System and method for securely monitoring and managing network devices

• US 20040230677A1
• Filed: 09/22/2003
• Published: 11/18/2004
• Est. Priority Date: 05/16/2003
• Status: Abandoned Application

• Current Assignee: JP Morgan Chase Bank, N.A. (JP Morgan Chase & Co)
• Original Assignee: JP Morgan Chase Bank, N.A. (JP Morgan Chase & Co)
• Inventors: OʼHara, Roger John
• Application Number:
  US10/667,752
• Publication Number:
  US 20040230677A1
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0859 by keeping history of different configuration generations or by rolling back to previous configuration versions
• CPC Class Codes: H04L 41/0863 by rolling back to previous configuration versions
• CPC Class Codes: H04L 41/0869 Validating the configuration within one network element
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system and method isolates a network management system from the network components that it monitors and controls. A network management system is connected to a port other than the network port of the network components via a terminal server. The terminal server performs translations between communications to and from the serial ports and communications to and from the network management system. In this manner, connectivity between the management device and the network components is through a protocol which is not networkable, routable or both by the managed network device.

Claims

1. A method for securely managing and monitoring a data network, said data network comprising a plurality of network components, said method comprising:

connecting a network management system to a non-network port of each of said network components;

managing each of said network components through said non-network port; and

monitoring each of said network components through said non-network port.

2. A method in accordance with claim 1 wherein connecting a network management system to a non-network port of each of said plurality of network components comprises:

connecting a network management system to a terminal server; and

connecting said terminal server to said non-network port of each of said network components.

3. A method in accordance with claim 2 further including establishing communication between said network management system and said terminal server via TCP/IP.

4. A method in accordance with claim 2 further including establishing communication between said terminal server and said plurality of network components via TCP/IP.

5. A method in accordance with claim 1 wherein said network management system includes a configuration manager, said method further comprising:

configuring said plurality of network components from said configuration manager through said non-network port of each of said network components.

6. A method in accordance with claim 1 wherein monitoring each of said network components comprises polling each of said network components.

7. A method in accordance with claim 1 wherein said network management system includes a system monitor, said method further comprising:

monitoring each of said plurality of network components by said system monitor.

8. A method in accordance with claim 7 wherein monitoring each of said plurality of network components by said system monitor comprise:

polling each of said network components by said system monitor.

9. A method in accordance with claim 1 wherein a terminal server is connected between said network management system and said plurality of network components and wherein said step of monitoring each of said plurality of network components comprises:

polling each of said plurality of network components by said terminal server responsive to said system monitor.

10. A method in accordance with claim 1 further comprising:

initiating communication between said network management system and said plurality of network components only from said network management system.

11. An apparatus for secure monitoring of network components in a data network comprising:

a plurality of network components, each of said plurality of network components having a data network port connected to said data network and each of said plurality of network components having a non-network port; and

a network management system connected to each of said plurality of network components at said non-network port and configured so that only said network management system may initiate communication with said plurality of network components.

12. An apparatus in accordance with claim 11 wherein said network management system is configured to poll each of said plurality of network components.

13. An apparatus in accordance with claim 11 further including a terminal server connected between said network management system and said plurality of network components.

14. An apparatus in accordance with claim 13 wherein said terminal server is configured to poll said plurality of network components.

15. An apparatus in accordance with claim 11 wherein said data network ports comprise serial ports.

16. An apparatus in accordance with claim 11 wherein said data network ports comprise RS232 ports.