Systems and methods for distributed node detection and management

• US 8,533,309 B1
• Filed: 10/24/2005
• Issued: 09/10/2013
• Est. Priority Date: 10/24/2005
• Status: Active Grant

• Current Assignee: Ivanti, Inc. (Ivanti Software, Inc.)
• Original Assignee: Crimson Corporation
• Inventors: Howarth, Mark E., Johnson, Peter E., Clay, Phillip E.
• Primary Examiner(s): Wang, Liangche A
• Assistant Examiner(s): LIN, SHERMAN L
• Application Number:
  US11/257,246
• Time in Patent Office: 2,878 Days
• Field of Search: 709/224, 709/223
• US Class Current: 709/223
• CPC Class Codes: H04L 41/048 mobile agents
• CPC Class Codes: H04L 41/0853 by actively collecting configuration information or by backing up configuration information
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes

Abstract

A discovery agent is running on a node within the network group. The network group is shielded from an administrative system by a communication limiting device. The communication limiting device prevents the administrative system from detecting nodes within the network group. The communication limiting device, however, does not prevent the node running the discovery agent from identifying other nodes within the network group. The discovery agent detects one or more nodes within the network group and transmits data identifying these nodes to the administrative system. Accordingly, the administrative system may identify and manage the newly detected nodes using a management agent installed on the nodes.

Claims

1. A method of detecting and managing nodes within a network group, comprising:

providing an administrative computer system, a network group, and a communication pathway for electronic communication between the administrative computer system and the network group, wherein a communication limiting device in the communication pathway prevents the administrative computer system from detecting a first node within the network group;

managing a second node within the network group using a management agent to enable the administrative computer system to communicate with and manage the second node through the communication limiting device;

from the second node within the network group, detecting, by a discovery agent installed on the second node, the first node within the network group, wherein the discovery agent is separate and distinct from the management agent;

obtaining, at the second node, identifying data to identify the first node, wherein the identifying data comprises an address of the first node;

transferring the address of the first node to the administrative computer system;

transferring an installable management agent from the second node to the first node;

transferring the discovery agent to the first node, wherein the discovery agent is transferred after the transfer of the installable management agent to the first node, and wherein the discovery agent on the first node is executable to detect additional nodes, wherein the identifying data is obtained at the second node before the installable management agent and the discovery agent are transferred to the first node, wherein the address of the first node is obtained by the second node and transferred from the second node to the administrative computer system before the discovery agent is transferred to the first node;

installing and maintaining the installable management agent on the first node to enable the administrative computer system to communicate with and manage the first node through the communication limiting device; and

maintaining the discovery agent on the first node to detect additional nodes.

2. The method of claim 1, further comprising:

compiling a list of nodes within the network group that are managed by the administrative computer system; and

based on the identifying data, determining whether the first node is included in the list of nodes, wherein transferring the installable management agent to the first node is based on whether the first node is included in the list of nodes.

3. The method of claim 1, wherein transferring the installable management agent to the first node comprises transferring the installable management agent from the second node to the first node.

4. The method of claim 3, wherein a domain login script on the second node is configured to transfer the installable management agent to the first node.

5. The method of claim 1, further comprising transferring credential data to the administrative system to enable the administrative system to communicate with the first node.

6. The method of claim 5, wherein transferring the installable management agent to the first node comprises transferring the installable management agent from the administrative system to the first node.

7. The method of claim 6, wherein the credential data allows the administrative system to establish a virtual private network connection with the first node.

8. The method of claim 1, wherein at least one of the first and second nodes are end-user nodes.

9. The method of claim 1, wherein the administrative computer system sends a command to the second node to transfer the installable management agent to the first node, wherein the installable management agent is not transferred to the first node until the command from the administrative computer system is received.

10. The method of claim 1, wherein obtaining identifying data to identify the first node comprises querying, by the discovery agent, at least one of User Datagram Protocol (UDP) packets, directory services, a Domain Name System (DNS) table, a Dynamic Host Configuration Protocol (DHCP) table, and a router table.

11. A system for detecting and managing nodes within a network group, comprising:

a first and a second node within a network group, the first and second nodes being in electronic communication with each other;

an administrative computer system;

a communication pathway for electronic communication between the network group and the administrative computer system;

a communication limiting device in the communication pathway that prevents the administrative computer system from detecting the first node within the network group, wherein the second node and administrative system include a computer-readable storage medium comprising instructions for detecting and managing nodes within the network group, the instructions being executable to;

manage the second node within the network group using a management agent to enable the administrative system to communicate with and manage the second node through the communication limiting device;

from the second node within the network group, detect, by a discovery agent installed on the second node, the first node within the network group, wherein the discovery agent is separate and distinct from the management agent;

obtain, at the second node, identifying data to identify the first node, wherein the identifying data comprises an address of the first node;

transfer the address of the first node to the administrative computer system;

transfer an installable management agent from the second node to the first node;

transfer the discovery agent to the first node, wherein the discovery agent is transferred after the transfer of the management agent to the first node, and wherein the discovery agent on the first node is executable to detect additional nodes, wherein the identifying data is obtained at the second node before the management agent and the discovery agent are transferred to the first node, wherein the address of the first node is obtained by the second node and transferred from the second node to the administrative computer system before the discovery agent is transferred to the first node;

install and maintain the installable management agent on the first node to enable the administrative computer system to communicate with and manage the first node through the communication limiting device; and

maintain the discovery agent on the first node to detect additional nodes.

12. The system of claim 11, wherein the instructions are further executable to:

compile a list of nodes within the network group that are managed by the administrative computer system; and

based on the identifying data, determine whether the first node is included in the list of nodes, wherein transferring the installable management agent to the first node is based on whether the first node is included in the list of nodes.

13. The system of claim 11, wherein the instructions to transfer the installable management agent to the first node comprise instructions to transfer the installable management agent from the second node to the first node.

14. The system of claim 11, wherein at least one of the first and second nodes are end-user nodes.

15. A non-transitory computer-readable storage medium comprising executable instructions for detecting and managing nodes within a network group, the instructions being executable to:

provide an administrative computer system, a network group, and a communication pathway for electronic communication between the administrative computer system and the network group, wherein a communication limiting device in the communication pathway prevents the administrative computer system from detecting a first node within the network group;

manage a second node within the network group using a management agent to enable the administrative system to communicate with and manage the second node through the communication limiting device;

from the second node within the network group, detect, by a discovery agent installed on the second node, the first node within the network group, wherein the discovery agent is separate and distinct from the management agent;

obtain, at the second node, identifying data to identify the first node, wherein the identifying data comprises an address of the first node;

transfer the address of the first node to the administrative computer system;

transfer an installable management agent from the second node to the first node;

transfer the discovery agent to the first node, wherein the discovery agent is transferred after the transfer of the installable management agent to the first node, and wherein the discovery agent on the first node is executable to detect additional nodes, wherein the identifying data is obtained at the second node before the management agent and the discovery agent are transferred to the first node, wherein the address of the first node is obtained by the second node and transferred from the second node to the administrative computer system before the discovery agent is transferred to the first node;

install and maintain the installable management agent on the first node to enable the administrative computer system to communicate with and manage the first node through the communication limiting device; and

maintain the discovery agent on the first node to detect additional nodes.

16. The non-transitory computer-readable storage medium of claim 15, wherein the instructions are further executable to:

compile a list of nodes within the network group that are managed by the administrative computer system; and

based on the identifying data, determine whether the first node is included in the list of nodes, wherein transferring the installable management agent to the first node is based on whether the first node is included in the list of nodes.

17. The non-transitory computer-readable storage medium of claim 15, wherein at least one of the first and second nodes are end-user nodes.