Centralized data transformation

• US 7,703,137 B2
• Filed: 04/08/2005
• Issued: 04/20/2010
• Est. Priority Date: 09/03/2004
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Durham, Roderick Harold
• Primary Examiner(s): Vu, Kimyen
• Assistant Examiner(s): Zee, Edward
• Application Number:
  US11/101,402
• Publication Number:
  US 20060053265A1
• Time in Patent Office: 1,838 Days
• Field of Search: 715/230, 726/1, 726 22- 25
• US Class Current: 726/22
• CPC Class Codes: G06F 16/258 Data format conversion from or to a database
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method of facilitating transformation of survey data from being in at least one foreign format used by a survey-tool to being in a desired format may include: receiving instances of foreign data from survey-tools, the foreign data being in foreign format used by the survey-tools, respectively; and appending, to the instances of foreign data, service-keys to identify the service tools which gathered the foreign data, respectively, to produce a data block that includes key-and-foreign-data pairs. Another such method may include: receiving such a data block; culling from the block key-and-foreign-data pairs; and operating upon the pairs to transform respective chunks of foreign data from being in respective foreign formats into being in corresponding desired formats according to corresponding service-keys, respectively.

Claims

1. A method of facilitating transformation of survey data from being in a foreign format used by a survey-tool on a host-asset to being in a desired format, the method comprising:

receiving, on a server over a network from an at least first service tool on the host asset, a block of survey data, the block including at least a first chunk of foreign data formatted according to an at least first foreign format and at least a first service-key to identify the at least first service tool which gathered the at-least first chunk, respectively, the block of survey data gathered automatically by the at least first service tool on the host asset and sent to the server;

culling, by executing instructions on a processor of the server, from the block at least a first pair of a service key and a corresponding chunk of foreign data, respectively, the at least first pair including the at least first service key and the at least first chunk of foreign data;

operating upon the at-least-first pair, by executing further instructions on the processor of the server, to transform respective chunks of foreign data from being in respective foreign formats into being in corresponding desired formats according to corresponding service-keys, respectively, wherein the transforming respective chunks of foreign data from being in respective foreign formats into being in corresponding desired formats includes;

identifying at least a first format-interpretation (FI) service appropriate to the at-least-first foreign format based upon the at-least-first service-key, respectively;

passing the at-least-first chunk to the at-least-first FI-service, respectively; and

receiving at least a first parcel of data formatted to the desired format from the at-least-first FI-service, respectively, the at-least-first parcel corresponding to the at-least-first chunk, respectively;

evaluating a policy active for the host asset using the at least first parcel to determine if the policy is violated;

when the policy is violated, identifying a remediation mapped to the violated policy; and

sending the identified remediation to the host asset.

2. The method of claim 1, wherein:

the block of survey data includes;

at least a second chunk of foreign data formatted according to at least a second foreign format, respectively, and

at least a second service-key to identify at least a second service tool which gathered the at-least-second chunk, respectively;

the culling from the block culls at least a second key-and-foreign-chunk pair; and

the operating upon the at-least-first pair further operates upon the at-least-second key-and-foreign-chunk pair to transform the at-least-second chunk according to the at-least-second second key, respectively.

3. The method of claim 2, wherein the transforming includes:

identifying at least first and second format-interpretation (FI) services appropriate to the at-least-first-and-second foreign formats based upon the at-least-first-and-second service-keys, respectively;

passing the at-least-first-and-second chunks to the at-least-first-and-second FI-services, respectively; and

receiving at least first and second parcels of data formatted to the desired format from the at-least-first-and-second FI-services, respectively, the at-least-first-and-second parcels corresponding to the at-least-first-and-second chunks, respectively.

4. The method of claim 1, wherein the operating upon the at-least-first pair includes:

determining if a service-key corresponds to a known foreign format; and

discarding, if the service-key does not correspond to a known foreign format, the corresponding chunk.

5. A machine-readable medium including instructions stored thereon, execution of which by a processor of a machine causes the machine to perform a method that transforms survey data from being in at least one foreign format used by a survey-tool on a host asset to being in a desired format, the method comprising:

receiving, on a server over a network from an at least first service tool on the host asset, a block of survey data, the block including at least a first chunk of foreign data formatted according to an at least first foreign format and at least a first service-key to identify the at least first service tool which gathered the at-least first chunk, respectively, the block of survey data gathered automatically by the at least first service tool on the host asset and sent to the server;

culling from the block at least a first pair of a service key and a corresponding chunk of foreign data, respectively, the at least first pair including the at least first service key and the at least first chunk of foreign data;

operating upon the at-least-first pair to transform respective chunks of foreign data from being in respective foreign formats into being in corresponding desired formats according to corresponding service-keys, respectively, wherein the transforming respective chunks of foreign data from being in respective foreign formats into being in corresponding desired formats includes;

identifying at least a first format-interpretation (FI) service appropriate to the at-least-first foreign format based upon the at-least-first service-key, respectively;

passing the at-least-first chunk to the at-least-first FI-service, respectively; and

receiving at least a first parcel of data formatted to the desired format from the at-least-first FI-service, respectively, the at-least-first parcel corresponding to the at-least-first chunk, respectively;

evaluating a policy active for the host asset using the at least first parcel to determine if the policy is violated;

when the policy is violated, identifying a remediation mapped to the violated policy; and

sending the identified remediation to the host asset.

6. The machine-readable medium of claim 5, wherein:

the block of survey data includes;

at least a second chunk of foreign data formatted according to at least a second foreign format, respectively, and

at least a second service-key to identify at least a second service tool which gathered the at-least-second chunk, respectively;

the culling further includes culling at least a second key-and-foreign-chunk pair; and

the operating further includes operating upon the at-least-second key-and-foreign-chunk pair to transform the at-least-second chunk according to the at-least-second second key, respectively.

7. The machine-readable medium of claim 6, wherein the operating further causes the machine to:

identify at least first and second format-interpretation (FI) services appropriate to the at-least-first-and-second foreign formats based upon the at-least-first-and-second service-keys, respectively;

pass the at-least-first-and-second chunks to the at-least-first-and-second FI-services, respectively; and

receive at least first and second parcels of data formatted to the desired format from the at-least-first-and-second FI-services, respectively, the at-least-first-and-second parcels corresponding to the at-least-first-and-second chunks, respectively.

8. The machine-readable medium of claim 5, wherein the operating further causes the machine to:

determine if a service-key corresponds to a known foreign format; and

discard, if the service-key does not correspond to a known foreign format, the corresponding chunk.