Systems and methods for enrolling and configuring agents

• US 9,515,877 B1
• Filed: 07/29/2014
• Issued: 12/06/2016
• Est. Priority Date: 07/29/2014
• Status: Active Grant

• Current Assignee: Ivanti, Inc. (Ivanti Software, Inc.)
• Original Assignee: Crimson Corporation
• Inventors: Tempel, Mark Robert, McDonald, Sean Michael, Krueger, Nicholas Paul, Hazzard, Matthew Mark, Olson, Kevin Gerard
• Primary Examiner(s): Zhao, Don
• Application Number:
  US14/445,353
• Time in Patent Office: 861 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method of managing an agent by an administrative server is described. The method includes receiving an enrollment request from the agent. The agent is disconnected from a core server, and the core server is periodically connected to the administrative server. The method also includes performing a provisional enrollment procedure with the agent. The method further includes performing an enrollment procedure between the agent and the core server. The method additionally includes performing a configuration procedure between the agent and the core server.

Claims

1. A method of managing an agent by an administrative server, comprising:

receiving, by the administrative server, an enrollment request from the agent that is running on a computing device, wherein the agent is disconnected from a core server, wherein the administrative server periodically establishes a network connection to the core server to facilitate the enrollment request;

performing a provisional enrollment procedure with the agent;

performing an enrollment procedure between the agent and the core server, comprising;

sending the enrollment request received from the agent to the core server during the network connection; and

receiving configuration information from the core server; and

the administrative server facilitating a configuration procedure on the agent based on the configuration information received from the core server, wherein the configuration information is stored at the administrative server and sent to the agent in response to a request from the agent for the configuration information.

2. The method of claim 1, wherein performing the provisional enrollment procedure comprises:

storing the enrollment request; and

sending a provisional enrollment policy to the agent in response to the enrollment request.

3. The method of claim 1, wherein performing the enrollment procedure between the agent and the core server comprises:

receiving an enrollment response and policy from the core server in response to the enrollment request;

storing the enrollment response and policy;

receiving a request for the enrollment response and policy from the agent; and

sending the enrollment response and policy to the agent.

4. The method of claim 1, wherein the enrollment request from the agent is created using authentication information received from the core server via the administrative server.

5. The method of claim 1, wherein the administrative server is a multi-tenant cloud-based administrative server.

6. The method of claim 1, wherein facilitating the configuration procedure on the agent comprises:

receiving the configuration information from the core server, wherein the configuration information comprises confidential configuration information and non-confidential configuration information;

storing the configuration information;

sending the configuration information to the agent in response to the request from the agent for the configuration information;

receiving configuration operation results from the agent, wherein the configuration operation results comprise confidential configuration operation results and non-confidential configuration operation results; and

sending the configuration operation results to the core server in response to a request from the core server for the configuration operation results.

7. The method of claim 6, wherein the configuration information includes past configurations of the agent with serial numbers indicating latest configuration information.

8. The method of claim 6, wherein the confidential configuration information is encrypted with a digital certificate public key of the agent and signed with a digital certificate private key of the core server.

9. The method of claim 6, wherein the non-confidential configuration information is signed with a digital certificate private key of the core server.

10. The method of claim 6, wherein the confidential configuration operation results are encrypted with a digital certificate public key of the core server and signed with a digital certificate private key of the agent.

11. The method of claim 6, wherein the non-confidential configuration operation results are signed with a digital certificate private key of the agent.

12. The method of claim 1, further comprising:

receive a request for a secure token from the core server that is based on registration credential information entered into a web portal

authenticate the request for the secure token based on input from a human administrative server administrator; and

send the secure token to the core server.

13. An administrative server that is configured for managing an agent, comprising:

a processor;

memory in electronic communication with the processor; and

instructions stored in the memory, the instructions being executable to;

receive, by the administrative server, an enrollment request from the agent that is running on a computing device, wherein the agent is disconnected from a core server, wherein the administrative server periodically establishes a network connection to the core server to facilitate the enrollment request;

perform a provisional enrollment procedure with the agent;

perform an enrollment procedure between the agent and the core server, comprising instructions executable to;

send the enrollment request received from the agent to the core server during the network connection; and

receive configuration information from the core server; and

facilitate a configuration procedure on the agent based on the configuration information received from the core server, wherein the configuration information is stored at the administrative server and sent to the agent in response to a request from the agent for the configuration information.

14. The administrative server of claim 13, wherein the instructions executable to perform the provisional enrollment procedure comprise instructions executable to:

store the enrollment request; and

send a provisional enrollment policy to the agent in response to the enrollment request.

15. The administrative server of claim 13, wherein the instructions executable to perform the enrollment procedure between the agent and the core server comprise instructions executable to:

receive an enrollment response and policy from the core server in response to the enrollment request;

store the enrollment response and policy;

receive a request for the enrollment response and policy from the agent; and

send the enrollment response and policy to the agent.

16. The administrative server of claim 13, wherein the enrollment request from the agent is created using authentication information received from the core server via the administrative server.

17. The administrative server of claim 13, wherein the administrative server is a multi-tenant cloud-based administrative server.

18. The administrative server of claim 13, wherein the instructions executable to facilitate the configuration procedure on the agent comprise instructions executable to:

receive the configuration information from the core server, wherein the configuration information comprises confidential configuration information and non-confidential configuration information;

store the configuration information;

send the configuration information to the agent in response to the request from the agent for the configuration information;

receive configuration operation results from the agent, wherein the configuration operation results comprise confidential configuration operation results and non-confidential configuration operation results; and

send the configuration operation results to the core server in response to a request from the core server for the configuration operation results.

19. The administrative server of claim 18, wherein the configuration information includes past configurations of the agent with serial numbers indicating latest configuration information.

20. The administrative server of claim 18, wherein the confidential configuration information is encrypted with a digital certificate public key of the agent and signed with a digital certificate private key of the core server.

21. The administrative server of claim 18, wherein the non-confidential configuration information is signed with a digital certificate private key of the core server.

22. The administrative server of claim 18, wherein the confidential configuration operation results are encrypted with a digital certificate public key of the core server and signed with a digital certificate private key of the agent.

23. The administrative server of claim 18, wherein the non-confidential configuration operation results are signed with a digital certificate private key of the agent.