MANAGING CHANGE EVENTS FOR DEVICES IN AN ENTERPRISE SYSTEM

• US 20170207985A1
• Filed: 03/31/2017
• Published: 07/20/2017
• Est. Priority Date: 09/24/2014
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Jayanti Venkata, Bhagavati Kumar, Maheshwari, Harsh, Das, Sidhartha
• Granted Patent: US 10,129,109 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 8/60 Software deployment
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 8/71 Version control security arrangements therefor G06F21/57; Configuration management
• CPC Class Codes: G06F 9/452 Remote windowing, e.g. X-Window System, desktop virtualisation protocols for virtual reality H04L67/131
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 41/20 Network management software packages
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 41/5096 wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 : for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 : Access control lists [ACL]
• CPC Class Codes: H04L 63/102 : Entity profiles
• CPC Class Codes: H04L 63/104 : Grouping of entities
• CPC Class Codes: H04L 63/105 : Multiple levels of security
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 : involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/02 : based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 : in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/12 : specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/306 : User profiles
• CPC Class Codes: H04L 67/55 : Push-based network services
• CPC Class Codes: H04L 67/75 : Indicating network or usage conditions on the user display
• CPC Class Codes: H04L 9/3268 : using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/33 : using wearable devices, e.g. using a smartwatch or smart-glasses
• CPC Class Codes: H04W 16/06 : Hybrid resource partitioning, e.g. channel borrowing
• CPC Class Codes: H04W 4/08 : User group management
• CPC Class Codes: H04W 4/50 : Service provisioning or reconfiguring
• CPC Class Codes: H04W 4/60 : Subscription-based services using application servers or record carriers, e.g. SIM application toolkits
• CPC Class Codes: H04W 4/70 : Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Abstract

Techniques are disclosed for communicating to remote devices information about change events related to changes in access to an enterprise system. A device access management system may facilitate communication about a change event to the remote devices. Information about a change event may be stored in a change event object based on the type of change event (e.g., a policy change, an application change, and a settings change). A change event queue may persistently store information corresponding to change events. One or more computing nodes may be scheduled to execute an action process for each change event based on the type of the change event. A computing node may communicate information (e.g., an instruction to implement adjust access) about a change event to remote devices. A change event may persist on the queue until all remote devices are notified about the change event.

Claims

1. A method comprising:

determining an action to be performed on a plurality of remote devices;

adding, on a queue, a first change event entry for each remote device in a first set of remote devices of the plurality of remote devices and a second change event entry for each remote device in a second set of remote devices of the plurality of remote devices, thereby adding multiple change event entries to the queue, wherein each remote device in the first set of remote devices is different from each remote device in the second set of remote devices, and wherein each of the first change event entry and the second change event entry includes information about a change event for a change in access to a computing system for each remote device in the first set of remote devices and each remote device in the second set of remote devices;

assigning, from the queue to a first computing node, a first change event entry corresponding to the first set of remote devices, wherein the first change event entry includes first information identifying each remote device in the first set of remote devices to be notified about the change event;

instantiating a first metadata object for the first change event entry and storing first metadata identifying each of the first set of remote devices in the first metadata object;

instructing, from the first computing node, the action to be taken on each of the first set of remote devices based on the first metadata object, wherein instructing the action to be taken on each of the first set of remote devices causes each remote device in the first set of remote devices to adjust access to the computing system based on the change event indicated by the first change event entry corresponding to the first metadata object;

assigning, from the queue to a second computing node, a second change event entry corresponding to the second set of remote devices, wherein the second change event entry includes second information identifying each remote device in the second set of remote devices to be notified about the change event;

instantiating a second metadata object for the second change event entry and storing second metadata identifying each of the second set of remote devices in the second metadata object; and

instructing, from the second computing node, the action to be taken on each of the second set of remote devices based on the second metadata object, wherein instructing the action to be taken on each of the second set of remote devices causes each remote device in the second set of remote devices to adjust access to the computing system based on the change event indicated by the second change event entry corresponding to the second metadata object.

2. The method of claim 1, wherein instantiating the first metadata object is performed on the first computing node, and wherein instantiating the second metadata object is performed on the second computing node.

3. The method of claim 1, further comprising:

selecting, based on a processing load of each of a plurality of computing nodes, a set of computing nodes of the plurality of computing nodes to initiate the action for the change in access, wherein the set of computing nodes includes the first computing node and the second computing node.

4. The method of claim 3, further comprising:

computing the processing load for each of the plurality of computing nodes, wherein a processing load of a computing node is computed based on a number of actions the computing node has initiated, and wherein the first computing node is selected for the set of computing nodes based on an action threshold, and wherein each of the set of computing nodes is selected based on the processing load for each of the set of computing nodes satisfying the action threshold.

5. The method of claim 1, further comprising:

determining a type of change event corresponding to the change event for the change in access to the computing system for each remote device in the first set of remote devices and each remote device in the second set of remote devices, wherein each of the first change event entry and the second change event entry indicates the type of change event.

6. The method of claim 5, wherein the first metadata object is instantiated based on the type of change event, and wherein the second metadata object is instantiated based on the type of change event.

7. The method of claim 5, wherein the type of change event includes a policy change, the policy change including a change in a compliance policy, a change in an enrollment policy, a change in a workspace policy, a change in a device policy, or a combination thereof.

8. The method of claim 5, wherein the type of change event includes an application change, the application change including adding an application to a catalog of applications accessible to the plurality of remote devices, removing an application from the catalog of applications, modifying a version of an application in the catalog of applications, or a combination thereof.

9. The method of claim 5, wherein the type of change event includes a change in a synchronization setting related to accessing the computing system.

10. The method of claim 5, further comprising:

determining, based on the type of change event, an action process to perform for the action.

11. The method of claim 1, wherein instructing, from the first computing node, the action to be taken on each of the first set of remote devices is performed concurrently with instructing, from the second computing node, the action to be taken on each of the second set of remote devices.

12. The method of claim 1, wherein the first metadata object for the first change event entry includes the information about the change event for the change in access to the computing system, and wherein the second metadata object for the second change event entry includes the information about the change event for the change in access to the computing system.

13. The method of claim 1, wherein instructing the action to be taken on each remote device in the first set of remote devices includes sending a first instruction indicating the action to each of the first set of remote devices to identified by the first information included in the first change event entry corresponding to the first metadata object, and wherein instructing the action to be taken on each remote device in the second set of remote devices includes sending a second instruction indicating the action to each of the second set of remote devices to identified by the second information included in the second change event entry corresponding to the second metadata object.

14. The method of claim 1, further comprising:

removing, from the queue, the first change event entry for the first set of remote devices upon receiving a response from each of the first set of remote devices, the response indicating that each of the first set of remote devices has adjusted access to the computing system based on the information about the change event included in the first change event entry.

15. The method of claim 14, wherein the response is a first response, and wherein the method further comprises:

removing, from the queue, the second change event entry for the second set of remote devices upon receiving a second response from each of the second set of remote devices, the second response indicating that each of the second set of remote devices has adjusted access to the computing system based on the information about the change event included in the second change event entry.

16. A system comprising:

one or more processors; and

a memory storing one or more instructions which, upon execution by the one or more processors, causes the one or more processors to;

determine an action to be performed on a plurality of remote devices;

add, on a queue, a first change event entry for each remote device in a first set of remote devices of the plurality of remote devices and a second change event entry for each remote device in a second set of remote devices of the plurality of remote devices, thereby adding multiple change event entries to the queue, wherein each remote device in the first set of remote devices is different from each remote device in the second set of remote devices, and wherein each of the first change event entry and the second change event entry includes information about a change event for a change in access to a computing system for each remote device in the first set of remote devices and each remote device in the second set of remote devices;

assign, from the queue to a first computing node, a first change event entry corresponding to the first set of remote devices, wherein the first change event entry includes first information identifying each remote device in the first set of remote devices to be notified about the change event;

instantiate a first metadata object for the first change event entry and storing first metadata identifying each of the first set of remote devices in the first metadata object;

instruct, from the first computing node, the action to be taken on each of the first set of remote devices based on the first metadata object, wherein instructing the action to be taken on each of the first set of remote devices causes each remote device in the first set of remote devices to adjust access to the computing system based on the change event indicated by the first change event entry corresponding to the first metadata object;

assign, from the queue to a second computing node, a second change event entry corresponding to the second set of remote devices, wherein the second change event entry includes second information identifying each remote device in the second set of remote devices to be notified about the change event;

instantiate a second metadata object for the second change event entry and storing second metadata identifying each of the second set of remote devices in the second metadata object; and

instruct, from the second computing node, the action to be taken on each of the second set of remote devices based on the second metadata object, wherein instructing the action to be taken on each of the second set of remote devices causes each remote device in the second set of remote devices to adjust access to the computing system based on the change event indicated by the second change event entry corresponding to the second metadata object.

17. The system of claim 16, wherein instructing the action to be taken on each remote device in the first set of remote devices includes sending a first instruction indicating the action to each of the first set of remote devices to identified by the first information included in the first change event entry corresponding to the first metadata object, and wherein instructing the action to be taken on each remote device in the second set of remote devices includes sending a second instruction indicating the action to each of the second set of remote devices to identified by the second information included in the second change event entry corresponding to the second metadata object.

18. The system of claim 16, wherein the first metadata object for the first change event entry includes the information about the change event for the change in access to the computing system, and wherein the second metadata object for the second change event entry includes the information about the change event for the change in access to the computing system.

19. A non-transitory computer-readable medium comprising one or more instructions stored thereon, that upon execution by one or more processors, causes the one or more processors to:

determine an action to be performed on a plurality of remote devices;

add, on a queue, a first change event entry for each remote device in a first set of remote devices of the plurality of remote devices and a second change event entry for each remote device in a second set of remote devices of the plurality of remote devices, thereby adding multiple change event entries to the queue, wherein each remote device in the first set of remote devices is different from each remote device in the second set of remote devices, and wherein each of the first change event entry and the second change event entry includes information about a change event for a change in access to a computing system for each remote device in the first set of remote devices and each remote device in the second set of remote devices;

assign, from the queue to a first computing node, a first change event entry corresponding to the first set of remote devices, wherein the first change event entry includes first information identifying each remote device in the first set of remote devices to be notified about the change event;

instantiate a first metadata object for the first change event entry and storing first metadata identifying each of the first set of remote devices in the first metadata object;

instruct, from the first computing node, the action to be taken on each of the first set of remote devices based on the first metadata object, wherein instructing the action to be taken on each of the first set of remote devices causes each remote device in the first set of remote devices to adjust access to the computing system based on the change event indicated by the first change event entry corresponding to the first metadata object;

assign, from the queue to a second computing node, a second change event entry corresponding to the second set of remote devices, wherein the second change event entry includes second information identifying each remote device in the second set of remote devices to be notified about the change event;

instantiate a second metadata object for the second change event entry and storing second metadata identifying each of the second set of remote devices in the second metadata object; and

instruct, from the second computing node, the action to be taken on each of the second set of remote devices based on the second metadata object, wherein instructing the action to be taken on each of the second set of remote devices causes each remote device in the second set of remote devices to adjust access to the computing system based on the change event indicated by the second change event entry corresponding to the second metadata object.

20. The non-transitory computer-readable medium of claim 19, wherein the one or more instructions, that upon execution by the one or more processors, further causes the one or more processors to:

remove, from the queue, the first change event entry for the first set of remote devices upon receiving a response from each of the first set of remote devices, the response indicating that each of the first set of remote devices has adjusted access to the computing system based on the information about the change event included in the first change event entry; and

remove, from the queue, the second change event entry for the second set of remote devices upon receiving a second response from each of the second set of remote devices, the second response indicating that each of the second set of remote devices has adjusted access to the computing system based on the information about the change event included in the second change event entry.