Compliance management in a local network

• US 10,824,729 B2
• Filed: 07/11/2018
• Issued: 11/03/2020
• Est. Priority Date: 07/14/2017
• Status: Active Grant

• Current Assignee: Tanium Inc.
• Original Assignee: Tanium Inc.
• Inventors: Hoscheit, James B., Smathers, Kevin N., Hindley, Connor J., Hunt, Christian L.
• Primary Examiner(s): Choudhury, Azizul
• Application Number:
  US16/033,131
• Publication Number:
  US 20190018965A1
• Time in Patent Office: 846 Days
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3428 Benchmarking
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: H04L 41/0853 by actively collecting configuration information or by backing up configuration information
• CPC Class Codes: H04L 41/0866 Checking the configuration
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416

Abstract

A local environment verification method, performed by a server of a computer network, includes injecting, into a linear communication orbit, a bundle of information items regarding deployment of a respective local environment verification framework at each of a first subset of nodes in the computer network. The bundle of information items is distributed to a respective node of the first subset of nodes through the linear communication orbit, and used to establish the respective local environment verification framework at the respective node of the first subset of nodes. The respective node of the first subset of nodes is configured to perform a set of local environment verifications using the respective local environment verification framework. The method further includes injecting, into the linear communication orbit, a query message to collect respective local results of the set of local environment verifications from the first subset of nodes.

Claims

1. A method, including:

at a server system in a computer network that has a plurality of nodes, wherein each said node comprises a respective computational device and has a respective defined location in a linearly ordered communication orbit comprising said plurality of nodes;

injecting, into the linearly ordered communication orbit, a bundle of information items regarding deployment of a respective local environment verification framework at each of a first subset of nodes in the computer network, wherein;

the bundle of information items is distributed to a respective node of the first subset of nodes through the linearly ordered communication orbit,

the respective local environment verification framework is established at the respective node of the first subset of nodes in accordance with the bundle of information items that is distributed to said respective node; and

the respective node of the first subset of nodes is configured to perform a first set of local environment verifications using the respective local environment verification framework that has been established at said respective node;

injecting, into the linearly ordered communication orbit, a query message to collect respective local results of the first set of local environment verifications from the first subset of nodes, wherein;

the query message is forwarded from node to node along the linearly ordered communication orbit, and

the respective node of the first subset of nodes, in response to receiving the query message through the linearly ordered communication orbit, sends the respective local results of the first set of local environment verifications that have been obtained at said respective node to the server system through the linearly ordered communication orbit.

2. The method of claim 1, wherein the bundle of information items regarding deployment of the respective local environment verification framework includes a plurality of compliance benchmarks and an engine for executing the plurality of compliance benchmarks.

3. The method of claim 1, further comprising, prior to injecting the query message, sending a verification request to perform the first set of local environment verifications at the first subset of nodes, wherein the verification request includes one or more parameters for performing the first set of local environment verifications at the first subset of nodes.

4. The method of claim 3, wherein the one or more parameters include one or more of:

a selection of the first set of local environment verifications from a full set of local environment verifications included in the bundle of information items,

a schedule by which the first set of local environment verifications is to be executed at the first subset of nodes,

a time interval during which the first set of local environment verifications is to be completed at the first subset of nodes, and

a batch size for running the first set of local environment verifications at a time.

5. The method of claim 1, including:

receiving a first instruction to deploy a local environment verification action to implement the first set of local environment verifications at the first subset of nodes, wherein the server system assembles the bundle of information items injected into the linearly ordered communication orbit.

6. The method of claim 5, wherein the first instruction specifies a first time interval during which to distribute the bundle of information items to the first subset of nodes.

7. The method of claim 5, wherein the first instruction specifies a second time interval for re-deploying the respective local environment verification framework at each of the first subset of nodes.

8. The method of claim 5, wherein the first instruction specifies one or more characteristics for dynamically identifying the first subset of nodes, and wherein the respective node of the first subset of nodes self-identifies as belonging to the first subset of nodes based on the one or more characteristics.

9. The method of claim 1, wherein injecting the bundle of information items into the linearly ordered communication orbit includes:

dividing the bundle of information items into a plurality of file shards from which the bundle of information items are restorable; and

sending the plurality of file shards to a selected node in the linearly ordered communication orbit.

10. The method of claim 9, wherein one or more copies of each file shard of the plurality of file shards are propagated from node to node along the linearly ordered communication orbit while the bundle of information items are being distributed to the first subset of nodes.

11. The method of claim 9, wherein the respective node of the first subset of nodes assembles the plurality of file shards into the bundle of information items after receiving each of the plurality of file shards through the linearly ordered communication orbit.

12. The method of claim 1, including:

receiving deployment status data from the first subset of nodes through the linearly ordered communication orbit, wherein the deployment status data includes respective messages from one or more nodes in the first subset of nodes indicating establishment of the respective local environment verification framework at said one or more nodes; and

in accordance with the received deployment status data, providing deployment progress updates to a user.

13. The method of claim 1, including:

receiving a second instruction to generate a report regarding execution of a local environment verification action at the first subset of nodes, wherein the server system injects the query message into the linearly ordered communication orbit in accordance with the second instruction.

14. The method of claim 13, wherein the second instruction specifies a second time interval for reissuing the query message to collect the respective local results of the first set of local environment verifications from the first subset of nodes.

15. The method of claim 13, including:

providing to a user a report on local results of the first set of local environment verifications at the first subset of nodes.

16. The method of claim 15, including:

receiving a third instruction to issue a remedial action command to the respective node of the first subset of nodes; and

sending the remedial action command to the respective node of the first subset of nodes through the linearly ordered communication orbit.

17. The method of claim 13, wherein:

the second instruction includes one or more custom verifications that are to be performed at the first subset of nodes; and

the method includes;

injecting, into the linearly ordered communication orbit, a second query message to request execution of the one or more custom verifications at the first subset of nodes;

forwarding the second query message from node to node along the linearly ordered communication orbit;

performing, at the respective node of the first subset of nodes, in response to receiving the second query message through the linearly ordered communication orbit, the one or more custom verifications; and

sending respective local results for the one or more custom verifications that have been obtained at said respective node to the server system through the linearly ordered communication orbit.

18. The method of claim 13, wherein the bundle of information items includes a plurality of rules of the respective local environment verification framework, and the second instruction includes an identifier mapping that maps first identifiers of the plurality of rules to second identifiers of the plurality of rules.

19. The method of claim 18, including:

generating a first report that includes the first identifiers of the plurality of rules of the respective local environment verification framework; and

generating a second report that includes the second identifiers of the plurality of rules of the respective local environment verification framework.

20. The method of claim 1, including:

receiving verification status data from the first subset of nodes through the linearly ordered communication orbit, wherein the verification status data includes respective messages from one or more nodes in the first subset of nodes indicating completion status of the first set of local environment verifications at said one or more nodes; and

in accordance with the received verification status data, providing action progress updates to a user.

21. The method of claim 1, including:

receiving an instruction to collect recent results for the first set of local environment verifications from the first subset of nodes; and

in response to receiving the instruction to collect the recent results, sending a third query message along the linearly ordered communication orbit to collect the recent results from the first subset of nodes, wherein;

in accordance with a determination that cached results for the first set of local environment verifications meet predefined age criteria, the respective node of the first subset of nodes sends the cached results to the server system through the linearly ordered communication orbit.

22. A server system in a computer network that has a plurality of nodes, wherein each said node comprises a respective computational device and has a respective defined location in a linearly ordered communication orbit comprising said plurality of nodes, the server system comprising:

one or more processors; and

memory having instructions stored thereon, which when executed by the one or more processors cause the server system to perform operations including;

injecting, into the linearly ordered communication orbit, a bundle of information items regarding deployment of a respective local environment verification framework at each of a first subset of nodes in the computer network, wherein;

the bundle of information items is distributed to a respective node of the first subset of nodes through the linearly ordered communication orbit,

the respective local environment verification framework is established at the respective node of the first subset of nodes in accordance with the bundle of information items that is distributed to said respective node; and

the respective node of the first subset of nodes is configured to perform a first set of local environment verifications using the respective local environment verification framework that has been established at said respective node;

injecting, into the linearly ordered communication orbit, a query message to collect respective local results of the first set of local environment verifications from the first subset of nodes, wherein;

the query message is forwarded from node to node along the linearly ordered communication orbit, and

the respective node of the first subset of nodes, in response to receiving the query message through the linearly ordered communication orbit, sends the respective local results of the first set of local environment verifications that have been obtained at said respective node to the server system through the linearly ordered communication orbit.

24. The server system of claim 22, wherein the bundle of information items regarding deployment of the respective local environment verification framework includes a plurality of compliance benchmarks and an engine for executing the plurality of compliance benchmarks.

25. The server system of claim 22, wherein the instructions stored in memory include instructions, which when executed by the one or more processors cause the server system to perform operations including, prior to injecting the query message, sending a verification request to perform the first set of local environment verifications at the first subset of nodes, wherein the verification request includes one or more parameters for performing the first set of local environment verifications at the first subset of nodes.

26. The server system of claim 25, wherein the one or more parameters include one or more of:

a selection of the first set of local environment verifications from a full set of local environment verifications included in the bundle of information items,

a schedule by which the first set of local environment verifications is to be executed at the first subset of nodes,

a time interval during which the first set of local environment verifications into be completed at the first subset of nodes, and

a batch size for running the first set of local environment verifications at a time.

27. The server system of claim 22, wherein the instructions stored in memory include instructions, which when executed by the one or more processors cause the server system to perform operations including:

receiving a first instruction to deploy a local environment verification action to implement the first set of local environment verifications at the first subset of nodes, wherein the server system assembles the bundle of information items injected into the linearly ordered communication orbit.

28. The server system of claim 27, wherein the first instruction specifies a first time interval during which to distribute the bundle of information items to the first subset of nodes.

29. The server system of claim 27, wherein the first instruction specifies a second time interval for re-deploying the respective local environment verification framework at each of the first subset of nodes.

30. The server system of claim 27, wherein the first instruction specifies one or more characteristics for dynamically identifying the first subset of nodes, and wherein the respective node of the first subset of nodes self-identifies as belonging to the first subset of nodes based on the one or more characteristics.

31. The server system of claim 22, wherein injecting the bundle of information items into the linearly ordered communication orbit includes:

dividing the bundle of information items into a plurality of file shards from which the bundle of information items are restorable; and

sending the plurality of file shards to a selected node in the linearly ordered communication orbit.

32. The server system of claim 31, wherein one or more copies of each file shard of the plurality of file shards are propagated from node to node along the linearly ordered communication orbit while the bundle of information items are being distributed to the first subset of nodes.

33. The server system of claim 31, wherein the respective node of the first subset of nodes assembles the plurality of file shards into the bundle of information items after receiving each of the plurality of file shards through the linearly ordered communication orbit.

34. The server system of claim 22, wherein the instructions stored in memory include instructions, which when executed by the one or more processors cause the server system to perform operations including:

receiving deployment status data from the first subset of nodes through the linearly ordered communication orbit, wherein the deployment status data includes respective messages from one or more nodes in the first subset of nodes indicating establishment of the respective local environment verification framework at said one or more nodes; and

in accordance with the received deployment status data, providing deployment progress updates to a user.

35. The server system of claim 22, wherein the instructions stored in memory include instructions, which when executed by the one or more processors cause the server system to perform operations including:

receiving a second instruction to generate a report regarding execution of a local environment verification action at the first subset of nodes, wherein the server system injects the query message into the linearly ordered communication orbit in accordance with the second instruction.

36. The server system of claim 35, wherein the second instruction specifies a second time interval for reissuing the query message to collect the respective local results of the first set of local environment verifications from the first subset of nodes.

37. The server system of claim 35, wherein the instructions stored in memory include instructions, which when executed by the one or more processors cause the server system to perform operations including:

providing to a user a report on local results of the first set of local environment verifications at the first subset of nodes.

38. The server system of claim 37, wherein the instructions stored in memory include instructions, which when executed by the one or more processors cause the server system to perform operations including:

receiving a third instruction to issue a remedial action command to the respective node of the first subset of nodes; and

sending the remedial action command to the respective node of the first subset of nodes through the linearly ordered communication orbit.

39. The server system of claim 35, wherein:

the second instruction includes one or more custom verifications that are to be performed at the first subset of nodes; and

the instructions stored in memory include instructions, which when executed by the one or more processors cause the server system to perform operations including;

injecting, into the linearly ordered communication orbit, a second query message to request execution of the one or more custom verifications at the first subset of nodes;

forwarding the second query message from node to node along the linearly ordered communication orbit;

performing, at the respective node of the first subset of nodes, in response to receiving the second query message through the linearly ordered communication orbit, the one or more custom verifications; and

sending respective local results for the one or more custom verifications that have been obtained at said respective node to the server system through the linearly ordered communication orbit.

40. The server system of claim 35, wherein the bundle of information items includes a plurality of rules of the respective local environment verification framework, and the second instruction includes an identifier mapping that maps first identifiers of the plurality of rules to second identifiers of the plurality of rules.

41. The server system of claim 40, wherein the instructions stored in memory include instructions, which when executed by the one or more processors cause the server system to perform operations including:

generating a first report that includes the first identifiers of the plurality of rules of the respective local environment verification framework; and

generating a second report that includes the second identifiers of the plurality of rules of the respective local environment verification framework.

42. The server system of claim 22, wherein the instructions stored in memory include instructions, which when executed by the one or more processors cause the server system to perform operations including:

receiving verification status data from the first subset of nodes through the linearly ordered communication orbit, wherein the verification status data includes respective messages from one or more nodes in the first subset of nodes indicating completion status of the first set of local environment verifications at said one or more nodes; and

in accordance with the received verification status data, providing action progress updates to a user.

43. The server system of claim 22, wherein the instructions stored in memory include instructions, which when executed by the one or more processors cause the server system to perform operations including:

receiving an instruction to collect recent results for the first set of local environment verifications from the first subset of nodes; and

in response to receiving the instruction to collect the recent results, sending a third query message along the linearly ordered communication orbit to collect the recent results from the first subset of nodes, wherein;

in accordance with a determination that cached results for the first set of local environment verifications meet predefined age criteria, the respective node of the first subset of nodes sends the cached results to the server system through the linearly ordered communication orbit.

23. A non-transitory computer-readable medium, having instructions stored thereon, which when executed by one or more processors of a server system of a computer network that has a plurality of nodes, wherein each said node comprises a respective computational device and has a respective defined location in a linearly ordered communication orbit comprising said plurality of nodes, cause the server system to perform operations including:

injecting, into the linearly ordered communication orbit, a bundle of information items regarding deployment of a respective local environment verification framework at each of a first subset of nodes in the computer network, wherein;

the bundle of information items is distributed to a respective node of the first subset of nodes through the linearly ordered communication orbit,

the respective local environment verification framework is established at the respective node of the first subset of nodes in accordance with the bundle of information items that is distributed to said respective node; and

the respective node of the first subset of nodes is configured to perform a first set of local environment verifications using the respective local environment verification framework that has been established at said respective node;

injecting, into the linearly ordered communication orbit, a query message to collect respective local results of the first set of local environment verifications from the first subset of nodes, wherein;

the query message is forwarded from node to node along the linearly ordered communication orbit, and

the respective node of the first subset of nodes, in response to receiving the query message through the linearly ordered communication orbit, sends the respective local results of the first set of local environment verifications that have been obtained at said respective node to the server system through the linearly ordered communication orbit.

44. The non-transitory computer-readable medium of claim 23, wherein the bundle of information items regarding deployment of the respective local environment verification framework includes a plurality of compliance benchmarks and an engine for executing the plurality of compliance benchmarks.

45. The non-transitory computer-readable medium of claim 23, further including instructions, which when executed by the one or more processors cause the server system to perform operations including, prior to injecting the query message, sending a verification request to perform the first set of local environment verifications at the first subset of nodes, wherein the verification request includes one or more parameters for performing the first set of local environment verifications at the first subset of nodes.

46. The non-transitory computer-readable medium of claim 45, wherein the one or more parameters include one or more of:

a selection of the first set of local environment verifications from a full set of local environment verifications included in the bundle of information items,

a schedule by which the first set of local environment verifications is to be executed at the first subset of nodes,

a time interval during which the first set of local environment verifications is to be completed at the first subset of nodes, and

a batch size for running the first set of local environment verifications at a time.

47. The non-transitory computer-readable medium of claim 23, further including instructions, which when executed by the one or more processors cause the server system to perform operations including:

receiving a first instruction to deploy a local environment verification action to implement the first set of local environment verifications at the first subset of nodes, wherein the server system assembles the bundle of information items injected into the linearly ordered communication orbit.

48. The non-transitory computer-readable medium of claim 47, wherein the first instruction specifies a first time interval during which to distribute the bundle of information items to the first subset of nodes.

49. The non-transitory computer-readable medium of claim 47, wherein the first instruction specifies a second time interval for re-deploying the respective local environment verification framework at each of the first subset of nodes.

50. The non-transitory computer-readable medium of claim 47, wherein the first instruction specifies one or more characteristics for dynamically identifying the first subset of nodes, and wherein the respective node of the first subset of nodes self-identifies as belonging to the first subset of nodes based on the one or more characteristics.

51. The non-transitory computer-readable medium of claim 23, wherein injecting the bundle of information items into the linearly ordered communication orbit includes:

dividing the bundle of information items into a plurality of file shards from which the bundle of information items are restorable; and

sending the plurality of file shards to a selected node in the linearly ordered communication orbit.

52. The non-transitory computer-readable medium of claim 51, wherein one or more copies of each file shard of the plurality of file shards are propagated from node to node along the linearly ordered communication orbit while the bundle of information items are being distributed to the first subset of nodes.

53. The non-transitory computer-readable medium of claim 51, wherein the respective node of the first subset of nodes assembles the plurality of file shards into the bundle of information items after receiving each of the plurality of file shards through the linearly ordered communication orbit.

54. The non-transitory computer-readable medium of claim 23, further including instructions, which when executed by the one or more processors cause the server system to perform operations including:

receiving deployment status data from the first subset of nodes through the linearly ordered communication orbit, wherein the deployment status data includes respective messages from one or more nodes in the first subset of nodes indicating establishment of the respective local environment verification framework at said one or more nodes; and

in accordance with the received deployment status data, providing deployment progress updates to a user.

55. The non-transitory computer-readable medium of claim 23, further including instructions, which when executed by the one or more processors cause the server system to perform operations including:

receiving a second instruction to generate a report regarding execution of a local environment verification action at the first subset of nodes, wherein the server system injects the query message into the linearly ordered communication orbit in accordance with the second instruction.

56. The non-transitory computer-readable medium of claim 55, wherein the second instruction specifies a second time interval for reissuing the query message to collect the respective local results of the first set of local environment verifications from the first subset of nodes.

57. The non-transitory computer-readable medium of claim 55, further including instructions, which when executed by the one or more processors cause the server system to perform operations including:

providing to a user a report on local results of the first set of local environment verifications at the first subset of nodes.

58. The non-transitory computer-readable medium of claim 57, further including instructions, which when executed by the one or more processors cause the server system to perform operations including:

receiving a third instruction to issue a remedial action command to the respective node of the first subset of nodes; and

sending the remedial action command to the respective node of the first subset of nodes through the linearly ordered communication orbit.

59. The non-transitory computer-readable medium of claim 55, wherein:

the second instruction includes one or more custom verifications that are to be performed at the first subset of nodes; and

further including instructions, which when executed by the one or more processors cause the server system to perform operations including;

injecting, into the linearly ordered communication orbit, a second query message to request execution of the one or more custom verifications at the first subset of nodes;

forwarding the second query message from node to node along the linearly ordered communication orbit;

performing, at the respective node of the first subset of nodes, in response to receiving the second query message through the linearly ordered communication orbit, the one or more custom verifications; and

sending respective local results for the one or more custom verifications that have been obtained at said respective node to the server system through the linearly ordered communication orbit.

60. The non-transitory computer-readable medium of claim 55, wherein the bundle of information items includes a plurality of rules of the respective local environment verification framework, and the second instruction includes an identifier mapping that maps first identifiers of the plurality of rules to second identifiers of the plurality of rules.

61. The non-transitory computer-readable medium of claim 60, further including instructions, which when executed by the one or more processors cause the server system to perform operations including:

generating a first report that includes the first identifiers of the plurality of rules of the respective local environment verification framework; and

generating a second report that includes the second identifiers of the plurality of rules of the respective local environment verification framework.

62. The non-transitory computer-readable medium of claim 23, further including instructions, which when executed by the one or more processors cause the server system to perform operations including:

receiving verification status data from the first subset of nodes through the linearly ordered communication orbit, wherein the verification status data includes respective messages from one or more nodes in the first subset of nodes indicating completion status of the first set of local environment verifications at said one or more nodes; and

in accordance with the received verification status data, providing action progress updates to a user.

63. The non-transitory computer-readable medium of claim 23, further including instructions, which when executed by the one or more processors cause the server system to perform operations including:

receiving an instruction to collect recent results for the first set of local environment verifications from the first subset of nodes; and

in response to receiving the instruction to collect the recent results, sending a third query message along the linearly ordered communication orbit to collect the recent results from the first subset of nodes, wherein;

in accordance with a determination that cached results for the first set of local environment verifications meet predefined age criteria, the respective node of the first subset of nodes sends the cached results to the server system through the linearly ordered communication orbit.