Patent Application
20070294376
Some of the purposes of the invention having been stated, others will appear as the description proceeds, when taken in connection with the accompanying drawings, in which:
While the present invention will be described more fully hereinafter with reference to the accompanying drawings, in which a preferred embodiment of the present invention is shown, it is to be understood at the outset of the description which follows that persons of skill in the appropriate arts may modify the invention here described while still achieving the favorable results of the invention. Accordingly, the description which follows is to be understood as being a broad, teaching disclosure directed to persons of skill in the appropriate arts, and not as limiting upon the present invention.
Referring now more particularly to
The method of this invention, as more fully described below, involves originating at a client computer system a request for initiation of software provisioning for the client system; receiving at a server computer system the request for initiation of software provisioning of the originating client system; generating at the server system in response to the received request a worklist directing provisioning as appropriate for the requesting client system; transmitting the worklist to the requesting client system; and executing the worklist at the client system to obtain provisioning. As embodied in hardware, the invention comprises a client computer system; computer executable code stored accessibly to the client computer system and effective when executing on the client system to originate a request for initiation of software provisioning for the client system; a server computer system; computer executable code stored accessibly to the server computer system and effective when executing on the server system to receive at the server computer system the request for initiation of software provisioning of the client system; generate at the server system in response to the received request a worklist directing provisioning as appropriate for the client system; and transmit the worklist to the client system; and in which the client system executable code is effective to execute the worklist on the client system to obtain provisioning. As a program product, the invention comprises computer readable media such as an optical disk and computer executable code stored on the media and effective when executing on computer systems to implement the method and instantiate the apparatus here described.
Referring now to
The end-point client 10 generates a set of services that need provisioning.
The end-point client sends a request to an Analyzer/Arbiter 21.
The Analyzer/Arbiter 21 parses client input and transforms request parameters for further processing for workflows.
The Analyzer/Arbiter 21, based on the workload of the system, assigns a DMS server 22 from a DMS server pool and extracts the necessary parameters for device enrollment.
The Analyzer/Arbiter 21, together with an intelligent orchestrater (TIO)/provisioning manager (TPM) creates a workflow, passing it along with corresponding DMS server and end-point device specific parameters.
A workflow is executed by a Deployment Engine which does a look-up of the service artifacts in the Data Center Model.
A recipe of provisioning actions—the worklist—is generated by the workflow. Every action is transformed and submitted to a DMS server 22 as Provisioning Jobs.
The workflow sends a notification message via HTTP to the end-point client to pull the pending service jobs from the registered DMS code server.
The client computer connects to the corresponding DMS server account and ‘pulls’ the services to its runtime and starts the services.
Upon completion, the process notifies both the system and the end-user about the completion of provisioning.
The present invention contemplates handling certain problems which arise in enterprise environments where a large number of client computers may have at least some access to supporting servers. In such environments, protecting the perimeter is one of the key capabilities that enterprise customers are looking for. Protecting the enterprise from “rogue” devices is based on two key technology capabilities: disallow devices that do not meet policy for the network, and monitoring the behavior of devices. To ensure the businesses network security the state of a device should be checked before it can be connected. Any device, if it may cause harm or is a risk to the enterprise network should be disallowed. The further requirement for network access control is not only to detect the posture of the device connected to the network but also to correct the failure of a trusted device.
Referring now to
The inventive solution is divided into three subsystems, Network Access Control 40, Compliance Manager 41, and Remediation Manager 42. Each of the subsystems contains server-based and client-based components. The illustration in
The solution provides the capability to define a policy in the Compliance Manager (CM) 41 which will be used to determine a device's “posture” to be on the network. This policy will be evaluated at a device when the network asks the device for its current “posture”. The CM client agent will be asked for compliance information and will respond with the current “posture”. If the device is determined to be non-compliant, the network will move the device to an isolated “remediation” network, returning to the CM agent a token specifying location information for remediation. The provisioning manager described hereinabove will be triggered by the CM agent to remediate the device, activating the remediation subsystem 42. Once remediation is complete and the compliance posture is acceptable the device will be allowed entry to the secure “production” network.
An illustrative scenario starts with an endpoint connecting to the network. The Network Access Control 40 challenges the CM client agent for its compliance posture and the agent returns its posture and policy level. This posture and policy information is sent to a server via a private connection and the server will determine whether the data returned by the endpoint is compliant with the policy version and posture defined at the server. If the client is compliant, it is admitted onto the production network. If the device is not compliant, the device is placed in a special isolated remediation network and sent an address within that isolated network to use for remediation.
Once in the isolated Remediation network, the CM client and Remediation client communicate the compliance violations to a Remediation listener. The listener invokes the appropriate remediation workflows on the provisioning manager server and these then call the transport layer to perform the actual updates that will remediate the violations.
Once the remediation is complete, the CM Agent is notified of this completion. The CM Agent rescans the host for compliance and creates a new compliance posture. The NAC polls the client periodically and at the next polling cycle, the new compliance posture is returned by the CM Agent. Once the correct posture has been returned, the endpoint is admitted to the production network.
In the drawings and specifications there has been set forth a preferred embodiment of the invention and, although specific terms are used, the description thus given uses terminology in a generic and descriptive sense only and not for purposes of limitation.
