Software updating system and method

• US 20040181787A1
• Filed: 03/10/2003
• Published: 09/16/2004
• Est. Priority Date: 03/10/2003
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Sardesai, Shantanu, Deo, Vinay, Khan, Shafqat U., Wickham, Robert T., Welker, Adam D.
• Granted Patent: US 7,555,749 B2
• Time in Patent Office: Days
• US Class Current: 717/168
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57

Abstract

In one embodiment, a server/client system, configured to update client software, generates audit data by analyzing a client'"'"'s file configuration with respect to rules within an update catalog. The audit data is then moved to the server, where updates indicated by the audit data may be approved. The approved updates are then distributed from the server to the client for installation.

Claims

1. A processor-readable medium comprising processor-executable instructions for distributing updates on a system comprising a server and a client, the processor-executable instructions comprising instructions for:

generating audit data by analyzing a client'"'"'s file configuration with respect to rules within an update catalog;

moving the audit data to the server;

approving updates within the audit data; and

distributing the approved updates from the server to the client.

2. A processor-readable medium as recited in claim 1, wherein generating audit data comprises further instructions for:

sending the rules to the client;

querying an operating system running on the client for file version information;

applying the rules to the file version information to produce the audit data; and

saving the audit data into a queryable interface.

3. A processor-readable medium as recited in claim 1, comprising further instructions for:

associating a grace period and an enforcement period with the approved updates;

allowing a user to defer the approved updates during the grace period; and

enforcing installation of the approved updates during the enforcement period.

4. A processor-readable medium as recited in claim 1, comprising further instructions for:

associating the approved updates with rebooting instructions.

5. A processor-readable medium as recited in claim 4, wherein the rebooting instructions comprise further instructions selected from a group of instructions comprising:

rebooting after installation of an exclusive primary update;

rebooting only if indicated after installation of an update; and

suppressing a reboot after installation of an update.

6. A processor-readable medium as recited in claim 1, comprising further instructions for:

installing an approved update on the client from among the approved updates;

obtaining a success code resulting from the installation of the approved update;

mapping the success code for consistency in success code meaning.

7. A processor-readable medium as recited in claim 1, wherein generating audit data comprises further instructions for configuring a data structure, comprising:

a first data field containing data indicating a file within the client'"'"'s file configuration;

a second data field containing data indicating if an update is applicable to the file indicated in the first data field;

a third data field containing data indicating when existence of the update to the file was detected in the update catalog;

a fourth data field containing data indicating when the update to the file was authorized; and

a fifth data field containing data indicating when the update to the file was applied.

8. A processor-readable medium as recited in claim 7, comprising further instructions for:

providing data including time elapsed from the indication that the update is applicable to the indication that the update was applied.

9. A processor-readable medium as recited in claim 1, wherein generating audit data comprises further instructions for:

obtaining specific information about files stored on the client; and

preparing the audit data by using the rules to determine which updates are needed based on the specific information.

10. A processor-readable medium as recited in claim 1, wherein moving the audit data comprises further instructions for:

depositing the audit data in WMI on the client; and

moving the audit data to the server via SMS.

11. A processor-readable medium as recited in claim 1, wherein approving updates comprises further instructions for:

providing a user interface on the server for selection of approved updates;

and

obtaining the approved updates based on selections made within the user interface.

12. A processor-readable medium as recited in claim 1, comprising further instructions for synchronizing the update catalog with an authority to keep the update catalog current.

13. A processor-readable medium as recited in claim 1, comprising further instructions for:

obtaining the rules formulated as an XML document from an update authority;

checking a code to determine if the XML document has been tampered with; and

storing the XML document in an SMS package for transmission to the client.

14. A processor-readable medium as recited in claim 1, comprising further instructions for:

maintaining a scan tool cache on the client to include current audit data to prevent installation of an unneeded update.

15. A processor-readable medium comprising processor-executable instructions for distributing updates on a system comprising a server and a client, the processor-executable instructions comprising instructions for:

locating an update catalog organized as an XML document on the server;

synchronizing the XML document with an authority to keep the XML document current;

generating audit data by analyzing a client'"'"'s file configuration with respect to rules within the update catalog by including instructions for;

sending the rules to the client;

querying an operating system running on the client for file version information; and

applying the rules to the file version information to produce the audit data;

moving the audit data to the server by saving the audit data into a WMI repository on the client and then moving the audit data to the server via SMS;

approving updates within the audit data by providing a user interface for selection of approved updates and obtaining the approved updates from a download center based on selections made within the user interface;

distributing the approved updates from the server to the client via SMS;

maintaining a scan tool cache on the client to include current audit data to prevent installation of an unneeded update; and

installing the approved updates, where indicated by the scan tool cache, on the client upon reaching an enforcement period, wherein the enforcement period follows a grace period during which the approved updates could be rejected by the client.

16. A processor-readable medium as recited in claim 15, wherein generating audit data comprises further instructions for configuring a data structure, comprising:

a first data field containing data indicating a file within the client'"'"'s file configuration;

a second data field containing data indicating if an update is applicable to the file indicated in the first data field;

a third data field containing data indicating when existence of the update to the file was detected in the update catalog;

a fourth data field containing data indicating when the update to the file was authorized; and

a fifth data field containing data indicating when the update to the file was applied.

17. A method by which a server assists a client to install software updates, comprising:

sending an update catalog from the server to the client, wherein the update catalog includes information on available updates, files to which the available updates apply and rules which govern application of the available updates to the files;

utilizing an automated tool to perform an audit of the client according to the rules; and

populating a queryable interface with results of the audit.

18. The method of claim 17, wherein populating the queryable interface comprises:

depositing the audit into WMI on the client in a format consistent with consumption by SMS and transmission to the server.

19. The method of claim 17, additionally comprising:

formulating a vulnerability matrix using the audit; and

providing a user interface on the server to express the vulnerability matrix to assist in a decision to apply software updates.

20. The method of claim 19, wherein formulating the vulnerability matrix comprises:

representing on a first axis known vulnerabilities using updates that are available or known to exist;

representing on a second axis known inventory as discovered by the audit of the client; and

indicating whether the updates have been applied to the known vulnerabilities in the known inventory inventory.

21. The method of claim 17, additionally comprising:

associating a grace period and an enforcement period with approved updates from the update catalog;

allowing a user to defer the approved updates during the grace period; and

enforcing installation of the approved updates during the enforcement period.

22. A system, comprising:

a server, comprising;

a software update approval tool to present an interface to allow selection of approved updates; and

a catalog synchronization module to keep a list of available updates and associated applicability rules current; and

a client, comprising;

a scan procedure to scan the client and to deposit audit results into a queryable interface, wherein the audit results identify files on the client and identify updates associated with the identified files, and wherein the audit results are configured for consumption by the software update approval tool and are based on the list of available updates and associated applicability rules;

a software update installation agent to install the approved updates; and

a scan cache configured to provide the software update installation agent with a confirmation that the approved updates should be installed on the client.

23. The system of claim 22, wherein the software update approval tool is additionally configured to fill a vulnerability matrix wherein the vulnerability matrix comprises:

the files identified in the audit results;

the updates associated with the files identified; and

an indication of whether the updates associated with the files identified have been installed on the files identified.

24. The system of claim 22, wherein the catalog synchronization module is additionally configured to check a code on the list of available updates to protect against using a tampered list.

25. The system of claim 22, wherein the scan procedure is configured to deposit the audit results into WMI on the client and to trigger SMS to replicate the audit results to the server.

26. The system of claim 22, wherein the scan cache configured to receive data from the scan procedure.

27. The system of claim 22, wherein the software update install agent is additionally configured to check for files indicating that the client needs to reboot and to initiate a re-boot if necessary.

28. A system, comprising:

a server, comprising;

means for presenting an interface to allow selection of approved updates; and

means for synchronizing a list of available updates and associated applicability rules with a list maintained by an authority; and

a client, comprising;

means for scanning the client and depositing audit results for replication to the means for presenting the interface, wherein the audit results identify files on the client and identify updates associated with the identified files, and wherein the audit results are consistent with the list of available updates and associated applicability rules;

means for refreshing the audit results to determine if the approved updates should be installed on the client; and

means for installing the approved updates on the client according to the refreshed audit results.

29. The system of claim 28, wherein the means for presenting an interface additionally comprises means for providing a vulnerability matrix comprising:

means for displaying the identified files;

means for displaying the updates associated with the identified files; and

means for providing an indication of whether the updates associated with the identified files have been installed on the identified files.

30. The system of claim 28, wherein the means for synchronizing additionally comprises means for checking a code on the list of available updates to verify its authenticity.

31. The system of claim 28, wherein the means for scanning the client additionally comprises means for depositing the audit results into WMI on the client and triggering SMS to replicate the audit results to the server.

32. The system of claim 28, wherein the means for refreshing the audit results additionally comprises means for receiving data from the means for scanning.

33. The system of claim 28, wherein the means for installing additionally comprises means for checking for files indicating that the client needs to reboot and means for initiating a re-boot if necessary.

34. The system of claim 28, wherein:

the means for presenting an interface additionally comprises means for providing a vulnerability matrix comprising;

means for displaying the identified files;

means for displaying the updates associated with the identified files; and

means for providing an indication of whether the updates associated with the identified files have been installed on the identified files;

the means for synchronizing additionally comprises means for checking a code on the list of available updates to verify authenticity of the list of available updates;

the means for scanning the client additionally comprises means for depositing the audit results into WMI on the client and triggering SMS to replicate the audit results to the server;

the means for refreshing the audit results additionally comprises means for receiving data from the means for scanning; and

the means for installing additionally comprises means for checking for files indicating that the client needs to reboot and means for initiating a re-boot if necessary.

35. A server for distributing updates, comprising:

means for synchronizing a catalog of available updates and associated applicability rules with a catalog maintained by an authority;

means for checking a code on the catalog of available updates to verify authenticity of the catalog; and

means for presenting a user interface to allow selection of approved updates from the catalog of available updates.

36. The server of claim 35, wherein the means for presenting the user interface additionally comprises means for displaying a vulnerability matrix, comprising:

means for displaying files identified on a client;

means for displaying the updates associated with the identified files; and

means for providing an indication of whether the updates associated with the identified files have been installed on the identified files;

37. The server of claim 35, additionally comprising:

means for replicating the synchronized catalog to client computers; and

means for replicating the approved updates to the client computers.

38. The server of claim 35, additionally comprising:

means for associating a grace period and an enforcement period with the approved updates;

means for allowing a user to defer the approved updates during the grace period; and

means for enforcing installation of the approved updates during the enforcement period.

39. A client configured for update maintenance, comprising:

means for parsing a catalog of file version information, update information and rules for application of updates to files;

means for querying an operating system operating on the client to determine file versions resident on the client; and

means for applying the rules to the file versions resident on the client and to the update information to produce audit data.

40. The client of claim 39, additionally comprising:

means for depositing the audit data in a queryable interface;

means for generating queries to retrieve information about needed updates from the queryable interface; and

means for intersecting the needed updates with updates approved by a central authority to determine updates to be applied.

41. The client of claim 39, additionally comprising:

means for updating the audit data by again querying the operating system operating on the client to determine versions of files resident on the client;

means for updating a scan cache to reflect the updated audit data;

means for inventorying received updates for comparison to the updated audit data; and

means for installing the received updates as indicated by the updated audit data.

42. The client of claim 39, additionally comprising:

installing an approved update on the client consistent with the audit data;

obtaining a success code resulting from the installation of the approved update;

mapping the success code to result in success code consistency.

43. A method of processing updates on a server, comprising:

synchronizing a catalog of available updates and associated applicability rules with a catalog maintained by an authority;

checking a code on the catalog of available updates to verify authenticity of the catalog; and

presenting an interface to allow selection of approved updates from the catalog of available updates.

44. The method of claim 43, wherein presenting the interface additionally comprises:

displaying a vulnerability matrix, wherein information contained within the vulnerability matrix comprises;

files situated on a client;

updates associated with the files; and

indications of whether the updates have been installed on the files.

45. The method of claim 43, additionally comprising:

replicating the synchronized catalog to client computers; and

replicating the approved updates to the client computers.

46. The method of claim 43, additionally comprising:

associating a grace period and an enforcement period with the approved updates;

allowing a user to defer the approved updates during the grace period; and

enforcing installation of the approved updates during the enforcement period.

47. The method of claim 43, additionally comprising:

associating the approved updates with rebooting instructions.

48. A method for performing update maintenance on a client, comprising:

parsing a catalog of file version information, update information and rules for application of updates to files;

querying an operating system operating on the client to determine versions of files resident on the client; and

applying the rules to the file versions resident on the client and to the update information to produce audit data.

49. The method of claim 48, additionally comprising:

depositing the audit data in a queryable interface; and

generating queries to retrieve information about needed updates from the queryable interface; and

intersecting the needed updates with updates approved by a central authority to determine updates to be applied.

50. The method of claim 48, additionally comprising:

updating the audit data by again querying the operating system operating on the client to determine versions of files resident on the client;

updating a scan cache to reflect the updated audit data;

inventorying received updates for comparison to the updated scan cache; and

installing the received updates as indicated by the updated scan cache.

51. The method of claim 50, wherein installing the received updates additionally comprises:

allowing installation of updates within a grace period to be deferred; and

enforcing installation of updates within an enforcement period.

52. The method of claim 50, wherein installing the received updates additionally comprises:

obtaining a success code from the installation; and

mapping the success code to result in consistent success code interpretation.