System and method for deploying preconfigured software

• US 9,244,671 B2
• Filed: 03/27/2013
• Issued: 01/26/2016
• Est. Priority Date: 12/25/2012
• Status: Active Grant

• Current Assignee: Lab A.O. Kaspersky
• Original Assignee: Lab A.O. Kaspersky
• Inventors: Voronkov, Konstantin P., Deshevykh, Stepan N., Yablokov, Victor V.
• Primary Examiner(s): MITCHELL, JASON D
• Application Number:
  US13/851,791
• Publication Number:
  US 20140181801A1
• Time in Patent Office: 1,035 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 8/63 Image based installation; Cloning; Build to order

Abstract

Automated deployment of a software application to be installed via a software installation package onto different user devices for different users. An initial software installation package, is obtained, along with information representing (a) associations between the users and the user devices, (b) user attributes from which access privilege level information for individual users is determinable, and (c) device attributes for each of the plurality of user devices, including network connectivity information. The initial software installation package is custom-configured for individual user devices based on the information representing (a) and (b) to produce a different specially-configured software installation packages. Each one includes installation parameters that establish functionality for the software application based on the access privilege level of the corresponding user. Data transfer channels are custom-configured for individual user devices based on the information representing (a) and (c).

Claims

1. A system for automated deployment of a software application to be installed, via a software installation package provided over a computer network, onto a plurality of different user devices for a plurality of different users, the system comprising:

a set of instructions executable by computing hardware and stored in a non-transitory storage medium that, when executed, cause the computing hardware to implement;

a task manager module that obtains an initial software installation package, and automatically communicates with a network attributes data store via the computer network to obtain information representing (a) associations between the plurality of users and the plurality of user devices, (b) user attributes from which access privilege level information for individual users is determinable, and (c) device attributes for each of the plurality of user devices, including network connectivity information;

a configurator module that;

determines a user-associated security policy requirement based on the obtained information representing (a), (b), and (c);

custom-configures the initial software installation package for individual ones of the plurality of user devices based on the obtained information to produce a plurality of different specially-configured software installation packages, each one of which corresponds to one or more specific users and one or more specific user devices, wherein each specially-configured software installation package includes installation parameters that establish functionality for the software application based on the access privilege level of the corresponding one or more specific users and on the user-associated security policy requirement; and

determines a type of data transfer network and a type of destination address, based on the obtained information for each one of the user devices to receive the software installation package delivery;

selects and custom-configures data transfer channels for delivering the specially-configured software installation packages to respective individual ones of the plurality of user devices based on the obtained information, and further based on the determined type of data transfer network and the determined type of destination address for each one of the user devices, each data transfer channel being automatically selected by the configurator module from among a plurality of different operative data transfer channels, each of the plurality of different operative data transfer channels configured to meet the security policy requirement such that data transfer channels incompatible with the security policy requirement are excluded from the plurality of different operative data transfer channels, and each selected data transfer channel corresponding to one or more specific users and one or more specific user devices, wherein each selected data transfer channel is associated with a selected data transfer protocol determined by the configurator module to meet the security policy requirement for the one or more specific user devices from among a set of different available data transfer protocols.

2. The system of claim 1, wherein the software application is a security application user agent.

3. The system of claim 1, wherein the functionality for the software application based on the access privilege level of the corresponding one or more specific users includes a capability to provide certain access credential information.

4. The system of claim 1, wherein the configurator module is adapted to produce each specially-configured software installation package such that the installation parameters establish functionality based further on the device attributes corresponding to the one or more user devices.

5. The system of claim 1, wherein the task manager module is adapted to obtain information representing a security policy, and wherein the configurator module is adapted to produce each specially-configured software installation package such that the installation parameters establish functionality based further on that security policy.

6. The system of claim 5, wherein the configurator module applies a set of expert rules to produce each specially-configured software installation package, wherein the set of expert rules define various software installation package parameter settings according to various characteristics of the security policy.

7. The system of claim 1, wherein the network attributes data store includes a directory service.

8. The system of claim 1, wherein the task manager module and the configurator module are executed on an administration server that is remotely situated from, but communicatively coupled to, the plurality of user devices and the network attributes data store.

9. The system of claim 1, wherein user attributes from which the access privilege level information for individual users is determinable includes at least one attribute selected from the group consisting of:

a title or role of the user in an organization;

a configuration of the user device, attributes of a network connection between the user device and the task manager module, a list of network resources accessible to the user via the user device;

an identification of an organization to which the user is assigned.

10. The system of claim 1, wherein the configurator module is communicatively coupled to a data delivery service module that supplies a link to a data store from which each specially-configured software installation package is downloadable by each user device.

11. The system of claim 1, wherein the configurator module is communicatively coupled to a mobile device administration module that supplies a link to a data store from which each specially-configured software installation package for user devices that are mobile devices is downloadable by each user device via a messaging service specific to mobile devices.

12. The system of claim 1, wherein the network connectivity information in (b) includes at least one attribute selected from the group consisting of:

a physical location of the user device, a presence of one or more certain communication modules on a user device, a mode of network connectivity employed by a user device, or any combination thereof.

13. The system of claim 1, wherein the configurator module custom-configures each data transfer channel differently in response to each item of network connectivity information that relates to mode of connectivity selected from among wired or wireless modes of network connectivity.

14. The system of claim 1, wherein the configurator module custom-configures each data transfer channel differently in response to each item of network connectivity information that relates to mode of connectivity selected from among local area network and wide area network connectivity.

15. The system of claim 1, wherein the configurator module custom-configures each data transfer channel differently in response to each item of network connectivity information that relates to mode of connectivity selected from among relatively low-bandwidth connectivity, and relatively high-bandwidth connectivity.

16. The system of claim 1, wherein the configurator module custom-configures each data transfer channel to include a certain degree of data encryption in response to each item of network connectivity information relating to security risk.

17. A method for automated deployment of a software application to be installed, via a software installation package provided over a computer network, onto a plurality of different user devices for a plurality of different users, the method comprising:

obtaining an initial software installation package, and information representing (a) associations between the plurality of users and the plurality of user devices, (b) user attributes from which access privilege level information for individual users is determinable, and (c) device attributes for each of the plurality of user devices, including network connectivity information;

determining a user-associated security policy requirement based on the obtained information representing (a), (b), and (c);

custom-configuring the initial software installation package for individual ones of the plurality of user devices based on the obtained information to produce a plurality of different specially-configured software installation packages, each one of which corresponds to one or more specific users and one or more specific user devices, wherein each specially-configured software installation package includes installation parameters that establish functionality for the software application based on the access privilege level of the corresponding one or more specific users;

determining a type of data transfer network and a type of destination address for each one of the user devices to receive the software installation package delivery;

selecting and custom-configuring data transfer channels for delivering the specially-configured software installation packages to respective individual ones of the plurality of user devices based on the obtained information, and further based on the determined type of data transfer network and the determined type of destination address for each one of the user devices, each data transfer channel being automatically selected by the configurator module from among a plurality of different available operative data transfer channels, each of the plurality of different operative data transfer channels configured to meet the security policy requirement such that data transfer channels incompatible with the security policy requirement are excluded from the plurality of different operative data transfer channels, and each selected data transfer channel corresponding to one or more specific users and one or more specific user devices, wherein each selected data transfer channel is associated with a selected data transfer protocol determined to meet the security policy requirement for the one or more specific user devices from among a set of different available data transfer protocols.

18. The method of claim 17, further comprising:

supplying, to each user device, a link to a data store from which each specially-configured software installation package is downloadable by each user device.

19. The method of claim 17, further comprising:

supplying, to each user device that is a mobile user device, a link to a data store from which each specially-configured software installation package is downloadable by each mobile user device via a messaging service specific to mobile devices.

20. The method of claim 17, wherein custom-configuring data transfer channels includes configuring each data transfer channel differently in response to each item of network connectivity information that relates to mode of connectivity selected from among wired or wireless modes of network connectivity.

21. The method of claim 17, wherein custom-configuring data transfer channels includes configuring each data transfer channel differently in response to each item of network connectivity information that relates to mode of connectivity selected from among local area network and wide area network connectivity.

22. The method of claim 17, wherein custom-configuring data transfer channels includes configuring each data transfer channel differently in response to each item of network connectivity information that relates to mode of connectivity selected from among relatively low-bandwidth connectivity, and relatively high-bandwidth connectivity.

23. The method of claim 17, wherein custom-configuring data transfer channels includes configuring each data transfer channel to include a certain degree of data encryption in response to each item of network connectivity information relating to security risk.