Method and apparatus for enterprise management

• US 20040015579A1
• Filed: 06/02/2003
• Published: 01/22/2004
• Est. Priority Date: 06/14/2001
• Status: Abandoned Application

• Current Assignee: Securify, Inc. (McAfee, LLC)
• Original Assignee: Securify, Inc. (McAfee, LLC)
• Inventors: Sherlock, Kieran G., Cooper, Geoffrey, Richardson, Harry, Valente, Luis
• Application Number:
  US10/453,817
• Publication Number:
  US 20040015579A1
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/32 by discarding or delaying data units, e.g. packets or frames
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A method and apparatus for a network monitor internals mechanism, which serves to translate packet data into multiple concurrent streams of encoded network event data, to contribute to enterprise management, reporting, and global mechanisms for aggregating monitors at a centralized aggregation point, and to facilitate rate limiting techniques because such monitors are not in control (i.e. cannot back pressure flow) is provided.

Claims

1. An apparatus for aggregating Monitors at a centralized aggregation point, said apparatus comprising:

at least one monitor device, each running a policy; and

an Enterprise Manager system for providing a consolidation point for said at least one monitor device, for providing an operational view of said at least one monitor device, and for providing centralized management of said at least one monitor device.

2. The apparatus of claim 1, wherein said at least one monitor is organized by policy domain, wherein a policy domain represents a collection of all monitors running a same policy.

3. The apparatus of claim 1, further comprising a studio system coupled to said Enterprise Manager system, said studio system querying online conformance data for analysis of policy violations.

4. The apparatus of claim 1, further comprising an Enterprise Reporting system coupled to said Enterprise Manager, said Enterprise Reporting system providing management reports and long term trend reporting.

5. The apparatus of claim 1, wherein a monitor device of said at least one monitor device provides any of the following:

means for 24×

7 monitoring of network traffic against policy;

a web-based operational view of conformance of monitored traffic;

a web-based console for systems management of monitoring application;

an interface to which a studio system can connect for querying online conformance data across multiple monitors;

means for generating alerts for CRITICAL violations of policy; and

means for generating alerts for status changes of monitor components.

6. The apparatus of claim 1, wherein said Enterprise Manager system provides any of the following:

a consolidated web-based operational view of conformance of traffic monitored by said at least one monitor device;

means for consolidated web-based trend reporting over data collected by said more than one monitor device;

a web-based console for systems management;

an interface to which a studio system can connect for querying online conformance data across multiple monitors. means for displaying CRITICAL violations of policy; and

means for generating alerts for status changes of monitor components.

7. The apparatus of claim 3, wherein said studio system provides an analysis environment allowing interrogation of said output.

8. The apparatus of claim 7, wherein said output may be located on any of:

said Enterprise Manager; and

said at least one monitor device.

9. The apparatus of claim 1, wherein either of or both of said at least one monitor device and said Enterprise Manager system comprise a web server platform for facilitating web server access.

10. The apparatus of claim 9, said web server platform comprising any of the following:

a reporting module;

a console module;

means for providing an operational view;

remote query support; and

a data transport access module for accessing traffic summaries.

11. The apparatus of claim 1, further comprising a plurality of Enterprise Manager systems.

12. The apparatus of claim 11, wherein said plurality of Enterprise Manager systems are organized into at least a first tier and a second tier, whereby a second tier Enterprise Manager system farms out requests to first tier Enterprise Managers, said second tier Enterprise Manager system using same protocols to interact with said first tier Enterprise Managers as said first tier Enterprise Managers use to communicate with monitors devices, and wherein further tiers are identical to said second tier.

13. The apparatus of claim 12, further comprising application logic on said second tier Enterprise Manager system for generating queries to said first tier Enterprise Managers and for rendering results of said queries.

14. The apparatus of claim 12, wherein each Enterprise Manager system comprises a user database, said apparatus further comprising any of the following functionality:

means for user accounts existing on any of said user database;

means for said user database containing an authentication database and an authorization database;

means for first tier Enterprise Managers providing operational views and management consoles;

means for second tier Enterprise Managers providing operational views only;

means for first tier Enterprise Managers having a list of trusted second tier Enterprise Managers;

means for second tier Enterprise Managers having a list of first tier Enterprise Managers of which to make requests;

means for authorizing first tier Enterprise Managers users for a role in a set of policy domains; and

means for authorizing second tier Enterprise Managers users for an operational view role in a set of first tier Enterprise Managers.

15. The apparatus of claim 14, wherein a first tier Enterprise Manager system and a second tier Enterprise Manager system share a user database.

16. The apparatus of claim 1, wherein said at least one monitor device comprises a platform and said Enterprise Manager system comprises a platform, wherein said at least one monitor device and said Enterprise Manager system each comprise a same set of core abstract classes, and wherein each of said set of core abstract classes is implemented by conforming to said monitor device platform and said Enterprise Manager system platform, respectively.

17. The apparatus of claim 16, wherein said Enterprise Manager system invokes operations on said at least one monitor device by accessing URLs, and wherein said Enterprise Manager system has capability to invoke operations on a plurality of monitor devices simultaneously.

18. The apparatus of claim 16, wherein said Enterprise Manager system invokes operations on said at least one monitor device by accessing a Command Manager communications module resident on said at least one monitor device, and wherein said Enterprise Manager system has capability to invoke operations on a plurality of monitor devices simultaneously.

19. The apparatus of claim 16, wherein said at least one monitor device has a Monitor Console, and wherein said core abstract classes facilitates any of the following interactions:

Enterprise Management Console to said Monitor Console,

Enterprise Management Command Manager to said Monitor Console;

said Monitor Console to a User Manager;

said Monitor Console to a Configuration Manager; and

said Monitor Console to a Status Manager.

20. The apparatus of claim 16, wherein said Enterprise Manager system has an Enterprise Manager Console, and wherein said core abstract classes facilitates any of the following interactions:

said Enterprise Management Console with a Configuration Manager,

said Enterprise Management Console with a Status Manager;

said Enterprise Management Console with a User Manager;

said Enterprise Management Console with a Monitor Console; and

said Enterprise Management Console with a Regional Management Console.

21. The apparatus of claim 2, further comprising a user interface providing a same look and feel for said at least one monitor device and said Enterprise Manager system, said user interface comprising:

a first level summary Web page in an event summary showing a table with each of a Policy Domain'"'"'s Reporting Elements and a count for each severity of each of said Reporting Elements;

a second level summary Web page showing an expansion of information for each of said Reporting Elements selected in said first level summary Web page, wherein each line has at least one Reporting Element; and

a third level summary Web page showing event detail summary for each row clicked on said second level summary Web page;

wherein a Reporting Element is a network object used for summarizing network activity.

22. The apparatus of claim 21, wherein said first level summary Web page further comprises views showing counts by outcome and counts by criticality.

23. The apparatus of claim 21, wherein said third level summary Web page allows selecting rows for performing a remote query on a coupled Monitor system.

24. The apparatus of claim 1, further comprising means for communicating using one or more Command Manager modules, each of said one or more Command Manager modules performing distributed command functions in a hierarchical collection of machines by automatically forwarding commands to particular machines needing to run said commands, said each of said one or more Command Manager modules Command Manager comprising:

a naming convention for addressing machines or collections of machines, based on Domain, Tier, and MachineID, wherein each field is optionally a wildcard; and

a set of commands for executing on said machines.

25. The apparatus of claim 24, wherein said naming convention uses a randomly-chosen large number to assign machine identity.

26. The apparatus of claim 24, further comprising means for using User Configuration Data for assigning a set of acceptable roles to a corresponding command request of a command.

27. The apparatus of claim 26, wherein said User Configuration Data is any of:

shared between all machines in a command framework; and

is separate for each machine in said command framework.

28. The apparatus of claim 26, wherein said assigned set of acceptable roles to said corresponding command request is used for limiting authorization to run said command.

29. The apparatus of claim 28, wherein said authorization to run said command is determined by intersecting sets of roles, wherein:

said user configuration data serves as the origination of one set of roles;

each machine that processes a forwarded command provides a set of roles associated with the previous machine;

each machine that is an intended target to execute a command provides a set of roles associated with that command;

any of the above sets of roles might be the set of all possible roles, indicating that any and all roles are accepted.

30. The apparatus of claim 24, wherein said set of commands is fixed at runtime for auditing purposes.

31. A method for aggregating Monitors at a centralized aggregation point, said method comprising the steps of:

providing at least one monitor device, each running a policy; and

providing an Enterprise Manager system for providing a consolidation point for said at least one monitor device, for providing an operational view of said at least one monitor device, and for providing centralized management of said at least one monitor device.

32. The method of claim 31, wherein said at least one monitor is organized by policy domain, wherein a policy domain represents a collection of all monitors running a same policy.

33. The method of claim 31, further comprising the step of providing a studio system coupled to said Enterprise Manager system, said studio system querying online conformance data for analysis of policy violations.

34. The method of claim 31, further comprising the step of providing an Enterprise Reporting system coupled to said Enterprise Manager, said Enterprise Reporting system providing management reports and long term trend reporting.

35. The method of claim 31, wherein a monitor device of said at least one monitor device provides any of the following:

means for 24×

7 monitoring of network traffic against policy;

a web-based operational view of conformance of monitored traffic;

a web-based console for systems management of monitoring application;

an interface to which a studio system can connect for querying online conformance data across multiple monitors;

means for generating alerts for CRITICAL violations of policy; and

means for generating alerts for status changes of monitor components.

36. The method of claim 31, wherein said Enterprise Manager system provides any of the following:

a consolidated web-based operational view of conformance of traffic monitored by said at least one monitor device;

means for consolidated web-based trend reporting over data collected by said more than one monitor device;

a web-based console for systems management;

an interface to which a studio system can connect for querying online conformance data across multiple monitors.

means for displaying CRITICAL violations of policy; and

means for generating alerts for status changes of monitor components.

37. The method of claim 33, wherein said studio system provides an analysis environment allowing interrogation of said output.

38. The method of claim 37, wherein said output may be located on any of:

said Enterprise Manager; and

said at least one monitor device.

39. The method of claim 31, wherein either of or both of said at least one monitor device and said Enterprise Manager system comprise a web server platform for facilitating web server access.

40. The method of claim 39, wherein said web server platform comprises any of the following:

a reporting module;

a console module;

means for providing an operational view;

remote query support; and

a data transport access module for accessing traffic summaries.

41. The method of claim 31, further comprising the step of providing a plurality of Enterprise Manager systems.

42. The method of claim 41, wherein said plurality of Enterprise Manager systems are organized into at least a first tier and a second tier, whereby a second tier Enterprise Manager system farms out requests to first tier Enterprise Managers, said second tier Enterprise Manager system using same protocols to interact with said first tier Enterprise Managers as said first tier Enterprise Managers use to communicate with monitors devices, and wherein further tiers are identical to said second tier.

43. The method of claim 42, further comprising the step of providing application logic on said second tier Enterprise Manager system for generating queries to said first tier Enterprise Managers and for rendering results of said queries.

44. The method of claim 42, wherein each Enterprise Manager system comprises a user database, said method further comprising any of the following functionality:

user accounts existing on any of said user database;

said user database containing an authentication database and an authorization database;

first tier Enterprise Managers providing operational views and management consoles;

second tier Enterprise Managers providing operational views only;

first tier Enterprise Managers having a list of trusted second tier Enterprise Managers;

second tier Enterprise Managers having a list of first tier Enterprise Managers of which to make requests;

authorizing first tier Enterprise Managers users for a role in a set of policy domains; and

authorizing second tier Enterprise Managers users for an operational view role in a set of first tier Enterprise Managers.

45. The method of claim 44, wherein a first tier Enterprise Manager system and a second tier Enterprise Manager system share a user database.

46. The method of claim 31, wherein said at least one monitor device comprises a platform and said Enterprise Manager system comprises a platform, wherein said at least one monitor device and said Enterprise Manager system each comprise a same set of core abstract classes, and wherein each of said set of core abstract classes is implemented by conforming to said monitor device platform and said Enterprise Manager system platform, respectively.

47. The method of claim 46, wherein said Enterprise Manager system invokes operations on said at least one monitor device by accessing URLS, and wherein said Enterprise Manager system has capability to invoke operations on a plurality of monitor devices simultaneously.

48. The method of claim 47, wherein said Enterprise Manager system invokes operations on said at least one monitor device by accessing a Command Manager communications module resident on said at least one monitor device, and wherein said Enterprise Manager system has capability to invoke operations on a plurality of monitor devices simultaneously.

49. The method of claim 46, wherein said at least one monitor device has a Monitor Console, and wherein said core abstract classes facilitates any of the following interactions:

Enterprise Management Console to said Monitor Console,

Enterprise Management Command Manager to said Monitor Console;

said Monitor Console to a User Manager;

said Monitor Console to a Configuration Manager; and

said Monitor Console to a Status Manager.

50. The method of claim 46, wherein said Enterprise Manager system has an Enterprise Manager Console, and wherein said core abstract classes facilitates any of the following interactions:

said Enterprise Management Console with a Configuration Manager, said Enterprise Management Console with a Status Manager;

said Enterprise Management Console with a User Manager;

said Enterprise Management Console with a Monitor Console; and

said Enterprise Management Console with a Regional Management Console.

51. The method of claim 32, further comprising the step of providing a user interface providing a same look and feel for said at least one monitor device and said Enterprise Manager system, said user interface comprising:

a first level summary Web page in an event summary showing a table with each of a Policy Domain'"'"'s Reporting Elements and a count for each severity of each of said Reporting Elements;

a second level summary Web page showing an expansion of information for each of said Reporting Elements selected in said first level summary Web page,

wherein each line has at least one Reporting Element; and

a third level summary Web page showing event detail summary for each row clicked on said second level summary Web page;

wherein a Reporting Element is a network object used for summarizing network activity.

52. The method of claim 51, wherein said first level summary Web page provides views showing counts by outcome and counts by criticality.

53. The method of claim 51, wherein said third level summary Web page allows selecting rows for performing a remote query on a coupled Monitor system.

54. The method of claim 31, further comprising the step of communicating using one or more Command Manager modules, each of said one or more Command Manager modules performing distributed command functions in a hierarchical collection of machines by automatically forwarding commands to particular machines needing to run said commands, said each of said one or more Command Manager modules Command Manager comprising:

a naming convention for addressing machines or collections of machines, based on Domain, Tier, and MachineID, wherein each field is optionally a wildcard; and

a set of commands for executing on said machines.

55. The method of claim 54, wherein said naming convention uses a randomly-chosen large number to assign machine identity.

56. The method of claim 54, further comprising the step of using User Configuration Data for assigning a set of acceptable roles to a corresponding command request of a command.

57. The method of claim 56, wherein said User Configuration Data is any of:

shared between all machines in a command framework; and

is separate for each machine in said command framework.

58. The method of claim 56, wherein said assigned set of acceptable roles to said corresponding command request is used for limiting authorization to run said command.

59. The method of claim 58, wherein said authorization to run said command is determined by intersecting sets of roles, wherein:

said user configuration data serves as the origination of one set of roles;

each machine that processes a forwarded command provides a set of roles associated with the previous machine;

each machine that is an intended target to execute a command provides a set of roles associated with that command;

any of the above sets of roles might be the set of all possible roles, indicating that any and all roles are accepted.

60. The method of claim 54, wherein said set of commands is fixed at runtime for auditing purposes.