Apparatus and method to automatically collect data regarding assets of a business entity

• US 20030200304A1
• Filed: 04/18/2002
• Published: 10/23/2003
• Est. Priority Date: 04/18/2002
• Status: Active Grant

• Current Assignee: BDNA Corporation (Flexera Software LLC)
• Original Assignee: BDNA Corporation (Flexera Software LLC)
• Inventors: Black, Alistair D?apos;Lougar, Delivanis, Constantin Stelio, Thorpe, John Robert, Marker, Charles Larry II
• Granted Patent: US 7,089,306 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06Q 10/10 Office automation; Time management

Abstract

A system to automatically gather attribute data about elements such as networks, network interface cards, operating systems, device types, installed software, processes in execution, financial data, etc. in an organization or a designated subset of the organization. Fingerprint files are used, each fingerprint file corresponding to an element of a specific type and each containing a list of attributes that will be found if that element exists in the system. Each fingerprint contains or points to one or more collection instructions which control a data collector process to attempt to gather attribute data. Each fingerprint contains or points to rules that are used to analyze the attribute data gathered to calculate the probability that the element exists. The rules can be fired sequentially, in if-then-else fashion or can be incorporated in a script in loops and with mathematical manipulations, tests and branching for more sophisticated analysis. Fingerprints can be turned on and off by configuration data and can be used in a logical order to do discovery without any prior knowledge of the systems being analyzed. A refresh schedule and collection calendar control how often the fingerprints are used in some embodiments, and collected data is stored with time stamps to enable analysis of changes in the data over time.

Claims

1. A method for using a fingerprint to collect attribute data and recognize an asset, comprising the steps of:

1) opening a fingerprint file and reading the element ID code there from;

2) finding all attributes having ID codes that map to said element ID;

3) for an attribute of the element identified in step 1, determining the collection instruction associated with said attribute, and looking up the protocol to use in executing said collection instruction;

4) using the protocol designated for each collection instruction, executing the collection instruction and collecting attribute data about the element;

5) repeating steps 3 and 4 for each other attribute of the element identified in step 1 to collect all the attribute data regarding said element;

6) executing one or more rules included in said fingerprint or pointed to by said fingerprint to calculate the probability that the element identified in step 1 exists.

2. The process of claim 1 further comprising the steps of picking another fingerprint designated in configuration data and repeating steps 1 through 6 for that fingerprint, and repeating the process of steps 1 through 6 for all fingerprints designated in configuration data to be used to collect and analyze data, and making an entry in the element and data tables for each element for which a fingerprint was used to collect and analyze data.

3. The process of claim 1 further comprising the steps of picking another fingerprint designated in configuration data and repeating steps 1 through 6 for that fingerprint, and repeating the process of steps 1 through 6 for all fingerprints designated in configuration data to be used to collect and analyze data, and making an entry in a data table for each element for which attribute data was collected along with a timestamp indicating when said attribute data was collected or at least the sequence in which the attribute data for each element was collected relative to the time when attribute data for another element was collected.

4. The process of claim 1 further comprising the steps of picking another fingerprint designated in configuration data and repeating steps 1 through 6 for that fingerprint, and repeating the process of steps 1 through 6 for all fingerprints designated in configuration data to be used to collect and analyze data, and making an entry in the element and data tables for each element for which attribute data was collected along with a timestamp indicating when said attribute data was collected or at least the sequence in which the attribute data for each element was collected relative to the time when attribute data for another element was collected, and repeating the steps recited in parent claim 1 and herein at a repetition rate specified in a refresh schedule table.

5. The process of claim 1 wherein step 1 comprises picking a fingerprint for a network and then executing steps 1 through 6 and making an entry in a data table for a network of the type identified in said fingerprint including the network attributes, and thereafter further comprising the steps of picking other fingerprints in a predetermined logical order set by configuration data and executing steps 1 through 6 for each said fingerprint and making an entry in said data table for each said element corresponding to a fingerprint.

6. The process of claim 1 wherein if said fingerprint has more than one rule, step 6 comprises executing all said rules in sequence, and further comprising the steps of, after completion of step 6, picking another fingerprint designated in configuration data defining which fingerprints to use and which to not use and determining from data in a refresh table and a collection calendar if a scheduled collection interval for collection of attribute data about the element corresponding to the fingerprint has elapsed and if the calendar indicates the collection should take place at the current time, and repeating steps 1 through 6 for that fingerprint if the refresh schedule and collection calendar data indicates it is time to collect attribute data about that element again, and repeating the process of steps 1 through 6 and as defined in this dependent claim for all fingerprints designated in configuration data to be used to collect and analyze data, and making an entry in the element and data tables for each element for which attribute data was collected along with a timestamp indicating when said attribute data for each element was collected or at least the sequence in which the attribute data for said element was collected relative to the time when attribute data for other elements or attribute data for the same element was previously collected.

7. A method for using a fingerprint to collect attribute data and recognize an asset, comprising the steps of:

1) opening a fingerprint file and reading the element ID code there from;

2) finding all attributes having ID codes that map to said element ID;

3) for an attribute of the element identified in step 1, determining the collection instruction associated with said attribute, and looking up the protocol to use in executing said collection instruction;

4) using the protocol designated for each collection instruction, executing the collection instruction and collecting attribute data about the element;

5) repeating steps 3 and 4 for each other attribute of the element identified in step 1 to collect all the attribute data regarding said element;

6) finding and reading one or more rules included in the fingerprint file opened in step 1 or pointed to by said fingerprint, and, if the fingerprint selected in step 1 has more than one rule, executing said rules in an if-then-else sequence with the path of execution of said rules determined by branching on tests and results of application of previous rules to calculate the probability that the element identified in step 1 exists; and

7) making an entry in a data table recording the element and its attribute data.

8. The process of claim 7 further comprising the steps of picking another fingerprint and repeating steps 1 through 7 for that fingerprint, but performing step 7 by making an entry in said data table for only elements that are found to have a high probability of existence, said entry including the attribute data of the found element.

9. The process of claim 7 wherein step 1 comprises picking a fingerprint for a network and then executing steps 1 through 7 to an entry in the element and data tables for a network of the type identified in said fingerprint including the network attributes if a network was found, and, if no network was found, repeating steps 1 through 7 using another network fingerprint, and repeating steps 1 through 7 for all network fingerprints available, and thereafter further comprising the steps of, for each found network, picking other fingerprints in a predetermined logical order set by configuration data and executing steps 1 through 7 for each said fingerprint to find all the elements of interest associated with computers on each network, and performing step 7 in such a way in each iteration through steps 1 through 7 that said element table is structured to shown the relationships between elements such that it is known which elements exist on which computers on which networks.

10. A method for using a fingerprint to collect attribute data and recognize an asset, comprising the steps of:

1) opening a fingerprint file and reading the element ID code there from;

2) finding all attribute having ID codes that map to said element ID;

3) for an attribute of the element identified in step 1, determining the collection instruction associated with said attribute, and looking up the protocol to use in executing said collection instruction;

4) using the protocol designated for each collection instruction, executing the collection instruction and collecting attribute data about the element;

5) repeating steps 3 and 4 for each other attribute of the element identified in step 1 to collect all the attribute data regarding said element;

6) finding and reading a script containing one or more rules and possibly including looping or other iterative program structure, branching and/or mathematical manipulations, said script included in the fingerprint file opened in step 1 or pointed to by said fingerprint, and, executing said script to calculate the probability that the element identified in step 1 exists; and

7) making an entry in an element and data tables recording the element and its attribute data.

11. The process of claim 10 further comprising the steps of picking another fingerprint and repeating steps 1 through 7 for that fingerprint, but performing step 7 by making an entry in said element and data tables for only elements that are found to have a high probability of existence, said entry including the attribute data of the found element.

12. The process of claim 10 wherein step 1 comprises picking a fingerprint for a network and then executing steps 1 through 7 to an entry in an element and data table for a network of the type identified in said fingerprint including the network attributes if a network was found, and, if no network was found, repeating steps 1 through 7 using another network fingerprint, and repeating steps 1 through 7 for all network fingerprints available, and thereafter further comprising the steps of, for each found network, picking other fingerprints in a predetermined logical order set by configuration data and executing steps 1 through 7 for each said fingerprint to find all the elements of interest associated with devices on each network, and performing step 7 in such a way in each iteration through steps 1 through 7 that said data table is structured to shown the relationships between elements such that it is known which elements exist on which devices on which networks.

13. A method for using a fingerprint to collect attribute data and recognize an asset, comprising the steps of:

1) opening a fingerprint file for one of one or more network fingerprints and reading the element ID code therefrom;

2) finding all attribute having ID codes that map to said element ID;

3) for an attribute of the element identified in step 1, determining the collection instruction associated with said attribute, and looking up the protocol to use in executing said collection instruction;

4) using the protocol designated for each collection instruction, executing the collection instruction and collecting attribute data about the element;

5) repeating steps 3 and 4 for each other attribute of the element identified in step 1 to collect all the attribute data regarding said element;

6) executing one or more rules included in said fingerprint or pointed to by said fingerprint to calculate the probability that the element identified in step 1 exists;

7) making an entry in a data table for a network of the type identified in said fingerprint opened in step 1 if such a network was found, said entry including the network attributes, but, if no network was found, repeating steps 1 through 6 using another of said one or more network fingerprints, and repeating steps 1 through 7 for all network fingerprints available;

8) for each found network, picking other fingerprints in a predetermined logical order set by configuration data and executing steps 1 through 6 for each said fingerprint to find all the elements of interest associated with devices on each network, and making an entry in an element and data table for each element for which a fingerprint was executed including the attributes of said element and performing this step 8 in such a way in each iteration through steps 1 through 7 that said data table is structured to shown the relationships between elements such that it is known which elements exist on which devices on which networks.

14. An article of manufacture comprising:

a computer useable medium having computer readable program code embodied therein for automatically using fingerprint files to control the automated collection of attribute data about elements of an organization and analyze said attribute data to determine the probability of existence or nonexistence of various elements, the computer readable program code comprising;

1) a computer readable program code segment for controlling a computer to open a fingerprint file and reading the element ID code therefrom;

2) a computer readable program code segment for controlling a computer to find all attributes having ID codes that map to said element ID;

3) a computer readable program code segment for controlling a computer to, for an attribute of the element identified by code segment 1, determine the collection instruction associated with said attribute, and look up the protocol to use in executing said collection instruction;

4) a computer readable program code segment for controlling a computer to use the protocol designated for each collection instruction, and execute the collection instruction and collect attribute data about the element;

5) a computer readable program code segment for controlling a computer to repeat the processing of code segments 3 and 4 for each other attribute of the element identified by code segment 1 to collect all the attribute data regarding said element;

6) a computer readable program code segment for controlling a computer to execute one or more rules included in said fingerprint or pointed to by said fingerprint to calculate the probability that the element identified in step 1 exists and to make an instance entry in an element and data table for each found element.

15. The article of manufacture of claim 14 further comprising a code segment that controls a computer to check configuration data to determine if a fingerprint is active before using the fingerprint.

16. The article of manufacture of claim 14 further comprising a code segment that controls a computer to check a refresh schedule and collection calendar and use said fingerprints to gather and analyze attribute data at the frequency specified in said refresh schedule and collection calendar for each said fingerprint.

17. The article of manufacture of claim 15 further comprising a code segment that controls a computer to check a refresh schedule and collection calendar and use said fingerprints that said configuration data indicates are active to gather and analyze attribute data at the frequency specified in said refresh schedule and collection calendar for each said fingerprint.

18. An article of manufacture comprising:

a computer useable medium having computer readable program code embodied therein for automatically using fingerprint files to control the automated collection of attribute data about elements of an organization and analyze said attribute data to determine the probability of existence or nonexistence of various elements, the computer readable program code comprising;

1) a code segment to control a computer to select and open a fingerprint file and read the element ID code therefrom;

2) a code segment to control a computer to find all attribute having ID codes that map to said element ID;

3) a code segment to control a computer to, for an attribute of the element identified by code segment 1, determine the collection instruction associated with said attribute, and look up the protocol to use in executing said collection instruction;

4) a code segment to control a computer to use the protocol designated for each collection instruction, and execute the collection instruction and collecting attribute data about the element;

5) a code segment to control a computer to repeat the procesing of code segments 3 and 4 for each other attribute of the element identified by code segment 1 to collect all the attribute data regarding said element;

6) a code segment to control a computer to find and read a script containing one or more rules and possibly including looping or other iterative program structure, branching and/or mathematical manipulations, said script included in the fingerprint file selected and opened by code segment 1 or pointed to by said fingerprint, and, execute said script to calculate the probability that the element identified by code segment 1 exists; and

7) a code segment to control a computer to make an entry in a data table recording the element and its attribute data.

19. An article of manufacture comprising:

a computer useable medium having computer readable program code embodied therein for automatically using fingerprint files to control the automated collection of attribute data about elements of an organization and analyze said attribute data to determine the probability of existence or nonexistence of various elements, the computer readable program code comprising;

1) a computer useable code segment to control a computer to open a fingerprint file and read the element ID code therefrom;

2) a computer useable code segment to control a computer to find all attribute having ID codes that map to said element ID;

3) a computer useable code segment to control a computer to, for an attribute of the element identified in step 1, determine the collection instruction associated with said attribute, and look up the protocol to use in executing said collection instruction;

4) a computer useable code segment to control a computer to use the protocol designated for each collection instruction, execute the collection instruction and collect attribute data about the element;

5) a computer useable code segment to control a computer to repeat the processing of code segments 3 and 4 for each other attribute of the element identified by code segment 1 to collect all the attribute data regarding said element;

6) a computer useable code segment to control a computer to find and read one or more rules included in the fingerprint file opened by code segment 1 or pointed to by said fingerprint, and, if the fingerprint selected by code segment 1 has more than one rule, controlling said computer to execute said rules in an if-then-else sequence with the path of execution of said rules determined by branching on tests and results of application of previous rules to calculate the probability that the element identified by code segment 1 exists; and

7) a computer useable code segment to control a computer to make an entry in an element and data table recording the element and its attribute data.

20.