Real-time policy distribution
View Patent ↗In an example, there is disclosed a method and system for real-time policy and task distribution to endpoints over a data exchange layer. According to one embodiment, a persistent point-to-point messaging framework is used to distributed configuration policy and tasks to a distributed, disparate set of devices immediately upon policy definition. Advantageously, the data exchange layer may facilitate delivery of messages even to endpoints that sit, for example, behind a firewall or NAT.
1. One or more non-transitory computer-readable mediums having stored thereon executable instructions for providing a data exchange layer (DXL) broker, the executable instructions when executed instruct a processor to:
communicatively couple to a DXL enterprise service bus (ESB);
provide an application programming interface (API) to authenticate and register DXL endpoints with the DXL broker;
maintain a DXL routing table of registered DXL endpoints for the DXL broker; and
provide real-time context-aware DXL messaging for registered DXL endpoints, wherein providing DXL message routing comprises providing a message queueing telemetry transport (MQTT)-based one-to-one (1:1) request-response framework on a one-to-many (1:N, N>1) publish-subscribe fabric.
2. The one or more non-transitory computer-readable mediums of claim 1 , wherein the executable instructions are further to instruct the processor to:
identify a policy update driver;
configure a policy update; and
publish the policy update as a DXL message via the DXL ESB.
3. The one or more non-transitory computer-readable mediums of claim 2 , wherein the DXL message is a command-level message.
4. The one or more non-transitory computer-readable mediums of claim 2 , wherein the DXL message is targeted to DXL endpoints.
5. The one or more non-transitory computer-readable mediums of claim 2 , wherein the instructions are further to instruct the processor to identify a policy update driver and receive a malware threat message from a threat intelligence service.
6. The one or more non-transitory computer-readable mediums of claim 2 , wherein the instructions are further to instruct the processor to identify a policy update driver and proactively identify a policy update need.
7. The one or more non-transitory computer-readable mediums of claim 2 , wherein the instructions are further to instruct the processor to identify a policy update driver and receive a policy update from an administrator.
8. The one or more non-transitory computer-readable mediums of claim 2 , wherein the instructions are further to instruct the processor to configure a policy update and direct DXL endpoints to take an action selected from the group consisting of quarantine, block, delete, sandbox, deny permissions, remedy, prompt, or custom action.
9. A data exchange layer (DXL) broker comprising:
a processor;
a network interface; and
a memory having stored therein executable instructions configured to instruct the processor to:
communicatively couple to a DXL enterprise service bus (ESB) via the network interface;
provide an application programming interface (API) to authenticate and register DXL endpoints with the DXL broker;
maintain a DXL routing table of registered DXL endpoints for the DXL broker; and
provide real-time context-aware DXL messaging for registered DXL endpoints, wherein providing DXL message routing comprises providing a message queueing telemetry transport (MQTT)-based one-to-one (1:1) request-response framework on a one-to-many (1:N, N>1) publish-subscribe fabric.
10. The DXL broker of claim 9 , wherein the executable instructions are further configured to instruct the processor to:
identify a policy update driver;
configure a policy update; and
publish the policy update as a DXL message via the DXL ESB.
11. The DXL broker of claim 10 , wherein the DXL message is a command-level message.
12. The DXL broker of claim 10 , wherein the DXL message is targeted to DXL endpoints.
13. The DXL broker of claim 10 , wherein the instructions configured to identify a policy update driver are configured to receive a malware threat message from a threat intelligence service.
14. The DXL broker of claim 10 , wherein the instructions configured to identify a policy update driver are configured to proactively identify a policy update need.
15. The DXL broker of claim 10 , wherein the instructions configured to identify a policy update driver are configured to receive a policy update from an administrator.
16. The DXL broker of claim 10 , wherein the instructions configured to configure a policy update are configured to direct DXL endpoints to take an action selected from the group consisting of quarantine, block, delete, sandbox, deny permissions, remedy, prompt, or custom action.
17. A method of providing data exchange layer (DXL) broker services, comprising:
communicatively coupling a computing apparatus to a DXL enterprise service bus (ESB);
providing an application programming interface (API) to authenticate and register DXL endpoints with the DXL broker;
maintaining a DXL routing table of registered DXL endpoints for the DXL broker; and
providing real-time context-aware DXL messaging for registered DXL endpoints, wherein providing DXL message routing comprises providing a message queueing telemetry transport (MQTT)-based one-to-one (1:1) request-response framework on a one-to-many (1:N, N>1) publish-subscribe fabric.
18. The method of claim 17 , further comprising:
identifying a policy update driver;
configuring a policy update; and
publishing the policy update as a DXL message via the DXL ESB.
19. The method of claim 18 , wherein the DXL message is a command-level message.
20. The method of claim 18 , wherein the DXL message is targeted to DXL endpoints.
21. The method of claim 18 , wherein identifying a policy update driver comprises receiving a malware threat message from a threat intelligence service.
22. The method of claim 18 , wherein identifying a policy update driver comprises proactively identifying a policy update need.
23. The method of claim 18 , wherein identifying a policy update driver comprises receiving a policy update from an administrator.
24. The method of claim 18 , wherein configuring a policy update comprises directing DXL endpoints to take an action selected from the group consisting of quarantine, block, delete, sandbox, deny permissions, remedy, prompt, or custom action.