Centrally managing data for orchestrating and managing user accounts and access control and security policies remotely across multiple devices

• US 10,326,802 B1
• Filed: 12/04/2018
• Issued: 06/18/2019
• Est. Priority Date: 12/04/2018
• Status: Active Grant

• Current Assignee: Xage Security, Inc.
• Original Assignee: Xage Security, Inc.
• Inventors: Irwan, Susanto Junaidi, Arutyunov, Roman M., Sugiarto, Andy, Jampani, Ganesh B., Ngo, Bao Q.
• Primary Examiner(s): Williams, Jeffery L
• Application Number:
  US16/209,547
• Time in Patent Office: 196 Days
• Field of Search: None
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 65/65 Network streaming protocols, e.g. real-time transport protocol [RTP] or real-time control protocol [RTCP]
• CPC Class Codes: H04L 67/025 for remote control or remote monitoring of applications
• CPC Class Codes: H04L 67/562 Brokering proxy services
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/12 Transmitting and receiving encryption devices synchronised or initially set up in a particular manner
• CPC Class Codes: H04L 9/3239 involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

In an embodiment, a computer-implemented method comprises receiving, at multiple broker computing devices, device control data from a plurality of directory services in a federation; posting, by the broker computing devices, the device control data to a distributed datastore including distributed ledger and blockchain; receiving, at a computing hardware device, the device control data from the distributed datastore; in response to receiving the device control data from the distributed datastore, remotely managing, by the computing hardware device, user accounts and access control and security policies on at least one networked device.

Claims

1. A computer-implemented method comprising:

receiving, at multiple broker computing devices, device control data from a plurality of directory services in a federation;

posting, by the broker computing devices, the device control data to a distributed datastore including distributed ledger and blockchain;

receiving, at a computing hardware device, the device control data from the distributed datastore;

in response to receiving the device control data from the distributed datastore, remotely managing, by the computing hardware device, user accounts and access control and security policies on at least one networked device.

2. The method of claim 1, further comprising, after remotely managing user accounts and access control and security policies on at least one networked device:

enforcing, by the at least one networked device, user accesses to the at least one networked device according to the user accounts and access control and security policies.

3. The method of claim 1, wherein remotely managing comprises transmitting the device control data to the at least one networked device.

4. The method of claim 3, wherein transmitting the device control data comprises using HTTP, Real Time Streaming Protocol (RTSP) over HTTP, Secure Socket Shell (SSH), Telnet, or Windows Remote Management (WinRM).

5. The method of claim 1, wherein the at least one networked device includes at least two networked devices, and further comprising:

managing the at least two networked devices such that the at least two networked devices are synchronized.

6. The method of claim 1, wherein the computing hardware device is configured with gateway functionalities.

7. The method of claim 1, wherein the device control data includes user accounts and access control and security policies.

8. One or more non-transitory computer-readable storage media storing one or more sequences of program instructions which, when executed by one or more computing devices, cause:

receiving, at multiple broker computing devices, device control data from a plurality of directory services in a federation;

posting, by the broker computing devices, the device control data to a distributed datastore including distributed ledger and blockchain;

receiving, at a computing hardware device, the device control data from the distributed datastore;

in response to receiving the device control data from the distributed datastore, remotely managing, by the computing hardware device, user accounts and access control and security policies on at least one networked device.

9. The one or more non-transitory machine-readable media of claim 8, further comprising instructions that, when executed by one or more computing devices, cause:

after remotely managing user accounts and access control and security policies on at least one networked device, enforcing, by the at least one networked device, user accesses to the at least one networked device according to the user accounts and access control and security policies.

10. The one or more non-transitory machine-readable media of claim 8, wherein remotely managing comprises transmitting the device control data to the at least one networked device.

11. The one or more non-transitory machine-readable media of claim 10, wherein transmitting the device control data comprises using HTTP, Real Time Streaming Protocol (RTSP) over HTTP, Secure Socket Shell (SSH), Telnet, or Windows Remote Management (WinRM).

12. The one or more non-transitory machine-readable media of claim 8, wherein the at least one networked device includes at least two networked devices, and further comprising instructions that, when executed by one or more computing devices, cause performing:

managing the at least two networked devices such that the at least two networked devices are synchronized.

13. The one or more non-transitory machine-readable media of claim 8, wherein the computing hardware device is configured with gateway functionalities.

14. The one or more non-transitory machine-readable media of claim 8, wherein the device control data includes user accounts and access control and security policies.

15. A computer system comprising:

a distributed datastore including distributed ledger and blockchain data repository;

a plurality of broker computing devices communicatively coupled with the distributed datastore including distributed ledger and blockchain data repository and a plurality of directory services in a federation, wherein each of the plurality of broker computing devices comprises a first non-transitory data storage medium storing a first set of instructions which, when executed by a respective broker computing device, cause;

receiving device control data from one of the plurality of directory services, wherein the plurality of broker computing devices posts all received device control data to the distributed datastore including distributed ledger and blockchain data repository;

a computing hardware device communicatively coupled with the distributed datastore including distributed ledger and blockchain data repository, wherein the computing hardware device comprises a second non-transitory data storage medium storing a second set of instructions which, when executed by the computing hardware device, cause;

receiving the posted device control data from the distributed datastore including distributed ledger and blockchain data repository;

in response to receiving the posted device control data from the distributed datastore including distributed ledger and blockchain data repository, remotely managing user accounts and access control and security policies on at least one networked device.

16. The computer system of claim 15, wherein remotely managing comprises transmitting the device control data to the at least one networked device.

17. The computer system of claim 16, wherein transmitting the device control data comprises using HTTP, Real Time Streaming Protocol (RTSP) over HTTP, Secure Socket Shell (SSH), Telnet, or Windows Remote Management (WinRM).

18. The computer system of claim 15, wherein the computing hardware device is configured with gateway functionalities.

19. The computer system of claim 15, wherein the device control data includes user accounts and access control and security policies.

20. The computer system of claim 16, further comprising a plurality of networked devices, wherein the plurality of networked devices is synchronized with the posted device control data in the distributed datastore including distributed ledger and blockchain data repository.