Abstract:
Embodiments relate to systems and methods for network management using a secure mesh command and control framework. A network management server can communicate with a set of supervisory hosts, which in turn communicate with an underlying set of targets. The set of targets can have associated digital certificates which can be authenticated by common certificate authorities. A controlled target can authenticate one or more other target requesting access to the controlled target via the trusted common certificate authority. One authenticated target can therefore mesh on a trusted basis with another target to perform installation, monitoring, testing, or other activities directly on the target of interest, without channeling commands through an intervening supervisory host.

Description:
FIELD  
       [0001]    The present teachings relate to systems and methods for network management using a secure mesh command and control framework, and more particularly to platforms and techniques for generating and managing the delivery of network management commands between target machines based on relationships with trusted supervisory hosts, using direct secure channels between the target machines. 
       BACKGROUND OF RELATED ART  
       [0002]    A variety of network management platforms exist to assist network administrators with installing and configuring network resources. In many platforms, a management server can be used to issue commands to hosts or other network nodes to manage the configuration of the network hosts, underlying clients or other devices. In the case of comparatively large-scale networks, and/or networks in which nodes are relatively widely dispersed geographically, the distribution of commands can become more problematic. For one thing, the systems administrator may not be aware of the best connection route or pathway through the network to a set of target machines, to most effectively “push” the commands to their destination. For example, certain systems may be reachable only through intermediate systems due to firewall configurations, and multiple levels of firewalls may be in place. 
         [0003]    For further example, it may be desirable to reduce or minimize the number of network nodes or “hops” that the commands need to traverse to arrive at the intended target machines. For again further example, in the case of relatively large-scale networks, for example on the order of hundreds or thousands of hosts and/or nodes or more, it may be desirable to transmit the commands as few times as necessary to avoid repetitively transmitting the commands over again each time. 
         [0004]    For yet further example, the reliance on a rigid control hierarchy where only a supervisory host can issue management commands can curtail the ability of lower-level machines to perform management functions directly with each other, since all command traffic must instead pass through a supervisory host. Responsiveness and flexibility can therefore be affected. It may thus be desirable to provide methods and systems that overcome these network management difficulties, and permit enhanced or more flexible network management at the level of target machines. 
     
    
     
       DESCRIPTION OF THE DRAWINGS 
         [0005]    The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments of the present teachings and together with the description, serve to explain the principles of the present teachings. In the figures: 
           [0006]      FIG. 1  illustrates an overall system for systems and methods for network management using a secure mesh command and control framework, according to various embodiments of the present teachings; 
           [0007]      FIG. 2  illustrates an overall system for systems and methods for network management using a secure mesh command and control framework in further regards including direct target interaction, according to various embodiments of the present teachings; 
           [0008]      FIG. 3  illustrates an exemplary hardware configuration of a network management server that can be used in systems and methods for network command delegation using auto-discovered pathways, according to various embodiments; and 
           [0009]      FIG. 4  illustrates overall network management processing for systems and methods for network management using a secure mesh command and control framework, according to various embodiments. 
       
    
    
     DESCRIPTION OF EMBODIMENTS 
       [0010]    Embodiments of the present teachings relate to systems and methods for network management using a secure mesh command and control framework. More particularly, embodiments relate to platforms and techniques in one regard for generating and distributing network configuration commands that can be shared between lower-level targets or “minions” without a need for communication via a set of supervisory hosts (which can be referred to as “overlord” servers). The set of targets along with other network elements can share a common certificate authority, which can be used to establish trusted relationships between the targets or minions, directly. In embodiments the set of lower-level hosts and/or targets can comprise comparatively large-scale networks or deployments, on the order for example of ten thousand machines, or less or more machines. 
         [0011]    Reference will now be made in detail to exemplary embodiments of the present teachings, which are illustrated in the accompanying drawings. Where possible the same reference numbers will be used throughout the drawings to refer to the same or like parts. 
         [0012]      FIG. 1  illustrates an overall system  100  consistent with systems and methods for network management using a secure mesh command and control framework, according to various embodiments of the present teachings. In embodiments as shown, in general a network management server  102  can communicate with a set of supervisory hosts  112  via one or more networks  110 . One or more networks  110  can be or include the Internet, or other public or private networks. One or more networks  110  can be or include wired, wireless, optical, and other network connections. Set of supervisory hosts  112  can be or include a set of servers configured to communicate with entities at other levels of one or more networks  110  and/or associated connections. In embodiments, set of supervisory hosts  112  can communicate with an intermediate set or sets of hosts, gateways, or servers. In embodiments, set of supervisory hosts  112  can function as “overlord” hosts or servers which communicate command data  120  to an underlying or low-level set of targets  116 . 
         [0013]    Set of supervisory hosts  112  can support or serve an underlying set of targets  116 , for example via a local area network, or other network(s) or connections. Set of targets  116  can be or include a set of personal computers, network-enabled media devices, or other clients, devices, or machines. Other hierarchies, topologies, and connections between network management server  102 , set of supervisory hosts  112 , any intermediate hosts, and/or set of targets  116  can be used. In embodiments, communications between network management server  102 , set of supervisory hosts  112 , and/or set of targets  116  or other entities can be conducted via one or more secure channels, such as the secure channel and related resources described in co-pending U.S. application Ser. No. 12/130,424, filed May 30, 2008, entitled “Systems and Methods for Remote Management of Networked Systems Using Secure Modular Platform,” which published as U.S. Patent Application Publication No. ______, assigned or under obligation of assignment to the same entity as this application, and which application is incorporated by reference herein. 
         [0014]    Network management server  102  can include or access resources to support the generation and transmission of one or more commands  120  via auto-discovered or other pathways to manage set of supervisory hosts  112 , and/or set of targets  116 , including a network store  104 . Network store  104  can be or include a database or other data store, and in embodiments can store a network map  106 . Network map  106  can record information related to the configuration and topology of network connections between set of supervisory hosts  112 , and/or set of targets  116 , as well as other data. In embodiments, network map  106  can be recorded in a file, tree, database, or other record. 
         [0015]    According to embodiments in one regard, network management server  102  can access network map  106  to carry out issue one or more commands  120  via one or more hosts in set of supervisory hosts  112  to underlying hosts, targets, and/or other devices. When network management server  102  generates one or more commands  120 , network management server  102  can access network map  106  to identify one or more supervisory hosts in set of supervisory hosts  112  to which to transmit one or more commands  120 . The recipient supervisory host(s) can receive one or more commands  120  and, in embodiments, access network map  106  and/or communicate with network management server  102  to extract a pathway by which to relay or transmit one or more commands  120  to underlying devices. The supervisory host(s) can then transmit the one or more commands  120  to a target or targets in set of targets  116 , using the identified pathway. 
         [0016]    In embodiments, it will be appreciated that any of network management server  102 , set of supervisory hosts  112 , any intermediate hosts, and/or set of targets  116  or other entities can be significantly or substantially geographically distributed, and can represent relatively large-scale groupings or clusters. For instance, different hosts in set of supervisory hosts  112  and/or associated targets in set of targets  116  can be located in different metropolitan areas, in different sections of a country, in different countries, or in different continents. For further instance, different hosts in set of supervisory hosts  112  and/or sets of targets in set of targets  116  can represent hundreds, thousands, or greater or lesser numbers of collective devices. 
         [0017]    According to embodiments as for instance shown in  FIG. 1 , set of supervisory hosts  112  can organize and manage the exchange of command data and other executables or information between any two or more targets in set of targets  116 . In embodiments, in general, one or more targets in set of targets  116  can have an associated credential  118 , such as a digital certificate or other security object or credential. In embodiments, set of targets  116 , set of supervisory hosts  112 , and/or other network elements can share a certificate authority, such as a certificate or authentication server. In further embodiments, a supervisory host in set of supervisory hosts  112  can act as a certificate authority for the credential  118  presented by one or more targets which that host supervises. In embodiments, a digital certificate can be signed or otherwise authenticated by the associated certificate authority, when presented by an underlying target. In embodiments, a target seeking security validation can be authenticated using a public/private key infrastructure Other security, authentication, or validation techniques can be used. 
         [0018]    Once one or more targets in set of targets  116  are validated via respective credential  118 , as illustrated in  FIG. 2 , targets in set of targets  116  can interact with each other and/or set of supervisory hosts  112  to initiate local meshes or secure connections to perform secure command and control operations. In embodiments as shown, a validated or trusted target which has been authenticated via credential  118  can establish or access a secure channel  108  to another target in set of targets  118 . Secure channel  108  can be or include, for instance, a secure socket layer (SSL) connection managed by the local supervisory host and/or network management server. Secure channel  108  can incorporate the secure channel and related resources described in the aforementioned co-pending U.S. application Ser. No. 12/130,424, filed May 30, 2008, entitled “Systems and Methods for Remote Management of Networked Systems Using Secure Modular Platform,” which published as U.S. Patent Application Publication No. ______. In embodiments, a secure channel  108  can be initiated between three or more targets. In embodiments, more than one secure channel  108  can be established between two or more participating targets. Other connections and connection topologies are possible. 
         [0019]    According to embodiments, with one or more secure channel  108  or other connection in place between two or more targets, the authenticated or trusted target(s) can initiate command and control operations by communicating command data  120  to the subject target(s). In embodiments, each target can maintain an access control list  122  to determine the identity of trust machines include other targets, which are authorized to run commands on or perform other actions on that machine via command data  120  or other instructions. In embodiments, the command data  120  can be or include data, commands, instructions, scripts, links, and/or other information to carry out network management and control functions on the subject target(s). In embodiments, command data  120  can be or include, for instance, an inventory command, a test command, a setup command, a configuration command, a trend command, a security command, and/or other commands. 
         [0020]    An authenticated or trusted target A can, for example, exchange command data  120  to monitor target B for processor load, bandwidth, or other properties or functions, and gain access to target B via secure channel  108  to monitor that target directly, again without necessarily invoking or communicating via a supervisory host. In general, each target which receives a request for access via command data  120  from another target can follow a process of for determining if any other target/minion can execute a command, including receive the incoming command data  120 /other communication, and then checking the certificate or other credential  118  of the incoming communication to ensure it was signed by the common certificate authority for the local mesh/network of set of targets  116 . If credential  118  was signed and is correct for the requesting target, the access control list  122  can be consulted to see if the requesting target has the authority to run the requested method. 
         [0021]    In embodiments, because in one regard more than one secure channel  108  or other connection can be built directly between two or more targets, the command data  120  and security operations performed by local targets need not depend on the support of any one supervisory host or channel. Because, in part, the potential trusted mesh between targets in set of targets  116  can be defined by access control list  122 , credential  118  for various targets, and other security data, the possible set of secure command subnetworks can be re-configured or dynamically change over time, in response to varying network operations and other factors. 
         [0022]      FIG. 3  illustrates an exemplary diagram of hardware and other resources that can be incorporated in a network management system  102  configured to communicate with set of supervisory hosts  112 , any intermediate hosts, and/or set of targets  116  or other entities via one or more networks  110 , according to embodiments. In embodiments as shown, network management system  102  can comprise a processor  124  communicating with memory  126 , such as electronic random access memory, operating under control of or in conjunction with operating system  130 . Operating system  130  can be, for example, a distribution of the Linux™ operating system, the Unix™ operating system, or other open-source or proprietary operating system or platform. Processor  124  also communicates with network store  104 , such as a database stored on a local hard drive. Processor  124  further communicates with network interface  128 , such as an Ethernet or wireless data connection, which in turn communicates with one or more networks  110 , such as the Internet or other public or private networks. Processor  124  also communicates with a network management module  132 , which can be or include logic to monitor and manage the operation of network  110  and associated or connected resources. Network management module  132  can for instance permit a user to view, delegate, and execute configuration operations in set of supervisory hosts  112 , set of targets  116 , and/or other entities. Other configurations of network management system  102 , associated network connections, and other hardware and software resources are possible. 
         [0023]      FIG. 4  illustrates overall processing for network management using a secure mesh command and control framework, according to various embodiments of the present teachings. In  402 , processing can begin. In  404 , set of supervisory hosts  112  can be initialized and/or configured in or via network  110 . In  406 , a set of targets  106  can be initialized and/or configured with corresponding hosts in set of supervisory hosts  112  acting as “overlord” or management entities. In  408 , the authentication of one or more targets in set of targets  106  can be initiated using credential  118  possessed by the respective target. In embodiments, the authentication can be initiated by one or more hosts in set of supervisory hosts  112 , by network management server  102 , and/or other entities or authorities. 
         [0024]    In  410 , a secure channel  108  can be established between a trusted or authenticated target and one or more subject target(s), based on the authentication. In embodiments, secure channel  108  can be or include a secure socket layer (SSL) connection, a public/private key infrastructure or connection, or other channel or connection. In  412 , an access control list  122  can be read or accessed by one or more participating targets, one or more supervisory hosts in set of supervisory hosts  112 , network management server  102 , or other entity to determine the actions or access permitted by the trusted or authenticated target on the subject target. In embodiments, two targets can be mutually authenticated to act upon each other. In  414 , command data  120  can be communicated to the subject target(s) to initiate or perform management operations, such as to generate hardware, software, or other inventories of a subject target. In  416 , the resulting configuration or other operational data related to the subject target can be reported to authenticated target(s), supervisory host(s), network management server  102 , or other entity or destination. In  418 , the mesh or network of authenticated or trusted targets and other entities can be dynamically adapted or updated based on a revised access control list  122 , versions of one or more credential  118 , and/or other data. In  420 , as understood by persons skilled in the art, processing can repeat, return to a prior processing point, jump to a further processing point, or end. 
         [0025]    The foregoing description is illustrative, and variations in configuration and implementation may occur to persons skilled in the art. For example, while embodiments have been described in which configuration commands or other data are generated and transmitted from one network management server  102 , in embodiments more than one server or other device or resource can serve as a control point. For further example, while embodiments have been described in which one or more hosts in a set of supervisory hosts  112  coordinate the distribution of commands and data to a set of targets  116 , in embodiments, implementations can involve the dissemination of commands or other data through different network hierarchies, trees, nodes, or arrangements. For instance, in embodiments, commands or other data can be delegated via supervisory hosts through more than two sub-hosts or other sub-levels. For yet further example, while embodiments have been described involving one level or layer of supervisory hosts, in embodiments, the overall network can be configured with multiple levels or layers of supervisory hosts (or “overlords”). Similarly, various targets in set of targets  116  can be configured at different levels within the overall network. 
         [0026]    Yet further, while embodiments have been described in which two targets installed or operating at the same hierarchical level can connect or mesh for secure command exchange, in embodiments, two or more targets occupying different network levels can connect and exchange commands or other data on a trusted basis. Other resources described as singular or integrated can in embodiments be plural or distributed, and resources described as multiple or distributed can in embodiments be combined. The scope of the present teachings is accordingly intended to be limited only by the following claims.