Automatic mapping and location discovery of computers in computer networks

• US 8,019,856 B1
• Filed: 11/07/2007
• Issued: 09/13/2011
• Est. Priority Date: 11/07/2007
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: Trend Micro Inc.
• Inventors: Chang, Chia-Chi, Lin, Kun-Shan, Hu, Kai-Chih
• Primary Examiner(s): Nawaz; Asad M
• Assistant Examiner(s): MURPHY, CHARLES C
• Application Number:
  US11/983,070
• Time in Patent Office: 1,406 Days
• Field of Search: 370/257, 370/277, 370/280, 370/310, 370/311, 370/315, 370/328, 370/329, 370/331, 370/338, 370/401, 370/399, 370/392, 370/390, 370/342, 370/312, 370/235, 709/203, 709/214, 709/206, 709/217, 709/218, 709/219, 709/223, 709/224, 709/227, 709/230, 709/231, 709/232, 709/239, 709/245, 709/242, 709/238, 709/229, 709/228, 709/221, 709/220, 455/3.06, 455/414.1, 455/434, 455/436, 455/437, 455/445, 455/456.1, 455/519, 455/561, 455/563, 455/69
• US Class Current: 709/224
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services

Abstract

A scan client in a subnet of an intranet may be designated as a root agent to provide subnet information to a scan server in the intranet. The subnet information may include addresses of computers belonging to the subnet. The scan server may use subnet information collected from various root agents to build a map of the intranet. The intranet map may be forwarded from the scan server to the root agents, which in turn provide the intranet map to scan clients in their respective subnets. The root agents may also receive antivirus modules from the scan server for distribution to scan clients. A scan client may look for computers indicated in the intranet map to determine whether or not it is connected to the intranet.

Claims

1. A computer-implemented method of discovering location of a computer, the method comprising:

collecting subnet information from a plurality of computers belonging to subnets of an intranet by a scan server, each of the subnet information comprising IP addresses of computers in a particular subnet of the intranet;

designating a scan client from the plurality of scan clients in each of the subnets as a root agent;

providing the subnet information to the scan server by the root agent;

creating an intranet map from the collected subnet information by the scan server;

providing the intranet map to the root agent by the scan server;

providing the intranet map to a scan client in the plurality of scan clients, by the root agent, to allow the scan client to determine whether or not the scan client is connected to a subnet of the intranet;

receiving, by the scan server, antivirus modules from a vendor of antivirus products employed in the plurality of scan clients;

receiving, by root agent, the antivirus modules from the scan server; and

providing, by the root agent, the antivirus modules to other scan clients in its particular subnet in the plurality of subnets.

2. The method of claim 1 wherein the intranet map comprises IP addresses of computers belonging to the intranet.

3. The method of claim 1 wherein using the intranet map to determine whether the computer roaming from one computer network location to another is connected to a subnet of the intranet comprises:

looking for one or more computers indicated in the intranet map.

4. A computer network comprising:

an intranet comprising a plurality of subnets;

a scan server configured to receive antivirus modules;

a gateway in each of the subnets;

a plurality of scan clients in each of the subnets, a scan client from the plurality of scan clients in each of the subnets being designated as a root agent, the root agent being configured to receive the antivirus modules from the scan server, to provide the antivirus modules to other scan clients in its particular subnet in the plurality of subnets, and to provide subnet information to the scan server, the subnet information comprising addresses of computers in the particular subnet;

wherein the scan server is further configured to create an intranet map from subnet information received from root agents and to provide the intranet map to the root agents, the root agents being configured to provide the intranet map to a particular scan client in the plurality of scan clients to allow the particular scan client to determine whether or not the particular scan client is connected to the intranet; and

wherein the scan server is further configured to receive the antivirus modules from a vendor of antivirus products employed in the plurality of scan clients.

5. The computer network of claim 4 wherein the intranet map comprises IP addresses of computers in the subnets.

6. The computer network of claim 4 wherein subnet information includes IP and MAC addresses of gateways employed in the particular subnet.

7. A computer-implemented method of discovering location of a computer, the method comprising:

a scan server receiving addresses of computers belonging to different subsections of a computer network from a first computer;

the scan server building a listing of the addresses;

providing the listing of the addresses to a first computer by the scan server;

providing the listing of the addresses from the first computer to a second computer;

using the listing of the addresses in the second computer to determine whether the second computer is connected to the computer network by connecting the second computer to one or more computers indicated in the listing of the addresses;

the scan server configured to receive antivirus modules from a vendor of antivirus products and to provide the antivirus modules to the first computer; and

the first computer configured to provide the antivirus modules to the second computer.

8. The method of claim 7 wherein the different subsections comprise subnets of an intranet, the computer network comprises:

an intranet, and the listing of the addresses comprises an intranet map comprising IP addresses of computers belonging to the subnets.

9. The method of claim 8 wherein the intranet map includes IP and MAC addresses of a gateway in each of the subnets.

10. The method of claim 7 wherein the first computer and the second computer belong to the same subnet.