver comprises receiving a policy update from an administrator.

24. The method of claim 18, wherein configuring a policy update comprises directing DXL endpoints to take an action selected from the group consisting of quarantine, block, delete, sandbox, deny permissions, remedy, prompt, or custom action.