FORMALIZING, DIFFUSING AND ENFORCING POLICY ADVISORIES AND MONITORING POLICY COMPLIANCE IN THE MANAGEMENT OF NETWORKS

• US 20100017494A1
• Filed: 09/29/2009
• Published: 01/21/2010
• Est. Priority Date: 11/09/2001
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: BigFix, Inc. (International Business Machines Corporation)
• Inventors: DONOHO, David Leigh, LINCROFT, Peter, BROWN, James Milton, HINDAWI, David Salim, HINDAWI, Orion Yosef, GOODROW, Dennis S., LOER, Peter Benjamin, LIPPINCOTT, Lisa Ellen
• Granted Patent: US 9,231,827 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements

Abstract

An apparatus and method for centralized policy management of large-scale networks (221) of computational devices is disclosed. The apparatus includes a number of distributed clients (400) run on registered computers (201-203), gathering policy advisories (401) and reporting (405) relevance (403) to a system administrator (224). The system administrator may view the relevant messages (505) through a management interface (500) and deploy suggested actions to distributed clients (503), where the actions are executed to apply the solutions of the advisories (408).

Claims

1. A system for communications comprising;

at least one distributed client configured for gathering messages targeted to distributed clients according to status of a distributed client;

at least one relay for relaying said targeted messages to said at least one distributed client and relaying messages reporting status of said at least one distributed client from said at least one distributed client to a management console; and

a distributed server architecture (DSA) for coordinating relay of said messages.

2. The system of claim 1, wherein said DSA comprises:

a plurality of processes running on one or more servers.

3. The system of claim 1, wherein said DSA comprises:

at least one registration process for processing registration requests from distributed clients and server-to-client communication requests from other components of said DSA;

at least one propagation process for receiving action requests from said management interface and serving said action requests up to individual distributed clients; and

at least one reporting process for processing reports of relevance events from distributed clients and passing said reports on to a central database.

4. The system of claim 1, wherein said at least one relay comprises at least one mirror server.

5. The system of claim 4, wherein said mirror server comprises means for managing bandwidth.

6. The system of claim 4, wherein said at least one mirror server comprises a plurality of mirror servers.

7. The system of claim 1, wherein said relay comprises an apparatus for a distributed client to anonymously request advisories from at least one advice provider site.

8. The system of claim 1, wherein said messages are encrypted.

9. The system of claim 1, wherein said messages targeted to distributed clients according to status of a distributed client comprise either of:

advice messages and actions.

10. The system of claim 9, wherein an advice message comprises:

wherein an advice message comprises a relevance clause that specifies criteria that describe relevance of said advisory.

11. The system of claim 9, wherein said advice message comprises an explanatory message.

12. The system of claim 9, wherein said advice message comprises at least one action that provides a solution.

13. The system of claim 9, wherein said at least one client distributes said gathered advice messages to said management interface by means of said at least one relay.

14. The system of claim 9, wherein an action comprises a message deployed to a client instructing it to implement an action specified by an advice message.

15. The system of claim 1, wherein said management interface comprises:

means for displaying advice messages;

means for deploying actions;

means for monitoring actions; and

means for monitoring client status.

16. The apparatus of claim 15, wherein said management interface further comprises:

means for adding, modifying, or canceling a subscription of said at least one distributed clients to one or more advice provider sites.

17. The apparatus of claim 15, wherein said means for deploying actions comprises:

means for selecting a group of computational devices, specifying action messages, scheduling, and controlling execution when deploying actions proposed by relevant advice messages.

18. The apparatus of claim 15, wherein said management interface further comprises:

means for deploying encrypted actions of relevant advice messages to a selected group of said distributed clients.

19. The apparatus of claim 15, wherein said means for monitoring actions comprises:

means for monitoring status of each distributed client while actions are being deployed and executed; and

means for stopping previously deployed actions which have not finished running.

20. The apparatus of claim 1, further comprising:

a central database for storing data about individual clients, about messages that are being actively monitored, and about actions being deployed and monitored.

21. An apparatus for formalizing, diffusing, and answering queries about the status of elements in a network of computational devices, comprising:

a management console;

a general-purpose language for formally expressing queries about software products used in an enterprise and properties of said software, hardware properties and configuration of said software and said hardware;

a protocol for diffusing queries across the network;

a plurality of distributed clients, wherein any of said distributed clients gather queries and obtain answers to said queries; and

wherein said management console displays reports from said distributed clients to a system administrator.

22. The apparatus of claim 21, wherein at least one of said queries and said reports are encrypted.

23. In a system for formalizing, diffusing, and enforcing policy advisories and for monitoring policy compliance in the management of networks of distributed clients, a management interface comprising:

a programmable interface, said programmable interface comprising means for;

displaying advice messages;

deploying actions to said distributed client;

means for monitoring deployed actions; and

means for monitoring client status.

24. The management interface of claim 23, said programmable interface further comprising:

means to specify an effective period for an action.

25. The management interface of claim 23, wherein said programmable interface further comprises:

means for selecting a group of computational devices, specifying action messages, scheduling, and controlling execution when deploying actions proposed by relevant advice messages.

26. The management interface of claim 23, wherein said programmable interface further comprises:

means for securely deploying actions of relevant advice messages to a selected group of said distributed clients.

27. The management interface of claim 23, wherein said means for monitoring deployed actions includes means for stopping deployed actions which have not finished running.

28. The management interface of claim 23, wherein said mean for monitoring client status includes means for monitoring status of each client while actions are being deployed and executed.

29. The management interface of claim 28, wherein said means for monitoring client status allows said system administrator to define and retrieve customized properties of clients.

30. A distributed client in a network policy management system, comprising:

means for gathering advisories from a plurality of advice provider sites;

means for determining relevance of said advisories; and

means for reporting relevance to a central server.

31. The distributed client of claim 30, further comprising:

means for gathering actions from said central server; and

means for executing said actions.

32. The distributed client of claim 30, wherein each of said advisories comprises:

a relevance clause written in a formal descriptive language to specify criteria determining when said advisory is relevant;

33. The distributed client of claim 30, wherein each of said advisories comprises:

a message providing explanatory material explaining said advisory.

34. The distributed client of claim 30, wherein each of said advisories comprises an action that provides a solution.

35. The distributed client of claim 30, wherein said action is only applied when said advisory is determined to be relevant to said computer.

36. The distributed client of claim 30, wherein said action can be constrained so that it may be executed when a computationally verifiable condition is met.

37. The distributed client of claim 30, wherein said action is digitally signed when deployed from a management interface.

38. The distributed client of claim 37, wherein said management interface comprises a programmed interface.

39. The distributed client of claim 37, wherein said management interface comprises a user interface.

40. The distributed client of claim 37, wherein said management interface comprises a software application being executed by a processor.

41. The distributed client of claim 37, wherein said management interface comprises a API (application programming interface).

42. The distributed client of claim 30, wherein said action is any of the group comprising:

deleting, moving, or copying specific files;

setting or deleting registry entries;

executing script commands;

deleting, adding, or committing various DLL modules;

deleting, closing, or restoring an advisory;

subscribing or unsubscribing to an advice provider site;

changing a gathering schedule or forcing an immediate gathering;

configuring hardware and software policies of a device;

configuring device hardware;

installing and uninstalling upgrades and patches; and

forcing an immediate relevance evaluation of advisories.