Granted Patent B2

US 11,704,407 · App. 16/206,200 · Granted Jul 18, 2023

Inventors: Peidong Chen (San Jose, CA); Manikandan Thiagarajan (Cupertino, CA); Michael Miller (Boulder Creek, CA); Xin Hu (Pleasanton, CA)

Assignee: Forcepoint LLC

G06F21/554G06F21/552H04L63/20G06F2221/034

Abstract

Claims (63)

1. A computer-implemented method for operating an endpoint core at an endpoint device, the method comprising:

providing the endpoint device with an endpoint agent, the endpoint device and the endpoint agent providing a protected endpoint, the protected endpoint comprising the endpoint core, the endpoint core comprising a subscription manager, a collector application program interface communicating with the subscription manager, an agent application program interface communicating with the subscription manager and an integrity manager communicating with the subscription manager, the collector application program interface and the agent application program interface allowing the endpoint agent to communicate with endpoint collectors;

receiving, at the endpoint core, an event subscription request from the endpoint agent over a message bus; and

managing, by the endpoint core, communication of events for processing by the endpoint agent based on the event subscription request so that events to which the endpoint agent has subscribed are selectively processed at the endpoint agent, wherein

said managing is performed using an event filter of the endpoint core configured to place only events associated with the event subscription request from the endpoint device on the message bus and the subscription manager of the endpoint core configured to distribute events associated with the event subscription request received from one or more endpoint collectors to the endpoint agent;

said managing includes checking integrity of files implementing the endpoint agent and checking integrity of files being loaded on the endpoint device, said checking integrity of files implement the endpoint agent and checking integrity of files being loaded on the endpoint device being performed by the integrity manager;

the endpoint core, endpoint agent, and one or more endpoint collectors cooperate with one another as resources of a unified endpoint system; and

the endpoint core dynamically reconfigures at least one of the endpoint collectors and the endpoint agent during operation of the endpoint device to prevent at least one of overutilization and underutilization of the resources of the unified endpoint system.

2. The computer-implemented method of claim 1 , wherein the method further comprises:

receiving events from one or more endpoint collectors over the message bus, wherein the events received from the one or more endpoint collectors are selectively processed by the endpoint agent based on events to which the endpoint agent has subscribed at the endpoint core.

3. The computer-implemented method of claim 2 , wherein at least one of the endpoint collectors includes multiple sensors, and wherein the method further comprises:

communicating with the endpoint collector having at least one sensor to selectively enable at least one or more sensors.

4. The computer-implemented method of claim 2 , wherein the method further comprises:

updating files used to implement the endpoint agent; and

updating files used to implement the one or more endpoint collectors.

5. The computer-implemented method of claim 1 , wherein the method further comprises:

communicating with the endpoint agent over the message bus through an endpoint agent API; and

communicating with one or more collectors over the message bus through an endpoint collector API.

6. The computer-implemented method of claim 1 , wherein the method further comprises:

operating the endpoint core to execute initial configuration of the endpoint agent and one or more endpoint collectors over the message bus; and

operating the endpoint core to dynamically reconfigure at least one of the endpoint collectors and the endpoint agent during operation of the endpoint device.

7. A system comprising:

a processor;

a data bus coupled to the processor; and

a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:

providing the endpoint device with an endpoint agent, the endpoint device and the endpoint agent providing a protected endpoint, the protected endpoint comprising the endpoint core, the endpoint core comprising a subscription manager, a collector application program interface communicating with the subscription manager, an agent application program interface communicating with the subscription manager and an integrity manager communicating with the subscription manager, the collector application program interface and the agent application program interface allowing the endpoint agent to communicate with endpoint collectors;

receiving, at an endpoint core, an event subscription request from the endpoint agent over a message bus; and

managing, at the endpoint core, communication of events for processing by the endpoint agent based on the event subscription request so that events to which the endpoint agent has subscribed are selectively processed at the endpoint agent, wherein

said managing is performed using an event filter of the endpoint core configured to place only certain events associated with the endpoint device on the message bus and the subscription manager of the endpoint core configured to distribute subscribed events received from one or more endpoint collectors to the endpoint agent;

said managing includes checking integrity of files implementing the endpoint agent and checking integrity of files being loaded on the endpoint device, said checking integrity of files implement the endpoint agent and checking integrity of files being loaded on the endpoint device being performed by the integrity manager;

the endpoint core, endpoint agent, and one or more endpoint collectors cooperate with one another as resources of a unified endpoint system; and

the endpoint core dynamically reconfigures at least one of the endpoint collectors and the endpoint agent during operation of the endpoint device to prevent at least one of overutilization and underutilization of the resources of the unified endpoint system.

8. The system of claim 7 , wherein the instructions are further configured for:

receiving events from one or more endpoint collectors over the message bus at the endpoint core, wherein the events received from the one or more endpoint collectors are selectively processed by the endpoint agent based on events to which the endpoint agent has subscribed at the endpoint core.

9. The system of claim 8 , wherein at least one of the one or more endpoint collectors includes multiple sensors, and wherein the instructions are further configured for:

operating the endpoint core to communicate with the endpoint collector having at least one sensor to selectively enable one or more sensors.

10. The system of claim 8 , wherein the instructions are further configured to operate the endpoint core for executing operations including:

updating files used to implement the endpoint agent; and

updating files used to implement the one or more endpoint collectors.

11. The system of claim 7 , wherein the instructions are further configured for:

operating the endpoint core to communicate with the endpoint agent over the message bus through an endpoint agent API; and

operating the endpoint core to communicate with one or more collectors over the message bus through an endpoint collector API.

12. The system of claim 7 , wherein the instructions are further configured for:

operating the endpoint core to execute initial configuration of the endpoint agent and one or more endpoint collectors over the message bus; and

operating the endpoint core to dynamically reconfigure at least one of the endpoint collectors and/or the endpoint agent during operation of an endpoint device having the endpoint core, the one or more endpoint collectors, and endpoint agent.

13. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:

providing the endpoint device with an endpoint agent, the endpoint device and the endpoint agent providing a protected endpoint, the protected endpoint comprising the endpoint core, the endpoint core comprising a subscription manager, a collector application program interface communicating with the subscription manager, an agent application program interface communicating with the subscription manager and an integrity manager communicating with the subscription manager, the collector application program interface and the agent application program interface allowing the endpoint agent to communicate with endpoint collectors;

receiving, at an endpoint core, an event subscription request from endpoint agent over a message bus; and

managing, at the endpoint core, communication of events for processing by the endpoint agent based on the event subscription request so that events to which the endpoint agent has subscribed are selectively processed at the endpoint agent, wherein

said managing is performed using an event filter of the endpoint core configured to place only certain events associated with the endpoint device on the message bus and the subscription manager of the endpoint core configured to distribute subscribed events received from one or more endpoint collectors to the endpoint agent;

said managing includes checking integrity of files implementing the endpoint agent and checking integrity of files being loaded on the endpoint device, said checking integrity of files implement the endpoint agent and checking integrity of files being loaded on the endpoint device being performed by the integrity manager;

the endpoint core, endpoint agent, and one or more endpoint collectors cooperate with one another as resources of a unified endpoint system; and

the endpoint core dynamically reconfigures at least one of the endpoint collectors and the endpoint agent during operation of the endpoint device to prevent at least one of overutilization and underutilization of the resources of the unified endpoint system.

14. The non-transitory, computer-readable storage medium of claim 13 , wherein the instructions are further configured for:

receiving events from one or more endpoint collectors over the message bus at the endpoint core, wherein the events received from the one or more endpoint collectors are selectively processed by the endpoint agent based on events to which the endpoint agent has subscribed at the endpoint core.

15. The non-transitory, computer-readable storage medium of claim 14 , wherein at least one of the one or more endpoint collectors includes multiple sensors, and wherein the instructions are further configured for:

operating the endpoint core to communicate with the endpoint collector having at least one sensor to selectively enable one or more sensors.

16. The non-transitory, computer-readable storage medium of claim 14 , wherein the instructions are further configured for operating the endpoint core to execute operations including:

updating files used to implement the endpoint agent; and

updating files used to implement the one or more endpoint collectors.

17. The non-transitory, computer-readable storage medium of claim 13 , wherein the instructions are further configured for:

operating the endpoint core to execute initial configuration of the endpoint agent and one or more endpoint collectors over the message bus; and

operating the endpoint core to dynamically reconfigure at least one of the endpoint collectors and the endpoint agent during operation of an endpoint device having the endpoint core, the one or more endpoint collectors, and endpoint agent.

Assignments (8)