Fast detection and remediation of unmanaged assets

• US 9,769,037 B2
• Filed: 11/25/2014
• Issued: 09/19/2017
• Est. Priority Date: 11/27/2013
• Status: Active Grant

• Current Assignee: Tanium Inc.
• Original Assignee: Tanium Inc.
• Inventors: Hindawi, David, Hindawi, Orion, Lippincott, Lisa, Lincroft, Peter
• Primary Examiner(s): Shin, Kyung H
• Application Number:
  US14/553,769
• Publication Number:
  US 20150149624A1
• Time in Patent Office: 1,029 Days
• Field of Search: 709223, 709224
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/044 comprising hierarchical management structures
• CPC Class Codes: H04L 41/0853 by actively collecting configuration information or by backing up configuration information
• CPC Class Codes: H04L 41/0866 Checking the configuration
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 43/065 related to network devices
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

In one aspect, methods, system, and computer-readable media for monitoring unmanaged assets in a network having a plurality of managed machines include: at a first managed machine of the plurality of managed machines, wherein the plurality of managed machine are arranged in a linear communication orbit and have respective identifiers, and each managed machine is coupled to at least one respective neighbor by a corresponding local segment of the linear communication orbit: responding to a detection instruction for detecting unmanaged assets currently present in the network, by: scanning for live unmanaged machines within a selected portion of the network that is associated with a range of identifiers that includes identifiers between the respective identifiers of the first managed machine and a respective neighbor of the first managed machine; and generating a local report identifying one or more unmanaged machines that have been detected within the selected portion of the network.

Claims

1. A method of monitoring unmanaged assets in a network having a plurality of managed machines, comprising:

at a first managed machine of the plurality of managed machines, wherein the plurality of managed machines are arranged in a linear communication orbit in accordance with a predefined order of respective machine identifiers of the plurality of managed machines, and each managed machine is coupled to at least one respective neighbor machine in the linear communication orbit by a corresponding local segment of the linear communication orbit;

responding to a detection instruction for detecting unmanaged assets currently present in the network, by;

scanning for live unmanaged machines within a first selected portion of the network that corresponds to a first range of machine identifiers that is between the respective machine identifiers of a respective upstream neighbor of the first managed machine and a respective downstream neighbor of the first managed machine in the linear communication orbit; and

generating a local report identifying one or more unmanaged machines that have been detected within the first selected portion of the network.

2. The method of claim 1, wherein each live unmanaged machine comprises a machine that responds to one or more predefined inquiries with one or more responses indicating that the machine is live and indicating that the machine is not a managed machine.

3. The method of claim 1, wherein the plurality of managed machines have self-assembled into the linear communication orbit in accordance with the predefined order of respective machine identifiers that have been assigned to the plurality of managed machines.

4. The method of claim 1, further comprising:

receiving the detection instruction from the respective upstream neighbor of the first managed machine, wherein the detection instruction has propagated from a source machine to the first managed machine through the linear communication orbit in a downstream direction.

5. The method of claim 4, further comprising:

in response to receiving the detection instruction from the respective upstream neighbor of the first managed machine, forwarding the detection instruction to the respective downstream neighbor of the first managed machine in the linear communication orbit.

6. The method of claim 1, further comprising:

determining that a predetermined criterion for initiating a scan for unmanaged assets has been triggered; and

generating the detection instruction in accordance with said determination.

7. The method of claim 1, further comprising:

at expiration of a predetermined time window since generation of the detection instruction, generating a reporting instruction for reporting the unmanaged asset that has been detected in the network; and

sending the reporting instruction to a next machine in the linear communication orbit along a predetermined direction.

8. The method of claim 1, further comprising:

receiving a reporting instruction for reporting the unmanaged asset that has been detected in the network; and

in response to receiving the reporting instruction;

incorporating the local report into an aggregated report included in the reporting instruction; and

after the incorporating, forwarding the reporting instruction to a next machine in the linear communication orbit along a predetermined direction.

9. The method of claim 1, further comprising:

receiving a remedial instruction, the remedial instruction specifying respective remedial instructions for live unmanaged machines that have been detected within the network;

in response to receiving the remedial instruction;

determining whether the remedial instruction specifies a respective remedial operation applicable to one or more live unmanaged machines that have been detected within the first selected portion of the network; and

requesting the one or more live unmanaged machines to execute the respective remedial operation specified by the remedial instruction; and

forwarding the remedial instruction to a next machine in the linear communication orbit along a predetermined direction.

10. The method of claim 1, further comprising:

obtaining an aggregated report of unmanaged assets currently present in the network;

in response to obtaining the aggregated report, generating a remedial instruction, the remedial instruction specifying respective remedial operations for live unmanaged machines that have been detected within the network; and

forwarding the remedial instruction to a next machine in the linear communication orbit along a predetermined direction.

11. A system for monitoring unmanaged assets in a network having a plurality of managed machines, comprising:

one or more processors; and

memory having instructions stored thereon, the instructions, when executed by the one or more processors, cause the processors to perform operations comprising;

at a first managed machine of the plurality of managed machines, wherein the plurality of managed machines are arranged in a linear communication orbit in accordance with a predefined order of respective machine identifiers of the plurality of managed machines, and each managed machine is coupled to at least one respective neighbor machine in the linear communication orbit by a corresponding local segment of the linear communication orbit;

responding to a detection instruction for detecting unmanaged assets currently present in the network, by;

scanning for live unmanaged machines within a first selected portion of the network that corresponds to a first range of machine identifiers that is between the respective machine identifiers of a respective upstream neighbor of the first managed machine and a respective downstream neighbor of the first managed machine in the linear communication orbit; and

generating a local report identifying one or more unmanaged machines that have been detected within the first selected portion of the network.

12. The system of claim 11, wherein each live unmanaged machine comprises a machine that responds to one or more predefined inquiries with one or more responses indicating that the machine is live and indicating that the machine is not a managed machine.

13. The system of claim 11, wherein the plurality of managed machines have self-assembled into the linear communication orbit in accordance with the predefined order of respective machine identifiers that have been assigned to the plurality of managed machines.

14. The system of claim 11, wherein the operations further comprise:

receiving the detection instruction from the respective upstream neighbor of the first managed machine, wherein the detection instruction has propagated from a source machine to the first managed machine through the linear communication orbit in a downstream direction.

15. The system of claim 14, wherein the operations further comprise:

in response to receiving the detection instruction from the respective upstream neighbor of the first managed machine, forwarding the detection instruction to the respective downstream neighbor of the first managed machine in the linear communication orbit.

16. The system of claim 11, wherein the operations further comprise:

determining that a predetermined criterion for initiating a scan for unmanaged assets has been triggered; and

generating the detection instruction in accordance with said determination.

17. The system of claim 11, wherein the operations further comprise:

at expiration of a predetermined time window since generation of the detection instruction, generating a reporting instruction for reporting the unmanaged asset that has been detected in the network; and

sending the reporting instruction to a next machine in the linear communication orbit along a predetermined direction.

18. The system of claim 11, wherein the operations further comprise:

receiving a reporting instruction for reporting the unmanaged asset that has been detected in the network; and

in response to receiving the reporting instruction;

incorporating the local report into an aggregated report included in the reporting instruction; and

after the incorporating, forwarding the reporting instruction to a next machine in the linear communication orbit along a predetermined direction.

19. The system of claim 11, wherein the operations further comprise:

receiving a remedial instruction, the remedial instruction specifying respective remedial instructions for live unmanaged machines that have been detected within the network;

in response to receiving the remedial instruction;

determining whether the remedial instruction specifies a respective remedial operation applicable to one or more live unmanaged machines that have been detected within the first selected portion of the network; and

requesting the one or more live unmanaged machines to execute the respective remedial operation specified by the remedial instruction; and

forwarding the remedial instruction to a next machine in the linear communication orbit along a predetermined direction.

20. The system of claim 11, wherein the operations further comprise:

obtaining an aggregated report of unmanaged assets currently present in the network;

in response to obtaining the aggregated report, generating a remedial instruction, the remedial instruction specifying respective remedial operations for live unmanaged machines that have been detected within the network; and

forwarding the remedial instruction to a next machine in the linear communication orbit along a predetermined direction.

21. A non-transitory computer-readable medium for monitoring unmanaged assets in a network having a plurality of managed machines, the computer-readable medium having instructions stored thereon, the instructions, when executed by one or more processors, cause the processors to perform operations comprising:

at a first managed machine of the plurality of managed machines, wherein the plurality of managed machines are arranged in a linear communication orbit in accordance with a predefined order of respective machine identifiers of the plurality of managed machines, and each managed machine is coupled to at least one respective neighbor machine in the linear communication orbit by a corresponding local segment of the linear communication orbit;

responding to a detection instruction for detecting unmanaged assets currently present in the network, by;

scanning for live unmanaged machines within a first selected portion of the network that corresponds to a first range of machine identifiers that is between the respective machine identifiers of a respective upstream neighbor of the first managed machine and a respective downstream neighbor of the first managed machine in the linear communication orbit; and

generating a local report identifying one or more unmanaged machines that have been detected within the first selected portion of the network.

22. The computer-readable medium of claim 21, wherein each live unmanaged machine comprises a machine that responds to one or more predefined inquiries with one or more responses indicating that the machine is live and indicating that the machine is not a managed machine.

23. The computer-readable medium of claim 21, wherein the plurality of managed machines have self-assembled into the linear communication orbit in accordance with the predefined order of respective machine identifiers that have been assigned to the plurality of managed machines.

24. The computer-readable medium of claim 21, wherein the operations further comprise:

receiving the detection instruction from the respective upstream neighbor of the first managed machine, wherein the detection instruction has propagated from a source machine to the first managed machine through the linear communication orbit in a downstream direction.

25. The computer-readable medium of claim 24, wherein the operations further comprise:

in response to receiving the detection instruction from the respective upstream neighbor of the first managed machine, forwarding the detection instruction to the respective downstream neighbor of the first managed machine in the linear communication orbit.

26. The computer-readable medium of claim 21, wherein the operations further comprise:

determining that a predetermined criterion for initiating a scan for unmanaged assets has been triggered; and

generating the detection instruction in accordance with said determination.

27. The computer-readable medium of claim 21, wherein the operations further comprise:

at expiration of a predetermined time window since generation of the detection instruction, generating a reporting instruction for reporting the unmanaged asset that has been detected in the network; and

sending the reporting instruction to a next machine in the linear communication orbit along a predetermined direction.

28. The computer-readable medium of claim 21, wherein the operations further comprise:

receiving a reporting instruction for reporting the unmanaged asset that has been detected in the network; and

in response to receiving the reporting instruction;

incorporating the local report into an aggregated report included in the reporting instruction; and

after the incorporating, forwarding the reporting instruction to a next machine in the linear communication orbit along a predetermined direction.

29. The computer-readable medium of claim 21, wherein the operations further comprise:

receiving a remedial instruction, the remedial instruction specifying respective remedial instructions for live unmanaged machines that have been detected within the network;

in response to receiving the remedial instruction;

determining whether the remedial instruction specifies a respective remedial operation applicable to one or more live unmanaged machines that have been detected within the first selected portion of the network; and

requesting the one or more live unmanaged machines to execute the respective remedial operation specified by the remedial instruction; and

forwarding the remedial instruction to a next machine in the linear communication orbit along a predetermined direction.

30. The computer-readable medium of claim 21, wherein the operations further comprise:

obtaining an aggregated report of unmanaged assets currently present in the network;

in response to obtaining the aggregated report, generating a remedial instruction, the remedial instruction specifying respective remedial operations for live unmanaged machines that have been detected within the network; and

forwarding the remedial instruction to a next machine in the linear communication orbit along a predetermined direction.