Evaluation systems and methods for coordinating software agents

• US 9,680,699 B2
• Filed: 11/03/2015
• Issued: 06/13/2017
• Est. Priority Date: 09/19/2006
• Status: Active Grant

• Current Assignee: MEC Management, LLC (Three Affiliated Tribes of the Fort Berthold Reservation, North Dakota)
• Original Assignee: The Invention Science Fund I, L.L.C. (Intellectual Ventures LLC)
• Inventors: Mangione-Smith, William Henry, Cohen, Alexander J., Jung, Edward K. Y., Levien, Royce A., Lord, Robert W., Malamud, Mark A.
• Primary Examiner(s): LEE, JASON T
• Application Number:
  US14/931,847
• Publication Number:
  US 20160234065A1
• Time in Patent Office: 588 Days
• Field of Search: 726 1, 726 4, 726 5
• CPC Class Codes: H04L 41/048 mobile agents
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04W 12/08 Access security

Abstract

A device, method, computer program product, and network subsystem are described for associating a first mobile agent with a first security policy and a second mobile agent with a second security policy or for providing a first agent with code for responding to situational information about the first agent and about a second agent and for evaluating a received message at least in response to an indication of the first security policy and to an indication of the second security policy or for deploying the first agent.

Claims

1. A network subsystem including at least one application distributed across a plurality of network nodes, the network subsystem comprising:

circuitry configured for providing a first agent with code for responding to situational information about the first agent and about a second agent including at least code configured for sending an inquiry to one or more network locations to determine whether the one or more network locations have one or more resources that enable performance of one or more selected data-transformative operations and code configured for obtaining raw vulnerability data; and

circuitry configured for deploying the first agent based on the determination of whether the one or more network locations have one or more resources that enable performance of one or more selected data-transformative operations including at least one security control operation.

2. The network subsystem of claim 1 wherein the circuitry configured for providing a first agent with code for responding to situational information about the first agent and about a second agent comprises:

circuitry configured for implementing a situation-dependent logic table in the first agent.

3. The network subsystem of claim 1 wherein the circuitry configured for providing a first agent with code for responding to situational information about the first agent and about a second agent comprises:

circuitry configured associating the second agent as a mobile agent successively with a series of past or current locations specified by Internet Protocol addresses.

4. The network subsystem of claim 1 wherein the circuitry configured for providing a first agent with code for responding to situational information about the first agent and about a second agent comprises:

circuitry configured for sending an inquiry to a network location; and

circuitry configured for receiving data from the network location.

5. The network subsystem of claim 1 wherein the circuitry configured for providing a first agent with code for responding to situational information about the first agent and about a second agent comprises:

at least one of

circuitry configured for deploying a mobile software agent as the second agent;

or

circuitry configured for transmitting the second agent to a processing core.

6. The network subsystem of claim 1 further comprising:

at least one of;

circuitry configured for performing one or more other operations;

circuitry configured for generating the situational information based on an agent output;

circuitry configured for receiving situational data about the second agent via the first agent;

or

circuitry configured for receiving situational data from the second agent.

7. The network subsystem of claim 1 wherein the circuitry configured for providing a first agent with code for responding to situational information about the first agent and about a second agent comprises:

circuitry configured for obtaining one or more risk indicators in the situational information about the first agent and about the second agent.

8. The network subsystem of claim 1 wherein the circuitry configured for providing a first agent with code for responding to situational information about the first agent and about a second agent comprises:

circuitry configured for including at least code for receiving a capacity indicator of the situational information.

9. The network subsystem of claim 1 wherein the circuitry configured for providing a first agent with code for responding to situational information about the first agent and about a second agent comprises:

circuitry configured for including at least code for obtaining a handle of a network location of the situational information.

10. The network subsystem of claim 1 wherein the circuitry configured for providing a first agent with code for responding to situational information about the first agent and about a second agent comprises:

circuitry configured for receiving a mobile software agent as the first agent.

11. The network subsystem of claim 1 wherein the circuitry configured for providing a first agent with code for responding to situational information about the first agent and about a second agent comprises:

circuitry configured for obtaining the code for responding to the situational information about the first agent and about the second agent before obtaining the first agent.

12. The network subsystem of claim 1 wherein the circuitry configured for providing a first agent with code for responding to situational information about the first agent and about a second agent comprises:

circuitry configured for configuring the first agent with policy update code.

13. The network subsystem of claim 1 wherein the circuitry configured for deploying the first agent comprises:

circuitry configured for deploying the first agent locally.

14. The network subsystem of claim 1 wherein the circuitry configured for deploying the first agent comprises:

circuitry configured for deploying the first agent to a first location in response to an association between a second location and the second agent.

15. The network subsystem of claim 1 further comprising:

one or more antennas operably coupled with the circuitry configured for deploying the first agent.

16. The network subsystem of claim 1 further comprising:

one or more data storage devices operably coupled with the circuitry configured for deploying the first agent.

17. The network subsystem of claim 1 further comprising:

one or more user interfaces operably coupled with the circuitry configured for deploying the first agent.

18. The network subsystem of claim 1 further comprising:

one or more processor cores operably coupled with the circuitry configured for deploying the first agent.

19. The network subsystem of claim 1 further comprising:

one or more power supplies operably coupled with the circuitry configured for deploying the first agent.

20. The network subsystem of claim 1 wherein the circuitry configured for deploying the first agent comprises:

at least one of;

circuitry configured for deploying the first agent to a first core operable to transmit a signal to a location of the second agent directly via a passive medium;

or

circuitry configured for deploying the first agent to a first core able to communicate with the second agent.

21. The network subsystem of claim 1 wherein the circuitry configured for providing a first agent with code for responding to situational information about the first agent and about a second agent comprises:

 

circuitry configured for associating the second agent with a remote location.

22. The network subsystem of claim 1 wherein the circuitry configured for providing a first agent with code for responding to situational information about the first agent and about a second agent comprises:

circuitry configured for sending an inquiry to a network location.

23. The network subsystem of claim 1 further comprising:

circuitry configured for sending a signal to the first agent.

24. The network subsystem of claim 1 further comprising:

circuitry configured for receiving a security policy update.

26. The network subsystem of claim 1 wherein the circuitry configured for providing a first agent with code for responding to situational information about the first agent and about a second agent includes:

circuitry configured for providing a first agent with code for responding to situational information about the first agent and about a second agent including at least code configured for sending an inquiry to one or more network locations to determine whether the one or more network locations have sufficient resources including at least one of processing power surplus, an upgrade, electrical power, internet service, geographic information, or surplus storage that enable performance of one or more selected data-transformative operations.

27. The network subsystem of claim 1 wherein the circuitry configured for providing a first agent with code for responding to situational information about the first agent and about a second agent includes:

circuitry configured for providing a first agent with code for responding to situational information about the first agent and about a second agent including at least code configured for broadcasting an inquiry to available nodes of an ad hoc network to determine whether the one or more network locations have one or more resources that enable performance of one or more selected data-transformative operations.

28. The network subsystem of claim 1 wherein the circuitry configured for providing a first agent with code for responding to situational information about the first agent and about a second agent includes:

circuitry configured for providing a first agent with code for responding to situational information about the first agent and about a second agent including at least code configured for sending an inquiry to one or more network locations to determine whether the one or more network locations have sufficient resources including at least one of encryption functionality, compiling functionality, compressing functionality, or multiplexing functionality that enable performance of one or more selected data-transformative operations.

29. The network subsystem of claim 1 wherein the circuitry configured for providing a first agent with code for responding to situational information about the first agent and about a second agent includes:

circuitry configured for providing a first agent with code for responding to situational information about the first agent and about a second agent including at least code configured for sending an inquiry to one or more network locations to determine whether the one or more network locations have one or more resources that enable performance of one or more selected data-transformative operations including at least one of encrypting, compiling, compressing, or multiplexing.

30. The network subsystem of claim 1 wherein the circuitry configured for providing a first agent with code for responding to situational information about the first agent and about a second agent includes:

circuitry configured for providing a first agent with code for responding to situational information about the first agent and about a second agent wherein the situational information includes situational aspects including at least one of location, connection types, aspects of resources, trust indications, aspects of policies, resource availability, policy availability, active processes, active controls, timestamps, or version indicators.

31. The network subsystem of claim 1 wherein the circuitry configured for deploying the first agent based on the determination of whether the one or more network locations have one or more resources that enable performance of one or more selected data-transformative operations including at least one security control operation includes:

circuitry configured for deploying the first agent based on the determination of whether the one or more network locations have one or more resources that enable performance of one or more selected data-transformative operations including at least one security policy update.

32. The network subsystem of claim 1 wherein the circuitry configured for deploying the first agent based on the determination of whether the one or more network locations have one or more resources that enable performance of one or more selected data-transformative operations including at least one security control operation includes:

circuitry configured for deploying the first agent based on the determination of whether the one or more network locations have one or more resources that enable performance of one or more selected data-transformative operations including at least one security policy patch.

33. The network subsystem of claim 1 wherein the circuitry configured for deploying the first agent based on the determination of whether the one or more network locations have one or more resources that enable performance of one or more selected data-transformative operations including at least one security control operation includes:

circuitry configured for deploying the first agent based on the determination of whether the one or more network locations have one or more resources that enable performance of one or more selected data-transformative operations including at least one security configuration authorization.

25. A computer program product comprising:

a non-transitory signal-bearing medium bearing at least;

one or more instructions for associating a first mobile agent with a first security policy and a second mobile agent with a second security policy; and

one or more instructions for evaluating a received message at least in response to an indication of the first security policy and to an indication of the second security policy including at least one or more instructions for updating at least one of the first security policy or the second security policy responsive to one or more inquiries relating to at least one of the first security policy or the second security policy operating in one or more processing cores.