Creation and maintenance of self-organizing communication orbits in distributed networks

• US 9,059,961 B2
• Filed: 03/12/2013
• Issued: 06/16/2015
• Est. Priority Date: 12/21/2012
• Status: Active Grant

• Current Assignee: Tanium Inc.
• Original Assignee: Tanium Inc.
• Inventors: Hindawi, David, Hindawi, Orion, Lippincott, Lisa, Lincroft, Peter
• Primary Examiner(s): Hussain, Tauqir
• Application Number:
  US13/797,962
• Publication Number:
  US 20140181295A1
• Time in Patent Office: 826 Days
• Field of Search: 709/224
• US Class Current: 1/1
• CPC Class Codes: H04L 41/04 Network management architectures or arrangements
• CPC Class Codes: H04L 41/044 comprising hierarchical management structures
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/344 Out-of-band transfers
• CPC Class Codes: H04L 43/02 Capturing of monitoring data
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks
• CPC Class Codes: H04L 67/1046 Joining mechanisms
• CPC Class Codes: H04L 67/1048 Departure or maintenance mechanisms
• CPC Class Codes: H04L 67/1063 Discovery through centralising entities
• CPC Class Codes: H04L 67/1065 : Discovery involving distributed pre-established resource-based relationships among peers, e.g. based on distributed hash tables [DHT] pre-configuration of logical or physical connections H04L67/1053
• CPC Class Codes: H04L 67/1072 : Discovery involving ranked list compilation of candidate peers
• CPC Class Codes: H04W 24/02 : Arrangements for optimising operational condition
• CPC Class Codes: H04W 48/16 : Discovering, processing access restriction or access information
• CPC Class Codes: H04W 72/20 : Control channels or signalling for resource management
• CPC Class Codes: H04W 8/005 : Discovery of network devices, e.g. terminals
• CPC Class Codes: H04W 84/18 : Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

In one aspect, machines in a managed network implements a set of rules that cause individual machines to directly interact with only a small number of machines in the network (i.e., a local neighborhood within the network), while the independent local actions of the individual machines collectively cause the individual machines to be self-organized into one or more communication orbits without any global control or coordination by a server or an administrator. The communication orbits are used for supporting network, security and system management communications in the managed network.

Claims

1. A method of managing a network comprising a non-static collection of machines, comprising:

at a first client node to be coupled to the network;

providing a registration message to a server of the network, the registration message specifying a respective unique identifier of the first client node;

receiving from the server contact information of one or more potential neighbor nodes for the first client node in a linear communication orbit, wherein the linear communication orbit is formed by a plurality of client nodes currently known to exist in the network according to a sequential order of respective unique identifiers of the plurality of client nodes, wherein the linear communication orbit includes a head node, a tail node, and a sequence of one or more intermediate nodes between the head node and the tail node, and wherein the server provides management messages to the plurality of client nodes through the head node, and each intermediate node receives the management messages from the server through a respective upstream neighbor node in the linear communication orbit and forwards the management messages to a respective downstream neighbor node in the linear communication orbit;

proactively establishing a respective reporting channel for providing information to a respective upstream neighbor of the first client node and allowing a respective receiving channel for receiving information from the respective upstream neighbor to be established by the respective upstream neighbor, the respective upstream neighbor comprising a closest live preceding node among the one or more potential neighbor nodes; and

when the one or more potential neighbor nodes include at least one live succeeding node;

proactively establishing a respective propagation channel for providing information to a respective downstream neighbor of the first client node and allowing a respective collection channel for receiving information from the respective downstream neighbor to be established by the respective downstream neighbor, the respective downstream neighbor comprising a closest live succeeding node among the one or more potential neighbor nodes; and

upon establishment of the respective receiving and propagation channels, terminating an existing communication channel from the server to the first client node and an existing communication channel from the first client node to the server.

2. The method of claim 1, further comprising:

prior to establishment of the respective receiving channel for receiving information from the respective upstream neighbor and the respective reporting channel for sending information to the respective upstream neighbor, proactively establishing a first communication channel for receiving information from the server, and a second communication channel for sending information to the server.

3. The method of claim 1, further comprising:

receiving a network management message from the respective upstream neighbor via the respective receiving channel of the first client node, the network management message including instructions from the server regarding a network management action;

performing the network management action according to the instructions in the network management message;

updating the network management message with local updates by the first client node; and

forwarding the updated network management message to the respective downstream neighbor via the respective propagation channel of the first client node.

4. The method of claim 1, further comprising:

receiving a report message from the respective downstream neighbor via the respective collection channel of the first client node;

updating the report message with local updates by the first client node; and

forwarding the updated report message to the respective upstream neighbor via the respective reporting channel of the first client node.

5. The method of claim 1, wherein:

when the one or more potential neighbor nodes include at least one live succeeding node;

the first client node establishes the respective propagation channel of the first client node before the respective receiving channel of the first client node is established; and

the first client node terminates the existing communication channel from the first client node to the server before terminating the existing communication channel from the server to the first client node.

6. A non-transitory computer-readable medium, having instructions stored thereon, which when executed by one or more processors cause the processors to perform operations comprising:

at a first client node to be coupled to a network comprising a non-static collection of machines;

providing a registration message to a server of the network, the registration message specifying a respective unique identifier of the first client node;

receiving from the server contact information of one or more potential neighbor nodes for the first client node in a linear communication orbit, wherein the linear communication orbit is formed by a plurality of client nodes currently known to exist in the network according to a sequential order of respective unique identifiers of the plurality of client nodes, wherein the linear communication orbit includes a head node, a tail node, and a sequence of one or more intermediate nodes between the head node and the tail node, and wherein the server provides management messages to the plurality of client nodes through the head node, and each intermediate node receives the management messages from the server through a respective upstream neighbor node in the linear communication orbit and forwards the management messages to a respective downstream neighbor node in the linear communication orbit;

proactively establishing a respective reporting channel for providing information to a respective upstream neighbor of the first client node and allowing a respective receiving channel for receiving information from the respective upstream neighbor to be established by the respective upstream neighbor, the respective upstream neighbor comprising a closest live preceding node among the one or more potential neighbor nodes; and

when the one or more potential neighbor nodes include at least one live succeeding node;

proactively establishing a respective propagation channel for providing information to a respective downstream neighbor of the first client node and allowing a respective collection channel for receiving information from the respective downstream neighbor to be established by the respective downstream neighbor, the respective downstream neighbor comprising a closest live succeeding node among the one or more potential neighbor nodes; and

upon establishment of the respective receiving and propagation channels, terminating an existing communication channel from the server to the first client node and an existing communication channel from the first client node to the server.

7. The non-transitory computer-readable medium of claim 6, wherein the operations further comprise:

prior to establishment of the respective receiving channel for receiving information from the respective upstream neighbor and the respective reporting channel for sending information to the respective upstream neighbor, proactively establishing a first communication channel for receiving information from the server, and a second communication channel for sending information to the server.

8. A system, comprising:

one or more processors; and

memory having instructions stored thereon, which when executed by the one or more processors cause the processors to perform operations comprising;

at a first client node to be coupled to a network comprising a non-static collection of machines;

providing a registration message to a server of the network, the registration message specifying a respective unique identifier of the first client node;

receiving from the server contact information of one or more potential neighbor nodes for the first client node in a linear communication orbit, wherein the linear communication orbit is formed by a plurality of client nodes currently known to exist in the network according to a sequential order of respective unique identifiers of the plurality of client nodes, wherein the linear communication orbit includes a head node, a tail node, and a sequence of one or more intermediate nodes between the head node and the tail node, and wherein the server provides management messages to the plurality of client nodes through the head node, and each intermediate node receives the management messages from the server through a respective upstream neighbor node in the linear communication orbit and forwards the management messages to a respective downstream neighbor node in the linear communication orbit;

proactively establishing a respective reporting channel for providing information to a respective upstream neighbor of the first client node and allowing a respective receiving channel for receiving information from the respective upstream neighbor to be established by the respective upstream neighbor, the respective upstream neighbor comprising a closest live preceding node among the one or more potential neighbor nodes; and

when the one or more potential neighbor nodes include at least one live succeeding node;

proactively establishing a respective propagation channel for providing information to a respective downstream neighbor of the first client node and allowing a respective collection channel for receiving information from the respective downstream neighbor to be established by the respective downstream neighbor, the respective downstream neighbor comprising a closest live succeeding node among the one or more potential neighbor nodes; and

upon establishment of the respective receiving and propagation channels, terminating an existing communication channel from the server to the first client node and an existing communication channel from the first client node to the server.

9. The system of claim 8, wherein the operations further comprise:

prior to establishment of the respective receiving channel for receiving information from the respective upstream neighbor and the respective reporting channel for sending information to the respective upstream neighbor, proactively establishing a first communication channel for receiving information from the server, and a second communication channel for sending information to the server.

10. A method of managing a network comprising a non-static collection of machines, comprising:

at a server of the network;

maintaining a record identifying a plurality of client nodes known to be coupled to the network during a present timeframe, wherein the plurality of client nodes are self-organized in a linear communication orbit, wherein the plurality of client nodes in the linear communication orbit include a head node, a tail node, and a sequence of one or more intermediate nodes between the head node and the tail node, and wherein the server provides management messages to the plurality of client nodes through the head node, and each intermediate node receives the management messages from the server through a respective upstream neighbor node in the linear communication orbit and forwards the management messages to a respective downstream neighbor node in the linear communication orbit;

receiving a respective request from a first client node to join the network; and

based on a respective unique identifier of the first client node, providing, to the first client node, contact information for a plurality of potential neighbor nodes for the first client node in the linear communication orbit, wherein the contact information is utilized by the first client node to establish a communication channel with at least one of the potential neighbor nodes and become part of the linear communication orbit.

11. The method of claim 10, wherein providing the contact information is based on a sequential order of the respective unique identifier of the first client node relative to respective unique identifiers of the plurality of client nodes.

12. The method of claim 10, wherein the plurality of potential neighbor nodes include one or more succeeding neighbor nodes for the first client node, and the one or more succeeding neighbor nodes include the head node of the linear communication orbit.

13. The method of claim 10, wherein the plurality of potential neighbor nodes include one or more preceding neighbor nodes for the first client node, and the one or more preceding neighbor nodes include the tail node of the linear communication orbit.

14. The method of claim 10, further comprising:

allowing a respective communication channel from the server to the first client node to persist until a forward communication channel has been established from a respective preceding neighbor node of the plurality of potential neighbor nodes to the first client node.

15. The method of claim 10, further comprising:

allowing a respective communication channel from the first client node to the server to persist until a forward communication channel has been established from the first client node to a respective succeeding neighbor node of the one or more potential neighbor nodes.

16. The method of claim 10, further comprising:

allowing a respective communication channel from the server to the head node to persist until a forward communication channel has been established from the first client machine to the head node.

17. The method of claim 16, further comprising:

allowing a respective communication channel from the head node to the server to persist until a backward communication channel has been established from the head node to the first client node.

18. The method of claim 17, further comprising:

after the respective communication channel from the server to the head node and the respective communication channel from the head node to the server have been terminated, utilizing the first client node as a new head node of the linear communication orbit.

19. The method of claim 10, wherein providing the contact information is based on a sequential order of respective IP addresses of the first client node and the plurality of client nodes.

20. The method of claim 10, wherein the contact information of the potential neighbor nodes are respective IP addresses of the potential neighbor nodes.

21. The method of claim 10, further comprising:

receiving respective registration messages from the plurality of client nodes according to a predetermined schedule; and

upon detecting that a particular client node of the plurality of client nodes has failed to provide a respective registration message according to the predetermined schedule, updating the record to reflect departure of the particular client node from the network and the linear communication orbit.

22. The method of claim 10, further comprising:

providing a particular management message to the plurality of client nodes by sending the particular management message to the head node via a respective communication channel from the server to the head node, wherein the head node acts upon the particular management message according to instructions contained in the particular management message and forwards the particular management message to a respective downstream neighbor of the head node in the linear communication orbit.

23. The method of claim 10, further comprising:

receiving a management report from at least one of the plurality of client nodes currently known to exist in the linear communication orbit, wherein management report includes information provided by a sequence of one or more client nodes preceding said at least one client node in the linear communication orbit.

24. The method of claim 23, wherein the at least one of the plurality of client nodes is the tail node of the linear communication orbit.

25. A non-transitory computer-readable medium, having instructions stored thereon, which when executed by one or more processors cause the processors to perform operations comprising:

at a server of a network comprising a non-static collection of machines;

maintaining a record identifying a plurality of client nodes known to be coupled to the network during a present timeframe, wherein the plurality of client nodes are self-organized in a linear communication orbit, wherein the plurality of client nodes in the linear communication orbit include a head node, a tail node, and a sequence of one or more intermediate nodes between the head node and the tail node, and wherein the server provides management messages to the plurality of client nodes through the head node, and each intermediate node receives the management messages from the server through a respective upstream neighbor node in the linear communication orbit and forwards the management messages to a respective downstream neighbor node in the linear communication orbit;

receiving a respective request from a first client node to join the network; and

based on a respective unique identifier of the first client node, providing, to the first client node, contact information for a plurality of potential neighbor nodes for the first client node in the linear communication orbit, wherein the contact information is utilized by the first client node to establish a communication channel with at least one of the potential neighbor nodes and become part of the linear communication orbit.

26. The non-transitory computer-readable medium of claim 25, wherein providing the contact information is based on a sequential order of the respective unique identifier of the first client node relative to respective unique identifiers of the plurality of client nodes.

28. The system of claim 26, wherein providing the contact information is based on a sequential order of the respective unique identifier of the first client node relative to respective unique identifiers of the plurality of client nodes.

27. A system, comprising:

one or more processors; and

memory having instructions stored thereon, which when executed by the one or more processors cause the processors to perform operations comprising;

at a server of a network comprising a non-static collection of machines;

maintaining a record identifying a plurality of client nodes known to be coupled to the network during a present timeframe, wherein the plurality of client nodes are self-organized in a linear communication orbit, wherein the plurality of client nodes in the linear communication orbit include a head node, a tail node, and a sequence of one or more intermediate nodes between the head node and the tail node, and wherein the server provides management messages to the plurality of client nodes through the head node, and each intermediate node receives the management messages from the server through a respective upstream neighbor node in the linear communication orbit and forwards the management messages to a respective downstream neighbor node in the linear communication orbit; and

receiving a respective request from a first client node to join the network;

based on a respective unique identifier of the first client node, providing, to the first client node, contact information for a plurality of potential neighbor nodes for the first client node in the linear communication orbit, wherein the contact information is utilized by the first client node to establish a communication channel with at least one of the potential neighbor nodes and become part of the linear communication orbit.