Method and apparatus for providing temporary access to a network device

• US 20050268345A1
• Filed: 05/26/2005
• Published: 12/01/2005
• Est. Priority Date: 05/29/2004
• Status: Active Grant

• Current Assignee: IronPort Systems Inc (Cisco Systems, Inc.)
• Original Assignee: IronPort Systems Inc (Cisco Systems, Inc.)
• Inventors: Harrison, Robert Brian, Cottrell, Ben, Clegg, Paul J., Jasinskyj, Lonhyn
• Granted Patent: US 8,166,310 B2
• Time in Patent Office: Days
• US Class Current: 726/27
• CPC Class Codes: G06F 21/305 by remotely controlling device operation
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/104 Grouping of entities

Abstract

A method and apparatus for providing access to resources of a network device is provided. A user instructs a network device to generate a user password that is concealed from the user of the network device. The network device generates the user password based on, at least in part, public input provided by the user, and an algorithm which is concealed from the user, but known to a support service provider. The user communicates the public input to the support service provider. The support service provider uses the public input to generate a provider password based on, at least in part, the algorithm. The support service provider may access the network device via a network by providing the provider password to the network device. If the provider password matches the user password generated, then the support service provider is granted access to resources of the network device.

Claims

1. A machine-implemented method for providing access to resources of a network device, the method comprising:

receiving input from a first user;

generating a first password for said resources of said network device based on, at least in part, (a) said input, and (b) an algorithm, wherein said algorithm is concealed from said first user, and wherein said first password is concealed from said first user;

receiving a second password from a second user, wherein said second password is generated based on, at least in part, (a) said input, and (b) said algorithm, wherein said algorithm is known to said second user, and wherein said second password is concealed from said first user;

determining whether said first password matches said second password; and

in response to determining that said first password matches said second password, providing said second user with access to said resources of said network device.

2. The method of claim 1, wherein the generation of said first password and the generation of said second password are both based on, at least in part, on (a) a set of data concealed from said first user but known to said second user, or (b) an identifier that uniquely identifies said network device.

3. The method of claim 1, further comprising:

receiving, from said first user, validity data that identifies a period of time in which said first password is valid, and

wherein said step of determining whether said first password matches said second password comprises;

determining whether said period of time has expired; and

in response to determining that said period of time has expired, denying access to said second user.

4. The method of claim 1, further comprising:

receiving a request, from said first user, to perform one action selected from the group comprising (a) generating a new password for said resources of said network device and (b) resetting or canceling said first password.

5. The method of claim 4, further comprising:

in response to said first user performing said action, preventing said second user from obtaining access to said resources of said network device using a password that matches said first password.

6. The method of claim 1, further comprising:

transmitting, from said first user to said second user, said input and an identifier that uniquely identifies said network device.

7. The method of claim 1, further comprising:

maintaining a list of passwords previously generated for said resources of said network device; and

comparing said first password against said list of passwords to determine if said first password has been previously generated.

8. The method of claim 1, further comprising:

comparing said input to a password of said first user to ensure that said input is not similar to said password.

9. The method of claim 1, further comprising:

upon expiration of said first password, revoking access to an open connection provided to a user that supplied a password that matched said first password.

10. A machine-readable medium carrying one or more sequences of instructions for providing access to resources of a network device, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform the steps of:

receiving input from a first user;

generating a first password for said resources of said network device based on, at least in part, (a) said input, and (b) an algorithm, wherein said algorithm is concealed from said first user, and wherein said first password is concealed from said first user;

receiving a second password from a second user, wherein said second password is generated based on, at least in part, (a) said input, and (b) said algorithm, wherein said algorithm is known to said second user, and wherein said second password is concealed from said first user;

determining whether said first password matches said second password; and

in response to determining that said first password matches said second password, providing said second user with access to said resources of said network device.

11. The machine-readable medium of claim 10, wherein the generation of said first password and the generation of said second password are both based on, at least in part, on (a) a set of data concealed from said first user but known to said second user, or (b) an identifier that uniquely identifies said network device.

12. The machine-readable medium of claim 10, wherein execution of the one or more sequences of instructions by the one or more processors further causes the one or more processors to perform the steps of:

receiving, from said first user, validity data that identifies a period of time in which said first password is valid, and

wherein said step of determining whether said first password matches said second password comprises;

determining whether said period of time has expired; and

in response to determining that said period of time has expired, denying access to said second user.

13. The machine-readable medium of claim 10, wherein execution of the one or more sequences of instructions by the one or more processors further causes the one or more processors to perform the step of:

receiving a request, from said first user, to perform one action selected from the group comprising (a) generating a new password for said resources of said network device and (b) resetting or canceling said first password.

14. The machine-readable medium of claim 13, wherein execution of the one or more sequences of instructions by the one or more processors further causes the one or more processors to perform the step of:

in response to said first user performing said action, preventing said second user from obtaining access to said resources of said network device using a password that matches said first password.

15. The machine-readable medium of claim 10, wherein execution of the one or more sequences of instructions by the one or more processors further causes the one or more processors to perform the step of:

transmitting, from said first user to said second user, said input and an identifier that uniquely identifies said network device.

16. The machine-readable medium of claim 10, wherein execution of the one or more sequences of instructions by the one or more processors further causes the one or more processors to perform the steps of:

maintaining a list of passwords previously generated for said resources of said network device; and

comparing said first password against said list of passwords to determine if said first password has been previously generated.

17. The machine-readable medium of claim 10, wherein execution of the one or more sequences of instructions by the one or more processors further causes the one or more processors to perform the step of:

comparing said input to a password of said first user to ensure that said input is not similar to said password.

18. The machine-readable medium of claim 10, wherein execution of the one or more sequences of instructions by the one or more processors further causes the one or more processors to perform the step of:

upon expiration of said first password, revoking access to an open connection provided to a user that supplied a password that matched said first password.

19. An apparatus comprising:

a processor; and

a memory coupled to the processor, the memory containing one or more sequences of instructions for monitoring email messages received at a server, wherein execution of the one or more sequences of instructions by the processor causes the processor to perform the steps of;

receiving input from a first user;

generating a first password for said resources of said network device based on, at least in part, (a) said input, and (b) an algorithm, wherein said algorithm is concealed from said first user, and wherein said first password is concealed from said first user;

receiving a second password from a second user, wherein said second password is generated based on, at least in part, (a) said input, and (b) said algorithm, wherein said algorithm is known to said second user, and wherein said second password is concealed from said first user;

determining whether said first password matches said second password; and

in response to determining that said first password matches said second password, providing said second user with access to said resources of said network device.

20. The apparatus of claim 19, wherein the generation of said first password and the generation of said second password are both based on, at least in part, on (a) a set of data concealed from said first user but known to said second user, or (b) an identifier that uniquely identifies said network device.

21. The apparatus of claim 19, wherein execution of the one or more sequences of instructions by the processor further causes the processor to perform the steps of:

receiving, from said first user, validity data that identifies a period of time in which said first password is valid, and

wherein said step of determining whether said first password matches said second password comprises;

determining whether said period of time has expired; and

in response to determining that said period of time has expired, denying access to said second user.

22. The apparatus of claim 19, wherein execution of the one or more sequences of instructions by the processor further causes the processor to perform the step of:

receiving a request, from said first user, to perform one action selected from the group comprising (a) generating a new password for said resources of said network device and (b) resetting or canceling said first password.

23. The apparatus of claim 22, wherein execution of the one or more sequences of instructions by the processor further causes the processor to perform the step of:

in response to said first user performing said action, preventing said second user from obtaining access to said resources of said network device using a password that matches said first password.

24. The apparatus of claim 19, further comprising:

transmitting, from said first user to said second user, said input and an identifier that uniquely identifies said network device.

25. The apparatus of claim 19, wherein execution of the one or more sequences of instructions by the processor further causes the processor to perform the steps of:

maintaining a list of passwords previously generated for said resources of said network device; and

comparing said first password against said list of passwords to determine if said first password has been previously generated.

26. The apparatus of claim 19, wherein execution of the one or more sequences of instructions by the processor further causes the processor to perform the step of:

comparing said input to a password of said first user to ensure that said input is not similar to said password.

27. The apparatus of claim 19, wherein execution of the one or more sequences of instructions by the processor further causes the processor to perform the step of:

upon expiration of said first password, revoking access to an open connection provided to a user that supplied a password that matched said first password.