Formalizing, diffusing and enforcing policy advisories and monitoring policy compliance in the management of networks

• US 9,231,827 B2
• Filed: 09/29/2009
• Issued: 01/05/2016
• Est. Priority Date: 11/09/2001
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Hindawi, David Salim, Donoho, David Leigh, Lippincott, Lisa Ellen, Goodrow, Dennis S., Brown, James Milton, Lincroft, Peter, Loer, Peter Benjamin, Hindawi, Orion Yosef
• Primary Examiner(s): NGUYEN, THU HA T
• Application Number:
  US12/569,640
• Publication Number:
  US 20100017494A1
• Time in Patent Office: 2,289 Days
• Field of Search: 709/223, 709/224
• US Class Current: 1/1
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements

Abstract

An apparatus and method for centralized policy management of large-scale networks (221) of computational devices is disclosed. The apparatus includes a number of distributed clients (400) run on registered computers (201-203), gathering policy advisories (401) and reporting (405) relevance (403) to a system administrator (224). The system administrator may view the relevant messages (505) through a management interface (500) and deploy suggested actions to distributed clients (503), where the actions are executed to apply the solutions of the advisories (408).

Claims

1. A system for communications comprising;

a processor; and

a memory coupled to the processor, wherein the memory comprises instructions which, when executed by the processor, cause the processor to;

gather, by a distributed client, advice messages from at least one advice provider site based on status of the distributed client;

determine relevance of each advice message by evaluating a relevance clause of the advice message with respect to properties of a computational device on which the distributed client runs;

responsive to determining a given advice message is relevant to the distributed client, report the given advice message from the distributed client to a management system, wherein the given advice message comprises an action to perform; and

responsive to receiving an action request from the management system, perform, by the distributed client, the action on the computational device.

2. The system of claim 1, wherein the instructions further cause the processor to:

register, by the distributed client, with the management system to identify that it is running and ready to communicate.

3. The system of claim 1, wherein gathering advice messages comprises:

gathering the advice messages from a mirror server, wherein the mirror server receives a pool of advice messages for a plurality of distributed clients.

4. The system of claim 3, wherein the distributed client communicates with the mirror server via a local area network.

5. The system of claim 3, wherein the mirror server communicates with the at least one advice provider site via the Internet.

6. The system of claim 1, wherein a given action request from the management system requests a given action comprising at least one of:

delete, move or copy files;

set or delete registry entries;

run operating system or programming language commands;

delete, add, or commit dynamic-link library modules;

delete, close, or restore an advice message;

subscribe or unsubscribe to a given advice provider site;

change a gathering schedule or force an immediate gathering of advice messages;

or

force an immediate relevance evaluation of advice messages.

7. The system of claim 1, wherein the distributed client gathers the advice messages anonymously.

8. The system of claim 1, wherein the advice messages are encrypted.

9. The system of claim 8, wherein each advice message comprises an explanatory message.

10. The system of claim 8, wherein each advice message comprises at least one action that provides a solution.

11. The system of claim 1, wherein reporting the given advice message from the distributed client to the management system comprises:

sending a text file from the distributed client to a reporting server within the management system using a hypertext transport protocol POST operation.

12. The system of claim 11, wherein the text file contains, in a transparent format, list of all changes in relevance status on the computational device since a previous relevance evaluation.

13. The system of claim 1, wherein the management system comprises a management interface configured to perform:

displaying advice messages;

deploying actions;

monitoring actions; and

monitoring status of distributed clients.

14. The system of claim 13, wherein the management interface is further configured to perform:

adding, modifying, or canceling a subscription of a given distributed client to one or more advice provider sites.

15. The system of claim 13, wherein the management interface is further configured to perform:

selecting a group of computational devices, specifying action messages, scheduling, and controlling execution when deploying actions proposed by relevant advice messages.

16. The system of claim 13, wherein the management interface is further configured to perform:

deploying encrypted actions of relevant advice messages to a selected group of distributed clients.

17. The system of claim 13, wherein the management interface is further configured to perform:

monitoring status of each distributed client while actions are being deployed and executed; and

stopping previously deployed actions which have not finished running.

18. The system of claim 1, further comprising:

a central database for storing data about distributed clients, about messages that are being actively monitored, and about actions being deployed and monitored.

19. A method, in a data processing system, for communications, the method comprising;

gathering, by a distributed client running on a computing device in the data processing system, advice messages from at least one advice provider site based on status of the distributed client;

determining relevance of each advice message by evaluating a relevance clause of the advice message with respect to properties of the computing device;

responsive to determining a given advice message is relevant to the distributed client, reporting the given advice message from the distributed client to a management system, wherein the given advice message comprises an action to perform; and

responsive to receiving an action request from the management system, performing, by the distributed client, the action on the computing device.

20. The method of claim 19, further comprising:

registering, by the distributed client, with the management system to identify that it is running and ready to communicate.

21. The method of claim 19, wherein gathering advice messages comprises:

gathering the advice messages from a mirror server, wherein the mirror server receives a pool of advice messages for a plurality of distributed clients.

22. The method of claim 21, wherein the distributed client communicates with the mirror server via a local area network.

23. The method of claim 21, wherein the mirror server communicates with the at least one advice provider site via the Internet.

24. The method of claim 19, wherein the distributed client gathers the advice messages anonymously.

25. The method of claim 19, wherein the advice messages are encrypted.

26. The method of claim 25, wherein each advice message comprises an explanatory message.

27. The method of claim 25, wherein each advice message comprises at least one action that provides a solution.

28. The method of claim 19, wherein the management system comprises a management interface configured to perform:

displaying advice messages;

deploying actions;

monitoring actions; and

monitoring status of distributed clients.

29. The method of claim 28, wherein the management interface is further configured to perform:

adding, modifying, or canceling a subscription of a given distributed client to one or more advice provider sites.

30. The method of claim 28, wherein the management interface is further configured to perform:

selecting a group of computing devices, specifying action messages, scheduling, and controlling execution when deploying actions proposed by relevant advice messages.

31. The method of claim 28, wherein the management interface is further configured to perform:

deploying encrypted actions of relevant advice messages to a selected group of distributed clients.

32. The method of claim 28, wherein the management interface is further configured to perform:

monitoring status of each distributed client while actions are being deployed and executed; and

stopping previously deployed actions which have not finished running.

33. The method of claim 19, further comprising:

storing in a central database data about distributed clients, about messages that are being actively monitored, and about actions being deployed and monitored.

34. A computer program product comprising a computer readable storage medium having a computer readable program stored therein, wherein the computer readable program, when executed on a computing device, causes the computing device to:

gather, by a distributed client running on the computing device, advice messages from at least one advice provider site based on status of the distributed client;

determine, by the distributed client, relevance of each advice message by evaluating a relevance clause of the advice message with respect to properties of the computing device;

responsive to the distributed client determining a given advice message is relevant, reporting the given advice message from the distributed client to a management system, wherein the given advice message comprises an action to perform; and

responsive to receiving an action request from the management system, performing, by the distributed client, the action on the computing device.

35. The computer program product of claim 34, wherein the computer readable program further causes the computing device to:

register, by the distributed client, with the management system to identify that it is running and ready to communicate.

36. The computer program product of claim 34, wherein gathering advice messages comprises:

gathering the advice messages from a mirror server, wherein the mirror server receives a pool of advice messages for a plurality of distributed clients.

37. The computer program product of claim 34, wherein the management system comprises a management interface configured to perform:

displaying advice messages;

deploying actions;

monitoring actions; and

monitoring status of distributed clients.