System, security and network management using self-organizing communication orbits in distributed networks

• US 9,246,977 B2
• Filed: 03/12/2013
• Issued: 01/26/2016
• Est. Priority Date: 12/21/2012
• Status: Active Grant

• Current Assignee: Tanium Inc.
• Original Assignee: Tanium Inc.
• Inventors: Hindawi, David, Hindawi, Orion, Lippincott, Lisa, Lincroft, Peter
• Primary Examiner(s): Park, Jeong S
• Application Number:
  US13/797,946
• Publication Number:
  US 20140181247A1
• Time in Patent Office: 1,050 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 41/04 Network management architectures or arrangements
• CPC Class Codes: H04L 41/044 comprising hierarchical management structures
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/344 Out-of-band transfers
• CPC Class Codes: H04L 43/02 Capturing of monitoring data
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks
• CPC Class Codes: H04L 67/1046 Joining mechanisms
• CPC Class Codes: H04L 67/1048 Departure or maintenance mechanisms
• CPC Class Codes: H04L 67/1063 Discovery through centralising entities
• CPC Class Codes: H04L 67/1065 : Discovery involving distributed pre-established resource-based relationships among peers, e.g. based on distributed hash tables [DHT] pre-configuration of logical or physical connections H04L67/1053
• CPC Class Codes: H04L 67/1072 : Discovery involving ranked list compilation of candidate peers
• CPC Class Codes: H04W 24/02 : Arrangements for optimising operational condition
• CPC Class Codes: H04W 48/16 : Discovering, processing access restriction or access information
• CPC Class Codes: H04W 72/20 : Control channels or signalling for resource management
• CPC Class Codes: H04W 8/005 : Discovery of network devices, e.g. terminals
• CPC Class Codes: H04W 84/18 : Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

In one aspect, machines in a managed network implements a set of rules that cause individual machines to directly interact with only a small number of machines in the network (i.e., a local neighborhood within the network), while the independent local actions of the individual machines collectively cause the individual machines to be self-organized into one or more communication orbits without any global control or coordination by a server or an administrator. The communication orbits are used for supporting network, security and system management communications in the managed network.

Claims

1. A method of managing a network comprising a non-static collection of machines, comprising:

at a first client node coupled to the network;

proactively constructing and maintaining a respective local segment of a linear communication orbit in the network,

wherein the respective local segment includes the first client node and four communication channels each originating from or terminating at the first client node, including;

(1) a respective receiving channel for receiving information from a preceding neighbor node of the first client node, (2) a respective reporting channel for sending information from the first client node to the preceding neighbor node, (3) a respective propagation channel for sending information to a succeeding neighbor node of the first client node, and (4) a respective collection channel for receiving information from the succeeding neighbor node of the first client node, and

wherein the proactive constructing and maintaining comprises;

obtaining contact information of one or more potential neighbor nodes for the first client node;

proactively establishing the respective propagation channel from the first client node to a downstream neighbor upon detecting that said respective propagation channel to the downstream neighbor does not already exist, the downstream neighbor comprising a live succeeding node among the one or more potential neighbor nodes; and

when the one or more potential neighbor nodes include at least one preceding node, proactively establishing the respective reporting channel from the first client node to an upstream neighbor upon detecting that said respective reporting channel to the upstream neighbor does not already exist, the upstream neighbor comprising a live preceding node among the one or more potential neighbor nodes,

wherein;

the downstream neighbor also performs said method with the first client node as its respective upstream neighbor and thereby proactively establishes a respective reporting channel from the downstream neighbor to the first client node, the respective reporting channel from the downstream neighbor to the first client node comprising the respective collection channel of the first client node, and

the upstream neighbor also performs said method with the first client node as its respective downstream neighbor and thereby proactively establishes a respective propagation channel from the upstream neighbor to the first client node, the respective propagation channel from the upstream neighbor to the first client node comprising the respective receiving channel of the first client node.

2. The method of claim 1, wherein the one or more potential neighbor nodes are identified based on proximity of respective unique identifiers of the one or more potential neighbor nodes to a respective unique identifier of the first client node.

3. The method of claim 2, wherein the downstream neighbor comprises a closest live succeeding node among the one or more potential neighbor nodes and the upstream neighbor comprises a closest live preceding node among the one or more potential neighbor nodes.

4. The method of claim 3, wherein the proactive constructing and maintaining further comprises:

upon establishing the respective propagation channel from the first client node to the downstream neighbor, terminating a previous propagation channel from the first client node to another succeeding node.

5. The method of claim 3, wherein the proactive constructing and maintaining further comprises:

upon establishing the respective reporting channel from the first client node to the upstream neighbor, terminating a previous reporting channel from the first client node to another preceding node.

6. The method of claim 3, wherein the proactive constructing and maintaining further comprises:

allowing the respective receiving channel from the upstream neighbor to the first client node to be established upon a request by the upstream neighbor, wherein the request has been generated by the upstream neighbor to establish a respective propagation channel thereof.

7. The method of claim 3, wherein the proactive constructing and maintaining further comprises:

allowing the respective collection channel from the downstream neighbor to the first client node to be established upon a request by the downstream neighbor, wherein the request has been generated by the downstream neighbor to establish a respective reporting channel thereof.

8. The method of claim 3, wherein the first client node is a new node to be inserted into the linear communication orbit.

9. The method of claim 3, wherein the first client node is an existing intermediate node in the linear communication orbit.

10. The method of claim 3, wherein the first client node is a new head node to be inserted into the linear communication orbit.

11. The method of claim 3, wherein the first client node is an existing head node of the linear communication orbit.

12. The method of claim 11, wherein the preceding neighbor node of the first client node is the server of the network.

13. The method of claim 3, wherein the first client node is an existing tail node of the linear communication orbit.

14. The method of claim 3, wherein obtaining the contact information of the one or more potential neighbor nodes comprises:

submitting a respective registration message to a server of the network according to a predetermined maintenance schedule, the registration message including a respective unique identifier of the first client node; and

receiving the contact information of the one or more potential neighbor nodes from the server, wherein the one or more potential neighbor nodes have been identified by the server for the first client node.

15. The method of claim 3, wherein proactively establishing the respective propagation channel from the first client node to the downstream neighbor further comprises:

monitoring responsiveness of a receiving end of an existing propagation channel of the first client node;

upon detecting that the receiving end of the existing propagation channel of the first client node has ceased to be responsive, contacting at least one of the one or more potential neighbor nodes to identify the downstream neighbor; and

proactively establishing a new propagation channel from the first client node to the downstream neighbor that has been identified.

16. The method of claim 3, wherein proactively establishing the respective reporting channel from the first client node to the upstream neighbor further comprises:

monitoring responsiveness of a receiving end of an existing reporting channel of the first client node;

upon detecting that the receiving end of the existing reporting channel of the first client node has ceased to be responsive, contacting at least one of the one or more potential neighbor nodes to identify the upstream neighbor; and

proactively establishing a new reporting channel from the first client node to the upstream neighbor that has been identified.

17. A non-transitory computer-readable medium, having instructions stored thereon, which when executed by one or more processors cause the processors to perform operations comprising:

at a first client node coupled to a network comprising a non-static collection of machines;

proactively constructing and maintaining a respective local segment of a linear communication orbit in the network,

wherein the respective local segment includes the first client node and four communication channels each originating from or terminating at the first client node, including;

(1) a respective receiving channel for receiving information from a preceding neighbor node of the first client node, (2) a respective reporting channel for sending information from the first client node to the preceding neighbor node, (3) a respective propagation channel for sending information to a succeeding neighbor node of the first client node, and (4) a respective collection channel for receiving information from the succeeding neighbor node of the first client node, and

wherein the proactive constructing and maintaining comprises;

obtaining contact information of one or more potential neighbor nodes for the first client node;

proactively establishing the respective propagation channel from the first client node to a downstream neighbor upon detecting that said respective propagation channel to the downstream neighbor does not already exist, the downstream neighbor comprising a live succeeding node among the one or more potential neighbor nodes; and

when the one or more potential neighbor nodes include at least one preceding node, proactively establishing the respective reporting channel from the first client node to an upstream neighbor upon detecting that said respective reporting channel to the upstream neighbor does not already exist, the upstream neighbor comprising a live preceding node among the one or more potential neighbor nodes,

wherein;

the downstream neighbor also performs said operations with the first client node as its respective upstream neighbor and thereby proactively establishes a respective reporting channel from the downstream neighbor to the first client node, the respective reporting channel from the downstream neighbor to the first client node comprising the respective collection channel of the first client node, and

the upstream neighbor also performs said method with the first client node as its respective downstream neighbor and thereby proactively establishes a respective propagation channel from the upstream neighbor to the first client node, the respective propagation channel from the upstream neighbor to the first client node comprising the respective receiving channel of the first client node.

18. The computer-readable medium of claim 17, wherein the one or more potential neighbor nodes are identified based on proximity of respective unique identifiers of the one or more potential neighbor nodes to a respective unique identifier of the first client node.

19. The computer-readable medium of claim 18, wherein the downstream neighbor comprises a closest live succeeding node among the one or more potential neighbor nodes and the upstream neighbor comprises a closest live preceding node among the one or more potential neighbor nodes.

20. The computer-readable medium of claim 19, wherein the proactive constructing and maintaining further comprises:

upon establishing the respective propagation channel from the first client node to the downstream neighbor, terminating a previous propagation channel from the first client node to another succeeding node.

21. The computer-readable medium of claim 20, wherein the proactive constructing and maintaining further comprises:

upon establishing the respective reporting channel from the first client node to the upstream neighbor, terminating a previous reporting channel from the first client node to another preceding node.

22. A system, comprising:

one or more processors; and

memory having instructions stored thereon, which when executed by the one or more processors cause the processors to perform operations comprising;

at a first client node coupled to a network comprising a non-static collection of machines;

proactively constructing and maintaining a respective local segment of a linear communication orbit in the network,

wherein the respective local segment includes the first client node and four communication channels each originating from or terminating at the first client node, including;

(1) a respective receiving channel for receiving information from a preceding neighbor node of the first client node, (2) a respective reporting channel for sending information from the first client node to the preceding neighbor node, (3) a respective propagation channel for sending information to a succeeding neighbor node of the first client node, and (4) a respective collection channel for receiving information from the succeeding neighbor node of the first client node, and

wherein the proactive constructing and maintaining comprises;

obtaining contact information of one or more potential neighbor nodes for the first client node;

proactively establishing the respective propagation channel from the first client node to a downstream neighbor upon detecting that said respective propagation channel to the downstream neighbor does not already exist, the downstream neighbor comprising a live succeeding node among the one or more potential neighbor nodes; and

when the one or more potential neighbor nodes include at least one preceding node, proactively establishing the respective reporting channel from the first client node to an upstream neighbor upon detecting that said respective reporting channel to the upstream neighbor does not already exist, the upstream neighbor comprising a live preceding node among the one or more potential neighbor nodes,

wherein;

the downstream neighbor also performs said operations with the first client node as its respective upstream neighbor and thereby proactively establishes a respective reporting channel from the downstream neighbor to the first client node, the respective reporting channel from the downstream neighbor to the first client node comprising the respective collection channel of the first client node, and

the upstream neighbor also performs said method with the first client node as its respective downstream neighbor and thereby proactively establishes a respective propagation channel from the upstream neighbor to the first client node, the respective propagation channel from the upstream neighbor to the first client node comprising the respective receiving channel of the first client node.

23. The system of claim 22, wherein the one or more potential neighbor nodes are identified based on proximity of respective unique identifiers of the one or more potential neighbor nodes to a respective unique identifier of the first client node.

24. The system of claim 23, wherein the downstream neighbor comprises a closest live succeeding node among the one or more potential neighbor nodes and the upstream neighbor comprises a closest live preceding node among the one or more potential neighbor nodes.

25. The system of claim 24, wherein the proactive constructing and maintaining further comprises:

upon establishing the respective propagation channel from the first client node to the downstream neighbor, terminating a previous propagation channel from the first client node to another succeeding node.

26. The system of claim 25, wherein the proactive constructing and maintaining further comprises:

upon establishing the respective reporting channel from the first client node to the upstream neighbor, terminating a previous reporting channel from the first client node to another preceding node.