Method and apparatus for distributing and activating security parameters

• US 20040123130A1
• Filed: 12/20/2002
• Published: 06/24/2004
• Est. Priority Date: 12/20/2002
• Status: Abandoned Application

• Current Assignee: Computer Network Technology Corp. (Broadcom, Inc.)
• Original Assignee: Inrange Technologies Corporation (Broadcom, Inc.)
• Inventors: Dani, Pankaj, Mathur, Akshay
• Application Number:
  US10/324,015
• Publication Number:
  US 20040123130A1
• Time in Patent Office: Days
• US Class Current: 713/200
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 49/65 Re-configuration of fast packet switches
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An apparatus and method for distributing and activating a new security parameter in a computer network in a non-disruptive manner includes transmitting a new security parameter to the an element in the network, instructing the element to place the new security element in a pending database of the element and activating the new security parameter. The present invention also determines possible conflicts in the computer network.

Claims

1. A method for non-disruptively distributing and activating security parameters in computer network, comprising the steps of:

sending a new security parameter to an element in the computer network;

placing the new security parameter in an active database of the element; and

activating the new security parameter.

2. The method as in claim 1, wherein the element is a switch.

3. The method as in claim 2, further comprising transmitting the security parameter to a network endpoint element in response to the switch receiving the new security parameter.

4. The method as in claim 1, wherein the new security parameter is stored in a pending database of the element.

5. The method as in claim 3, wherein the new security parameter is stored in a pending database of the network endpoint element.

6. The method as in claim 3, wherein the switch, in response to receiving an activate command, distributes the activate command to the network endpoint element.

7. The method as in claim 1, wherein the step of activating the new security command comprises exchanging security capability parameters (ESCP) among elements in the computer network.

8. The method as in claim 7, wherein if the ESCP is successful, then the elements exchange a network element list.

9. The method as in claim 7, wherein if the ESCP is not successful, then a link is shut down.

10. The method as in claim 9, wherein the link is a Inter Switch Link.

11. The method as in claim 8, wherein if the network element list is not successful, then a link will shut down.

12. The method as in claim 1, further comprising setting the new security parameter.

13. The method as in claim 12, further comprising determining a current security parameter of the element in the computer network.

14. The method as in claim 13, further comprising identifying any potential conflict.

15. The method as in claim 13, further comprising identifying a new inter switch link in the computer network.

16. The method as in claim 15, further comprising exchanging security capability parameters (ESCP) among elements in the computer network.

17. The method as in claim 16, wherein if the ESCP is successful, then the elements exchange a network element list.

18. The method as in claim 7, wherein if the ESCP is not successful, then the new inter switch link is shut down.

19. An apparatus for non-disruptively distributing and activating security parameters in computer network, comprising:

means for sending a new security parameter to an element in the computer network;

means for placing the new security parameter in a means for storing located in the element; and

means for activating the new security parameter.

20. The apparatus as in claim 19, further comprising means for transmitting the security parameter to a network endpoint element in response to a switch receiving the new security parameter.

21. The apparatus as in claim 19, wherein the means for storing is a pending database.

22. An apparatus for distributing and activating a security parameter in computer network, comprising:

a security parameter generator, which comprises generating a security capability parameter and network element list;

a transmitter linked to the security parameter generator;

a instructor linked to the transmitter, wherein the instructor generates and instruction concerning the new security parameter; and

an activator linked to the transmitter, wherein the activator transmits a command to initialize the new security parameter.

23. The apparatus as in claim 22, wherein the instruction is to commit the new security parameter.

24. The apparatus as in claim 22, further comprising a determintor linked to the transmitter.

25. The apparatus as in claim 24, wherein the determinator determines the computer network topology.

26. The apparatus as in claim 24, wherein the determinator determines a current security parameter.

27. A computer readable medium containing executable code comprising:

sending a new security parameter to an element in a computer network;

placing the new security parameter in an active database of the element; and

activating the new security parameter.

28. The computer readable medium as in claim 27, wherein the element is a switch.

29. The computer readable medium as in claim 28, further comprising transmitting the security parameter to a network endpoint element in response to the switch receiving the new security parameter.

30. The computer readable medium as in claim 27, wherein the new security parameter is stored in a pending database of the element.

31. The computer readable medium as in claim 29, wherein the new security parameter is stored in a pending database of the network endpoint element.

32. The computer readable medium as in claim 29, wherein the switch, in response to receiving an activate command, distributes the activate command to the network endpoint element.

33. The computer readable medium as in claim 27, wherein the step of activating the new security command comprises exchanging security capability parameters (ESCP) among elements in the computer network.

34. The computer readable medium as in claim 33, wherein if the ESCP is successful, then the elements exchange a network element list.

35. The computer readable medium as in claim 33, wherein if the ESCP is not successful, then a link is shut down.

36. The computer readable medium as in claim 34, wherein if the network element list is not successful, then a link will shut down.

37. The computer readable network as in claim 27, wherein the computer network is fiber channel network.