Secure management script deployment

Patent metadata

Field	Value
Publication number	US-11734438-B2
Application number	US-202017086177-A
Country	US
Kind code	B2
Filing date	Oct 30, 2020
Priority date	Oct 30, 2020
Publication date	Aug 22, 2023
Grant date	Aug 22, 2023

Abstract

An indication is received to initiate a resource discovery process of a client system. The client system includes resources to be discovered and the resource discovery process is associated with a script. A connection is made from a management server to the client system with a first level of security privileges of the client system. The client system is provided with an encapsulation program for an execution of the script. The encapsulation program is configured to determine ownership information of the script. The encapsulation program is also configured to cause the execution of the script on the client system with modified security privileges corresponding to the ownership information of the script rather than the first level of security privileges of the client system.

First claim

What is claimed is:

1. A method, comprising:
receiving an indication to initiate a resource discovery process of a client system, wherein the client system includes resources to be discovered, and wherein the resource discovery process is associated with a script;
connecting from a management server to the client system with a first level of security privileges of the client system;
providing to the client system an encapsulation program for an execution of the script, wherein the encapsulation program is configured to: determine ownership information of the script, identify an execution command of the script, determine ownership information of the execution command of the script, and cause an execution of the execution command with modified security privileges corresponding to the ownership information of the execution command different from the first level of security privileges of the client system; and
tracking the modified security privileges associated with the execution of the execution command including by:
receiving a record of the modified security privileges associated with the execution of the execution command; and
storing the received record of the modified security privileges associated with the execution of the execution command.

2. The method of claim 1 , further comprising:
receiving a description of the resources of the client system at the management server; and
storing the received description of the resources of the client system.

3. The method of claim 1 , wherein the script is a custom discovery script, and wherein the custom discovery script includes execution requests for a plurality of commands on the client system.

4. The method of claim 1 , wherein the first level of security privileges of the client system are administrative security privileges.

5. The method of claim 1 , wherein the first level of security privileges of the client system includes more privileges than the modified security privileges corresponding to the ownership information of the execution command.

6. The method of claim 1 , further comprising removing the provided encapsulation program from the client system.

7. The method of claim 1 , further comprising uploading the script to the client system.

8. The method of claim 1 , further comprising providing to the client system a network location of the script for the client system to retrieve.

9. The method of claim 1 , further comprising initiating deletion of the script from the client system.

10. The method of claim 1 , wherein the encapsulation program is configured to intercept a plurality of execution commands of the script.

11. The method of claim 10 , wherein the encapsulation program is configured to: parse the script to identify the execution command of the script.

12. The method of claim 1 , wherein the ownership information of the execution command includes a user identifier and a group identifier.

13. The method of claim 12 , wherein the encapsulation program is configured to:
spawn a new process, wherein the new process is configured using the user identifier associated with the ownership information of the execution command.

14. The method of claim 1 , wherein the ownership information of the execution command includes a path location of the execution command.

15. The method of claim 1 , wherein security privileges corresponding to the ownership information of the script includes more privileges than the modified security privileges corresponding to the ownership information of the execution command.

16. The method of claim 1 , further comprising verifying a digital signature of the script.

17. A system, comprising:
one or more processors; and
a memory coupled to the one or more processors, wherein the memory is configured to provide the one or more processors with instructions which when executed cause the one or more processors to:
receive an indication to initiate a resource discovery process of a client system, wherein the client system includes resources to be discovered, and wherein the resource discovery process is associated with a script;
connect from a management server to the client system with a first level of security privileges of the client system;
provide to the client system an encapsulation program for an execution of the script, wherein the encapsulation program is configured to: determine ownership information of the script, identify an execution command of the script, determine ownership information of the execution command of the script, and cause an execution of the execution command with modified security privileges corresponding to the ownership information of the execution command different from the first level of security privileges of the client system; and
track the modified security privileges associated with the execution of the execution command including by being configured to:
receive a record of the modified security privileges associated with the execution of the execution command; and
store the received record of the modified security privileges associated with the execution of the execution command.

18. The system of claim 17 , wherein the first level of security privileges of the client system are administrative security privileges.

19. The system of claim 17 , wherein the first level of security privileges of the client system includes more privileges than the modified security privileges corresponding to the ownership information of the execution command.

20. A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
receiving an indication to initiate a resource discovery process of a client system, wherein the client system includes resources to be discovered, and wherein the resource discovery process is associated with a script;
connecting from a management server to the client system with a first level of security privileges of the client system;
providing to the client system an encapsulation program for an execution of the script, wherein the encapsulation program is configured to: determine ownership information of the script, identify an execution command of the script, determine ownership information of the execution command of the script, and cause an execution of the execution command with modified security privileges corresponding to the ownership information of the execution command different from the first level of security privileges of the client system; and
tracking the modified security privileges associated with the execution of the execution command including by:
receiving a record of the modified security privileges associated with the execution of the execution command; and
storing the received record of the modified security privileges associated with the execution of the execution command.

Assignees

• Servicenow Inc

Inventors

• Talmat Mohamed Sofiane

Classifications

• G06F21/6209 Primary

  to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself · CPC title

• G06F8/62

  Uninstallation · CPC title

• H04L9/3247

  involving digital signatures · CPC title

• G06F2221/2101

  Auditing as a secondary aspect · CPC title

• G06F21/606 Primary

  by securing the transmission between two devices or processes · CPC title