International Business Machines Corporation

Bigfix, Inc.

Dennis Sidney Goodrow

Peter Benjamin Loer

Lisa Ellen Lippincott

Peter Lincroft

Gregory Mitchell Toto

David Salim Hindawi

David Leigh Donoho

James M Brown

Orion Hindawi

Amrit Tsering Williams

Benjamin John Kus

James B Evans

Jonathan S Fan

Jason E Mealins

Jeremy Scott Spiegel

John Edward Firebaugh

An apparatus and method for centralized policy management of large-scale networks () of computational devices is disclosed. The apparatus includes a number of distributed clients () run on registered computers (-), gathering policy advisories () and reporting () relevance () to a system administrator (). The system administrator may view the relevant messages () through a management interface () and deploy suggested actions to distributed clients (), where the actions are executed to apply the solutions of the advisories ().

Formalizing, diffusing and enforcing policy advisories and monitoring policy compliance in the management of networks

A pseudo-agent is disclosed herein that bridges this divide. For purposes of the discussion herein, a pseudo-agent is a machine that is installed on a fully capable host machine, such as a Windows or UNIX machine, and that gathers and evaluates content from a management server, takes actions if so instructed, and reports the results of its evaluation upstream. However, unlike an agent in a traditional management system, which inspects and acts on the local machine, the pseudo-agent actually inspects and acts on a remote device, or many remote devices.

Mechanisms for evaluating relevance of information to a managed device and performing management operations using a pseudo-agent

A client hypervisor comprises a virtual agent that runs outside of a system OS and that allows device management independent of the OS and user. The virtual agent is tied to a device and not a specific instance of the OS. Such client hypervisors expose new functionality to ease managing systems. Some of these capabilities come from the persistence and privileges outside the OS. In some embodiments of the invention, this new management functionality is exposed to allow device management via new virtualization concepts, such as multiple VMs per system, VM replacement, snapshot/rollback, etc.

Endpoint-hosted hypervisor management

An approximation of the bandwidth of the narrowest link in a network is determined by watching how fast data gets to the other end and then back again. The rate of data transmission is limited according to this approximation. Dynamic capacity of the link, i.e. the amount of data that can be in-flight at the same time, neglecting any buffers, is also tracked. The technique looks at how much data is in-flight and, if there is more data in flight than the dynamic capacity of the network, the data transmission rate is slowed down.

Dynamic bandwidth throttling

An embodiment of the invention provides a technique that extends relevance-based computation to include computation based on information accessed from or exchanged with other agents. Mechanisms are provided by which an agent accesses or exchanges information between or among other agents and may include one or more of: central bulletin board, broadcast, direct request&#x2014;pull, direct request&#x2014;push, and server-routed. Architectural models of distributed decision making to facilitate a distributed and policy-based management of IT infrastructure are provided.

Method and apparatus for distributed policy-based management and computed relevance messaging with remote attributes

Pseudo-agent

A console for an enterprise suite is disclosed. The enterprise suite addresses the increasingly complex problem of keeping critical systems updated, compatible, and free of security holes. It uses Fixlet&#xae; technology to identify vulnerable computers on the network and then allows authorized personnel to correct problems across any subset of the network with a few simple mouse-clicks. The enterprise suite helps keep the networked computers updated and properly patched, all from a central console which, along with supporting architectural enhancements, is the subject matter of this document. The invention allows rolling out a security patch in minutes instead of months, thus allowing an administrator to stay ahead of potential hacker attacks. The invention also makes it possible to track the progress of each computer as updates are applied, thus making it simple to gauge the level of compliance across the entire enterprise.

Enterprise console

An embodiment of the invention provides a technique that allows the collection, storage, and manipulation of data collected in a computer network.

Statistical data inspector

Formalizing, diffusing, and enforcing policy advisories and monitoring policy compliance in the management of networks

The invention disclosed herein enables a collection of computers and associated communications infrastructure to offer a new communications process which allows a requestor to receive configuration information of a computational device from a responder. The requester first sends query documents that contain queries for configuration information of a computational device to the responder; the responder automatically collects the answers for the queries and sends a response document that contains the configuration information of the computational device to the requestor. The queries are written in a formal descriptive language which is transparent, safe for network evaluation, and extensible, and the configuration reader of the responder can parse the queries and automatically invoke a set of standard inspectors to obtain the corresponding configuration information.

Growing community of inventors

Santa Rosa, CA, United States of America

Dennis Sidney Goodrow