On-demand advertising of software packages

• US 8,230,415 B1
• Filed: 03/13/2007
• Issued: 07/24/2012
• Est. Priority Date: 03/13/2007
• Status: Active Grant

• Current Assignee: Pulse Secure, LLC (Ivanti Software, Inc.)
• Original Assignee: Juniper Networks Incorporated
• Inventors: Thomas, Christopher N.
• Primary Examiner(s): Bullock, Jr, Lewis A
• Assistant Examiner(s): GOORAY, MARK A
• Application Number:
  US11/685,374
• Time in Patent Office: 1,960 Days
• Field of Search: None
• US Class Current: 717/173
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57

Abstract

A network system includes an access control device and a client device. The access control device provides access to an enterprise network using a virtual private network (VPN) and provides a software update package to the client device. The client device includes an operating system that maintains a user context for a user having restricted privileges and a system context having elevated privileges. The client device further includes a user-level setup module, a system-level installation service and a user-level installation service. The setup module, system-level installation service and the user-level installation service interact to provide on-demand advertisement and installation of authorized software update packages on computing devices when needed by the user without requiring action by an administrator.

Claims

1. A method for installing a software update package on a computing device comprising:

receiving, in a user context of an operating system executing on the computing device, parameters for the software update package for a user associated with the computing device, wherein the user context has a restricted privilege level within the computing device;

determining, in the user context, whether to update software executing within the computing device based on the received parameters;

automatically downloading the software package to the user context of the computing device based on the determination of whether to update the software executed within the computing device;

automatically invoking a system-level installation service from the user context of the operating system of the computing device, wherein the system-level installation service executes within a system context of the operating system of the computing device, authenticates the software update package to ensure the software upgrade package is from a trusted source and, after authenticating the software update package, invokes a user-level installer service executing within the user context to advertise the software update package to the operating system from the user context so as to register the software update package with the operating system and enable subsequent installation of the software update package by the user; and

after advertising the software update package, installing the software update package with the user-level installer service executing in the user context of the operation system.

2. The method of claim 1, further comprising accessing an access control device of a virtual private network (VPN) with the computing device,

wherein the parameters are downloaded from the access control device, and

wherein determining whether to update the software executing within the computing device comprises determining whether to update the software executing on the computing device based on parameters downloaded from the access control device.

3. The method of claim 2, wherein determining whether to update the software executing within the computing device comprises:

downloading product name and version parameters from the access control device;

comparing the downloaded product name and version parameters to the version of the software residing on the computing device; and

determining to update the software residing on the computing device if the version of the software does not match the version parameter.

4. The method of claim 2, wherein automatically downloading the software update package comprises automatically downloading the software update package from the access control device based on the determination.

5. The method of claim 1, wherein advertising the software update package with the system-level installation service comprises advertising the software update package on-demand when needed by the user by performing a real-time determination of whether to update software installed on the computing device based on corporate policies, downloading the software update package, and advertising the software update package with no action by an administrator.

6. The method of claim 1, wherein authenticating the software update package comprises performing a security check with the system-level installation service to verify that the software update package was produced by a trusted source.

7. The method of claim 6, wherein advertising the software update package comprises advertising the software update package if the security check verifies that the software update package was produced by the trusted source.

8. The method of claim 1, wherein advertising the software update package further comprises advertising the software update package by interacting with a user-level Windows installer executing within the user context of the operating system through a MSIexec command line interface based on the authentication.

9. The method of claim 8, wherein advertising the software update package by interacting with the user-level Windows installer comprises advertising the software update package by issuing a command according to the following syntax to the MSIexec command line interface based on the authentication:

/j<

u|m>

<

Product.msi>

[/t<

Transform List>

][/g<

Language ID>

]

where “

/j”

specifies the advertising function, “

<

u|m>

”

specifies the scope of the advertisement, “

<

Product.msi>

”

specifies the location of the software update package to advertise, “

[/t<

Transform List>

]”

specifies an optional transform list, and “

[/g<

Language ID>

]”

specifies an optional language identifier.

10. The method of claim 1, wherein installing the software update package comprises installing the software update package by interacting with the user-level installer service executing within the user context of the operating system through a command line interface after advertising the software update package to preserve user-specific installation details.

11. The method of claim 10, wherein installing the software update package further comprises installing the software update package by issuing a command according to the following syntax into the command line interface such that user-specific installation details are preserved:

<

/package|/i>

<

Product.msi>

where “

<

/package|/i>

”

specifies the install operation and “

<

Product.msi>

”

specifies the location of the software update package to install.

12. The method of claim 1, wherein the software update package comprises a MSI package delineated by the “

.msi”

file extension.

13. A network system comprising:

an access control device that provides access to an enterprise network using a virtual private network (VPN) and includes software update package; and

a client device that includes;

an operating system that maintains a user context for a user having restricted privileges and a system context having elevated privileges;

a user-level setup module executing within the user context that determines whether to update software residing on a client device based on at least one parameter downloaded from the access control device when the user has successfully logged into the VPN, and wherein the user-level setup module is configured to automatically download the software update package to the user context of the operating system from the access control device based on the determination; and

a system-level installation service executing within the system context of the operating system that is automatically invoked from the user context of the operating system to authenticate the software update package to ensure the software upgrade package is from a trusted source; and

a user-level installer service executing within the user context of the operating system that is invoked by the system-level installation service to advertise the software update package upon request by the system-level installation service by registering the software update package with the operating system to enable subsequent installation of the software update package by the user,

wherein the user-level setup module is configured to direct the user-level installer service to install the authenticated software update package within the client device after the user-level installer service advertises the software update package.

14. The network system of claim 13, wherein the user-level setup module is configured to determine whether to update the software residing on the client device by:

downloading product name and version parameters from the access control device;

comparing the downloaded product name and version parameters to the version of the software residing on the client device; and

determining to update the software residing on the client device if the version of the software does not match the version parameter.

15. The network system of claim 13, wherein the system-level installation service authenticates the software update package by performing a security check to verify that the software update package was produced by a trusted source.

16. The network system of claim 15, wherein the installer service advertises the software update package by advertising the software update package if the security check verifies that that the software update package was produced by the trusted source.

17. The network system of claim 13, wherein the system-level installation service advertises the software update package by advertising the software update package using a command line interface of the user-level installer service based on the authentication.

18. The network system of claim 17, wherein the system-level installation service advertises the software update package via the interactions by issuing a command according to the following syntax into the command line interface based on the authentication:

/j<

u|m>

<

Product.msi>

[/t<

Transform List>

][/g<

Language ID>

],

where “

/j”

specifies the advertising function, “

<

u|m>

”

specifies the scope of the advertisement, “

<

Product.msi>

”

specifies the location of the software update package to advertise, “

[/t<

Transform List>

]”

specifies an optional transform list, and “

[/g<

Language ID>

]”

specifies an optional language identifier.

19. The network system of claim 13, wherein the user-level setup module installs the authenticated software update package by installing the authenticated software update package through interactions with a MSIexec command line interface of a Windows installer after advertising the software update package.

20. The network system of claim 19, wherein the user-level setup module installs the authenticated software update package by issuing a command according to the following syntax into the MSIexec command line interface such that user-specific installation details are preserved:

<

/package|/i>

<

Product.msi>

where “

<

/package|/i>

”

specifies the install operation and “

<

Product.msi>

”

specifies the location of the software update package to install.

21. The network system of claim 13, wherein the software update package comprises a MSI package delineated by the “

.msi”

file extension.

22. The network system of claim 13,

wherein the client device further comprises a system-level access service that executes within the system context, provides secure remote access services to the client device with respect to remotely accessing the enterprise network via the access control device, and loads plug-ins for execution on the client device, and

wherein the system-level installation service comprises a plug-in loaded by the access service from access control device.

23. The network system of claim 13, wherein the client device further comprises a user-level memory within the user context and accessible by the user-level setup module, wherein the user-level setup module stores the software update package to the user-level memory after downloading the software update package.

24. A device comprising:

a processor that executes an operating system that maintains a user context for a user having restricted privileges and a system context having elevated privileges;

a user-level setup module executing within the user context that determines whether to update software residing on the device when needed by the user device based on at least one parameter and automatically download a software update package to the user context of the operating system based on the determination; and

a system-level installation service executing within the system context and invoked by the user-level setup module to authenticate a software update package to ensure the software upgrade package is from a trusted source; and

a user-level installer service executing within the user context of the operating system that is invoked by the system-level installation service to advertise the software update package upon request by the system-level installation service so as to register the software update package with the operating system to enable subsequent installation of the software update package by the user,

wherein the user-level setup module is configured to direct the user-level installer service to install the authenticated software update package within the client device after the user-level installer service advertises the software update package.

25. A non-transitory computer-readable storage medium comprising instructions for causing a processor of a computing device to:

receive, in a user context of an operating system executing on the computing device, parameters for a software update package for a user associated with the computing device, wherein the user context has a restricted privilege level within the computing device;

determine, in the user context, whether to update software executing within the computing device based on the received parameters;

automatically download the software package to the user context of the computing device based on the determination of whether to update the software executed within the computing device;

automatically invoke a system-level installation service from the user context of the operating system of the computing device, wherein the system-level installation service executes within a system context of an operating system of the computing device, authenticates the software update package to ensure the software upgrade package is from a trusted source and, after authenticating the software update package, invokes a user-level installer service executing within the user context to advertise the software update package to the operating system from the user context so as to register the software update package with the operating system and enable subsequent installation of the software update package by the user; and

after advertising the software update package, install the software update package with the user-level installer service executing in the user context of the operation system.