Method and apparatus for process enforced configuration management

• US 8,701,182 B2
• Filed: 07/25/2012
• Issued: 04/15/2014
• Est. Priority Date: 01/10/2007
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Bhargava, Rishi, Vittal, Chiradeep, Saveram, Swaroop
• Primary Examiner(s): Gee, Jason
• Application Number:
  US13/558,181
• Publication Number:
  US 20120297176A1
• Time in Patent Office: 629 Days
• Field of Search: 726/17, 726/21
• US Class Current: 726/17
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3051 Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs verification or detection of system hardware configuration G06F11/2247
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules

Abstract

A system for and method of automatically enforcing a configuration change process for change requests of one or more configurable element within one or more configurable computation systems. The system comprises means for managing a configuration change process for one or more configurable elements within a corresponding configurable computation system, means for generation a configuration request, means for applying a set of authorization rules to the configuration change requests to generate selective authorization of the CEs, and means for selectively locking and unlocking changes to configurable elements within the configurable computational systems.

Claims

1. A method comprising:

managing, using a configuration management system, a configuration change process for a plurality of configurable elements (CEs) within a corresponding at least one configurable computation system (CCS);

generating, using the configuration management system, a configuration change request for the plurality of configurable elements;

applying, using an analytics module communicably connected to the CCS over a network, one or more authorization rules to a configuration change request to generate a selective configuration change authorization for a subset of the CEs meeting the one or more authorization rules;

providing a time window in the selective configuration change authorization, during which configuration changes are enabled, to one or more selective configuration locks in the at least one CCS corresponding to the subset of the one or more CEs over the network; and

selectively locking configuration changes, using the one or more selective configuration locks in the at least one CCS corresponding to the subset of the one or more CEs, wherein the locking can selectively enable configuration changes to the subset of the one or more CEs according to the time window in the selective configuration change authorization.

2. The method of claim 1, wherein the applying one or more authorization rules further comprises processing one or more current conditions as a variable in generating the selective configuration change authorization.

3. The method of claim 2, wherein the one or more current conditions include at least one of:

a current time, a date, a day of the week, an inventory level, and a state of a mechanical device.

4. The method of claim 1, further comprising authenticating the selective configuration change authorization of one or more selective locks.

5. The method of claim 4, wherein the authenticating comprises a secure socket layer (SSL) key exchange.

6. The method of claim 1, wherein the locking the configuration changes further comprises generating configuration change status information.

7. The method of claim 6, further comprising associating the configuration change status information with the configuration change request.

8. The method of claim 7, wherein the associating the configuration change status information further associates the configuration change status information with the corresponding CCS of the associated configuration change request.

9. The method of claim 8, wherein the associating the configuration change status information further associates the configuration change status information with the corresponding one or more CEs of the associated configuration change request.

10. The method of claim 9, wherein the configuration change status information contains at least one of:

the status of each CE configuration change, the status of each CCS configuration change, and information associated with success or failure of the CE configuration change.

11. The method of claim 8, further comprising generating a report, wherein the report contains the configuration change status information, wherein the status information is associated with at least one of the configuration change requests, the corresponding CEs, and the corresponding CCSs.

12. Logic encoded in non-transitory media that includes instructions for execution and when executed by a processor, is operable to perform operations comprising:

managing, using a configuration management system, a configuration change process for a plurality of configurable elements (CEs) within a corresponding at least one configurable computation system (CCS);

generating, using the configuration management system, a configuration change request for the plurality of configurable elements;

applying, using an analytics module communicably connected to the CCS over a network, one or more authorization rules to a configuration change request to generate a selective configuration change authorization for a subset of the CEs meeting the one or more authorization rules;

providing a time window in the selective configuration change authorization, during which configuration changes are enabled, to one or more selective configuration locks in the at least one CCS corresponding to the subset of the one or more CEs over the network; and

selectively locking configuration changes, using the one or more selective configuration locks in the at least one CCS corresponding to the subset of the one or more CEs, wherein the locking can selectively enable configuration changes to the subset of the one or more CEs according to the time window in the selective configuration change authorization.

13. The logic of claim 12, wherein the applying one or more authorization rules further comprises processing one or more current conditions as a variable in generating the selective configuration change authorization.

14. The logic of claim 12, the operations further comprising authenticating the selective configuration change authorization of one or more selective locks.

15. The logic of claim 12, wherein the locking configuration changes further comprises generating configuration change status information.

16. The logic of claim 15, further comprising associating the configuration change status information with the configuration change request.

17. One or more processors configured to execute instructions, the instructions, comprising:

managing, using a configuration management system, a configuration change process for a plurality of configurable elements (CEs) within a corresponding at least one configurable computation system (CCS);

generating, using the configuration management system, a configuration change request for the plurality of configurable elements;

applying, using an analytics module communicably connected to the CCS over a network, one or more authorization rules to a configuration change request to generate a selective configuration change authorization for a subset of the CEs meeting the one or more authorization rules;

providing a time window in the selective configuration change authorization, during which configuration changes are enabled, to one or more selective configuration locks in the at least one CCS corresponding to the subset of the one or more CEs over the network; and

selectively locking configuration changes, using the one or more selective configuration locks in the at least one CCS corresponding to the subset of the one or more CEs, wherein the locking can selectively enable configuration changes to the subset of the one or more CEs according to the time window in the selective configuration change authorization.

18. The instructions of claim 17, wherein the applying the one or more authorization rules further comprises processing one or more current conditions as a variable in generating the selective configuration change authorization.

19. The instructions of claim 17, further configured for authenticating the selective configuration change authorization of one or more selective locks.

20. The instructions of claim 17, wherein the locking the configuration changes further comprises generating configuration change status information.