Fast detection and remediation of unmanaged assets

• US 10,148,536 B2
• Filed: 08/24/2017
• Issued: 12/04/2018
• Est. Priority Date: 11/27/2013
• Status: Active Grant

• Current Assignee: Tanium Inc.
• Original Assignee: Tanium Inc.
• Inventors: Hindawi, David, Hindawi, Orion, Lippincott, Lisa, Lincroft, Peter
• Primary Examiner(s): Shin, Kyung H
• Application Number:
  US15/686,054
• Publication Number:
  US 20170353369A1
• Time in Patent Office: 467 Days
• Field of Search: 709223
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/044 comprising hierarchical management structures
• CPC Class Codes: H04L 41/0853 by actively collecting configuration information or by backing up configuration information
• CPC Class Codes: H04L 41/0866 Checking the configuration
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 43/065 related to network devices
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A first managed machine of a plurality of managed machines arranged in a linear communication orbit based on a predefined order of respective machine identifiers of the managed machines scans for live unmanaged machines within a selected portion of the network that is associated with a first range of machine identifiers that includes identifiers between the respective identifiers of the first managed machine and a respective neighbor machine of the first managed machine, determines whether the remedial instruction specifies a respective remedial operation applicable to the one or more live unmanaged machines that have been detected within the selected portion of the network, and requests the one or more live unmanaged machines to execute the respective remedial operation specified by the remedial instruction.

Claims

1. A method of remediating unmanaged assets in a network having a plurality of managed machines, comprising:

at a first managed machine of the plurality of managed machines, wherein the plurality of managed machines are arranged in a linear communication orbit in accordance with a predefined order of respective machine identifiers of the plurality of managed machines, and each managed machine is coupled to at least one respective neighbor machine by a corresponding local segment of the linear communication orbit;

scanning for live unmanaged machines within a selected portion of the network that is associated with a first range of machine identifiers that includes identifiers between the respective identifiers of the first managed machine and a respective neighbor machine of the first managed machine;

detecting one or more live unmanaged machines within the selected portion of the network in accordance with the scanning;

receiving or accessing a remedial instruction, the remedial instruction specifying respective remedial actions for live unmanaged machines that have been detected within the network;

in response to receiving or accessing the remedial instruction;

determining whether the remedial instruction specifies a respective remedial operation applicable to the one or more live unmanaged machines that have been detected within the selected portion of the network; and

requesting the one or more live unmanaged machines to execute the respective remedial operation specified by the remedial instruction.

2. The method of claim 1, further comprising, in response to receiving or accessing the remedial instruction, forwarding the remedial instruction to a next machine in the linear communication orbit along a predetermined direction.

3. The method of claim 1, wherein each live unmanaged machine comprises a machine that responds to one or more predefined inquiries with one or more responses indicating that the machine is live and indicating that the machine is not a managed machine.

4. The method of claim 1, further comprising:

determining that a predetermined criterion for initiating a scan for live unmanaged assets has been triggered; and

initiating the scanning in accordance with said determination.

5. The method of claim 1, further comprising:

receiving an input from a user of the first managed machine, wherein the input requests a scan for unmanaged assets currently present in the network; and

initiating the scanning in accordance with the input.

6. The method of claim 1, further comprising:

receiving a reporting instruction for reporting the one or more live unmanaged machines that have been detected in the network; and

in response to receiving the reporting instruction;

incorporating a local report into an aggregated report included in the reporting instruction; and

after the incorporating, forwarding the reporting instruction to a next machine in the linear communication orbit along the predetermined direction.

7. The method of claim 1, wherein the remedial instruction further comprises respective remedial operations suitable for the detected live unmanaged machines based on a quarantine policy, wherein the quarantine policy specifies different remedial operations for different types of unmanaged assets.

8. The method of claim 1, wherein scanning for live unmanaged machines within the selected portion of the network further comprises:

pinging respective network addresses associated with machine identifiers within the first range of machine identifiers;

in response to a respective echo received from a live machine within the selected portion of the network, determining whether said live machine is an unmanaged machine; and

in response to determining that said live machine is an unmanaged machine, adding a machine identifier of said live machine to a local report.

9. The method of claim 8, wherein the local report includes information specific to each of the one or more unmanaged machines detected in the selected portion of the network.

10. The method of claim 9, wherein the information comprises at least one or more of:

a MAC address, an IP address, a computer name, an operation system name, or a hardware vendor name.

11. A system for monitoring unmanaged assets in a network having a plurality of managed machines, comprising:

one or more processors; and

memory having instructions stored thereon, the instructions, when executed by the one or more processors, cause the processors to perform operations comprising;

in a network having a plurality of managed machines;

at a first managed machine of the plurality of managed machines, wherein the plurality of managed machines are arranged in a linear communication orbit in accordance with a predefined order of respective machine identifiers of the plurality of managed machines, and each managed machine is coupled to at least one respective neighbor machine by a corresponding local segment of the linear communication orbit;

scanning for live unmanaged machines within a selected portion of the network that is associated with a first range of machine identifiers that includes identifiers between the respective identifiers of the first managed machine and a respective neighbor machine of the first managed machine;

detecting one or more live unmanaged machines within the selected portion of the network in accordance with the scanning;

receiving or accessing a remedial instruction, the remedial instruction specifying respective remedial actions for live unmanaged machines that have been detected within the network;

in response to receiving or accessing the remedial instruction;

 

determining whether the remedial instruction specifies a respective remedial operation applicable to the one or more live unmanaged machines that have been detected within the selected portion of the network; and

 

requesting the one or more live unmanaged machines to execute the respective remedial operation specified by the remedial instruction.

12. The system of claim 11, wherein the operations further comprise:

in response to receiving or accessing the remedial instruction, forwarding the remedial instruction to a next machine in the linear communication orbit along a predetermined direction.

13. The system of claim 11, wherein each live unmanaged machine comprises a machine that responds to one or more predefined inquiries with one or more responses indicating that the machine is live and indicating that the machine is not a managed machine.

14. The system of claim 11, wherein the operations further comprise:

determining that a predetermined criterion for initiating a scan for live unmanaged assets has been triggered; and

initiating the scanning in accordance with said determination.

15. The system of claim 11, wherein the operations further comprise:

receiving an input from a user of the first managed machine, wherein the input requests a scan for unmanaged assets currently present in the network; and

initiating the scanning in accordance with the input.

16. The system of claim 11, wherein the operations further comprise:

receiving a reporting instruction for reporting the one or more live unmanaged machines that have been detected in the network; and

in response to receiving the reporting instruction;

incorporating a local report into an aggregated report included in the reporting instruction; and

after the incorporating, forwarding the reporting instruction to a next machine in the linear communication orbit along the predetermined direction.

17. The system of claim 11, wherein the remedial instruction further comprises respective remedial operations suitable for the detected live unmanaged machines based on a quarantine policy, wherein the quarantine policy specifies different remedial operations for different types of unmanaged assets.

18. The system of claim 11, wherein scanning for live unmanaged machines within the selected portion of the network further comprises:

pinging respective network addresses associated with machine identifiers within the first range of machine identifiers;

in response to a respective echo received from a live machine within the selected portion of the network, determining whether said live machine is an unmanaged machine; and

in response to determining that said live machine is an unmanaged machine, adding a machine identifier of said live machine to a local report.

19. The system of claim 18, wherein the local report includes information specific to each of the one or more unmanaged machines detected in the selected portion of the network.

20. The system of claim 19, wherein the information comprises at least one or more of:

a MAC address, an IP address, a computer name, an operation system name, or a hardware vendor name.

21. A non-transitory computer-readable storage medium for monitoring unmanaged assets in a network having a plurality of managed machines, the computer-readable medium having instructions stored thereon, the instructions, when executed by one or more processors, cause the processors to perform operations comprising:

in a network having a plurality of managed machines;

at a first managed machine of the plurality of managed machines, wherein the plurality of managed machines are arranged in a linear communication orbit in accordance with a predefined order of respective machine identifiers of the plurality of managed machines, and each managed machine is coupled to at least one respective neighbor machine by a corresponding local segment of the linear communication orbit;

scanning for live unmanaged machines within a selected portion of the network that is associated with a first range of machine identifiers that includes identifiers between the respective identifiers of the first managed machine and a respective neighbor machine of the first managed machine;

detecting one or more live unmanaged machines within the selected portion of the network in accordance with the scanning;

receiving or accessing a remedial instruction, the remedial instruction specifying respective remedial actions for live unmanaged machines that have been detected within the network;

in response to receiving or accessing the remedial instruction;

determining whether the remedial instruction specifies a respective remedial operation applicable to the one or more live unmanaged machines that have been detected within the selected portion of the network; and

requesting the one or more live unmanaged machines to execute the respective remedial operation specified by the remedial instruction.

22. The computer-readable storage medium of claim 21, wherein the operations further comprise:

in response to receiving or accessing the remedial instruction, forwarding the remedial instruction to a next machine in the linear communication orbit along a predetermined direction.

23. The computer-readable storage medium of claim 21, wherein each live unmanaged machine comprises a machine that responds to one or more predefined inquiries with one or more responses indicating that the machine is live and indicating that the machine is not a managed machine.

24. The computer-readable storage medium of claim 21, wherein the operations further comprise:

determining that a predetermined criterion for initiating a scan for live unmanaged assets has been triggered; and

initiating the scanning in accordance with said determination.

25. The computer-readable storage medium of claim 21, wherein the operations further comprise:

receiving an input from a user of the first managed machine, wherein the input requests a scan for unmanaged assets currently present in the network; and

initiating the scanning in accordance with the input.

26. The computer-readable storage medium of claim 21, wherein the operations further comprise:

receiving a reporting instruction for reporting the one or more live unmanaged machines that have been detected in the network; and

in response to receiving the reporting instruction;

incorporating a local report into an aggregated report included in the reporting instruction; and

after the incorporating, forwarding the reporting instruction to a next machine in the linear communication orbit along the predetermined direction.

27. The computer-readable storage medium of claim 21, wherein the remedial instruction further comprises respective remedial operations suitable for the detected live unmanaged machines based on a quarantine policy, wherein the quarantine policy specifies different remedial operations for different types of unmanaged assets.

28. The computer-readable storage medium of claim 21, wherein scanning for live unmanaged machines within the selected portion of the network further comprises:

pinging respective network addresses associated with machine identifiers within the first range of machine identifiers;

in response to a respective echo received from a live machine within the selected portion of the network, determining whether said live machine is an unmanaged machine; and

in response to determining that said live machine is an unmanaged machine, adding a machine identifier of said live machine to a local report.

29. The computer-readable storage medium of claim 28, wherein the local report includes information specific to each of the one or more unmanaged machines detected in the selected portion of the network.

30. The computer-readable storage medium of claim 29, wherein the information comprises at least one or more of:

a MAC address, an IP address, a computer name, an operation system name, or a hardware vendor name.