Abstract:
Embodiments relate to systems and methods for depopulation of user data from a network. A network management platform can communicate with a set of managed machines in a network, and generally manage user accounts including user lDs, associated network processes, services, application files, data files, and/or other user data. In embodiments, a user may have a change in status, such as departing from the organization operating the network, changing their name or user name, or other updates. In such cases, a systems administrator may need to update or delete files, processes, services, and/or other user data associated with the user from the network. The network management platform can interrogate the network for files, processes, or other resources associated with the user ID of interest. The search can exhaustively interrogate every available node in the network, to update or purge all files associated with the subject user ID(s).

Description:
FIELD 
       [0001]    The present teachings relate to systems and methods for the depopulation of user data from a network, and more particularly to platforms and techniques for automatically scanning a network for files, processes, profiles, and/or other data related to a user whose user ID is changed or deactivated in the network. 
       BACKGROUND OF RELATED ART 
       [0002]    A variety of network management platforms exist to assist network administrators with installing and configuring network resources and services. In many platforms, a management server can be used to issue commands to hosts or other network nodes to manage the configuration of the network hosts, underlying clients or other devices. As part of the management of comparatively large-scale and other networks, a network management platform can have the responsibility of maintaining a set of valid user IDs and resources and privileges associated with those user Ids. 
         [0003]    It is a not infrequent occurrence in network operations that a user can undergo a change in status in their employment, subscription, or other relationship to the network to which they are registered. In a corporate setting, for example, a user can have a change in marital status and a resulting change in their legal name, or can depart from a company or other organization. In those and other cases, the accumulated files, user profiles, processes, or other resources associated with the user ID for that user may remain in the network. 
         [0004]    In existing network management platforms, a systems administrator confronted with a set of obsolete user lDs has no particular tools or services available to them to locate and remote the undesired residual user IDs, and/or associated files, user profiles, processes, or other resources. Those managers therefore must typically access each individual data store, user machine, or other nodes on the managed network, and look for the out-of-date user data. It may thus be desirable to provide methods and systems that overcome these network management difficulties, and permit an administrator or other user to track down and update or remove obsolete user IDs and related user data. 
     
    
     
       DESCRIPTION OF THE DRAWINGS 
         [0005]    The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments of the present teachings and together with the description, serve to explain the principles of the present teachings. In the figures: 
           [0006]      FIG. 1  illustrates an overall network in which systems and methods for depopulation of user data from a network can be implemented, according to various embodiments of the present teachings; 
           [0007]      FIG. 2  illustrates an overall network in which systems and methods for depopulation of user data from a network can be implemented, according to various embodiments of the present teachings in further regards; 
           [0008]      FIG. 3  illustrates an exemplary hardware configuration of a network management platform that can be used in systems and methods for depopulation of user data from a network, according to various embodiments of the present teachings; and 
           [0009]      FIG. 4  illustrates overall network management processing for depopulation of user data from a network can be implemented, according to various embodiments of the present teachings. 
       
    
    
     DESCRIPTION OF EMBODIMENTS 
       [0010]    Embodiments of the present teachings relate to systems and methods for depopulation of user data from a network. More particularly, embodiments relate to platforms and techniques in one regard for identifying obsolete or unwanted user IDs via a network management server, and automatically scanning the network to which the user IDs are registered to detect user data associated with those IDs. The user data can be or include, for example, executing processes, services, user profiles, application or data files, or other user data authored by, belonging to, or otherwise associated with a user ID. The user data can be stored or hosted in a variety of locations in the network, including, for example, databases or other data stores, servers, personal computers or workstations, removable media, and/or other locations. When a systems administrator or other user desires to begin a purge of obsolete or undesired user IDs and associated user data, the network management platform can commence a full-network scan to comprehensively access and examine all computing, storage, and/or other nodes in the network and search the directories, memory, storage, and/or other resources therein to detect processes, services, files, user profiles, or other user data associated with those user IDs. The network management platform can then perform any desired modification or update to the user lDs and/or associated user data, such as, for example, changing the user IDs or data, exporting the user IDs or data, and/or deleting the user IDs or data. According to embodiments in one regard, the network management platform can thereby locate, update, and/or dispose of obsolete user IDs and/or user data from one central processing point, using comparatively compact global commands. 
         [0011]    Reference will now be made in detail to exemplary embodiments of the present teachings, which are illustrated in the accompanying drawings. Where possible the same reference numbers will be used throughout the drawings to refer to the same or like parts. 
         [0012]      FIG. 1  illustrates an overall system  100  consistent with systems and methods for depopulating user data from a network, according to various embodiments of the present teachings. In embodiments as shown, a network management platform  102  can maintain and manage a managed network  116 . Network management platform  102  can communicate with a set of supervisory hosts  112  via one or more networks  110 . One or more networks  110  can be or include the Internet, or other public or private networks. One or more networks  110  can be or include wired, wireless, optical, and other network connections. Set of supervisory hosts  112  can be or include a set of servers configured to communicate with entities at other levels of one or more networks  110  and/or associated connections. In embodiments, set of supervisory hosts  112  can communicate with an intermediate set or sets of hosts, gateways, or servers. In embodiments, set of supervisory hosts  112  can function as “overlord” hosts or servers which communicate command data  120  to an underlying or low-level set of targets  180 , or other devices in managed network  116 . 
         [0013]    Set of supervisory hosts  112  can support or serve an underlying managed network  116 , for example via a local area network, or other network(s) or connections. Managed network  116  including set of targets  180  can be or include a set of personal computers, network-enabled media devices, or other clients, devices, or machines. Other hierarchies, topologies, and connections between network management platform  102 , set of supervisory hosts  112 , any intermediate hosts, set of targets  180 , and/or other entities or devices of managed network  116  can be used. In embodiments, communications between network management platform  102 , set of supervisory hosts  112 , set of targets  180 , and/or other entities or devices in managed network  116  or other entities can be conducted via one or more secure channel  108 , such as the secure channel and related resources described in co-pending U.S. application Ser. No. 12/130,424, filed May 30, 2008, entitled “Systems and Methods for Remote Management of Networked Systems Using Secure Modular Platform,” which published as U.S. Patent Application Publication No. ______, assigned or under obligation of assignment to the same entity as this application, and which application is incorporated by reference herein. 
         [0014]    Network management platform  102  can include or access resources to support the generation and transmission of one or more discovery command  120  via auto-discovered or other pathways to manage set of supervisory hosts  112 , set of targets  180 , and/or other entities or devices of managed network  116 , including a network store  104 . Network store  104  can be or include a database or other data store, and in embodiments can store a network map  106 . Network map  106  can record information related to the configuration and topology of network connections between set of supervisory hosts  112 , set of targets  180 , and/or other entities or devices of managed network  116 , as well as other data. In embodiments, network map  106  can be recorded in a file, tree, database, or other record. 
         [0015]    According to embodiments in one regard, network management platform  102  can access network map  106  to carry out management and maintenance operations on set of user IDs  162 . Set of user IDs  162  can contain a set of user names, account names, account numbers, stored passwords, and/or other resources related to the identification and/or validation of users of managed network  116 . According to embodiments, in general, each user ID in set of users IDs  162  can have an associated set of user data  164  hosted, stored, or located throughout the network of managed network  116 . 
         [0016]    Set of user data  164  can be or include any one or more of processes, services, user profiles, data files such as database, word processing, spreadsheet, media, or other data files, application files, passwords or other credentials, and/or other data related to the user identified by a given user ID in set of user IDs  162 . Portions of user data in set of user data  164  can be located in diverse or multiple locations, such as in local or remote servers, personal computers or other client machines or devices, workstations, network-enabled mobile devices, databases, archives or RAID sites, or other nodes, facilities, or locations in managed network  116 . Set of user data  164  can further comprise, for instance, files that contain references to a user ID which control access to applications or services, such as “/etc/group/.” Set of user data  164  can likewise include information such as aliases, groups, access control lists (ACLs), references by user ID or user name, or other information. 
         [0017]    Network management platform  102  can determine a set of target IDs  166  in set of user IDs  162  to locate, modify, and/or remove set of user data  164  in or from managed network  116  and/or associated network or networks. In embodiments, set of target IDs  166  can be imported to network management platform  102 , and/or can be manually specified by a systems administrator or other user. In embodiments, set of target IDs  166  can be generated by network management platform  102 , for example, by identifying all user IDs that have not been used for a defined period of time, such as one year or other period of time. 
         [0018]    As for instance illustrated in  FIG. 2 , once network management platform  102  has accessed, received, or generated set of target IDs  166 , network management platform  102  can issue commands and/or invoke services to locate, modify, and/or purge set of target. IDs  166  and/or set of user data  164  associated with each of those user IDs. Network management platform  102  can generate one or more discovery command  120  to transmit to set of supervisory hosts  112 , managed network  116 , one or more networks  110 , and/or other machines, locations, or resources. One or more discovery command  120  can contain an identification of set of target IDs  166  and other data to locate, identify, authenticate, and/or set of user data  164  associated with those IDs in the overall network. When network management platform  102  generates one or more discovery command  120 , network management platform  102  can access network map  106  to identify one or more supervisory hosts in set of supervisory hosts  112  to or through which to transmit one or more discovery command  120 . The recipient supervisory host(s) can receive one or more discovery command  120  and, in embodiments, access network map  106  and/or communicate with network management platform  102  to extract a pathway by which to relay or transmit one or more discovery command  120  to managed network  116  and/or other underlying devices. The supervisory host(s) can then transmit or relay the one or more discovery command  120  to a target or targets in managed network  116 , using the identified pathway. 
         [0019]    In embodiments, network management platform  102  can receive data back from set of supervisory hosts  112 , managed network  116 , and/or other resources indicating the presence of user data  164  for one or more user IDs in set of target lDs  166 . Upon detection of user data  164  for those user IDs, network management platform  102 can proceed to generate one or more modification command  168  to initiate a modification, update, migration, and/or deletion or removal of a portion or all of user data  164 , and/or set of target IDs  166 . For example, network management platform  102  can direct that files, directories, user profiles, and/or executing processes can be modified, updated, deleted, archived, terminated, removed, or otherwise processed to purge obsolete, inaccurate, insecure, or unwanted data. In embodiments, the modification can include substituting a new user ID for an obsolete user ID. In embodiments, the modification can include substituting new credentials, privileges, or other attributes for the existing attributes for the subject user ID. Other modifications or processing of set of target IDs  166  can be done. For example, two or more user IDs and associated user data  164  can be combined, or a single user ID can be split into multiple user data  164 , IDs, or attributes. 
         [0020]    According to various embodiments, network management platform  102  can be configured to periodically probe the network including set of manage machines  116 , set of supervisory hosts  112 , and/or other resources with repeated or additional one or more discovery command  120 , to locate files, processes, and/or other user data  164  that was not present, visible, or identifiable during previous scans. In embodiments, a process of repeatedly interrogating the network for user data  164  can be repeated until a termination criteria are met, such as, for instance, the failure to discover any further user data  164  after a predetermined number of discovery attempts, or after a certain amount of time. 
         [0021]    In terms of operational scope, it will be appreciated that any of network management platform  102 , set of supervisory hosts  112 , any intermediate hosts, and/or managed network  116  or other entities can be significantly or substantially geographically distributed, and can represent relatively large-scale groupings or clusters. For instance, different hosts in set of supervisory hosts  112  and/or associated targets in managed network  116  can be located in different metropolitan areas, in different sections of a country, in different countries, or in different continents. For further instance, different hosts in set of supervisory hosts  112  and/or sets of targets in managed network  116  can represent hundreds, thousands, or greater or lesser numbers of collective devices. 
         [0022]      FIG. 3  illustrates an exemplary diagram of hardware and other resources that can be incorporated in a network management platform  102  configured to communicate with set of supervisory hosts  112 , any intermediate hosts, set of targets  180 , and/or other entities or devices of managed network  116  via one or more networks  110  or other connections, according to embodiments. In embodiments as shown, network management system  102  can comprise a processor  124  communicating with memory  126 , such as electronic random access memory, operating under control of or in conjunction with operating system  130 . Operating system  130  can be, for example, a distribution of the Linux™ operating system, the Unix™ operating system, or other open-source or proprietary operating system or platform. Processor  124  also communicates with network store  104 , such as a database stored on a local hard drive. Processor  124  further communicates with network interface  128 , such as an Ethernet or wireless data connection, which in turn communicates with one or more networks  110 , such as the Internet or other public or private networks. Processor  124  also communicates with a network management module  132 , which can be or include logic to monitor and manage the operation of network  110  and associated or connected resources. Network management module  132  can for instance permit a user to view, delegate, and execute configuration operations in set of supervisory hosts  112 , set of targets  180 , managed network  116 , and/or other resources or entities. Other configurations of network management system  102 , associated network connections, and other hardware and software resources are possible. 
         [0023]      FIG. 4  illustrates overall processing for depopulation of user data from a network, according to various embodiments of the present teachings. In  402 , processing can begin. In  404 , a secure channel  108  can be established between network management platform  102  and one or more networks  110 , set of supervisory hosts  112 , set of targets  180 , and/or other entities or devices of managed network  116 . In embodiments, secure channel  108  can be or include a secure socket layer (SSL) connection, a public/private key infrastructure or connection, or other channel or connection. In  406 , network management platform  102  can access, receive, or generate set of target IDs  166  reflecting user lDs whose associated user data  164  is to be scanned for in the overall network. In  408 , network management platform  102  can transmit one or more discovery command  120  to one or more networks  110 , set of supervisory hosts  112 , set of targets  180 , or other devices, entities or resources of managed network  116 . In  410 , network management platform  102  can receive one or more responses from the network indicating the presence of user data  164  associated with set of target IDs  166 . User data  164  can be or include processes, services, user profiles, data files, application files, and/or other data. 
         [0024]    In  412 , network management platform  102  can proceed to generate one or more modification command  168  to initiate a modification, update, and/or deletion or removal of a portion or all of user data  164 , and/or set of target IDs  166 . For example, network management platform  102 can direct that files, directories, user profiles, and/or executing processes can be modified, updated, deleted, archived, terminated, removed, or otherwise processed to purge obsolete, inaccurate, insecure, or unwanted data. In  414 , the modification, updating, and/or deletion of user data  164  can be carried out. In  416 , network management platform  102  can update set of user IDs  162  and/or any user data  164  to reflect the modifications or deletions, as appropriate. In  418 , network management platform  102  can store a record of all locations in which one or more of set of target IDs  166  and/or user data  164  were found, to record a map of user ID/user data repositories within the network, as appropriate. In  420 , as understood by persons skilled in the art, processing can repeat, return to a prior processing point, jump to a further processing point, or end. 
         [0025]    The foregoing description is illustrative, and variations in configuration and implementation may occur to persons skilled in the art. For example, while embodiments have been described in which configuration commands or other data are generated and transmitted from one network management platform  102 , in embodiments more than one server or other device or resource can serve as a central control point. For further example, while embodiments have been described in which one or more hosts in a set of supervisory hosts  112  coordinate the distribution of commands and data to a managed network  116 , in embodiments, implementations can involve the dissemination of commands or other data through different network hierarchies, trees, nodes, or arrangements. For instance, in embodiments, commands or other data can be delegated via supervisory hosts through more than two sub-hosts or other sub-levels. For yet further example, while embodiments have been described involving one level or layer of supervisory hosts, in embodiments, the overall network can be configured with multiple levels or layers of supervisory hosts (or “overlords”). Similarly, various targets in managed network  116  can be configured at different levels within the overall network. For further example, while in embodiments the depopulation activity has been described as operating on a set of user IDs  162  and target IDs  166 , in embodiments, other types of identifiers can be used. For example, in embodiments user data  164  associated with a given address, such as an Internet Protocol (IP) address, or other address or identifier, can be used to identify users or other entities for modification and/or removal. Other resources described as singular or integrated can in embodiments be plural or distributed, and resources described as multiple or distributed can in embodiments be combined. The scope of the present teachings is accordingly intended to be limited only by the following claims.