Non-invasive automatic offsite patch fingerprinting and updating system and method

• US 7,823,147 B2
• Filed: 06/23/2005
• Issued: 10/26/2010
• Est. Priority Date: 09/22/2000
• Status: Active Grant

• Current Assignee: Ivanti, Inc. (Ivanti Software, Inc.)
• Original Assignee: Lumension Security, Inc. (Ivanti Software, Inc.)
• Inventors: Bacon, Michael, Lane, Jonathan, Ferguson, Dan, Gordon, Jonathan M., Andrew, Christopher A. H., Hudler, Jack Lee, Horton, James J., Moshir, Sean, Williams, Noah, Li, Leon
• Primary Examiner(s): Yigdall; Michael J
• Application Number:
  US11/160,439
• Publication Number:
  US 20050257214A1
• Time in Patent Office: 1,951 Days
• Field of Search: None
• US Class Current: 717/173
• CPC Class Codes: G06F 11/1433 during software upgrading
• CPC Class Codes: G06F 8/62 Uninstallation
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57

Abstract

Methods, systems, and configured storage media are provided for discovering software updates, discovering if a given computer can use the software update, and then updating the computers with the software as needed automatically across a network without storing the updates on an intermediate machine within the network. Furthermore, when a failure is detected, the rollout is stopped and the software can be automatically removed from those computers that already were updated. The software update can be stored originally at an address that is inaccessible through the network firewall by intermediately uploading the software update to an update computer which is not a part of the network but has access through the firewall, which is then used to distribute the update.

Claims

1. A system comprising:

(a) a package computer having a plurality of patch fingerprints;

(i) wherein the plurality of patch fingerprints includes at least a first patch fingerprint and a second patch fingerprint, different than the first patch fingerprint;

(i) wherein at least the first and second patch fingerprints each comprises at least one Extensible Markup Language (XML) metadata query, wherein the first patch fingerprint includes a first XML metadata query, and wherein the second patch fingerprint includes a second XML metadata query, different than the first XML metadata query;

(ii) wherein at least the first and second patch fingerprints are both associated with a specific software update;

(b) an update server in communication with the package computer;

(i) wherein the update server stores at least the first and second patch fingerprints of the package computer;

(ii) wherein the update server is located remote from the package computer; and

(c) a discovery agent configured to separately interact with both the first XML metadata query and the second XML metadata query to produce first target computer information relating to the first target computer;

wherein the system is configured to;

(A) send the first XML metadata query and the second XML metadata query of the first and second patch fingerprints from the update server to the discovery agent to gather the first target computer information;

(I) wherein the first target computer information is related to at least registry information, software presence information, and software version information relative to the first target computer;

(II) wherein a first portion of the first target computer information is associated with the first patch fingerprint and the first XML metadata query;

(III) wherein a separate second portion of the first target computer information is associated with the second patch fingerprint and the second XML metadata query;

(B) determine, at the update server based on the first target computer information, whether the specific software update is both applicable to and absent from the first target computer;

(i) wherein the determination step comprises;

(1) evaluating the first portion of the first target computer information to determine the applicability of the specific software update to the first target computer; and

(2) if the specific software update is applicable to the first target computer, then evaluating the second portion of the first target computer information to determine the presence or absence of;

(A) the applicable files;

(B) the applicable registry keys; and

(C) the applicable configuration information of the specific software update;

wherein the system is configured to, based on the determination (B), download the specific software update to one of (i) the update server and (ii) the first target computer.

2. The system of claim 1, wherein the specific software update is one of patch files, data files, script files, new application files, and executable files, or any combination thereof.

3. The system of claim 1, wherein the update server is configured to:

monitor the package computer for a new patch fingerprint; and

receive the new patch fingerprint from the package computer.

4. The system of claim 1, wherein the first target computer information is contained in a results file, wherein the results file is in an XML format, and wherein the results file is stored at the update server.

5. The system of claim 1, further comprising:

an update task list located on the update server;

wherein the update server is configured to review the update task list for a target computer that has not received the specific software update and, if one is found, add an update task identifier for that target computer to the update task list.

6. The system of claim 5, further comprising:

a monitor configured to monitor the installation of the specific software update on the first target computer;

wherein, if the monitor determines that the installation of the specific software update was successful, the update server reviews the update task list for a target computer that has not received the specific software update and, if one is found, adds an update task identifier for that target computer to the update task list.