Method and system for a network management console

• US 20050198323A1
• Filed: 03/06/2003
• Published: 09/08/2005
• Est. Priority Date: 03/06/2002
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Schenkel, Dvid, Ramaswamy, Arvind, Slavitch, Michael
• Granted Patent: US 8,676,972 B2
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A method and a system for identifying unauthorized accesses to a data network service by a particular node in a data network is disclosed. The NMC communicates with an agent periodically to gather a list of users of the service node. An agent is installed on the service node to monitor all network accesses to the service. By configuring the agent to monitor all access to the service node, through SNMP or a similar protocol, the agent maintains a list of all accesses to that service node. This list is stored internally by the agent and queried for by the NMC periodically. The access information stored by the agent is periodically retrieved by the NMC for all monitored nodes and compared with the authorization list for the node. If unauthorized accesses are found, they are identified by the NMC. These unauthorized accesses can be notified to the appropriate entity in a number of ways such as through paging, email or a report viewable through the NMC.

Claims

1. A data network management system for identifying unauthorized access to a data network service, provided at a service node in a data network, by a user node in said data network, said service node having an agent and having means for maintaining a user access list, said user access list having at least one data network address corresponding to at least one user node in said data network, said system comprising:

a data communication means for periodically polling said agent at said service node and for retrieving a user access list from said agent;

a database for maintaining an authorized access list for said service node; and

a data processing means for comparing said user access list to said authorized user access list and for updating said authorized user access list, said authorized user access list being maintained in said database, an updated authorized user access list based on an updated user access list for said agent.

2. The data network management system as defined in claim 1, wherein said agent is a Simple Network Management Protocol agent.

3. The data network management system as defined in claim 1, wherein said data communication means is a Simple Network Management Protocol communication means.

4. The data network management system as defined in claim 1, further including means for installing said agent at said service node, said agent having means to communicate with said data communication means.

19. The data network as defined in claim 1, wherein said authorized user access list is a common authorized user access list, and wherein said common authorization user access list includes a range of user nodes for comparing to said user access list to determine if said user access list is a subset of said common authorization user access list.

5. A method for identifying unauthorized access to a data network service, provided at a service node in a data network, by a user node in said data network, said service node having an agent and having means for maintaining a user access list, said user access list having at least one data network address corresponding to at least one user node in said data network, said steps comprising:

a) periodically polling an agent and retrieving said user access list, for a given period of time, from said service node in said data network;

b) comparing said user access list to an authorized access list;

c) determining if said unauthorized access occurred based on said comparison step b);

d) if determined that said unauthorized access occurred in step c), initiating a notification process.

6. The method as defined in claim 5, further including a step of updating said authorized access list based on an updated user access list provided by said agent.

7. The method as defined in claim 5, further including a step of installing said agent at said user node, prior to periodically polling and retrieving said user access list in step a).

8. The method as defined in claim 5, further including a step of selecting said service node for identification based on a predetermined criteria, prior to retrieving said user access list in step a).

9. The method as defined in claim 5, wherein said notification process further including a step of notifying a Network Operations Console.

10. The method as defined in claim 5, wherein steps a) through c) are repeated, and wherein said user node is selected from one of a plurality of user nodes in said data network.

11. The method as defined in claim 5, wherein steps a) through d) are repeated, and wherein said user node is selected from one of a plurality of user nodes in said data network.

12. The method as defined in claim 5, wherein said agent is a Simple Network Management Protocol agent.

13. A computer-readable medium for identifying unauthorized access to a data network service, provided at a service node in a data network, by a user node in said data network, said service node having an agent and having means for maintaining a user access list, said user access list having at least one data network address corresponding to at least one user node in said data network, and said medium having stored thereon, computer-readable and computer-executable instructions which, when executed by a processor, cause said processor to perform steps comprising:

a) periodically polling an agent and retrieving said user access list, for a given period of time, from said service node in a data network;

b) comparing said user access list to an authorized access list;

c) determining if said unauthorized access occurred based on said comparison step b);

d) if determined that said unauthorized access occurred in step c), initiating a notification process.

14. The computer-readable medium as defined in claim 13, further containing computer-readable and computer-executable instructions which perform a step of updating said authorized access list based on user access information.

15. The computer-readable medium as defined in claim 13, further containing computer-readable and computer-executable instructions which perform a step of installing said agent at said user node, prior to retrieving said user access list in step a).

16. The computer-readable medium as defined in claim 13, further containing computer-readable and computer-executable instructions wherein said steps a) through c) are repeated, and wherein said user node is selected from one of a plurality of user nodes in said data network.

17. The computer-readable medium as defined in claim 13, wherein said agent is a Simple Network Management Protocol agent.

18. A computer for use in a data network for identifying unauthorized access to a data network service, provided at a service node in a data network, by a user node in said data network, said service node having an agent and having means for maintaining a user access list, said user access list having at least one data network address corresponding to at least one user node in said data network, said computer comprising:

a storage means;

a central processing unit;

a data communication means for periodically polling said agent at said service node and retrieving a user access list from said agent;

said storage means having a database for maintaining an authorized access list for said service node; and

a data processing means for comparing said user access list to said authorized user access list and for updating said authorized user access list, said authorized user access list being maintained in said database, an updated authorized user access list based on an updated user access list for said agent.