Data processing: software development – installation – and managem – Software upgrading or updating – Network
Reexamination Certificate
1999-02-01
2002-11-19
Dam, Tuan Q. (Department: 2124)
Data processing: software development, installation, and managem
Software upgrading or updating
Network
C717S178000, C707S793000, C709S220000, C709S221000
Reexamination Certificate
active
06484315
ABSTRACT:
TECHNICAL FIELD OF THE INVENTION
This invention relates generally to computer networking, and more particularly to a method and system for dynamically distributing updates in a network.
BACKGROUND OF THE INVENTION
Computer networks have become an increasingly important means for communicating public and private information between and within distributed locations. The Internet is one example of a public network commonly used for communicating public and private information. Internet web servers provide access to public information, such as news, business information, and government information, which the Internet makes readily available around the world. The Internet is also becoming a popular forum for business transactions, including securities transactions and sales of goods and services. A large number of people have come to depend upon reliable Internet access and secure communications on a day-by-day and even second-by-second basis. Like the Internet, private networks also have become common means for communicating important information. Private networks, such as company intranets, local area networks (LANs), and wide area networks (WANs) generally limit access on a user-by-user basis and communicate data over dedicated lines or by controlling access through passwords, encryption, or other security measures.
One danger to reliable and secure network communications is posed by hackers or other unauthorized users disrupting or interfering with network resources. The danger posed by unauthorized access to computer network resources can vary from simple embarrassment to substantial financial losses. For example, serious financial disruptions occur when hackers obtain financial account information or credit card information and use that information to misappropriate funds.
Typically, network administrators use various levels of security measures to protect the network against unauthorized use. Intrusion detection systems are commonly used to detect and identify unauthorized use of a computer network before the network resources and information are substantially disrupted or violated. In general, intrusion detection systems look for specific patterns in network traffic, known as intrusion signatures to detect malicious activity. Conventional intrusion detection systems often use finite state machines, simple pattern matching, or specialized algorithms to identify intrusion signatures in network traffic. Detected intrusion signatures are reported to network administration.
A problem with conventional intrusion detection systems is that when a new vulnerability, or type of attack on the network, is discovered, a new intrusion signature must be generated and installed for each intrusion detection system. As a result, unless a network administrator frequently checks for new signatures developed by an intrusion detection provider and installs the new signatures for each sensor in his or her system, the system will remain vulnerable to the new types of attack. Because new types of attacks appear more frequently than network administrators typically check with an intrusion detection provider for new signatures, networks often remain vulnerable to new types of attacks even though new signatures are available to identify and prevent such attacks.
SUMMARY OF THE INVENTION
The present invention provides a method and system for dynamically distributing intrusion detection and other types of updates in a network that substantially eliminate or reduce disadvantages and problems associated with prior methods and systems. In particular, the present invention automatically downloads updates from a remote site in response to a timed event.
In accordance with one embodiment of the present invention, a first version of a program operating at a network site is updated by automatically downloading from a remote site any update for the program in response to an automated event. A downloaded update is installed to generate a second version of the program. The second version of the program is operated at the network site in place of the first version.
More particularly, in accordance with a particular embodiment of the present invention, the automated event is a timed event. In this embodiment, the first version of the program is aged and the timed event is the first version reaching a specified age. The specified age may be 24 hours or other suitable age. In other embodiments, the timed event may be a specified time such that any updates are automatically downloaded once a day, once a week, or at other suitable frequency.
After installation of a downloaded update, it may be determined whether the second version of the program is operating correctly. In response to incorrect operation of the second version, the first version of the program may be restored for operation at the network site. In response to correct operation of the second version, the downloaded update may be distributed to disparate network sites operating the first version of the program. There, the downloaded update may be installed to generate the second version of the program at the disparate network sites. The second version of the program is operated in the place of the first version at the disparate network sites.
Technical advantages of the present invention include providing an improved method and system for distributing updates in a network. In particular, programs are automatically updated by downloading and distributing an update in response to an automated event, such as a timed event. As a result, systems with a common program separately running at several sites may update each site with no or minimal operator interaction. In addition, updates may be automatic or with minimal operator interaction rolled back at each site in a system in response to an upgrade problem.
Additional technical advantages of the present invention include providing an improved intrusion detection system. In particular, each intrusion detection sensor may automatically connect to a remote site and download new intrusion detection signatures. Each sensor may also distribute the new signatures to related sensors within a system. Accordingly, network vulnerability due to new types of attacks is reduced. In addition, an intrusion detection service provider may update all of its customers by simply providing new signatures on a website from which each customer's system will automatically connect to and download the new signatures in accordance with a specified frequency. Accordingly, the costs of providing intrusion detection services are reduced.
Other technical advantages will be readily apparent to one skilled in the art for the following figures, description, and claims.
REFERENCES:
patent: 4456788 (1984-06-01), Kline et al.
patent: 5032979 (1991-07-01), Hecht et al.
patent: 5101402 (1992-03-01), Chiu et al.
patent: 5278901 (1994-01-01), Shieh et al.
patent: 5414833 (1995-05-01), Hershey et al.
patent: 5448724 (1995-09-01), Hayashi
patent: 5488715 (1996-01-01), Wainwright
patent: 5524238 (1996-06-01), Miller et al.
patent: 5557742 (1996-09-01), Smaha et al.
patent: 5606668 (1997-02-01), Shwed
patent: 5621889 (1997-04-01), Lermuzeaux et al.
patent: 5699513 (1997-12-01), Feigen et al.
patent: 5715462 (1998-02-01), Iwamoto et al.
patent: 5793763 (1998-08-01), Mayes et al.
patent: 5796942 (1998-08-01), Esbensen
patent: 5798706 (1998-08-01), Kraemer et al.
patent: 5805801 (1998-09-01), Holloway et al.
patent: 5826014 (1998-10-01), Coley et al.
patent: 5835911 (1998-11-01), Nakagawa et al.
patent: 5860012 (1999-01-01), Luu
patent: 5919247 (1999-07-01), Hoff et al.
patent: 5919257 (1999-07-01), Trostle
patent: 5931946 (1999-08-01), Terada et al.
patent: 5991881 (1999-11-01), Conklin et al.
patent: 6006034 (1999-12-01), Heath et al.
patent: 6009274 (1999-12-01), Fletcher et al.
patent: 6138153 (2000-10-01), Collins, III et al
patent: 6154878 (2000-11-01), Saboff
patent: 6161218 (2000-12-01), Taylor
patent: 6338149 (2002-01-01), Ciccone, Jr. et al.
“Introduction to Algorithms,” by Thomas H. Cormen, Charles E. Leiserson, Ronald L. Rivest, Chap. 34, pp
Baker & Botts L.L.P.
Cisco Technology Inc.
Dam Tuan Q.
LandOfFree
Method and system for dynamically distributing updates in a... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Method and system for dynamically distributing updates in a..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Method and system for dynamically distributing updates in a... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-2976788