MANAGING CHANGE EVENTS FOR DEVICES IN AN ENTERPRISE SYSTEM

• US 20160087854A1
• Filed: 04/17/2015
• Published: 03/24/2016
• Est. Priority Date: 09/24/2014
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Jayanti Venkata, Bhagavati Kumar, Maheshwari, Harsh, Das, Sidhartha
• Granted Patent: US 9,652,212 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 8/60 Software deployment
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 8/71 Version control security arrangements therefor G06F21/57; Configuration management
• CPC Class Codes: G06F 9/452 Remote windowing, e.g. X-Window System, desktop virtualisation protocols for virtual reality H04L67/131
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 41/20 Network management software packages
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 : for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 : Access control lists [ACL]
• CPC Class Codes: H04L 63/102 : Entity profiles
• CPC Class Codes: H04L 63/104 : Grouping of entities
• CPC Class Codes: H04L 63/105 : Multiple levels of security
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 : involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/02 : based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 : in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/12 : specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/306 : User profiles
• CPC Class Codes: H04L 67/55 : Push-based network services
• CPC Class Codes: H04L 67/75 : Indicating network or usage conditions on the user display
• CPC Class Codes: H04L 9/3268 : using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/33 : using wearable devices, e.g. using a smartwatch or smart-glasses
• CPC Class Codes: H04W 16/06 : Hybrid resource partitioning, e.g. channel borrowing
• CPC Class Codes: H04W 4/08 : User group management
• CPC Class Codes: H04W 4/50 : Service provisioning or reconfiguring
• CPC Class Codes: H04W 4/60 : Subscription-based services using application servers or record carriers, e.g. SIM application toolkits
• CPC Class Codes: H04W 4/70 : Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Abstract

Techniques are disclosed for communicating to remote devices information about change events related to changes in access to an enterprise system. A device access management system may facilitate communication about a change event to the remote devices. Information about a change event may be stored in a change event object based on the type of change event (e.g., a policy change, an application change, and a settings change). A change event queue may persistently store information corresponding to change events. One or more computing nodes may be scheduled to execute an action process for each change event based on the type of the change event. A computing node may communicate information (e.g., an instruction to implement adjust access) about a change event to remote devices. A change event may persist on the queue until all remote devices are notified about the change event.

Claims

1. A method comprising:

determining a type of change event corresponding to a change in access to an enterprise system for a plurality of remote devices;

identifying an action process class associated with the type of change event, wherein the action process class defines an action process to perform for the type of change event;

selecting, based on a processing load of each of a plurality of computing nodes, a set of computing nodes of the plurality of computing nodes to perform the action process for the change in access;

establishing, by a computer system, based on the type of change event, a first change event object for a first set of remote devices in the plurality of remote devices, wherein a change event object indicates information about the change in access;

establishing, by the computer system, based on the type of change event, a second change event object for a second set of remote devices in the plurality of remote devices, wherein each of the first set of remote devices is different from each of the second set of remote devices;

initiating, by a first computing node of the set of computing nodes, using the first change event object, the action process for a first action process object, wherein the first action process object is established based on the action process class; and

initiating, by a second computing node of the set of computing nodes, using the second change event object, the action process for a second action process object, wherein the second action process object is established based on the action process class.

2. The method of claim 1, further comprising:

adding, to a change event queue, a change event entry for each of the first set of remote devices and the second set of remote devices, wherein the change event entry indicates the change in access and the type of change event.

3. The method of claim 2, wherein establishing the first change event object includes instantiating the first change event object based on a change event entry for the first set of remote devices, and wherein the change event entry for the first set of remote devices includes information identifying each of the first set of remote devices.

4. The method of claim 2, further comprising:

removing, from the change event queue, the change event entry for the first set of remote devices upon receiving a response from each of the first set of remote devices, the response indicating that each of the first set of remote devices has applied the change in access corresponding to the type of change event.

5. The method of claim 1, wherein the first change event object includes information identifying each of the first set of remote devices.

6. The method of claim 1, wherein initiating, using the first change event object, the action process for a first action process object includes:

establishing the first action process object by instantiating the action process class using the first change event object; and

invoking the action process using the first action process object.

7. The method of claim 1, wherein the action process initiated for the first action process object is initiated concurrently with the action process initiated for the second action process object.

8. The method of claim 1, wherein the type of change event includes a policy change, the policy change including a change in a compliance policy, a change in an enrollment policy, a change in a workspace policy, a change in a device policy, or a combination thereof.

9. The method of claim 8, wherein the action process to perform for a set of remote devices includes instructing each of the set of remote devices to apply the policy change.

10. The method of claim 1, wherein the type of change event includes an application change, the application change including adding an application to a catalog of applications accessible to the plurality of remote devices, removing an application from the catalog, modifying a version of an application in the catalog, or a combination thereof.

11. The method of claim 10, wherein the action process to perform for a set of remote devices includes instructing each of the set of remote devices to apply the application change.

12. The method of claim 1, wherein the type of change event includes a change in a synchronization setting related to accessing the enterprise system.

13. The method of claim 1, wherein the action process to perform for a set of remote devices includes instructing each of the set of remote devices to apply the change in the synchronization setting.

14. The method of claim 1, wherein change event objects and action process objects are plain old Java®

objects.

15. A non-transitory computer-readable medium for protecting a computer from an electronic communication containing malicious code, comprising instructions stored thereon, that when executed on a processor, perform the steps of claim 1.

16. A system comprising:

one or more processors; and

a memory storing instructions that, when executed by the one or more processors, cause the one or more processors to;

determine a type of change event corresponding to a change in access to an enterprise system for a plurality of remote devices;

identify an action process class associated with the type of change event, wherein the action process class defines an action process to perform for the type of change event;

select, based on a processing load of each of a plurality of computing nodes, a set of computing nodes of the plurality of computing nodes to perform the action process for the change in access;

establish, based on the type of change event, a first change event object for a first set of remote devices in the plurality of remote devices, wherein a change event object indicates information about the change in access;

establish, based on the type of change event, a second change event object for a second set of remote devices in the plurality of remote devices, wherein each of the first set of remote devices is different from each of the second set of remote devices;

initiate, by a first computing node of the set of computing nodes, using the first change event object, the action process for a first action process object, wherein the first action process object is established based on the action process class; and

initiate, by a second computing node of the set of computing nodes, using the second change event object, the action process for a second action process object, wherein the second action process object is established based on the action process class.

17. The system of claim 16, wherein the instructions, when executed by the one or more processors, further cause the one or more processors to:

compute the processing load for each of the plurality of computing nodes, wherein a processing load of a computing node is computed based on a number of action processes the computing node has initiated, and wherein the first computing node is selected for the set of computing nodes based on an action process threshold, and wherein each of the set of computing nodes is selected based on the processing load for each of the set of computing nodes satisfying the action process threshold.

18. The system of claim 16, wherein the action process invoked using the first action process object includes transmitting, to each of the first set of remote devices, an instruction indicating the change in access, and wherein the instruction causes at least one remote device in the first set of remote devices to apply the change in access.

19. A method comprising:

determining an action to be performed on a plurality of remote devices;

adding, on a queue, a change event entry for each of a first set of remote devices and a second set of remote devices of the plurality of remote devices, thereby adding multiple change event entries to the queue, wherein each of the first set of remote devices is different from each of the second set of remote devices;

assigning, from the queue to a first computing node, a first change event entry corresponding to the first set of remote devices;

instantiating a first metadata object for the first change event entry and storing metadata identifying each of the first set of remote devices in the first metadata object;

instructing, from the first computing node, the action to be taken on each of the first set of remote devices based on the first metadata object;

assigning, from the queue to a second computing node, a second change event entry corresponding to the second set of remote devices;

instantiating a second metadata object for the second change event entry and storing metadata identifying each of the second set of remote devices in the second metadata object; and

instructing, from the second computing node, the action to be taken on each of the second set of remote devices based on the second metadata object.

20. The method of claim 19, wherein instantiating the first metadata object is performed on the first computing node.