Managing servers based on pairing keys to implement an administrative domain-wide policy

• US 9,397,892 B2
• Filed: 10/29/2014
• Issued: 07/19/2016
• Est. Priority Date: 11/04/2013
• Status: Active Grant

• Current Assignee: Illumio, Inc.
• Original Assignee: Illumio, Inc.
• Inventors: Kirner, Paul J., Cook, Daniel R., Glenn, Matthew K., Gupta, Mukesh, Scott, Jerry B., Verghese, Thukalan V.
• Primary Examiner(s): BAROT, BHARAT
• Application Number:
  US14/527,372
• Publication Number:
  US 20150127832A1
• Time in Patent Office: 629 Days
• Field of Search: 709202-203, 709223-229
• US Class Current: 1/1
• CPC Class Codes: H04L 41/0869 Validating the configuration within one network element
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/303 Terminal profiles
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC

Abstract

A server is paired. A pairing request that includes a pairing key is received from an unpaired server. A determination is made regarding whether to approve or reject the pairing request. Making the determination comprises attempting to validate the pairing key in the pairing request. Responsive to determining to approve the pairing request: the unpaired server is notified that the unpaired server is now a managed server; a description of the managed server is generated, wherein the managed server description includes a set of one or more labels that describe the managed server; management instructions are generated for the managed server based on the managed server description and based on an administrative domain-wide management policy that includes a rule that refers to managed servers using a label; and the management instructions are sent to the managed server.

Claims

1. A method for pairing a server, comprising:

receiving, from an unpaired server, a pairing request that includes a pairing key and a requested value representing one of;

a requested label, a requested configured characteristic, or a requested server state;

determining whether to approve or reject the pairing request, comprising;

identifying a pairing profile that includes a pairing key that matches the pairing key in the pairing request;

determining that the pairing profile includes a locked default value that matches the requested value;

determining whether the locked default value differs from the requested value; and

determining whether to approve or reject the pairing request based on whether the locked default value differs from the requested value; and

responsive to determining to approve the pairing request;

notifying the unpaired server that the unpaired server is now a managed server;

generating a description of the managed server, wherein the managed server description includes a set of one or more labels that describe the managed server, wherein the generated managed server description uses the locked default value responsive to approval of the pairing request;

generating management instructions for the managed server based on the managed server description and based on an administrative domain-wide management policy that includes a rule that refers to managed servers using a label; and

sending the management instructions to the managed server.

2. The method of claim 1, further comprising:

attempting to validate the pairing key in the pairing request, comprising;

attempting to identify a pairing profile that includes a pairing key that matches the pairing key in the pairing request; and

responsive to failing to identify the pairing profile that includes the pairing key that matches the pairing key in the pairing request;

determining that the pairing key in the pairing request is invalid; and

determining to reject the pairing request.

3. The method of claim 2, wherein attempting to validate the pairing key in the pairing request further comprises:

responsive to identifying the pairing profile that includes the pairing key that matches the pairing key in the pairing request, determining whether the pairing key in the pairing request has been exhausted, has expired, or has been revoked; and

responsive to determining that the pairing key in the pairing request has been exhausted, has expired, or has been revoked;

determining that the pairing key in the pairing request is invalid; and

determining to reject the pairing request.

4. The method of claim 1, wherein the pairing request further includes information regarding the unpaired server, and wherein determining whether to approve or reject the pairing request further comprises:

identifying a pairing profile that includes a pairing key that matches the pairing key in the pairing request;

determining that the pairing profile includes a test to perform using the unpaired server information;

performing the test using the unpaired server information; and

responsive to the test failing, determining to reject the pairing request.

5. The method of claim 4, wherein the test concerns the unpaired server'"'"'s geographical location, operating system, service information, cloud service provider, or threat status.

6. The method of claim 1, further comprising responsive to determining to approve the pairing request and prior to notifying the unpaired server that the unpaired server is now the managed server:

analyzing information associated with the unpaired server; and

based on the analysis, approving or rejecting a change of the unpaired server to the managed server,

wherein generating the managed server description comprises setting a server state of the managed server to a “

managed”

server state.

7. The method of claim 1, further comprising prior to receiving, from the unpaired server, the pairing request that includes the pairing key:

generating the pairing key; and

storing the pairing key.

8. The method of claim 7, further comprising prior to receiving, from the unpaired server, the pairing request that includes the pairing key:

sending the pairing key to the unpaired server using out-of-band communication.

9. The method of claim 1, further comprising responsive to determining to reject the pairing request:

generating a log entry that includes the pairing request, a reason for rejecting the pairing request, or a timestamp indicating when the rejection occurred; and

storing the log entry.

10. A non-transitory computer-readable storage medium storing computer program modules for pairing a server, the computer program modules comprising instructions for performing steps comprising:

receiving, from an unpaired server, a pairing request that includes a pairing key and a requested value representing one of;

a requested label, a requested configured characteristic, or a requested server state;

determining whether to approve or reject the pairing request, comprising;

identifying a pairing profile that includes a pairing key that matches the pairing key in the pairing request;

determining that the pairing profile includes a locked default value that matches the requested value;

determining whether the locked default value differs from the requested value; and

determining whether to approve or reject the pairing request based on whether the locked default value differs from the requested value; and

responsive to determining to approve the pairing request;

notifying the unpaired server that the unpaired server is now a managed server;

generating a description of the managed server, wherein the managed server description includes a set of one or more labels that describe the managed server, wherein the generated managed server description uses the locked default value responsive to approval of the pairing request;

generating management instructions for the managed server based on the managed server description and based on an administrative domain-wide management policy that includes a rule that refers to managed servers using a label; and

sending the management instructions to the managed server.

11. The non-transitory computer-readable storage medium of claim 10, wherein the computer program modules further comprise instructions for performing steps comprising:

attempting to validate the pairing key in the pairing request comprising;

attempting to identify a pairing profile that includes a pairing key that matches the pairing key in the pairing request; and

responsive to failing to identify the pairing profile that includes the pairing key that matches the pairing key in the pairing request;

determining that the pairing key in the pairing request is invalid; and

determining to reject the pairing request.

12. The non-transitory computer-readable storage medium of claim 11, wherein attempting to validate the pairing key in the pairing request further comprises:

responsive to identifying the pairing profile that includes the pairing key that matches the pairing key in the pairing request, determining whether the pairing key in the pairing request has been exhausted, has expired, or has been revoked; and

responsive to determining that the pairing key in the pairing request has been exhausted, has expired, or has been revoked;

determining that the pairing key in the pairing request is invalid; and

determining to reject the pairing request.

13. The non-transitory computer-readable storage medium of claim 10, wherein the pairing request further includes information regarding the unpaired server, and wherein determining whether to approve or reject the pairing request further comprises:

identifying a pairing profile that includes a pairing key that matches the pairing key in the pairing request;

determining that the pairing profile includes a test to perform using the unpaired server information;

performing the test using the unpaired server information; and

responsive to the test failing, determining to reject the pairing request.

14. The non-transitory computer-readable storage medium of claim 13, wherein the test concerns the unpaired server'"'"'s geographical location, operating system, service information, cloud service provider, or threat status.

15. The non-transitory computer-readable storage medium of claim 10, wherein the steps further comprise responsive to determining to approve the pairing request and prior to notifying the unpaired server that the unpaired server is now the managed server:

analyzing information associated with the unpaired server; and

based on the analysis, approving or rejecting a change of the unpaired server to the managed server,

wherein generating the managed server description comprises setting a server state of the managed server to a “

managed”

server state.

16. The non-transitory computer-readable storage medium of claim 10, wherein the computer program modules further comprise instructions for performing steps comprising:

prior to receiving, from the unpaired server, the pairing request that includes the pairing key;

generating the pairing key; and

sending the pairing key to the unpaired server using out-of-band communication.

17. A computer system for pairing a server, the computer system comprising:

a processor; and

a non-transitory computer-readable storage medium storing computer program modules comprising instructions for execution by the processor, the computer program modules comprising instructions for performing steps comprising;

receiving, from an unpaired server, a pairing request that includes a pairing key and a requested value representing one of;

a requested label, a requested configured characteristic, or a requested server state;

determining whether to approve or reject the pairing request, comprising;

identifying a pairing profile that includes a pairing key that matches the pairing key in the pairing request;

determining that the pairing profile includes a locked default value that matches the requested value;

determining whether the locked default value differs from the requested value; and

determining whether to approve or reject the pairing request based on whether the locked default value differs from the requested value; and

responsive to determining to approve the pairing request;

notifying the unpaired server that the unpaired server is now a managed server;

generating a description of the managed server, wherein the managed server description includes a set of one or more labels that describe the managed server, wherein the generated managed server description uses the locked default value responsive to approval of the pairing request;

generating management instructions for the managed server based on the managed server description and based on an administrative domain-wide management policy that includes a rule that refers to managed servers using a label; and

sending the management instructions to the managed server; and

a computer processor for executing the computer program modules.

18. The computer system of claim 17, wherein the computer program modules further comprise instructions for performing steps comprising:

attempting to validate the pairing key in the pairing request, comprising;

attempting to identify a pairing profile that includes a pairing key that matches the pairing key in the pairing request; and

responsive to failing to identify the pairing profile that includes the pairing key that matches the pairing key in the pairing request;

determining that the pairing key in the pairing request is invalid; and

determining to reject the pairing request.

19. The computer system of claim 17, wherein the pairing request further includes information regarding the unpaired server, and wherein determining whether to approve or reject the pairing request further comprises:

identifying a pairing profile that includes a pairing key that matches the pairing key in the pairing request;

determining that the pairing profile includes a test to perform using the unpaired server information;

performing the test using the unpaired server information; and

responsive to the test failing, determining to reject the pairing request.

20. The computer system of claim 17, wherein the computer program modules further comprise instructions for performing steps comprising:

responsive to determining to approve the pairing request and prior to notifying the unpaired server that the unpaired server is now the managed server;

analyzing information associated with the unpaired server; and

based on the analysis, approving or rejecting a change of the unpaired server to the managed server,

wherein generating the managed server description comprises setting a server state of the managed server to a “

managed”

server state.