Automated change approval

• US 9,680,707 B2
• Filed: 08/02/2011
• Issued: 06/13/2017
• Est. Priority Date: 03/31/2005
• Status: Active Grant

• Current Assignee: Tripwire Incorporated (Belden Inc.)
• Original Assignee: Tripwire Incorporated (Belden Inc.)
• Inventors: Torrence, Gregor W., Thompson, Troy D.
• Primary Examiner(s): ZAND, DAVOUD AMAN
• Application Number:
  US13/196,666
• Publication Number:
  US 20120023076A1
• Time in Patent Office: 2,142 Days
• Field of Search: 709221, 712 15, 713100
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 41/0843 based on generic templates
• CPC Class Codes: H04L 41/0866 Checking the configuration

Abstract

An automated method for facilitating management of a data processing environment is disclosed. In various embodiments, the method may include facilitating creation of a first memorialization, in digital form, of first one or more changes made to a first data processing device of the data processing environment. In various embodiments, the method may further include facilitating creation of a second and a third memorialization, both in digital form, of second and third one or more changes made to a second and a third data processing device of the data processing environment, respectively. In various embodiments, the method may still further include facilitating automated approval of the second and third changes made to the second and third data processing devices, using the first, second and third memorializations. Other embodiments of the present invention may include, but are not limited to, apparatus adapted to facilitate practice of the above-described method.

Claims

1. An automated method for facilitating management of a data processing environment comprising:

by a computer;

creating in digital form a first record of first one or more changes made to a first data processing device of the data processing environment, wherein the changes made to the first data processing device are represented at least in part by one or more hashes of software or of data on the first data processing device;

creating in digital form a second record of second one or more changes directed to be made to a second data processing device of the data processing environment, wherein the changes directed to be made to the second data processing device are represented at least in part by one or more hashes of software or of data on the second data processing device;

receiving an indication from a user that the first record is to be used as a template of approved changes;

comparing data in the second record to data in the template according to one or more of;

(a) whether an object name and hash in the template and the second record match;

(b) whether an object name in the template and the second record match;

or (c) whether a rule name in the template and the second record match; and

in response to the comparing, determining that the data in the second record does not match the data in the template and providing an alert response, wherein the providing the alert response comprises displaying a report that includes detected changes at the second processing device that match the changes specified in the template and detected data at the second processing device that does not match the changes specified in the template,

wherein the second data processing device is a networking device, a router, a switch, a server, a desktop computer, a laptop computer, a tablet computer, a personal digital assistant, a cellular phone, a set top box, or a media player.

2. The method of claim 1, further comprising providing a remediation response configured to remediate the second data processing device through a change to the second data processing device that matches a corresponding change in the first data processing device.

3. The method of claim 1, wherein the first data processing device is a first server and wherein the second data processing device is a second server.

4. The method of claim 1, wherein the first one or more changes are at least two changes.

5. The method of claim 1, wherein the first data processing device is a test server and the second data processing device is a production server.

6. The method of claim 1, wherein the changes made to the first data processing device are detected by comparing one or more pre-change hashes of the software or of data on the first data processing device with corresponding one or more post-change hashes of the software or of data on the first data processing device.

7. The method of claim 1, wherein at least one of the hashes is generated using an MD5, SHA, or HAVL hashing technique.

8. The method of claim 1, wherein the comparing data in the second record to data in the template is performed according to whether an object name and hash in the template and the second record match.

9. A non-transitory computer-readable medium storing computer-executable instructions which when executed by a computer cause the computer to perform a method, the method comprising:

facilitating creation of a first record of first one or more changes made to a first data processing device of a data processing environment, wherein the changes made to the first data processing device and indicated by the first record are represented at least in part by hashes of software or of data on the first data processing device;

facilitating creation of a second record of second one or more changes directed to be made to a second data processing device of the data processing environment, wherein the changes directed to be made to the second data processing device and indicated by the second record are represented at least in part by hashes of software or of data on the second data processing device;

receiving an indication from a user that the first record is to be used as a template of approved changes;

comparing data in the second record to data in the template, according to one or more of;

(a) whether an object name and hash in the template and the second record match;

(b) whether an object name in the template and the second record match;

or (c) whether a rule name in the template and the second record match; and

in response to the comparing, automatically providing an alert response if the data in the second record does not match the data in the template;

wherein the alert response comprises a report that includes an unapproved change at the second data processing device that does not match any of the approved changes specified in the template of approved changes, and

wherein the second data processing device comprises a networking device, a router, a switch, a server, a desktop computer, a laptop computer, a tablet computer, a personal digital assistant, a cellular phone, a set to box, or a media player.

10. The non-transitory computer-readable medium of claim 9, wherein the first one or more changes are at least two changes.

11. The non-transitory computer-readable medium of claim 9, wherein the method further comprises approving the changes made to the second data processing device if the data in the second record matches the data in the template.

12. The non-transitory computer-readable medium of claim 9, wherein the first data processing device is a test server and the second data processing device is a production server.

13. The non-transitory computer-readable medium of claim 9, wherein the changes made to the first data processing device and indicated by the first record are detected by comparing one or more pre-change hashes of the software or of data on the first data processing device with corresponding one or more post-change hashes of the software or of data on the first data processing device.

14. The non-transitory computer-readable medium of claim 9, wherein at least one of the hashes is generated using an MD5, SHA, or HAVL hashing technique.

15. The non-transitory computer-readable medium of claim 9, wherein the comparing data in the second record to data in the template is performed according to whether an object name and hash in the template and the second record match.

16. A system for facilitating management of a data processing environment, the system comprising:

one or more computers configured to;

facilitate creation in digital form of a first record of first one or more changes made to a first data processing device of the data processing environment, wherein the changes made to the first data processing device and indicated by the first record are represented at least in part by hashes of software or of data on the first data processing device;

facilitate creation in digital form of a second record of second one or more changes directed to be made to a second data processing device of the data processing environment, wherein the changes directed to be made to the second data processing device and indicated by the second record are represented at least in part by hashes of software or of data on the second data processing device;

receive an indication from a user that the first record is to be used as a template of approved changes;

compare data in the second record to data in the template according to one or more of;

(a) whether an object name and hash in the template and the second record match;

(b) whether an object name in the template and the second record match;

or (c) whether a rule name in the template and the second record match;

responsive to the comparison, determine that the data in the second record does not match the data in the template; and

responsive to the determination, provide an alert response, the alert response comprising a report indicating the data of the second record that does not match the changes specified in the template,

wherein the second data processing device is a device selected from the group consisting of a networking device, a router, a switch, a server, a desktop computer, a laptop computer, a tablet computer, a personal digital assistant, a cellular phone, a set top box, and a media player.

17. The system of claim 16, wherein the one or more computers are further configured to provide a remediation response if the data in the second record does not match the data in the template.

18. The system of claim 16, wherein the first one or more changes are at least two changes.

19. The system of claim 16, wherein the first data processing device is a test server and the second data processing device is a production server.

20. The system of claim 16, wherein the changes made to the first data processing device and indicated by the first record are detected by comparing one or more pre-change hashes of the software or of data on the first data processing device with corresponding one or more post-change hashes of the software or of data on the first data processing device.

21. The system of claim 16, wherein at least one of the hashes is generated using an MD5, SHA, or HAVL hashing technique.

22. The system of claim 16, wherein the comparing data in the second record to data in the template is performed according to whether an object name and hash in the template and the second record match.

23. A non-transitory computer-readable medium storing computer-executable instructions which when executed by a computer cause the computer to perform a method, the method comprising:

creating in digital form a first record of first changes made to a first data processing device of a data processing environment, wherein the changes made to the first data processing device are identified at least in part by hashes of software or of data on the first data processing device;

creating in digital form a second record of second one or more changes made to a second data processing device of the data processing environment, wherein the changes made to the second data processing device are identified at least in part by hashes of software or of data on the second data processing device;

receiving an indication from a user that the first record is to be used as a template of approved changes;

facilitating automated approval of the second changes made to the second data processing devices by comparing data in the second record to data in the template according to one or more of;

(a) whether an object name and hash in the template and the second record match;

(b) whether an object name in the template and the second record match;

or (c) whether a rule name in the template and the second record match; and

displaying a report that identifies detected changes at the second processing device that match the changes specified in the template or detected changes at the second processing device that do not match the changes specified in the template,

wherein the second data processing device is a networking device or a server.

24. The non-transitory computer-readable medium of claim 23, wherein the method further comprises causing at least one of the hashes to be generated using an MD5, SHA, or HAVL hashing technique.

25. A system for facilitating management of a data processing environment, the system comprising:

one or more computers configured to;

create, in digital form, a first record of changes made to a first data processing device of the data processing environment, wherein the changes made to the first data processing device are indicated in the first record at least in part by hashes of software or of data on the first data processing device;

create, in digital form, a plurality of secondary records of changes made to a plurality of secondary data processing devices of the data processing environment, wherein the changes made to the secondary data processing devices are indicated in the secondary records at least in part by hashes of software or of data on the respective secondary data processing devices;

receive an indication from a user that the first record is to be used as a template of approved changes;

compare data in the secondary records to data in the template according to one or more of;

(a) whether an object name and hash in the template and the secondary records match;

or (b) whether an object name in the template and the secondary records match; and

display a report that comprises one or more of detected changes at the second processing device that match the changes specified in the template or of detected changes at the second processing device that do not match the changes specified in the template,

wherein the second data processing devices are networking devices or servers.

26. The system of claim 25, wherein the one or more computers are further configured to approve the changes made to the second data processing devices if the data in the respective secondary records match the data in the template.

27. The system of claim 25, wherein the first data processing device is a test server and the secondary data processing devices are production servers.

28. The system of claim 25, wherein the changes made to the first data processing device and indicated by the first record are detected by comparing one or more pre-change hashes of the software or of data on the first data processing device with corresponding one or more post-change hashes of the software or of data on the first data processing device.

29. The system of claim 25, wherein at least one of the hashes is generated using an MD5, SHA, or HAVL hashing technique.

30. The system of claim 25, wherein the comparing data in the secondary records to data in the template is performed according to whether an object name and hash in the template and the secondary records match.

31. A method for maintaining data security in a distributed network of different types of data processing devices, comprising:

storing a first digital record of a first data change made to a first data processing device;

receiving an indication from a user that the first digital record comprises an approved data change template;

storing a second digital record of a second data change made to a second data processing device of the network of different types of data processing devices;

comparing at least a portion of the second digital record to the approved data change template so as to determine whether the at least a portion of the second digital record matches the approved data change template;

generating a report of a failed match when the at least a portion of the second digital record does not match the approved data change template; and

generating a report of a match when the at least a portion of the second digital record matches the approved data change template;

wherein the approved data change template comprises a first object name and a first hash, and the second digital record comprises a second object name and a second hash;

wherein the comparing the at least a portion of the second digital record to the approved data change template so as to determine whether the at least a portion of the second digital record matches the approved data change template comprises;

identifying whether the first object name matches the second object name, and

identifying whether the first hash matches the second hash;

wherein the first data processing device comprises a test server; and

wherein the second data processing device comprises a production server.

32. The method of claim 31, further comprising generating a remediation response to facilitate correction of the second data processing device so as to match the approved data change template.

33. The method of claim 31, further comprising generating a display of a first amount of second data changes that match the approved data change template and a second amount of second data changes that do not match the approved data change template.

34. The method of claim 31, wherein the first hash or the second hash is an MD5, SHA, or HAVL hash.

35. The method of claim 31, wherein the different types of data processing devices comprise a router, a switch, a server, a desktop computer, a laptop computer, a tablet computer, a personal digital assistant, a cellular phone, a set top box, or a media player.

36. A system for maintaining data security in a distributed network of different types of data processing devices, comprising:

a first storage device configured to store a first digital record of a first data change made to a first data processing device, store an indication from a user that the first digital record comprises an approved data change template, and store a second digital record comprising a second data change made to a second data processing device of the distributed network of different types of data processing devices; and

a processor configured to compare the second data change of the second digital record to the approved data change template so as to determine whether the second data change matches the approved data change template,

wherein the approved data change template comprises a first object name and a first hash, and the second data change of the second digital record comprises a second object name and a second hash;

wherein the processor is configured to identify;

(a) whether the first object name matches the second object name and identify whether the first hash matches the second hash;

(b) whether the first object name matches the second object name;

or (c) whether the first hash matches the second hash;

wherein the processor is further configured to display a report that indicates one or more identified changes at the second processing device that match the changes specified in the template or one or more identified changes at the second processing device that do not match the changes specified in the template;

wherein the first data processing device comprises a test server; and

wherein the second data processing device comprises a production server.

37. The system of claim 36, wherein the processor is further configured to provide a remediation response when either (a) the first object name is not found in the second record;

or (b) the first hash does not match the second hash.

38. The system of claim 37, wherein the remediation response facilitates changes to the second data processing device so that the second processing device satisfies the approved data change template.

39. The system of claim 36, wherein the first hash and the second hash are MD5, SHA, or HAVL hashes.

40. The system of claim 36, wherein the different types of data processing devices comprise a router, a switch, a server, a desktop computer, a laptop computer, a tablet computer, a personal digital assistant, a cellular phone, a set top box, or a media player.

41. A method for maintaining data security in a distributed network of different types of data processing devices including routers, switches, servers, desktop computers, laptop computers, tablet computers, personal digital assistants, cellular phones, set to boxes, or media players comprising:

storing a first digital record of a first data change made to a first data processing device of the distributed network of different types of data processing devices;

receiving an indication from a user that the first digital record comprises an approved data change template;

storing a second digital record comprising a second data change made to a second data processing device of the distributed network of different types of data processing devices;

comparing the second data change of the second digital record to the approved data change template so as to determine whether the second data change matches the approved data change template;

generating an approval response when the second data change matches the approved data change template; and

displaying an indication that the second data change matches the approved data change template,

wherein the approved data change template comprises a first object name and a first hash, and the second data change of the second digital record comprises a second object name and a second hash,

wherein the comparing the second data change of the second digital record to the approved data change template so as to determine whether the second data change matches the approved data change template comprises identifying whether the first object name matches the second object name and identifying whether the first hash matches the second hash,

wherein the generating the approval response is performed when the first object name matches the second object name and the first hash matches the second hash.

42. The method of claim 41, further comprising causing the first and second hashes to be generated using an MD5, SHA, or HAVL hashing technique.

43. The method of claim 41, further comprising generating a remediation response when the second data change does not match the approved data change template.

44. The method of claim 43, wherein the remediation response is configured to implement changes to the second data processing device so that the second processing device satisfies the approved data change template.

45. The method of claim 41, wherein the second data processing device comprises a plurality of different networking devices.

46. The method of claim 41, wherein the first data processing device comprises a test server, and the second data processing device comprises a production server.

47. A system for maintaining data security in a distributed network of different types of data processing devices that includes routers, switches, servers, desktop computers, laptop computers, tablet computers, personal digital assistants, cellular phones, set top boxes, or media players, comprising:

a storage device configured to store a first digital record of a first data change made to a first data processing device of the distributed network of different types of data processing devices, to store an indication from a user that the first digital record comprises an approved data change template, and to store a second digital record comprising a second data change made to a second data processing device of the network of different types of data processing devices;

a processor configured to compare the second data change to the approved data change template so as to determine whether the second data change matches the approved data change template, and generate an approval response when the second data change matches the approved data change template,

wherein the comparing the second data change to the approved data change template so as to determine whether the second data change matches the approved data change template comprises identifying whether a first object name matches a second object name and identifying whether a first hash matches a second hash,

wherein the generating the approval response is performed when the first object name matches the second object name and the first hash matches the second hash, and

wherein the processor is further configured to generate a report indicating that the second data change matches the approved data change template.

48. The system of claim 47, wherein the first hash and the second hash are generated using an MD5, SHA, or HAVL hashing technique.

49. The system of claim 47, wherein the processor is further programmed to generate a remediation response when the second data change does not match the approved data change template.

50. The system of claim 49, wherein the remediation response is configured to implement changes to the second data processing device so that the second processing device satisfies the approved data change template.

51. The system of claim 47, wherein the first data processing device is a first networking device and the second data processing device is a second networking device.

52. The system of claim 47, wherein the report indicates a total number of changes to the second data processing device that match the approved data change template.

53. The system of claim 47, wherein the first data processing device comprises a test server;

and wherein the second data processing device comprises a production server.

54. A method for maintaining data security in a distributed network of different types of data processing devices that includes routers, switches, servers, desktop computers, laptop computers, tablet computers, personal digital assistants, cellular phones, set to boxes, or media players, comprising:

storing a first digital record of an approved set of data changes made to a first data processing device of the distributed network of different types of data processing devices;

receiving a second digital record comprising state data of a second data processing device of the network of different types of data processing devices;

comparing the state data of the second digital record to the approved set of data changes made to the first data processing device so as to determine whether the state data matches the approved set of data changes; and

providing an alert as a result of the state data of the second data processing device not matching the approved set of data changes made to the first data processing device, the alert comprising a display indicating one or more data changes to the second data processing device that do not match the approved set of data changes,

wherein the approved set of data changes made to the first data processing device comprises a first hash value.

55. The method of claim 54, wherein the comparing the state data of the second digital record to the approved set of data changes comprises identifying whether the first hash value matches a second hash value in the state data of the second digital record.

56. The method of claim 54, further comprising generating a remediation response configured to alter the second data processing device into a state that satisfies the approved set of changes.

57. The method of claim 54, wherein the second data processing device comprises a router or a server.

58. The method of claim 54, further comprising generating a display indicating a first number of data changes to the second data processing device that match the approved set of data changes.

59. The method of claim 54, wherein the first data processing device comprises a test server, and the second data processing device comprises a production server.

60. A data security system for maintaining data security in a distributed network of different types of data processing devices that includes routers, switches, servers, desktop computers, laptop computers, tablet computers, personal digital assistants, cellular phones, set to boxes, or media players, comprising:

a storage device configured to store a first digital record of an approved set of data changes made to a first data processing device of the distributed network of different types of data processing devices; and

a processor configured to receive a second digital record comprising state data of a second data processing device of the network of different types of data processing devices;

compare the state data of the second digital record to the approved set of data changes so as to determine whether the state data matches the approved set of data changes; and

provide an alert as a result of the state data of the second data processing device not matching the approved set of data changes made to the first data processing device, the alert comprising a display indicating one or more data changes to the second data processing device that do not match the approved set of data changes,

wherein the approved set of data changes made to the first data processing device comprises a first hash value.

61. The system of claim 60, wherein the processor is configured to compare the state data of the second digital record to the approved set of data changes by identifying whether the first hash value matches a second hash value in the state data of the second digital record.

62. The system of claim 60, wherein the processor is configured to generate a remediation response when the first hash value does not match a second hash value of the second data processing device.

63. The system of claim 60, wherein the processor is configured to provide a remediation response configured to alter the second data processing device into a state that matches the approved set of data changes.

64. The system of claim 60, wherein the first data processing device is a first networking device and the second data processing device is a second networking device.

65. The system of claim 60, wherein the different types of data processing devices comprise a router, a switch, a server, a desktop computer, a laptop computer, a tablet computer, a personal digital assistant, a cellular phone, a set top box, or a media player.

66. The system of claim 60, wherein the first data processing device comprises a test server, and the second data processing device comprises a production server.

67. A system for maintaining data security in a distributed network of different types of data processing devices, comprising:

means for receiving a first digital record of an approved data change made to a test server;

means for receiving a second digital record of a state of a production server of the distributed network of different types of data processing devices;

means for comparing the second digital record to the approved data change so as to determine whether the state of the production server matches the approved data change,

wherein the approved data change comprises a first object name and a first hash, and the state of the second digital record comprises a second object name and a second hash; and

wherein the comparing the second digital record to the approved data change so as to determine whether the state of the production server matches the approved data change comprises identifying whether the first hash matches the second hash; and

means for generating an alert response when the first hash does not match the second hash, wherein the generating the alert response comprises generating a display indicating one or more approved changes at the production server, one or more missing changes at the production server, or one or more unapproved changes at the production server.

68. The system of claim 67, further comprising means for generating a remediation response configured to modify the production server so as to match the approved data change.

69. The system of claim 67, wherein the first hash and the second hash are generated using an MD5, SHA, or HAVL hashing technique.

70. A data security system for maintaining data security in a distributed network of different types of data processing devices, comprising:

a data security controller configured to receive a first digital record comprising an approved data change made to a test server in the distributed network of data processing devices, receive a second digital record associated with a requested data change to a production server of the distributed network of different types of data processing devices, compare the requested data change of the second digital record to the approved data change of the first digital record so as to determine whether the requested data change matches the approved data change, and generate a remediation response when the requested data change does not match the approved data change,

wherein the approved data change comprises a first object name and a first hash, and the requested data change comprises a second object name and a second hash,

wherein the data security controller is configured to identify whether the first object name matches the second object name, or whether the first hash matches the second hash,

wherein the data security controller is configured to generate the remediation response when the first object name does not match the second object name or when the first hash does not match the second hash, and

wherein the data security controller is configured to generate a display of at least one of a number of approved changes at the production server or a number of missing or unapproved changes at the production server.

71. The system of claim 70, wherein the remediation response is configured to correct the production server so that a corrected second object name and a corrected second hash of the production server match the first object name and the first hash of the approved data change.

72. The system of claim 70, wherein the data security controller is configured to generate a display of a total number of approved changes at the production server and a total number of missing or unapproved changes at the production server.