Granted Patent B2

US 10,715,556 · App. 16/208,237 · Granted Jul 14, 2020

Abstract

Claims (41)

1. A domain master for a data exchange layer (DXL), comprising:

a hardware platform configured to execute instructions; and

one or more memories having stored thereon instructions to instruct the hardware platform to:

communicatively couple to the DXL;

provide a DXL messaging service comprising native support for request-response (1:1) transactions via a publish-subscribe (1:N, N>1) fabric;

provide DXL domain master services for a DXL domain; and

provide DXL-based real-time policy and task distribution for DXL endpoints of the DXL domain.

2. The domain master of claim 1 , wherein providing real-time policy and task distribution comprises:

identifying a policy update driver;

configuring a policy update according to the policy update driver; and

publishing the policy update as a DXL message.

3. The domain master of claim 2 , wherein the DXL message is a command-level DXL message.

4. The domain master of claim 2 , wherein the DXL message includes DXL metadata to target the DXL message to DXL endpoints.

5. The domain master of claim 2 , wherein identifying a policy update driver comprises receiving a malware or threat identification from a threat intelligence service.

6. The domain master of claim 2 , wherein identifying a policy update driver comprises independently identifying a policy update need.

7. The domain master of claim 2 , wherein identifying a policy update driver comprises receiving a policy update from a domain administrator.

8. One or more tangible, non-transitory computer-readable mediums having stored thereon executable instructions that when executed instruct a processor to:

communicatively couple to a data exchange layer (DXL);

provide a DXL messaging layer for communicating with the DXL, the DXL messaging layer configured to support request-response (1:1) transactions over a publish-subscribe (1:N, N>1) fabric;

act as a domain master for a DXL domain; and

distribute real-time policy and task updates to the DXL domain.

9. The one or more tangible, non-transitory computer-readable mediums of claim 8 , wherein distributing real-time policy and task updates comprises:

identifying a policy update driver;

configuring a policy update according to the policy update driver; and

publishing the policy update as a DXL message.

10. The one or more tangible, non-transitory computer-readable mediums of claim 9 , wherein the DXL message is a command-level DXL message.

11. The one or more tangible, non-transitory computer-readable mediums of claim 9 , wherein the DXL message includes DXL metadata to target the DXL message to DXL endpoints.

12. The one or more tangible, non-transitory computer-readable mediums of claim 9 , wherein identifying a policy update driver comprises receiving a malware or threat identification from a threat intelligence service.

13. The one or more tangible, non-transitory computer-readable mediums of claim 9 , wherein identifying a policy update driver comprises independently identifying a policy update need.

14. The one or more tangible, non-transitory computer-readable mediums of claim 9 , wherein identifying a policy update driver comprises receiving a policy update from a domain administrator.

15. A method of providing real-time policy and task updates to a data exchange layer (DXL) domain, comprising:

communicatively coupling to a data exchange layer (DXL), wherein the DXL is configured to natively support request-response (1:1) transactions over a publish-subscribe (1:N, N>1) fabric;

identifying as a domain master for the DXL domain;

identifying a policy update driver;

configuring a policy update according to the policy update driver; and

publishing the policy update as a DXL message.

16. The method of claim 15 , wherein the DXL message is a command-level DXL message.

17. The method of claim 15 , wherein the DXL message includes DXL metadata to target the DXL message to DXL endpoints.

18. The method of claim 15 , wherein identifying a policy update driver comprises receiving a malware or threat identification from a threat intelligence service.

19. The method of claim 15 , wherein identifying a policy update driver comprises independently identifying a policy update need.

20. The method of claim 15 , wherein identifying a policy update driver comprises receiving a policy update from a domain administrator.

Assignments (13)