Method and apparatus for process enforced configuration management

• US 9,864,868 B2
• Filed: 04/11/2014
• Issued: 01/09/2018
• Est. Priority Date: 01/10/2007
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Bhargava, Rishi, Vittal, Chiradeep, Sayeram, Swaroop
• Primary Examiner(s): Gee, Jason K
• Application Number:
  US14/251,009
• Publication Number:
  US 20140351895A1
• Time in Patent Office: 1,369 Days
• Field of Search: 726 17
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3051 Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs verification or detection of system hardware configuration G06F11/2247
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules

Abstract

A system for and method of automatically enforcing a configuration change process for change requests of one or more configurable element within one or more configurable computation systems. The system comprises means for managing a configuration change process for one or more configurable elements within a corresponding configurable computation system, means for generation a configuration request, means for applying a set of authorization rules to the configuration change requests to generate selective authorization of the CEs, and means for selectively locking and unlocking changes to configurable elements within the configurable computational systems.

Claims

1. Non-transitory machine readable media that include software instructions, wherein the instructions, when executed by at least one processor, cause the processor to perform a method comprising:

receiving, from a configuration management system, at an analytics module, a configuration change request for a plurality of configurable elements (CEs) within a configurable computation system (CCS);

applying, by the analytics module, one or more authorization rules to the configuration change request to generate a selective configuration change authorization for a subset of the CEs meeting the one or more authorization rules;

providing, by the analytics module to one or more selective configuration locks in the CCS corresponding to the subset of the CEs over a network, a time window, during which configuration changes are enabled, in the selective configuration change authorization, wherein the one or more selective configuration locks are one or more hooks into a file system driver of the CCS to monitor and control changes to files associated with the CEs, and a communication of the time window is encrypted and authenticated between the analytics module and the one or more selective configuration locks; and

receiving configuration change status information at the analytics module from the one or more selective configuration locks regarding an occurrence of a failure of a configuration change.

2. The media of claim 1, wherein the configuration changes are selectively lockable by the one or more selective configuration locks, and a locking by the one or more selective configuration locks selectively enables the configuration changes to the subset of the CEs according to the time window.

3. The media of claim 1, wherein the configuration change request corresponds to a configuration change process managed by the configuration management system.

4. The media of claim 1, wherein the applying one or more authorization rules comprises processing one or more current conditions in generating the selective configuration change authorization, wherein the one or more current conditions include at least one of:

a current time, a date, a day of the week, an inventory level, and a state of a mechanical device.

5. The media of claim 1, the method further comprising:

authenticating the selective configuration change authorization by a secure socket layer (SSL) key exchange over the network.

6. The media of claim 2, wherein the locking by the one or more selective configuration locks further comprises generating the configuration change status information.

7. The media of claim 2, wherein the configuration change status information includes at least one of:

a status of each CE configuration change, a status of each CCS configuration change, and information associated with success of the CE configuration change.

8. The media of claim 6, wherein the method further comprises:

generating a report, wherein the report includes the configuration change status information, and the configuration change status information is associated with at least one of the configuration change request, the CEs, and the CCS.

9. The media of claim 1, wherein the files are further associated with a configuration change ticket resulting from the configuration change request.

10. Non-transitory machine readable media that include software instructions, wherein the instructions, when executed by at least one processor, cause the processor to perform a method comprising:

receiving over a network, from an analytics module, at one of one or more selective configuration locks in a configurable computation system (CCS) including a subset of configurable elements (CEs), a selective configuration change authorization having a time window during which configuration changes are enabled, wherein a communication of the time window is encrypted and authenticated between the analytics module and the one or more selective configuration locks, and the selective configuration change authorization is generated by applying one or more authorization rules to a configuration change request, the subset of the CEs meeting the one or more authorization rules;

selectively locking, by the one or more selective configuration locks, the configuration changes by selectively enabling configuration changes to the subset of the CEs according to the time window in the selective configuration change authorization, wherein the one or more selective configuration locks are one or more hooks into a file system driver of the CCS to monitor and control changes to files associated with the CEs; and

transmitting configuration change status information to the analytics module from the one or more selective configuration locks, the configuration change status information including information associated with a failure of a configuration change.

11. The media of claim 10, the method further comprising:

authenticating the selective configuration change authorization by a secure socket layer (SSL) key exchange over the network.

12. The media of claim 10, wherein the configuration change status information is associated with at least one of the CCS and the subset of CEs.

13. The media of claim 10, wherein the configuration change status information includes at least one of:

a status of each CE configuration change, a status of each CCS configuration change, and information associated with success of the CE configuration change.

14. The media of claim 10, wherein the files are further associated with a configuration change ticket resulting from the configuration change request.

15. The media of claim 10, wherein the configuration change status information includes information associated with a reason for the failure, and the reason for the failure is an incompatible operating system, an insufficient memory to do the configuration change, or an insufficient permission to access a file.

16. An apparatus, comprising:

a processing system configured to receive over a network, from an analytics module, at one of one or more selective configuration locks in a configurable computation system (CCS) including a subset of configurable elements (CEs), a selective configuration change authorization having a time window during which configuration changes are enabled, wherein a communication of the time window is encrypted and authenticated between the analytics module and the one or more selective configuration locks, and the selective configuration change authorization is generated by applying one or more authorization rules to a configuration change request, the subset of the CEs meeting the one or more authorization rules,

the processing system configured to selectively lock, by the one or more selective configuration locks, the configuration changes by selectively enabling configuration changes to the subset of the CEs according to the time window in the selective configuration change authorization, wherein the one or more selective configuration locks are one or more hooks into a file system driver of the CCS to monitor and control changes to files associated with the CEs,

the processing system configured to transmit configuration change status information to the analytics module from the one or more selective configuration locks, the configuration change status information including information associated with a failure of a configuration change.

17. The apparatus of claim 16, wherein the processing system is further configured to authenticate the selective configuration change authorization.

18. The apparatus of claim 17, wherein the processing system authenticates the selective configuration change authorization by a secure socket layer (SSL) key exchange over the network.

19. The apparatus of claim 16, wherein the configuration change status information is associated with at least one of the CCS and the subset of CEs.

20. The apparatus of claim 16, wherein the configuration change status information includes at least one of:

a status of each CE configuration change, a status of each CCS configuration change, and information associated with success of the CE configuration change.

21. The apparatus of claim 16, wherein the files are further associated with a configuration change ticket resulting from the configuration change request.