Parallel distributed network management

• US 10,708,116 B2
• Filed: 08/03/2017
• Issued: 07/07/2020
• Est. Priority Date: 11/10/2008
• Status: Active Grant

• Current Assignee: Tanium Inc.
• Original Assignee: Tanium Inc.
• Inventors: Hindawi, David, Hindawi, Orion, Lippincott, Lisa, Lincroft, Peter
• Primary Examiner(s): Strange, Aaron N
• Application Number:
  US15/668,665
• Publication Number:
  US 20170359248A1
• Time in Patent Office: 1,069 Days
• CPC Class Codes: G06F 16/27 Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
• CPC Class Codes: H04L 41/04 Network management architectures or arrangements
• CPC Class Codes: H04L 41/0853 by actively collecting configuration information or by backing up configuration information
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/26 using dedicated tools for LAN [Local Area Network] management
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/065 related to network devices
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 45/16 Multipoint routing
• CPC Class Codes: H04L 45/44 Distributed routing

Abstract

In a network of a plurality of machines and a server, the machines have self-organized into a linearly ordered sequence in accordance with a predefined order of their respective machine identifiers. The linearly ordered sequence includes one or more local segments each include a first machine followed by a sequence of second machines. A query regarding management information of a local segment is injected into the network at the first machine of the local segment. The query is forwarded along the local segment, and each machine in the local segment responds to the query by adding its own local information to any answers already accumulated in the payload of the query. A second machine in the local segment sends a report message containing aggregated management information that has been collected in the payload of the query to the server.

Claims

1. A method, comprising:

in a network of a plurality of machines and at least one server, wherein;

each machine of the plurality of machines has a respective machine identifier,

the plurality of machines have self-organized into a linearly ordered sequence in accordance with a predefined order of the respective machine identifiers of the plurality of machines, wherein a respective machine that is newly coupled to the network proactively queries one or more existing machines in the linearly ordered sequence to establish its position in the linearly ordered sequence,

the linearly ordered sequence includes one or more local segments, each local segment including a first machine of the local segment followed by a sequence of second machines of the local segment, and

each machine of a respective local segment is configured to communicate, via a respective network communication link, with a corresponding next machine in the respective local segment;

at the first machine of the respective local segment, injecting, into the network of the plurality of machines, a query regarding a set of management information regarding the respective local segment that corresponds to the first machine, wherein;

the query includes a header and a payload;

the query is forwarded along the respective local segment through the respective network communication links of the first machine and the sequence of second machines in the respective local segment,

each machine of the first subset of machines in the respective local segment responds to the query by adding its respective local information to any answers already accumulated in the payload of the query; and

at least one of the sequence of second machines in the respective local segment sends, to the at least one server of the network, a report message containing aggregated management information that has been collected in the payload of the query, wherein the method further comprises;

at the first machine of the plurality of machines in the network;

prior to establishing respective communications with the corresponding next machine of the first machine, identifying a subset of the plurality of machines that have respective machine addresses within a predetermined proximity to the respective machine address of the first machine; and

notifying the subset of the plurality of machines of entry of the first machine into the network and the respective machine address of the first machine.

2. The method of claim 1, further comprising:

at the first machine of the respective local segment, injecting, into the network of the plurality of machines, a machine command that specifies a set of operations to be executed by a first subset of machines in the respective local segment, wherein the command designates the first subset of machines by specifying a shared machine property for the first subset of machines, wherein;

the machine command is forwarded along the respective local segment through the respective network communication links of the first machine and the sequence of second machines following the first machine in the respective local segment, and

each machine of the first subset of machine having the shared machine property executes the set of operations in response to receiving the machine command.

3. The method of claim 1, wherein the query is selected from a set of frequently-asked network queries and automatically injected into the network at multiple times.

4. The method of claim 1, wherein the query is selected from a set of audit or compliance rules and automatically injected into the network at multiple times.

5. The method of claim 1, including:

at the at least one server of the network;

receiving respective registration messages from each of the plurality of machines currently coupled to the network, wherein each of the plurality of machines is configured to send registration messages to the server at a respective frequency such that a load on the server has an upper bound limited to a constant with respect to a varying size of the network.

6. The method of claim 1, further comprising:

at the at least one server of the network;

sending an instruction message to the first machines of one or more local segments of the linearly ordered sequence, wherein the instruction message specifies (1) an action to be performed by a subset of the plurality of machines and (2) a criterion for selecting the subset of the plurality of machines.

7. The method of claim 1, wherein the query was initially generated by the first machine based on a local occurrence of a first state at the first machine.

8. The method of claim 1, wherein the payload of the query includes a hash code corresponding to a logical representation of the requested set of management information.

9. The method of claim 1, further comprising:

at the first machine of the plurality of machines in the network;

prior to decoupling from the network, informing respective presence of a first subset of the plurality of machines to a second subset of the plurality of machines, wherein the first subset and the second subset are not overlapping, the first subset of machines includes a machine having a respective lower machine addresses relative to the respective machine address of the first machine among the plurality machines, and the second subset of machines includes a machine having a respective higher machine addresses relative to the respective machine address of the first machine among the plurality of machines; and

decoupling from the network after the informing.

10. A system, including:

a device comprising one or more processors, and memory storing instructions, wherein;

the device is coupled to a network of a plurality of machines and at least one server,

each machine of the plurality of machines has a respective machine identifier,

the plurality of machines have self-organized into a linearly ordered sequence in accordance with a predefined order of the respective machine identifiers of the plurality of machines, wherein a respective machine that is newly coupled to the network proactively queries one or more existing machines in the linearly ordered sequence to establish its position in the linearly ordered sequence,

the linearly ordered sequence includes one or more local segments, each local segment including a first machine of the local segment followed by a sequence of second machines of the local segment, and

each machine of a respective local segment is configured to communicate, via a respective network communication link, with a corresponding next machine in the respective local segment, and

the device serves as the first machine of a respective local segment of the device, and, when the instructions are executed by the one or more processors of the device, performs machine operations comprising;

injecting, into the network of the plurality of machines, a query regarding a set of management information regarding the respective local segment that corresponds to the first machine, wherein;

the query includes a header and a payload;

the query is forwarded along the respective local segment of the first machine through the respective network communication links of the first machine and the sequence of second machines in the respective local segment,

each machine of the first subset of machines in the respective local segment responds to the query by adding its respective local information to any answers already accumulated in the payload of the query; and

at least one of the sequence of second machines in the respective local segment sends, to the at least one server of the network, a report message containing aggregated management information that has been collected in the payload of the query, wherein the machine operations further include;

prior to establishing respective communications with the corresponding next machine of the first machine, identifying a subset of the plurality of machines that have respective machine addresses within a predetermined proximity to the respective machine address of the first machine; and

notifying the subset of the plurality of machines of entry of the first machine into the network and the respective machine address of the first machine.

11. The system of claim 10, wherein the machine operations further comprise:

injecting, into the network of the plurality of machines, a machine command that specifies a set of operations to be executed by a first subset of machines in the respective local segment, wherein the command designates the first subset of machines by specifying a shared machine property for the first subset of machines, wherein;

the machine command is forwarded along the respective local segment through the respective network communication links of the first machine and the sequence of second machines following the first machine in the respective local segment, and

each machine of the first subset of machine having the shared machine property executes the set of operations in response to receiving the machine command.

12. The system of claim 10, wherein the query is selected from a set of frequently-asked network queries and automatically injected into the network at multiple times.

13. The system of claim 10, wherein the query is selected from a set of audit or compliance rules and automatically injected into the network at multiple times.

14. The system of claim 10, further including:

the at least one server of the network, wherein the at least one server includes one or more processors and memory, the memory includes instructions, which when executed by the one or more processors of the at least one server, cause the one or more processors of the at least one server to perform server operations comprising;

receiving respective registration messages from each of the plurality of machines currently coupled to the network, wherein each of the plurality of machines is configured to send registration messages to the server at a respective frequency such that a load on the server has an upper bound limited to a constant with respect to a varying size of the network.

15. The system of claim 10, further including:

the at least one server of the network, wherein the at least one server includes one or more processors and memory, the memory storing instructions, which when executed by the one or more processors of the at least one server, cause the one or more processors of the at least one server to perform server operations comprising;

sending an instruction message to the first machines of one or more local segments of the linearly ordered sequence, wherein the instruction message specifies (1) an action to be performed by a subset of the plurality of machines and (2) a criterion for selecting the subset of the plurality of machines.

16. The system of claim 10, wherein the query was initially generated by the first machine based on a local occurrence of a first state at the first machine.

17. The system of claim 10, wherein the payload of the query includes a hash code corresponding to a logical representation of the requested set of management information.

18. The system of claim 10, wherein the machine operations further include:

prior to decoupling from the network, informing respective presence of a first subset of the plurality of machines to a second subset of the plurality of machines, wherein the first subset and the second subset are not overlapping, the first subset of machines includes a machine having a respective lower machine addresses relative to the respective machine address of the first machine among the plurality machines, and the second subset of machines includes a machine having a respective higher machine addresses relative to the respective machine address of the first machine among the plurality of machines; and

decoupling from the network after the informing.

19. A non-transitory computer-readable medium having instructions stored thereon, the instructions, when executed by one or more processors, cause the processors to perform operations comprising:

in network of a plurality of machines and at least one server, wherein;

each machine of the plurality of machines has a respective machine identifier,

the plurality of machines have self-organized into a linearly ordered sequence in accordance with a predefined order of the respective machine identifiers of the plurality of machines, wherein a respective machine that is newly coupled to the network proactively queries one or more existing machines in the linearly ordered sequence to establish its position in the linearly ordered sequence,

the linearly ordered sequence includes one or more local segments, each local segment including a first machine of the local segment followed by a sequence of second machines of the local segment, and

each machine of a respective local segment is configured to communicate, via a respective network communication link, with a corresponding next machine in the respective local segment;

at the first machine of a respective local segment of the device;

injecting, into the network of the plurality of machines, a query regarding a set of management information regarding the respective local segment that corresponds to the first machine, wherein;

 

the query includes a header and a payload;

 

the query is forwarded along the respective local segment of the first machine through the respective network communication links of the first machine and the sequence of second machines in the respective local segment,

 

each machine of the first subset of machines in the respective local segment responds to the query by adding its respective local information to any answers already accumulated in the payload of the query; and

 

at least one of the sequence of second machines in the respective local segment sends, to the at least one server of the network, a report message containing aggregated management information that has been collected in the payload of the query, wherein the operations further include;

at the first machine of the plurality of machines in the network;

prior to establishing respective communications with the corresponding next machine of the first machine, identifying a subset of the plurality of machines that have respective machine addresses within a predetermined proximity to the respective machine address of the first machine; and

notifying the subset of the plurality of machines of entry of the first machine into the network and the respective machine address of the first machine.

20. The non-transitory computer-readable medium of claim 19, wherein the operations further comprise:

at the first machine of the respective local segment, injecting, into the network of the plurality of machines, a machine command that specifies a set of operations to be executed by a first subset of machines in the respective local segment, wherein the command designates the first subset of machines by specifying a shared machine property for the first subset of machines, wherein;

the machine command is forwarded along the respective local segment through the respective network communication links of the first machine and the sequence of second machines following the first machine in the respective local segment, and

each machine of the first subset of machine having the shared machine property executes the set of operations in response to receiving the machine command.

21. The non-transitory computer-readable medium of claim 19, wherein the query is selected from a set of frequently-asked network queries and automatically injected into the network at multiple times.

22. The non-transitory computer-readable medium of claim 19, wherein the query is selected from a set of audit or compliance rules and automatically injected into the network at multiple times.

23. The non-transitory computer-readable medium of claim 19, wherein the operations further comprise:

at the at least one server of the network;

receiving respective registration messages from each of the plurality of machines currently coupled to the network, wherein each of the plurality of machines is configured to send registration messages to the server at a respective frequency such that a load on the server has an upper bound limited to a constant with respect to a varying size of the network.

24. The non-transitory computer-readable medium of claim 19, wherein the operations further comprise:

at the at least one server of the network;

sending an instruction message to the first machines of one or more local segments of the linearly ordered sequence, wherein the instruction message specifies (1) an action to be performed by a subset of the plurality of machines and (2) a criterion for selecting the subset of the plurality of machines.

25. The non-transitory computer-readable medium of claim 19, wherein the query was initially generated by the first machine based on a local occurrence of a first state at the first machine.

26. The non-transitory computer-readable medium of claim 19, wherein the payload of the query includes a hash code corresponding to a logical representation of the requested set of management information.

27. The non-transitory computer-readable medium of claim 19, wherein the operations further include:

prior to decoupling from the network, informing respective presence of a first subset of the plurality of machines to a second subset of the plurality of machines, wherein the first subset and the second subset are not overlapping, the first subset of machines includes a machine having a respective lower machine addresses relative to the respective machine address of the first machine among the plurality machines, and the second subset of machines includes a machine having a respective higher machine addresses relative to the respective machine address of the first machine among the plurality of machines; and

decoupling from the network after the informing.