Automated change approval

• US 10,721,129 B2
• Filed: 05/31/2017
• Issued: 07/21/2020
• Est. Priority Date: 03/31/2005
• Status: Active Grant

• Current Assignee: Tripwire Incorporated (Belden Inc.)
• Original Assignee: Tripwire Incorporated (Belden Inc.)
• Inventors: Torrence, Gregor, Thompson, Troy D.
• Primary Examiner(s): Zand, Davoud
• Application Number:
  US15/610,181
• Publication Number:
  US 20170272323A1
• Time in Patent Office: 1,147 Days
• Field of Search: 709201, 709202, 709203, 709221, 707696
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 41/0843 based on generic templates
• CPC Class Codes: H04L 41/0866 Checking the configuration

Abstract

An automated method for facilitating management of a data processing environment is disclosed. In various embodiments, the method may include facilitating creation of a first memorialization, in digital form, of first one or more changes made to a first data processing device of the data processing environment. In various embodiments, the method may further include facilitating creation of a second and a third memorialization, both in digital form, of second and third one or more changes made to a second and a third data processing device of the data processing environment, respectively. In various embodiments, the method may still further include facilitating automated approval of the second and third changes made to the second and third data processing devices, using the first, second and third memorializations. Other embodiments of the present invention may include, but are not limited to, apparatus adapted to facilitate practice of the above-described method.

Claims

1. A system for facilitating management of a data processing environment, the system comprising:

one or more computers configured to;

generate a template of trusted changes, wherein the trusted changes are changes that were directed to and verified to have been made at a first data processing device of the data processing environment, wherein the first data processing device is a server or a network router, and wherein the changes made to the first data processing device are represented in the template at least in part by hashes of first data processing device data objects and by object names of the first data processing device data objects;

create a record of second data processing device data objects detected at a second data processing device, wherein the second data processing device was directed to have the same changes made as the first data processing device of the data processing environment, wherein the second data processing device is a server or a network router, and wherein the second data processing device data objects are represented in the record at least in part by hashes of second data processing device data objects and by object names of the second data processing device data objects;

compare data from the record of second data processing device data objects to data in the template of trusted changes according to a matching criterion comprising one of;

(a) whether an object name and hash in the template match an object name and hash in the record;

(b) whether a hash in the template matches a hash in the record;

or (c) whether an object name in the template matches an object name in the record; and

display a report that identifies one or more second data processing device data objects that satisfy the matching criterion and one or more second data processing device data object that do not satisfy the matching criterion.

2. The system of claim 1, wherein the one or more computers are further configured to provide a remediation response for the one or more of the second data processing device data objects that do not satisfy the matching criterion.

3. The system of claim 1, wherein the trusted changes are detected by comparing one or more pre-change hashes of the first data processing device data objects with corresponding one or more post-change hashes of the first data processing device data objects.

4. The system of claim 1, wherein the first data processing device is a test server and the second data processing device is a production server.

5. The system of claim 1, wherein the displaying comprises displaying a total number of the second data processing device data objects that meet the matching criterion.

6. The system of claim 1, wherein the displaying comprises displaying a total number of the second data processing device data objects that do not meet the matching criterion.

7. The system of claim 1, wherein the matching criterion applied is user selectable.

8. A computer-implemented method for facilitating management of servers in a data processing environment comprising:

creating a first record of changes that were made to a first server of the data processing environment, wherein the changes made to the first server are represented in the first record at least in part by hashes of first server data objects and by object names of the first server data objects;

receiving an indication from a user that the first record of changes is to be used as a template of trusted changes;

creating a second record of second server data objects stored at a second server, wherein the second server was directed to have the same changes as the first server, wherein the second server data objects are represented in the second record at least in part by hashes of the second server data objects and by object names of the second server data objects;

comparing data from the second record of second server data objects to data in the template of trusted changes according to a matching criterion comprising one of;

(a) whether an object name and hash in the template match an object name and hash in the second record of second server data objects;

(b) whether a hash in the template matches a hash in the second record of second server data objects;

or (c) whether an object name in the template matches an object name in the second record of second server data objects; and

displaying a report that identifies one or more second data processing device data objects that do not satisfy the matching criterion.

9. The method of claim 8, further comprising providing a remediation response for the one or more of the second server data objects that do not satisfy the matching criterion.

10. The method of claim 8, wherein the creating the first record of changes that were made to the first server comprises comparing pre-change hashes of the first server data objects with post-change hashes of the first server data objects.

11. The method of claim 8, wherein the displaying further comprises displaying a total number of the second server data objects that meet the matching criterion.

12. The method of claim 8, wherein the displaying further comprises displaying a total number of the second server data objects that do not meet the matching criterion.

13. The method of claim 8, wherein the report also identifies one or more second data processing device data objects that satisfy the matching criterion.

14. A computer-implemented method for facilitating management of servers in a data processing environment comprising:

receiving hashes of data objects stored at a first server in the data processing environment, the data objects including changed first server data objects that were directed to be changed;

creating a template of approved changes comprising the hashes of the data objects stored at the first server;

receiving hashes of data objects stored at a second server in the data processing environment, the data objects including second server data objects that were intended to be changed in a same manner as the changed first server data objects;

evaluating whether the hashes of the template of approved changes match the hashes of data objects stored at the second server; and

displaying a report that identifies data objects at the second server having hashes that match hashes of the first server and identifies data objects at the second server having hashes that do not match hashes of the first server.

15. The method of claim 14, further comprising providing a remediation response configured to remediate the second data processing device through a change to the second data processing device.

16. The method of claim 14, wherein the first data processing device is a test server and the second data processing device is a production server.

17. The method of claim 14, wherein the displaying comprises displaying a total number of the hashes from the first server that match hashes from the second server.

18. The method of claim 14, wherein the displaying comprises displaying a total number of the hashes from the first server that do not match hashes from second server.

19. The method of claim 14, wherein the hashes are generated by an MD5, SHA, or HAVL hashing technique.

20. The method of claim 14, further comprising:

receiving data object names for the data objects stored at the first server;

receiving data object names for the data objects stored at the second server;

evaluating whether the data object names at the first server match the data object names at the second server; and

displaying a report that identifies second server data objects having data object names that match the data object names at the first server and second server data objects having data object names that do not match the data object names at the first server.