Pairing in a Distributed Network Management System that Uses a Logical Multi-Dimensional Label-Based Policy Model

• US 20150127832A1
• Filed: 10/29/2014
• Published: 05/07/2015
• Est. Priority Date: 11/04/2013
• Status: Active Grant

• Current Assignee: Illumio, Inc.
• Original Assignee: Illumio, Inc.
• Inventors: Kirner, Paul J., Cook, Daniel R., Glenn, Matthew K., Gupta, Mukesh, Scott, Jerry B., Verghese, Thukalan V.
• Granted Patent: US 9,397,892 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: H04L 41/0869 Validating the configuration within one network element
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/303 Terminal profiles
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC

Abstract

A server is paired. A pairing request that includes a pairing key is received from an unpaired server. A determination is made regarding whether to approve or reject the pairing request. Making the determination comprises attempting to validate the pairing key in the pairing request. Responsive to determining to approve the pairing request: the unpaired server is notified that the unpaired server is now a managed server; a description of the managed server is generated, wherein the managed server description includes a set of one or more labels that describe the managed server; management instructions are generated for the managed server based on the managed server description and based on an administrative domain-wide management policy that includes a rule that refers to managed servers using a label; and the management instructions are sent to the managed server.

Claims

1. A method for pairing a server, comprising:

receiving, from an unpaired server, a pairing request that includes a pairing key;

determining whether to approve or reject the pairing request, comprising attempting to validate the pairing key in the pairing request; and

responsive to determining to approve the pairing request;

notifying the unpaired server that the unpaired server is now a managed server;

generating a description of the managed server, wherein the managed server description includes a set of one or more labels that describe the managed server;

generating management instructions for the managed server based on the managed server description and based on an administrative domain-wide management policy that includes a rule that refers to managed servers using a label; and

sending the management instructions to the managed server.

2. The method of claim 1, wherein attempting to validate the pairing key in the pairing request comprises:

attempting to identify a pairing profile that includes a pairing key that matches the pairing key in the pairing request; and

responsive to failing to identify the pairing profile that includes the pairing key that matches the pairing key in the pairing request;

determining that the pairing key in the pairing request is invalid; and

determining to reject the pairing request.

3. The method of claim 2, wherein attempting to validate the pairing key in the pairing request further comprises:

responsive to identifying the pairing profile that includes the pairing key that matches the pairing key in the pairing request, determining whether the pairing key in the pairing request has been exhausted, has expired, or has been revoked; and

responsive to determining that the pairing key in the pairing request has been exhausted, has expired, or has been revoked;

determining that the pairing key in the pairing request is invalid; and

determining to reject the pairing request.

4. The method of claim 1, wherein the pairing request further includes a requested label, and wherein determining whether to approve or reject the pairing request further comprises:

identifying a pairing profile that includes a pairing key that matches the pairing key in the pairing request;

determining that the pairing profile includes a locked default label with a dimension that matches a dimension of the requested label;

determining whether a value of the locked default label differs from a value of the requested label; and

responsive to determining that the value of the locked default label differs from the value of the requested label;

determining to reject the pairing request;

or

determining to use the value of the locked default label in the managed server description.

5. The method of claim 1, wherein the pairing request further includes a requested configured characteristic, and wherein determining whether to approve or reject the pairing request further comprises:

identifying a pairing profile that includes a pairing key that matches the pairing key in the pairing request;

determining that the pairing profile includes a locked default configured characteristic with a key that matches a key of the requested configured characteristic;

determining whether a value of the locked default configured characteristic differs from a value of the requested configured characteristic; and

responsive to determining that the value of the locked default configured characteristic differs from the value of the requested configured characteristic;

determining to reject the pairing request;

or

determining to use the value of the locked default configured characteristic in the managed server description.

6. The method of claim 1, wherein the pairing request further includes a requested server state, and wherein determining whether to approve or reject the pairing request further comprises:

identifying a pairing profile that includes a pairing key that matches the pairing key in the pairing request;

determining that the pairing profile includes a locked default server state;

determining whether a value of the locked default server state differs from a value of the requested server state; and

responsive to determining that the value of the locked default server state differs from the value of the requested server state;

determining to reject the pairing request;

or

determining to use the value of the locked default server state in the managed server description.

7. The method of claim 1, wherein the pairing request further includes information regarding the unpaired server, and wherein determining whether to approve or reject the pairing request further comprises:

identifying a pairing profile that includes a pairing key that matches the pairing key in the pairing request;

determining that the pairing profile includes a test to perform using the unpaired server information;

performing the test using the unpaired server information; and

responsive to the test failing, determining to reject the pairing request.

8. The method of claim 7, wherein the test concerns the unpaired server'"'"'s geographical location, operating system, service information, cloud service provider, or threat status.

9. The method of claim 1, further comprising responsive to determining to approve the pairing request and prior to notifying the unpaired server that the unpaired server is now the managed server:

analyzing information associated with the unpaired server; and

based on the analysis, approving or rejecting a change of the unpaired server to the managed server;

wherein generating the managed server description comprises setting a server state of the managed server to a “

managed”

server state.

10. The method of claim 1, wherein generating the managed server description comprises generating the set of labels based on a pairing profile or based on the pairing request.

11. The method of claim 1, further comprising prior to receiving, from the unpaired server, the pairing request that includes the pairing key:

generating the pairing key; and

storing the pairing key.

12. The method of claim 11, further comprising prior to receiving, from the unpaired server, the pairing request that includes the pairing key:

sending the pairing key to the unpaired server using out-of-band communication.

13. The method of claim 1, further comprising responsive to determining to reject the pairing request:

generating a log entry that includes the pairing request, a reason for rejecting the pairing request, or a timestamp indicating when the rejection occurred; and

storing the log entry.

14. A non-transitory computer-readable storage medium storing computer program modules for pairing a server, the computer program modules executable to perform steps comprising:

receiving, from an unpaired server, a pairing request that includes a pairing key;

determining whether to approve or reject the pairing request, comprising attempting to validate the pairing key in the pairing request; and

responsive to determining to approve the pairing request;

notifying the unpaired server that the unpaired server is now a managed server;

generating a description of the managed server, wherein the managed server description includes a set of one or more labels that describe the managed server;

generating management instructions for the managed server based on the managed server description and based on an administrative domain-wide management policy that includes a rule that refers to managed servers using a label; and

sending the management instructions to the managed server.

15. The non-transitory computer-readable storage medium of claim 14, wherein attempting to validate the pairing key in the pairing request comprises:

attempting to identify a pairing profile that includes a pairing key that matches the pairing key in the pairing request; and

responsive to failing to identify the pairing profile that includes the pairing key that matches the pairing key in the pairing request;

determining that the pairing key in the pairing request is invalid; and

determining to reject the pairing request.

16. The non-transitory computer-readable storage medium of claim 14, wherein the pairing request further includes a requested label, and wherein determining whether to approve or reject the pairing request further comprises:

identifying a pairing profile that includes a pairing key that matches the pairing key in the pairing request;

determining that the pairing profile includes a locked default label with a dimension that matches a dimension of the requested label;

determining whether a value of the locked default label differs from a value of the requested label; and

responsive to determining that the value of the locked default label differs from the value of the requested label;

determining to reject the pairing request;

or

determining to use the value of the locked default label in the managed server description.

17. The non-transitory computer-readable storage medium of claim 14, wherein the pairing request further includes information regarding the unpaired server, and wherein determining whether to approve or reject the pairing request further comprises:

identifying a pairing profile that includes a pairing key that matches the pairing key in the pairing request;

determining that the pairing profile includes a test to perform using the unpaired server information;

performing the test using the unpaired server information; and

responsive to the test failing, determining to reject the pairing request.

18. The non-transitory computer-readable storage medium of claim 14, wherein the steps further comprise responsive to determining to approve the pairing request and prior to notifying the unpaired server that the unpaired server is now the managed server:

analyzing information associated with the unpaired server; and

based on the analysis, approving or rejecting a change of the unpaired server to the managed server;

wherein generating the managed server description comprises setting a server state of the managed server to a “

managed”

server state.

19. The non-transitory computer-readable storage medium of claim 14, wherein generating the managed server description comprises generating the set of labels based on a pairing profile or based on the pairing request.

20. A system for pairing a server, the system comprising:

a non-transitory computer-readable storage medium storing computer program modules executable to perform steps comprising;

receiving, from an unpaired server, a pairing request that includes a pairing key;

determining whether to approve or reject the pairing request, comprising attempting to validate the pairing key in the pairing request; and

responsive to determining to approve the pairing request;

notifying the unpaired server that the unpaired server is now a managed server;

generating a description of the managed server, wherein the managed server description includes a set of one or more labels that describe the managed server;

generating management instructions for the managed server based on the managed server description and based on an administrative domain-wide management policy that includes a rule that refers to managed servers using a label; and

sending the management instructions to the managed server; and

a computer processor for executing the computer program modules.