Privilege assurance of computer network environments
A system and method for privilege assurance protection of computer networks that remedies the deficiencies of the current directory service structure. The system uses a software agent to collect and store snapshots of all network resources on a computer network by identifying network domains, searching the directory service of each domain for network resources, and periodically querying the network resources for changes. The software agent communicates with a backend server which provides searching, querying, storage, administrative and other functionality to the agent via remote procedure calls.
1 . A system for privilege assurance protection of computer networks operating a directory service, comprising:
a software agent comprising a first plurality of programming instructions stored in a memory of, and operating on a processor of, a first computing device within a computer network operating a directory service, wherein the first plurality of programming instructions, when operating on the processor of the first computing device, causes the first computing device to:
search the directory service to identify a plurality of network resources operating on the computer network;
periodically query the plurality of network resources for network information, the network information comprising device identifiers and configuration parameters;
receive responses to the queries from the plurality of network resources, the responses comprising the network information;
send the responses to a backend server for storage in a database;
for each periodic query, create a current state of the plurality of network resources from the responses, the current state comprising either an initial state of the plurality of network resources or differences from a previous state of the plurality of network resources relative to the current state, wherein the differences from the previous state of the plurality of network resources relative to the current state are determined using a highest committed update sequence number (USN) obtained from the directory service before the periodic query is performed; and
send the current state of the plurality of network resources to the backend server for storage in the database; and
the backend server comprising a second plurality of programming instructions stored in a memory of, and operating on a processor of, a second computing device, wherein the second plurality of programming instructions, when operating on the processor of the second computing device, causes the second computing device to:
receive the responses from each periodic query and store the responses them in the database; and
receive the current stte from each periodic query and store the current state it in the database;
wherein the computer network comprises a plurality of domains in a hierarchy having a master domain and one or more sub-domains,
wherein the software agent is installed and operated on a top-level domain of the hierarchy, and
wherein the software agent monitors the plurality of network resources separately for each domain.
2 . The system of claim 1 , wherein communications between the software agent and the backend server are facilitated by remote procedure calls, wherein the software agent makes the remote procedure calls to the backend server, and the methods associated with the remote procedure calls are stored on, and executed by, the backend server.
3 . The system of claim 2 , wherein each remote procedure call by the software agent includes credentials of the software agent contained in metadata of the remote procedure call.
4 . The system of claim 1 , wherein the initial state, current state, and previous state are created and stored as cookies.
5 . The system of claim 1 , wherein the search of the directory service to identify a plurality of network resources includes searching for deleted network resources.
6 . The system of claim 1 , wherein the computer network comprises a plurality of domains, each comprising a directory service and some of the network resources, and the software agent monitors the network resources separately for each domain.
7 . The system of claim 1 , wherein the computer network comprises a plurality of domains, each comprising a directory service and some of the network resources, and a separate software agent is installed on and monitors the network resources separately for each domain.
8 . A method for privilege assurance protection of computer networks operating a directory service, comprising the steps of:
using a software agent operating on a first computing device within a computer network to:
search the directory service to identify a plurality of network resources operating on the computer network;
periodically query the plurality of network resources for network information, the network information comprising device identifiers and configuration parameters;
receive responses to the queries from the plurality of network resources, the responses comprising the network information;
send the responses to a backend server for storage in a database;
for each periodic query, create a current state of the plurality of network resources from the responses, the current state comprising either an initial state of the plurality of network resources or differences from a previous state of the plurality of network resources relative to the current state, wherein the differences from the previous state of the plurality of network resources relative to the current state are determined using a highest committed update sequence number (USN) obtained from the directory service before the periodic query is performed; and
send the current state of the plurality of network resources to the backend server for storage in the database; and
using the backend server operating on a second computing device to:
receive the responses from each periodic query and store the responses in the database; and
receive the current state from each periodic query and store the current state in the database;
wherein the computer network comprises a plurality of domains in a hierarchy having a master domain and one or more sub-domains,
wherein the software agent is installed and operated on a top-level domain of the hierarchy, and
wherein the software agent monitors the network resources separately for each domain.
9 . The method of claim 8 , wherein communications between the software agent and the backend server are facilitated by remote procedure calls, wherein the software agent makes the remote procedure calls to the backend server, and the methods associated with the remote procedure calls are stored on, and executed by, the backend server.
10 . The method of claim 9 , wherein each remote procedure call by the software agent includes credentials of the software agent contained in the metadata of the remote procedure call.
11 . The method of claim 8 , wherein the initial state, current state, and previous state are created and stored as cookies.
12 . The method of claim 8 , wherein the search of the directory service to identify a plurality of network resources includes searching for deleted network resources.
13 . The method of claim 8 , wherein the computer network comprises a plurality of domains, each comprising a directory service and some of the network resources, and the software agent monitors the network resources separately for each domain.
14 . The method of claim 8 , wherein the computer network comprises a plurality of domains, each comprising a directory service and some of the network resources, and a separate software agent is installed on and monitors the network resources separately for each domain.