Operating system patching and software update reconciliation

• US 9,766,873 B2
• Filed: 09/28/2012
• Issued: 09/19/2017
• Est. Priority Date: 08/17/2012
• Status: Active Grant

• Current Assignee: Tripwire Incorporated (Belden Inc.)
• Original Assignee: Tripwire Incorporated (Belden Inc.)
• Inventors: Steigleder, Andrew C.
• Primary Examiner(s): Chowdhury, Ziaul A
• Application Number:
  US13/631,517
• Publication Number:
  US 20140053145A1
• Time in Patent Office: 1,817 Days
• CPC Class Codes: G06F 16/00 Information retrieval; Database structures therefor; File system structures therefor
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 8/658 Incremental updates; Differential updates

Abstract

Apparatus and methods are disclosed for implementing software reconciliation frameworks to process changes detected to software installed on computer hosts. According to one embodiment, a method includes receiving change data describing changes to one or more software components stored on a computer-readable storage device, determining installed software on a computer associated with the computer-readable storage device, receiving a manifest comprising a description of file changes associated with a software patch or update for the installed software, and comparing the change data to the manifest. Based on the comparing, if the change data matches the manifest, the changes are promoted, and if the change data does not match the manifest, the changes are marked for further analysis.

Claims

1. A computer-implemented method of using a Software Reconciliation Framework (SRF) tool for reconciling software changes on a host computer, the method comprising:

receiving detected changes to one or more files stored on a computer-readable storage device coupled to the host computer, the changes being detected with an agent or compliance and configuration tool executing on the host computer;

generating change data describing the detected changes, wherein the change data comprises one or more identifiers of one or more changed files;

determining a network address associated with a software repository for installed software based on repository information stored on the computer-readable storage device;

transmitting a request to receive a manifest for the installed software to a remote server associated with the installed software, the request identifying at least some of the installed software, wherein the request for the manifest is transmitted over a network based on the network address;

responsive to the receiving of the detecting changes, matching the one or more identifiers of the one or more changed files to a change condition associated with the manifest for the installed software, wherein the manifest for the installed software comprises a description of file changes associated with a software patch or update for the installed software, wherein the description of file changes comprises one or more identifiers of files changed by the software patch or update;

comparing the one or more identifiers of the one or more changed files in the change data to the one or more identifiers of files changed by the software patch or update described in the manifest; and

when the comparing indicates the change data matches the manifest, promoting the changes, thereby producing promoted changes, and

when the comparing indicates the change data does not match the manifest, marking the changes for further analysis, thereby producing marked changes.

2. The method of claim 1, wherein an act of determining and comparing are initiated in response to the receiving the changes.

3. The method of claim 1, wherein the manifest is based at least in part on expected changes specified by a user of the computer.

4. The method of claim 1, wherein the manifest is generated by a publisher or distributor of the installed software.

5. The method of claim 1, wherein the manifest is based at least in part on a listing of files associated with a version of the patch or update of the installed software.

6. The method of claim 1, wherein the manifest includes a regular expression describing a data file location that does not include program files for the installed software.

7. The method of claim 1, wherein the change condition associated with the manifest for the installed software comprises a regular expression that is matched to the one or more identifiers of the one or more changed files.

8. The method of claim 1, wherein:

the change data further comprises one or more identifiers of one or more changed registry entries; and

the manifest further comprises one or more identifiers of one or more registry entries changed by the software patch or update.

9. A system, comprising:

one or more processors;

memory coupled to the processors;

at least one network interface; and

one or more non-transitory computer-readable storage media coupled to the processors, the computer-readable storage media storing modules comprising computer-executable instructions executable by the processors, the modules comprising;

a manifest acquisition module stored in the computer-readable storage media, wherein the manifest acquisition module is configured to;

determine a network address associated with a software repository for one or more software modules stored on the computer-readable storage media, based on repository information stored on the computer-readable storage media,

transmit a request to receive one or more manifests for the one or more software modules to a remote server associated with the one or more software modules, wherein the request for the one or more manifests is transmitted over a network based on the network address, and receive the one or more manifests using the network interface, the one or more manifests comprising descriptions of file changes associated with a software patch or update for the one or more software modules stored on the computer-readable storage media, wherein the descriptions of file changes comprise one or more identifiers of files changed by the software patch or update for the one or more software modules;

a user-configurable reconciliation module stored in the computer-readable storage media, wherein the user-configurable reconciliation module is configured to reconcile changes detected in the system by;

causing the manifest acquisition module to request the one or more manifests based on at least one of the detected changes, wherein a data file identifier of the at least one of the detected changes is matched to one or more change conditions associated with the one or more manifests, and reconciling the at least one of the detected changes based on approved changes determined with the received one or more manifests, wherein the reconciling comprises comparing the data file identifier of the at least one of the detected changes to the one or more identifiers of files changed by the software patch or update for the one or more software modules described in the one or more manifests;

a configuration module stored in the computer-readable storage media, wherein the configuration module is configured to provide access to system credentials and network addresses that can be accessed by the manifest acquisition module to request the manifests using an application layer of the network interface; and

a rule configuration module stored in the computer-readable storage media, wherein the rule configuration module is configured to manage rules defining changes to software modules that have been defined as approved.

10. The system of claim 9, further comprising a cache for storing the manifests, the cache allowing the reconciliation module to access a previously-received manifest without using the network interface.

11. The system of claim 9, further comprising a promotion database configured to store definitions of changes that have been promoted using the rule configuration module.

12. One or more non-transitory computer-readable storage media storing computer-executable instructions that, when executed by a processor, cause the processor to perform operations, the operations comprising:

detecting changes to one or more files stored on a computer-readable storage device coupled to a host computer and generating change data describing the detected changes, wherein the change data comprises one or more identifiers of one or more changed files;

determining a network address associated with a software repository for installed software based on repository information stored on the computer-readable storage device;

matching the one or more identifiers of the one or more changed files to a change condition associated with a manifest for the installed software, wherein the manifest comprises a description of file changes associated with a software patch or update for the installed software, wherein the description of file changes comprises one or more identifiers of files changed by the software patch or update;

transmitting a request to receive the manifest for the installed software to a remote server associated with the installed software, the request identifying at least some of the installed software, wherein the request for the manifest is transmitted over a network based on the network address;

comparing the one or more identifiers of the one or more changed files in the change data to the one or more identifiers of files changed by the software patch or update described in the manifest;

if the change data matches the manifest, promoting the changes, thereby producing promoted changes; and

otherwise, marking the changes for further analysis, thereby producing marked changes.

13. The one or more non-transitory computer-readable storage media of claim 12, wherein detecting the changes to the one or more files comprises detecting a file change trigger.

14. The one or more non-transitory computer-readable storage media of claim 12, wherein the detected changes are a first set of detected changes, and wherein the operations further comprise:

detecting a second set of one or more changes, the second set of changes including at least one change in the first set of changes;

comparing one or more identifiers of the one or more changed files in the second set of changes to the one or more identifiers of files changed by the software patch or update described in the manifest; and

not marking at least one of the changes in the second set of changes for further analysis, based on at least one or more of the second set of changes matching one of the produced promoted changes.

15. The one or more non-transitory computer-readable storage media of claim 12, wherein the operations further comprise analyzing the host computer to detect one or more software packages installed on the host computer, wherein the generating the change data is based at least in part on the detected one or more installed software packages.

16. The one or more non-transitory computer-readable storage media of claim 12, wherein the operations further comprise:

generating a description of expected changes by comparing one or more software components associated with a version of the installed software to generate a list of updated or changed software components; and

transmitting the description to the host computer, wherein the description includes an indication of the version of the installed software and the list of updated or changed software components.

17. The one or more non-transitory computer-readable storage media of claim 12, wherein the operations further comprise:

generating a description of expected changes by comparing one or more software components to entries in a user-defined list, the user-defined list indicating expected changes to at least one of the software components installed on the host computer; and

transmitting the description to the host computer, wherein the description includes an indication of the version of the installed software and the list of updated or changed software components.