NON-INVASIVE AUTOMATIC OFFSITE PATCH FINGERPRINTING AND UPDATING SYSTEM AND METHOD

• US 20110029966A1
• Filed: 10/08/2010
• Published: 02/03/2011
• Est. Priority Date: 09/22/2000
• Status: Active Grant

• Current Assignee: Ivanti, Inc. (Ivanti Software, Inc.)
• Original Assignee: Lumension Security, Inc. (Ivanti Software, Inc.)
• Inventors: Lane, Jonathan, Ferguson, Dan, Gordon, Jonathan M., Andrew, Christopher A. H., Hudler, Jack Lee, Bacon, Michael, Horton, James J., Moshir, Sean, Williams, Noah, Li, Leon
• Granted Patent: US 8,407,687 B2
• Time in Patent Office: Days
• US Class Current: 717/173
• CPC Class Codes: G06F 11/1433 during software upgrading
• CPC Class Codes: G06F 8/62 Uninstallation
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57

Abstract

Methods, systems, and configured storage media are provided for discovering software updates, discovering if a given computer can use the software update, and then updating the computers with the software as needed automatically across a network without storing the updates on an intermediate machine within the network. Furthermore, when a failure is detected, the rollout is stopped and the software can be automatically removed from those computers that already were updated. The software update can be stored originally at an address that is inaccessible through the network firewall by intermediately uploading the software update to an update computer which is not a part of the network but has access through the firewall, which is then used to distribute the update.

Claims

1-20. -20. (canceled)

21. A method comprising:

(a) storing at least one patch fingerprint at a package computer;

wherein each patch fingerprint comprises at least one extensible markup language (XML) metadata query;

wherein at least one of the patch fingerprints is associated with a specific software update;

(b) downloading the at least one patch fingerprint from the package computer to a repository component of an update server;

wherein the package computer is apart from the update server;

(c) sending the at least one XML metadata query from the update server to the first target computer;

(d) scanning the first target computer via a discovery agent located on the first target computer,

wherein the scanning comprises utilizing the at least one XML metadata query in combination with the discovery agent to produce target computer information;

wherein the target computer information is related to at least hardware configuration information, registry information, software presence information, and software version information relative to the first target computer;

wherein the first target computer is separated from the package computer via a firewall;

(e) sending the target computer information to the repository component located on the update server;

(f) storing the target computer information in the repository component located on the update server;

(g) comparing, at the update server, at least a portion of the target computer information with at least one of the patch fingerprints;

(h) determining, at the update server, in response to the comparing step (g), whether the specific software update is absent from the first target computer;

(i) downloading, in response to the determining step (h), the specific software update to the update server; and

(j) downloading, in response to the determining step (h) or the downloading step (i), the specific software update from the update server to the first target computer.

22. The method of claim 21, wherein the target computer information is contained in a results file, and wherein the results file is in an XML format.

23. The method of claim 21, wherein the specific software update is one of patch files, data files, script files, new application files, and executable files, or any combination thereof.

24. The method of claim 21, comprising:

monitoring the package computer for a new patch fingerprint; and

downloading the new patch fingerprint from the package computer to the update server.

25. The method of claim 21, comprising:

notifying an administrator after the comparing step (e), wherein the notifying an administrator comprises sending a message to a predetermined address.

26. The method of claim 21, wherein the XML metadata query is in the form of an XML-based request input file.

27. The method of claim 21, comprising:

(k) installing the specific software update on the first target computer; and

(l) verifying that the installation step (k) was successfully completed.

28. The method of claim 21, wherein the determining step (h) comprises determining whether the specific software update is applicable to the first target computer.