Systems and methods for enrolling and configuring agents

A method of managing an agent by an administrative server is described. The method includes receiving an enrollment request from the agent. The agent is disconnected from a core server, and the core server is periodically connected to the administrative server. The method also includes performing a provisional enrollment procedure with the agent. The method further includes performing an enrollment procedure between the agent and the core server. The method additionally includes performing a configuration procedure between the agent and the core server.

TECHNICAL FIELD

The present disclosure generally relates to computers and computer-related technology. More specifically, the present disclosure relates to systems and methods for securely enrolling and configuring loosely connected autonomous agents.

BACKGROUND

The use of electronic devices has become increasingly prevalent in modern society. As the cost of electronic devices has declined and as the usefulness of electronic devices has increased, people are using them for a wide variety of purposes. For example, many people use electronic devices to perform work tasks as well as to seek entertainment. One type of an electronic device is a computer.

Computer technologies continue to advance at a rapid pace. Computers commonly used include everything from hand-held computing devices to large multi-processor computer systems. These computers include software, such as applications including user interfaces, in order to make them useful and accessible to an end user. Computers are increasingly linked with other computers through networks. With the expansion of computer technology, the size of networks has continued to increase. Networks may link computers together that are a great distance apart.

One of the challenges involved with networks is that it is difficult to enroll and configure networked computing devices under contemporary practices when the computing devices never or only intermittently share a direct connection, where a direct connection between devices means that one device can establish a communication session with another device via a communications protocol that allows immediate send and receive operations. Additionally, current methods of enrolling and configuring loosely connected devices may burden a network and jeopardize a network's data security. As can be observed from this discussion, systems and methods that make enrolling and configuring loosely connected autonomous agents secure may be beneficial to the management of a computer network.

DETAILED DESCRIPTION

A method of managing an agent by an administrative server is described. The method includes receiving an enrollment request from the agent. The agent is disconnected from a core server, and the core server is periodically connected to the administrative server. The method also includes performing a provisional enrollment procedure with the agent. The method further includes performing an enrollment procedure between the agent and the core server. The method additionally includes performing a configuration procedure between the agent and the core server.

Performing the provisional enrollment procedure may include storing an enrollment request. Performing the provisional enrollment procedure may also include sending a provisional enrollment policy to the agent in response to the enrollment request.

Performing the enrollment procedure between the agent and the core server may include sending an enrollment request received from the agent to the core server. An enrollment response and policy may be received from the core server in response to the enrollment request. The enrollment response and policy may be stored. A request for the enrollment response and policy from the agent may be received. The enrollment response and policy may be sent to the agent.

The enrollment request from the agent may be created using authentication information received from the core server via the administrative server. The administrative server may be a multi-tenant cloud-based administrative server.

Performing the configuration procedure between the agent and the core server may include receiving configuration information from the core server. The configuration information may be stored. The configuration information may be sent to the agent in response to a request from the agent for the configuration information. Configuration and administrative operation results may be received from the agent. The configuration and administrative operation results may be sent to the core server in response to a request from the core server for the configuration and administrative operation results.

The configuration information may include past configurations of the agent with serial numbers indicating the latest configuration information. Confidential configuration information may be encrypted with a digital certificate public key of the agent and signed with a digital certificate private key of the core server. Non-confidential configuration information may be signed with a digital certificate private key of the core server.

Confidential configuration information results may be encrypted with a digital certificate public key of the core server and signed with a digital certificate private key of the agent. Non-confidential configuration information results may be signed with a digital certificate private key of the agent.

A computing device that is configured for managing an agent is also described. The computing device includes a processor, memory in electronic communication with the processor, and instructions stored in the memory. The computing device receives an enrollment request from the agent. The agent is disconnected from a core server, and the core server is periodically connected to the computing device. The computing device also performs a provisional enrollment procedure with the agent. The computing device further performs an enrollment procedure between the agent and the core server. The computing device additionally performs a configuration procedure between the agent and the core server.

As indicated above, aspects of the present disclosure are directed to improvements related to securely enrolling and configuring loosely connected autonomous agents. When a new computing device is being added to a computer network, the computer network administrator may enroll the computing device in a network management system, and configure the computing device to operate in a manner desired by the administrator of that computer network. Because of this, computer network administrators may resort to various techniques of device enrollment and configuration.

Some approaches for controlling enrollment in a management system and controlling configuration rely on establishing a direct connection between a core server and the computing device. In such approaches, the core server may perform enrollment and configuration procedures on the computing device directly. For devices that are capable of establishing such a direct connection, this may be adequate. However, for computing devices and core servers that rarely, or never, establish a direct connection, these approaches are not adequate.

As demonstrated, there is a need for systems and methods for enrolling and configuring a computing device that is rarely and or never directly connected to a core server. Further, there is a need for systems and methods that may also make enrollment and configuration of the computing device secure and efficient. The systems and methods disclosed herein facilitate this device enrollment and configuration, and may further make these operations secure. Compared to other approaches, the systems and methods disclosed herein may further decrease time requirements and inefficiencies related to enrolling and configuring a loosely connected computing device. Aspects of the present disclosure will be described in relation to a computing network that includes various components for managing computing devices belonging to an enterprise.

In many IT infrastructures, there are nodes being managed that do not have a direct connection to the system used to manage them. In these cases, autonomous agents that communicate via a trusted infrastructure may be used to manage those nodes. The systems and methods described herein may allow autonomous agents to enroll with a management system when not connected to the same network as the management system by using a cloud-based intermediary. Further, the systems and methods described herein describe the manner in which the management system configures autonomous agents via the cloud-based intermediary.

In one configuration, the described systems and methods may involve a core server (e.g., management system), an administrative server (e.g., a cloud-based intermediary), and an autonomous agent. Management decisions are made at the core server, and communicated to the autonomous agent via the administrative server. The autonomous agent enacts those decisions on a managed node on which they are installed. To perform these operations, the core server must have a secure channel to communicate with autonomous agents.

The autonomous agent may enroll with the administrative server by providing an externally generated authentication token. The administrative server may give the autonomous agent an enrollment response that allows the autonomous agent to perform a restricted set of operations on the management network. This response places the agent into an enrollment mode termed provisionally enrolled.

The core server may communicate with the administrative server on a periodic basis, and may retrieve pending enrollment requests. The core server may optionally validate the externally generated authentication token used to provisionally enroll the autonomous agent. When the core server receives enrollment requests, it evaluates the enrollment request to determine if the agent is allowed to join the trusted communications infrastructure. If the autonomous agent is allowed on the infrastructure, the core server may complete the enrollment and upload the completed information to the administrative server for the autonomous agent to retrieve.

Once the agent is enrolled with the core server, the core server will have a secure channel to communicate management decisions via configuration information to the autonomous agents. The configuration data may be created on the core server, passed through the administrative server and consumed by the autonomous agent.

Configuration data may be one of two types: content that must be authenticated-only, and content that must be authenticated and confidential. All content is signed by the core server. Authenticated-only content can be read by the administrative server. Content that is confidential is encrypted with the public key of its intended recipient (in most cases, the autonomous agent) and cannot be read by the administrative server.

The described systems and methods may allow both the autonomous agent and the core server to independently communicate with the administrative server to submit and/or retrieve information. The core server may apply configuration changes to disconnected agents by sending a combination of non-confidential and confidential information to the administrative server to describe the latest configuration state.

The administrative server may have information to determine if new content is available to the autonomous agent and will only return configuration data to the agent if new data is available. The autonomous agent may periodically poll the administrative server to determine whether or not it has the latest information. If new information is retrieved, the agent will apply the new configuration, authenticate all information and decrypt confidential information. In the case where the autonomous agent may connect directly to the core server, the agent may use configuration data serial numbers to determine whether or not it has received stale information from the administrative server.

Various configurations of the systems and methods are now described with reference to the Figures, where like reference numbers may indicate identical or functionally similar elements. The configurations of the present systems and methods, as generally described and illustrated in the Figures herein, could be arranged and designed in a wide variety of different configurations. Thus, the following more detailed description of several configurations, as represented in the Figures, is not intended to limit the scope of the systems and methods, as claimed, but is merely representative of the various configurations of the systems and methods.

FIG. 1is a block diagram illustrating one configuration of a network100that includes a plurality of electronic devices that are in electronic communication with one another via a connection to an administrative server102. The network100may include one or more core servers104and one or more managed nodes106that are coupled to the administrative server102.

The network100may be a multi-tenant cloud-based architecture that enables one or more different tenants to access a common administrative server102without interfering with one another's operations. The one or more tenants may be one or more different enterprises. In one configuration, one or more managed nodes106and one or more core servers104may be operated by one tenant (e.g., enterprise, client, customer, etc.) while other managed nodes106and other core servers104may be operated by one or more other tenants. Therefore, the network100may be a multi-tenant architecture.

In one configuration, the core server104may be intermittently connected to the administrative server102. In other words, the core server104may have periods of time when it is not connected to the administrative server102followed by periods when the core server104may connect to and communicate with the administrative server. The core server104may be unable to connect to the managed node106. For example, a network firewall may prevent the core server104from directly accessing the managed node106.

The one or more managed nodes106may be desktop computers, laptop computers, tablet computers, smartphones, printers, etc. The one or more core servers104may perform a variety of management-related operations with respect to the one or more managed nodes106. Examples of these management-related operations may include managing the node's106operating configurations, the node's106files, security patches, system updates, etc.

If a managed node106is a new electronic device that has not yet been enrolled and configured by a core server104, the core server104may not be able to perform management-related functions with respect to the managed node106. Further, when the managed node106is rarely or never directly connected to the core server104, the core server104may not be able to enroll and or configure an agent116operating on the managed node106. This problem may be alleviated through the disclosed systems and methods of enrolling and configuring a managed node106without a direct connection to the core server104.

The administrative server102may be in electronic communication with the one or more core servers104and the one or more managed nodes106. The administrative server102may perform a variety of management-related operations with respect to the one or more core servers104and or one or more managed nodes106. Examples of management-related operations may include providing infrastructure services, node administration, etc. The administrative server102may be part of a software-as-a-service (SaaS) or cloud-based architecture in which one or more clients (e.g., customers, tenants, client-organizations) may independently operate a managed node106but may interface with the administrative server102for one or more services. In one configuration, the administrative server102implementation may be included as part of a software as a service (SaaS) or a multi-tenant cloud-based architecture. The multi-tenant cloud-based architecture may be a cloud-based network100that enables one or more different tenants to access the administrative server102without being aware of or interfering with the operations of another tenant. The one or more tenants may be one or more different enterprises. The cloud-based network100may enroll and configure a managed node106that is rarely or never directly connected to a core server104.

In order to securely communicate and perform management operations with the administrative server102, the core server104administrator may use an administrator interface108to negotiate with a secure token service110on the administrative server102for a core server secure token112. The core server secure token112may enable the core server104to access management functions on the administrative server102. For instance, the core server secure token112may allow the administrator of the core server104to access an agent management module114on the administrative server102. The agent management module114may be used to manage an agent116operating on a managed node106. Managing an agent116operating on a managed node106may include performing enrollment and configuration procedures without a direct connection between the core server104and the managed node106.

The agent management module114may include an agent installation module118designed to install and configure the agent116on a managed node106. The administrator of the core server104may use the agent installation module118to designate which managed nodes106need to have the agent116installed.

The administrator on the core server104may further allocate agent activation keys120on the agent management module114to complete the installation of the agents116. The agent activation keys120may be used to authenticate the installation and configuration of the agent116on the managed node106. After the administrator has allocated agent activation keys120and designated a managed node106in the agent installation module118, the agent management module114may use a notification module122to notify the managed node106of the agent installation and configuration information. The notification module122may notify an administrator of the managed node106of the agent installation information via several mechanisms. For example, the notification may be in the form of an email, a desktop notification, etc.

After receiving the notification from the notification module122, the administrator of the managed node106may use a user interface124to provide the agent installation module114with an activation key. The activation key will allow the agent installation module118to install and configure the agent116on the managed node106.

The agent116installed on the managed node106may enable the core server104and administrative server102to perform management-related functions with respect to the managed node106, even when the managed node106never or rarely directly connects to the core server104. For instance, the agent116may allow the core server104to send agent policies128stored in a core server database130to a managed node database132. A database is any stored collection of data, in various kinds of structures include a simple flat file database to a complex database management system (DBMS). The databases may include keyed indexed storage. The databases114,116may include a stored collection of data that may be accessed by applications

To accomplish this, the agent policies128may first be sent to an administrative server database136, where the agent116on the managed node106may retrieve it.

The agent116installed on the managed node106may use the agent policies128to perform management actions that produce result documents138. Result documents138may represent configuration information, operation status information or operational audits reports detailing actions taken by the autonomous agent. The result documents138may be sent to the administrative server database136on the administrative server102. The result documents138may then be sent from the administrative server102to the core server104and stored on the core server database130. Managed node certificates148, described below, may be stored in the core server database130.

The core server may include a core server certificate140. The core server certificate140may be a digital certificate used in a public key cryptography. Public-key cryptography, which is also known as asymmetric cryptography, refers to a cryptographic algorithm that requires two separate keys: a private key and a public key. These keys may be referred to collectively as a key pair. The private key is kept secret, but the public key is widely distributed. A private key and its corresponding public key are mathematically linked, but the parameters are chosen so that calculating the private key from the public key is extremely difficult.

Public-key cryptography facilitates computing devices to securely communicate with one another. In particular, a message that is digitally “signed” (i.e., processed in accordance with an appropriate cryptographic algorithm) using the sender's private key may be verified by anyone who has access to the sender's public key. A valid digital signature gives a recipient reason to believe that the message was actually created by the sender.

A digital certificate is an electronic document that uses a digital signature to bind a public key with an entity. Thus, digital certificates may be used to verify that a particular message originated from a particular computing entity, and may be used to encrypt messages for specific recipients. Each core server certificate140may include a public key142of the core server104and information144identifying the core server104. Each core server certificate140may also be associated with a core server private key146of the core server104. The managed node106may have a copy of the core server certificate140of its managing core server104installed to validate messages sent by the core server104.

In a manner similar to the core server104, managed nodes106may be issued a managed node certificate148. The managed node certificate148may include a managed node public key150and identifying information152of the managed node106. The managed node public key150may correspond to a managed node private key154. The core server104may also have a copy of managed node certificates148.

The administrative server102may be configured to perform a number of operations involved in managing the agent116on the managed node106. The administrative server102may receive an enrollment request from the agent116. The agent116may be disconnected from a core server104, and the core server104may be periodically connected to the administrative server102. Upon receiving the enrollment request from the agent116, the administrative server102may perform a provisional enrollment procedure with the agent116that may enable the agent116to be provisionally managed by the administrative server102. One configuration of a provisional enrollment procedure is described in connection withFIG. 6.

The administrative server102may also perform an enrollment procedure between the agent116and the core server104that may enable the agent116to be managed by the core server104via the administrative server102. One configuration of an enrollment procedure is described in connection withFIGS. 7 and 8.

The administrative server102may additionally perform a configuration procedure between the agent116and the core server104. The configuration procedure may be a means of managing the managed node106by the core server104via the administrative server102and the agent116. Some implementations of configuration procedures are described in connection withFIGS. 9 and 10.

FIG. 2is a flow diagram illustrating one configuration of a method200of managing an agent116operating on a managed node106. The method200may be implemented by an administrative server102that is connected to an agent116operating on a managed node106and a core server104. The managed node106may not be connected to the core server104.

The administrative server102may receive202an enrollment request from the agent116. For example, when an agent116is installed on the managed node106, it may need to be enrolled with a managing core server104in order to be managed properly. To become enrolled with the core server104, the agent116on the managed node106may create an enrollment request that is sent to the core server104. Because the agent116on the managed node106is not directly connected to the core server104, the administrative server102may serve as an intermediary between the managed node106and the core server104. Therefore, the administrative server102may receive202the enrollment request from the agent116. The enrollment request may include information such as agent activation keys120that were defined by the core server104administrator and sent to the managed node106administrator by the administrative server102.

The administrative server102may perform204a provisional enrollment procedure with the agent116on the managed node106. The provisional enrollment procedure may include storing the enrollment request on an administrative server database136. The provisional enrollment procedure may further include the administrative server102sending a provisional enrollment policy to the managed node106.

The provisional enrollment policy may include a variety of agent policies128to be used while the enrollment request is being delivered to the core server104and processed. For example, the provisional enrollment policy may include agent policies128instructing the agent to not perform tasks, to periodically poll the administrative server102for an enrollment policy, etc. The provisional enrollment policy may further include a temporary managed node certificate148to be used in identifying the managed node106. Further the agent116may remove itself from the managed node106if a timeout, specified in calendar time, has occurred before it is fully enrolled.

The administrative server102may perform206an enrollment procedure between the agent116and the core server104. For instance, the core server104may be configured to poll the administrative server102periodically to check for agent enrollment requests. A first step in the enrollment procedure may be to send any enrollment requests (from the agent116on the managed node106) stored in the administrative server database136to the requesting core server104. Upon receiving the enrollment requests, the core server104administrator may be able to grant or deny the full enrollment policies in response to the agent116enrollment requests.

The administrative server102may then receive either the granted full enrollment response for the agent116or a notification of denial from the core server104. The enrollment response or notification of denial may be stored in the administrative server database136. The provisional policy delivered to the agent116on the managed node106may configure the agent116to periodically poll the administrative server102for a stored enrollment response to the enrollment request. Upon receiving the poll for an enrollment response from the agent116, the administrative server102may send the enrollment response and agent policy128to the agent116on the managed node106.

The administrative server102may perform208a configuration procedure between the agent116on the managed node106and the core server104. A configuration procedure may include many potential operations between the agent116on the managed node106and the core server104.

For example, a configuration procedure may involve applying new agent policies128to an agent116on a managed node106. An administrator of the core server104may decide to update the agent policies128of the one or more agents116on one or more managed nodes106that are managed by that particular core server104. In such a circumstance, the administrative server102may receive the updated agent policy128from the core server104and store it in the administrative server database136. The administrative server102may send the stored agent policy128to an agent116on a managed node106in response to a periodic poll from the agent116requesting updated agent policies128. The agent116on the managed node106may receive the updated agent policies128and may store them to the managed node database132.

In another example, a configuration procedure may involve an agent116performing an operation on a managed node106and sending a results document138from the operation to the core server104. For instance, the agent policies128delivered to the agent116by the core server104in the previous example may include instructions for the agent116to perform an operation (e.g. a malware scan, a file catalog, etc.) that produces a results document138. The administrative system102may receive the results document138from the agent116on the managed node106and may store the results document138on the administrative server database136. The administrative server102may then send the results document138to the core server104in response to a periodic request received from the core server104for the results document. The core server104may then receive the results document138and use it to better configure the managed node106.

FIG. 3illustrates a configuration of a cloud-based network300in which systems and methods for managing an agent116by an administrative system102may be implemented. The cloud-based network300may have a plurality of core servers304, a plurality of managed nodes306, and a plurality of networks356. The cloud-based network300may include an administrative server302. The core server304may be similar to the core server104described in connection withFIG. 1. The managed node306may be similar to the managed node106described in connection withFIG. 1. The administrative server302may be similar to the administrative server102described in connection withFIG. 1.

The one or more networks356, and the corresponding managed nodes306and core servers304on each network356may all be owned and operated by one enterprise. The one or more networks356, and the corresponding managed nodes306and core servers304on each network356, may alternatively be owned and operated by one or more different enterprises. The one or more networks356may be incapable of communicating with each other. For instance the networks356could be separate subnets of an enterprise, or could be on networks356that do not share a direct connection. Alternatively, the one or more networks356may be capable of communicating with each other. For instance, the networks356may be on the same subnet of an enterprise, or may intermittently share a direct connection. The one or more networks356and the administrative server302may be connected to the Internet358. The administrative server302may facilitate operations described herein.

FIG. 4is a sequence diagram that illustrates various operations400that may be performed between a core server404and an administrative server402in registering a core server404. The core server404may be intermittently connected to the administrative server402. The core server404may establish401a connection to an administrative server402. After establishing401a connection with the administrative server402, the core server404may request403a core server secure token112from the secure token service110on the administrative server402. In one configuration, the request for the core server secure token112may be based upon registration credentials entered into a web portal. The request may further consist of other credentials such as a core server404administrator password, core server404identifying information, etc.

The core server secure token112may enable the core server404to access the agent management module114on the administrative server402. Once accessed, the agent management module114on the administrative server402may enable the core server404to register409itself with the administrative system402as a core server404capable of managing an agent116on a managed node106. This registration409may include the core server certificate140and may enable the administrative server402to provide management support to the core server404, such as storing data, performing agent116management-related operations, etc.

FIG. 5is a sequence diagram that illustrates various operations500that that may be performed by a core server504, an administrative server502and a managed node506in installing and configuring an agent116. The administrator on a managed node506may install the agent116on the managed node506. The newly added agent116may not yet be fully manageable by the core server504or administrative server502as it has not yet been configured using a corresponding agent activation key120. Further, the agent116may not be capable of establishing a direct connection to the core server504. Alternatively, the agent116may be capable of establishing only an intermittent or infrequent direct connection to the core server504.

In order to manage the new agent116, an administrator on a core server504may allocate501agent activation keys120for the agent116on a managed node506. The administrator may allocate501agent activation keys120in order to validate that the agent116is authorized by the core server504to operate on the managed node506. Agent activation keys120may include a passcode that is shared between an administrator of the managed node506and the administrator of the core server504, a line of computer language that automatically activates a selected agent116on a managed node506, etc. The agent activation keys120may be a cryptographic nonce or may include information from the administrator of the managed node506such as identification information, email address, etc.

The core server504may establish503a connection with an administrative server502. This connection may be a direct connection via the Internet358, a direct connection via a network356, etc. The core server504may request505a secure token from the secure token service110on the administrative server502. The request may be based upon some registration credentials entered into a web portal. The request may consist of other credentials such as a core server504administrator password, core server504identifying information, etc.

The core server504may send507the core server certificate140as credentials. The core server certificate140may serve to authenticate that the request for a secure token (e.g., a core server secure token112) originated from the core server504and that the core server504may be trusted. The administrative server502may authenticate the request for a core server secure token112automatically using the provided credential information. The administrative server502may alternatively authenticate the request for a core server secure token112with the input of a human administrative server502administrator. Once the administrative server502has authenticated the request for a core server secure token112, it may send509the core server secure token112to the core server504.

The core server secure token112may enable the core server504to access the agent management module114on the administrative server502. Once accessed, the core server504may add511agent activation keys120to the agent management module114on the administrative server502. The agent activation keys120may be the same activation keys120allocated501by the core server administrator in step501. The agent activation keys120may include one or more different agent activation keys120previously allocated by a core server504administrator for one or more new agents116on one or more managed nodes506.

After the agent activation keys120have been added511to the agent management module114, the administrative server502may send513a notification to the managed node506. For example, the notification module122on the agent management module114of the administrative server502may be configured to send513a notification to the managed node506. This notification may be sent513to the administrator of the managed node506using the identifying information included in the agent activation keys120. This notification may also be configured to be sent513automatically, or it may be configured to be sent513at the discretion of an administrator.

The notification sent513to the managed node506by the administrative server502may include the agent activation keys120for the new agent116on the managed node506and information to access the agent installation module118on the agent management module114. The administrator of the managed node506may use the information contained in the notification to enable the agent116operating on the managed node506to be activated and configured so that the core server504and administrative server502may perform management-related functions on the agent116operating on the managed node506.

Using the information contained in the notification sent513by the notification module122to the agent116on the managed node506, the managed node506may establish515a connection with the administrative server502. This connection may be a direct connection via the Internet358, a direct connection via a network356, etc.

The managed node506may download517an agent configurator. The agent configurator may be designed to install and apply configuration settings to the agent116on the managed node506. The administrator of the managed node506may input519the agent activation keys120contained in the notification sent513by the notification module122into the agent configurator. The agent activation keys120may authorize the agent configurator to begin configuring the agent116on the managed node506so that the core server504and administrative server502may perform management-related functions with respect to the agent116.

FIG. 6is a sequence diagram that illustrates various operations600that may be performed between an administrative server602and an agent616during a provisional enrollment procedure. An administrator may input601agent activation keys120into an agent configurator of the agent616. This may be accomplished as described in connection withFIG. 5. At some point after the administrator of the managed node106inputs601the agent activation keys120into the agent configurator, the agent616may establish603a connection with the administrative server602.

The agent616may send607the agent activation keys120entered into the agent configurator to the administrative server602. The administrative server602may use the agent activation keys120to validate612the enrollment request611. In order for the agent616to function properly, it may be enrolled with the core server604and obtain agent policies128which may apply various configurations to the agent616. To enroll and obtain these agent policies128, the agent616may send611an enrollment request to the administrative server602for the administrative system602to deliver to the core server604. The enrollment request611may contain a managed node certification request.

The administrative server602may store613the enrollment request in the administrative server database136for when the next connection is established between the administrative server602and the core server604. The administrative server602may configure615an agent provisional policy while the enrollment request is pending.

The agent provisional policy may include a temporary digital certificate that may identify the agent616on the managed node106. The agent provisional policy may include a provisional agent policy that applies temporary agent policies128to the agent616. As an example of temporary agent policies that may be applied to the agent616, the provisional agent policies may apply a temporary configuration that instructs the agent616to poll the administrative server602for core server604issued agent policies128at specific time intervals. The administrative server602may send617the agent provisional policy to the agent616on the managed node106.

FIG. 7is a sequence diagram that illustrates various operations700that may be performed by a core server704, an administrative server702and an agent716during an enrollment procedure. The agent716may send701an enrollment request to the administrative server702. The administrative server702may store703the enrollment request from the agent716. This may be accomplished as described in connection withFIG. 6. The administrative server702may have intermittent connections with the core server704. At some point after the administrative server702stores703the enrollment request from the agent716, the core server704may establish705a connection to the administrative server702.

This connection may be a direct connection via the Internet358, a direct connection via a network356, etc. The core server704may request707a secure token from the secure token service110on the administrative server702. The request may be based upon registration credentials entered into a web portal. The request may also consist of other credentials such as a core server704administrator password, core server704identifying information, etc.

The core server704may send709the core server certificate140as credentials. The core server certificate140may serve to authenticate that the request for a secure token originated from the core server704. The core server certificate140may indicate that the core server704can be trusted. The administrative server702may authenticate the request for a core server secure token112automatically using the provided credential information. The administrative server702may alternatively authenticate the request for a core server secure token112with the input of an administrative server702administrator. Once the administrative server702has authenticated the request for a core server secure token112, it may send711the core server secure token112to the core server704.

After the core server704has received the core server secure token112, the core server704may request713that any stored enrollment requests be sent from the administrative server702to the core server704. The administrative server702may send715all stored enrollment requests to the core server704in response to this request. It should be noted that the administrative server702may send enrollment requests associated with one or more agents716.

The core server704may determine717the enrollment status of the enrollment requests and configure agent policies128. In determining717the enrollment status of the enrollment requests, the core server704may authorize or deny enrollment for each enrollment request. Authorizing an enrollment request acknowledges that the agent716making the enrollment request has been granted valid agent activation keys120and that the agent716should be sent permanent agent policies128. The core server704may then configure the agent policies128based on the desired operations of the administrator of the core server704. For example, the agent policies128may be configured to instruct the agent716to perform a wide variety of operations including running malware scans, taking program inventories, gathering user logs, etc. The agent policies128may also include managed node certificates148that will be used in identifying messages from the agent716operating on the managed node706and for secure transmissions. The agent policies128may further include any needed credentials, configuration information to maintain the health of the agent, etc.

The core server704may send719the agent policies128to the administrative server702for the administrative server702to deliver to the agent716on the managed node506during one of the agent's716periodic polls of the administrative server702. The core server704may also send720agent enrollment response to the administrative server702for the administrative server702to deliver to the agent716on the managed node706during one of the agent's716periodic polls of the administrative server702. The administrative server702may store721the agent policies128in the administrative server database136. The administrative server702may also store722the agent enrollment response in the administrative server database136.

FIG. 8is a sequence diagram that illustrates various operations800that may be performed by a core server804, an administrative server802and an agent816during an enrollment procedure. The core server804may send801an agent policy and enrollment response to the administrative server802. The administrative server802may store803the agent policy and enrollment response from the core server804. This may be accomplished as described in connection withFIG. 7. At some point after the administrative server802stores803the agent policy and enrollment response, the agent816may establish805a connection with the administrative server802.

The agent816may request807a secure token from the secure token service110on the administrative server802. The agent816may send809the temporary managed node certificate issued to the agent816by the administrative server802during the provisional enrollment. The administrative server802may use the temporary managed node certificate to create and send811a secure token to the agent816. The secure token sent811to the agent816may be referred to as an agent secure token126.

After receiving the agent secure token126, the agent816may request813delivery of any stored agent policies128from the administrative server802. In response to this request813, the administrative server802may send815the agent policies and enrollment response128to the agent816. After receiving the agent policies128from the administrative server802, the agent816may and apply817the enrollment response and update its agent policies128with the newly received agent policies128. Updating the agent policies128may include applying the new managed node certificates148, new configurations, etc., to the agent816.

In one configuration, the managed node certificates148may be valid for a designated time period. The agent816on the managed node106may perform a recertification procedure to obtain a new managed node certificate148prior to the expiration of the current managed node certificate148. To accomplish this, the agent816may submit a certification request to the administrative server802. The administrative server802may store the certification request and may return an empty result to the agent816. The empty result indicates to the agent816that the recertification response will be returned as an attachment to a later poll from the agent816.

At some later time, the core server804may retrieve the certification request from the administrative server802and may issue a new managed node certificate148as a response. The core server804may send new managed node certificates148to the administrative server802where the administrative server802may store new managed node certificates148.

The agent816may poll the administrative server802its new managed node certificate148and the administrative server802may send the new managed node certificate148to the agent816as a response. The agent816applies the new managed node certificate148to the managed node106and sends a message to the administrative server802informing the administrative server802that the new managed node certificate148is being used. This message may be sent to the core server804, where the core server804may update its certificate data.

The core server804may send a message to the administrative server802indicating that it has updated its certificate data. The administrative server802may then update its certificate data. The agent816may try to authenticate with the administrative server802using the current managed node certificate148until authentication fails. At which time, the agent816will begin authenticating with the administrative server802using the new managed node certificate148.

FIG. 9is a sequence diagram that illustrates various operations900that may be performed by a core server904, an administrative server902and an agent916during a result transfer procedure. After an agent916has been enrolled with a core server904and has received agent policies128from the core server904, the agent916may perform an operation as instructed by the agent policies128. This operation may be a variety of operations that the administrator of the core server904desires and may be appropriate for the management of the managed node106. For example, operations may include a malware scan, a file catalog, a user catalog, etc. At the completion of one of these operations, the results of the operation may need to be sent to the core server904for evaluation. In order to do so, the agent916operating on the managed node106may establish901a connection with the administrative server902.

The agent916may request903a secure token from the secure token service110on the administrative server902. The agent916may send905the managed node certificate148issued to the agent916operating on the managed node106by the core server904during the operations described in connection withFIGS. 7 and 8. The administrative server902may use the managed node certificate148to create and send907a secure token to the agent916. The secure token sent907to the agent916may be referred to as an agent secure token126.

After negotiating the agent secure token126, the agent916operating on the managed node106may send909a results document138to the administrative server902for the administrative server902to deliver to the core server904. The results document138may be results from an operation that was performed as instructed by the agent policies128. For example, the results document138could be results from a malware scan, a file catalog, a user catalog, etc. The administrative server902may store911the results document138in the administrative server database136.

In one scenario, the results document138may include sensitive information that may be need to be encrypted to protect the security of the information. In such a scenario, the agent916may encrypt the sensitive information with the core server904public key142. After encrypting the information, it may be sent909and stored911securely on the administrative server902. Because the information may only be decrypted by the core server private key146which only resides on the core server904, the core server904is the only computing entity capable of deciphering the information.

In another scenario, the results document138may not include sensitive information. When the results document138does not need to be protected for data privacy, the agent916operating on the managed node106may sign the results document138with the managed node private key154. Thus, another computing entity may be able to authenticate the information using the managed node public key150, which may be distributed to computing devices in communication with the managed node106.

The core server904may have intermittent connections to the administrative server902. At some point after the administrative server902stores911the results document138from the agent916, the core server904may establish913a connection with the administrative server902.

This connection may be a direct connection via the Internet358, a direct connection via a network356, etc. The core server904may request915a secure token from the secure token service110on the administrative server902. The request may be based upon registration credentials entered into a web portal. The request may also consist of other credentials such as a core server904administrator password, core server904identifying information, etc.

The core server904may send917the core server certificate140to the administrative server902as credentials. The core server certificate140may serve to authenticate the request for a secure token from the core server904. The core server certificate140may indicate that the core server904can be trusted. The administrative server902may authenticate the request for a core server secure token112automatically using the provided credential information. The administrative server902may alternatively authenticate the request for a core server secure token112with the input of an administrative server902administrator. Once the administrative server902has authenticated the request for a core server secure token112, it may send919the core server secure token112to the core server904.

After receiving the core server secure token112, the core server904may request921the results documents138from the administrative server902. In response to this request921for results documents138, the administrative server902may send923the results documents138stored on the administrative server database136to the core server904. The core server904may store925the results documents138in the core server database130.

FIG. 10is a sequence diagram that illustrates additional operations1000that may be performed by a core server1004, an administrative server1002and an agent1016during a configuration procedure.

At some point after an agent1016operating on a managed node106is enrolled with a core server1004and has received agent policies128, an administrator of the core server1004may update1001the agent policies128on the core server1004. For instance, the administrator of the core server1004may desire to add an additional operation to those that are being conducted by the agents1016on the managed nodes106. In order to update the agent1016on the managed node106with new agent policies128, the core server1004may establish1003a connection to the administrative server1002.

This connection may be a direct connection via the Internet358, a direct connection via a network356, etc. The core server1004may request1005a secure token from the secure token service110on the administrative server1002. The request may be based upon registration credentials entered into a web portal. The request may also consist of other credentials such as a core server1004administrator password, core server1004identifying information, etc.

The core server1004may send1007the core server certificate140to the administrative server1002as credentials. The core server certificate140may serve to authenticate the request for a secure token sent from the core server1004. The core server certificate140may indicate that the core server1004can be trusted. The administrative server1002may authenticate the request for a core server secure token112automatically using the provided credential information. The administrative server1002may alternatively authenticate the request for a core server secure token112with the input of an administrative server1002administrator. Once the administrative server1002has authenticated the request for a core server secure token112, it may send1009the core server secure token112to the core server1004.

After receiving the core server secure token112, the core server1004may send1011the updated agent policies128and a list of the agents1016affected by the updates to the administrative server1002. The updated agent policies128and list of agents1016affected may be stored1013in the administrative system database136on the administrative system1002.

The updated agent policies128and list of agents1016affected may include sensitive information that may need to be encrypted to protect the security of the information. In such a scenario, the core server1004may encrypt the sensitive information with the managed node public key150for which an agent1016is operating on. After encrypting the information, it may be sent1011and stored1013securely on the administrative server1002. Because the information may only be decrypted by the managed node private key154, which only resides on the managed node106, the agent1016operating on the managed node106is the only computing entity capable of deciphering the information.

The updated agent policies128and list of agents1016affected may not include sensitive information. When the updated agent policies128and list of agents1016affected does not need to be protected for data privacy, the core server1004may sign the agent policies128with the core server private key146. Thus, another computing entity may be able to authenticate the information using the core server1004public key142, which may be distributed to computing devices in communication with the core server1004. By verifying the signature on the updated agent policies128and list of agents1016affected, the receiving computing device can verify that the updated agent policies128and list of agents1016affected was produced by the core server1004.

At some point after the administrative server1002stores1013the updated agent policies128and list of agents1016affected, an agent1016may establish1015a connection with the administrative server1002.

The agent1016may request1017a secure token from the secure token service110on the administrative server1002. The agent1016may send1019the managed node certificate148issued to the agent1016operating on the managed node106by the core server1004during the operations described in connection withFIGS. 7 and 8. The administrative server1002may use the managed node certificate148to create and send1021a secure token to the agent1016. The secure token sent1021to the agent1016may be referred to as an agent secure token126.

The agent1016may send1023a request for updated agent policies128to the administrative server1002. The agent1016may be configured to periodically poll the administrative server1002for updated agent policies128. The agent1016may be instructed to poll the administrative server1002for updated agent policies128at the discretion of the core server1004administrator using configuration contained in the agent policies128. In response to the request updated agent policies128, the administrative server1002may recognize that the agent1016is listed as one affected by a recent update of agent policies128. The administrative server1002may send1025updated agent policies128to the agent1016. The agent1016may store1027the updated agent policies128and apply the new agent policies128to the managed node106.

FIG. 11is a block diagram that illustrates one configuration of a network1100where systems and methods for enrolling and configuring agents116by an administrative server102may be implemented.

An administrative server1102is connected to a router1160. The router1160is connected to switches1162a,1162b,1162c. The switch1162ais connected to several nodes1106a,1106b,1106c, etc., via their respective subnets1164a,1164b,1164c. The switch1162bis connected to several nodes1106d,1106e,1106f, etc., via their respective subnets1164d,1164e,1164f. The switch1162cis connected to several nodes1106g,1106h,1106i, etc., via their respective subnets1164g,1164h,1164i. AlthoughFIG. 11only shows one router1160and a limited number of switches1162, subnets1164and nodes1106, many and varied numbers of routers1160, switches1162, subnets1164and nodes1106may be included in networks and/or systems that may implement systems and methods for network management. It should be noted that one or more of the nodes1106a-imay be examples of one or more of the nodes106,306and506described herein. Additionally or alternatively, the administrative server1102may be one example of the administrative servers102,302,402,502,602,702,802,902and1002described herein.

FIG. 12illustrates various components that may be utilized in a computing device1266. The computing device1266may be configured in accordance with one or more of the administrative servers102,302,402,502,602,702,802,902and1002, core servers104,304,404,504,604,704.804,904and1004and managed nodes106,306and406described herein. The computing device1266may include a processor1268and memory1270. The memory1270may include instructions1272aand data1274a. The processor1268controls the operation of the computing device1266and may be, for example, a microprocessor, a microcontroller, a digital signal processor (DSP) or other device known in the art. The processor1268typically performs logical and arithmetic operations based on program instructions1272band/or data1274breceived from the memory1270.

The computing device1266typically may include one or more communication interfaces1276for communicating with other electronic devices. The communication interfaces1276may be based on wired communication technology, wireless communication technology or both. Examples of different types of communication interfaces1276include a serial port, a parallel port, a Universal Serial Bus (USB), an Ethernet adapter, an IEEE bus interface, a small computer system interface (SCSI) bus interface, an infrared (IR) communication port, a Bluetooth wireless communication adapter and so forth.

The computing device1266typically may include one or more input devices1278and one or more output devices1280. Examples of different kinds of input devices1278include a keyboard, mouse, microphone, remote control device, button, joystick, trackball, touchpad, lightpen, etc. Examples of different kinds of output devices1280include a speaker, printer, etc. One specific type of output device that may be included in a computer system is a display device1282. Display devices1282used with configurations disclosed herein may utilize any suitable image projection technology, such as liquid crystal display (LCD), light-emitting diode (LED), gas plasma, electroluminescence, a cathode ray tube (CRT) or the like.

A display controller1284may also be provided, for converting data stored in the memory1270into text, graphics and/or moving images (as appropriate) shown on the display device1282. Of course,FIG. 12illustrates only one possible configuration of a computing device1266. Various other architectures and components may be utilized.

The methods disclosed herein comprise one or more steps or actions for achieving the described methods. The method steps and/or actions may be interchanged with one another without departing from the scope of the claims. In other words, unless a specific order of steps or actions is required for proper operation of the method that is being described, the order and/or use of specific steps and/or actions may be modified without departing from the scope of the claims.