Method and system for detection of aliases in a network

• US 20060036866A1
• Filed: 08/12/2004
• Published: 02/16/2006
• Est. Priority Date: 08/12/2004
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Nagendra, Ps, Kiran, Vishnu Ls
• Granted Patent: US 7,698,561 B2
• Time in Patent Office: Days
• US Class Current: 713/181
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/30 Managing network names, e.g. use of aliases or nicknames name-to-address mapping H04L61/45
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

The invention provides a method and system of detecting aliases in a network. The network comprises at least one device and at least one Network management system (NMS) for managing the devices. The NMS identifies each device available in the network with a message digest. The NMS retrieves the message digest of a device that is submitted for management. The NMS tries to locate the retrieved message digest with a database of message digests. In case the retrieved message digest is located on the database, the NMS declares the device as an alias. However, if the message digest is not located on the database, the NMS stores the message digest in the database and starts managing the device.

Claims

1. A method for detecting aliases in a network having a plurality of devices, the method comprising:

requesting a device having a message digest;

retrieving the message digest from the device;

locating the retrieved message digest in a database of message digests; and

detecting the device as an alias.

2. A method for detecting aliases in a network having a plurality of devices and at least one Network Management System (NMS) for managing the devices, the method comprising:

requesting a device having a message digest computed from values for a set of Object Identifiers (OIDs) associated with the device;

retrieving the message digest from the device;

locating the retrieved message digest in a database of stored message digests; and

declaring the device as an alias since the retrieved message digest is located in the database.

3. The method of claim 2, wherein the retrieving the message digest from the device comprises:

registering the set of OIDs associated with the device;

sending the registered set of OIDs to a requesting NMS; and

computing the message digest using the values of the set of OIDs.

4. The method of claim 2, wherein the retrieving the message digest comprises retrieving the message digest when there is a change in value of at least one OID belonging to the set of OIDs.

5. The method of claim 4 wherein said retrieving the message digest when there is a change in value of at least one OID belonging to the set of OIDs comprises:

informing each NMS in the network about the change in the value of the set of OIDs associated with the device;

requesting the device for the list of OIDs on whose values the message digest is to be computed;

computing the message digest using the changed values of the set of OIDs; and

updating the database of each NMS that stores the message digest of the device with the computed message digest.

6. The method of claim 5 further comprising the step of adding the retrieved message digest in the database when the retrieved message digest is not found in the database.

7. The method of claim 6, wherein the adding the retrieved message digest in the database comprises

obtaining the set of OIDs;

obtaining values for the set of OIDs;

computing the message digest using the values of the set of OIDs; and

storing the computed message digest in the database belonging to a requesting NMS.

8. The method of claim 2, wherein the communication between the device and the NMS is based on a Simple Network Management Protocol (SNMP).

9. A method for detecting an attack on a network having a plurality of devices and at least one Network Management System (NMS) for managing the devices, the method comprising:

assigning a message digest to each device, the message digest being an identifier for the device, the assigning being performed by the NMS in coordination with each device;

retrieving the message digest from a device;

locating the retrieved message digest in a database of message digests, the locating being performed by the NMS; and

declaring the device as being attacked if the retrieved message digest cannot be located on the database, the declaring being performed by the NMS.

10. The method as recited in claim 9, wherein the assigning the message digest to the device comprises

sending a set of object identifiers (OIDs) associated with the device to the NMS, the sending being performed by the device;

and

computing the message digest using the values of the set of OIDs, the computing being performed by the NMS.

11. A method for detecting aliases in a network having a plurality of devices and at least one Network Management System (NMS) for managing the plurality of devices, the method comprising:

requesting a device for a set of Object Identifiers (OIDs) associated with the device, the requesting being performed by an NMS;

computing a message digest using values of the set of OIDs, the message digest being an identifier to the device, the computing being independently performed by the device and the requesting NMS;

assigning the message digest to the device, the assigning being performed by the requesting NMS;

locating the assigned message digest in the database of message digests, the locating being performed by the requesting NMS; and

declaring the device as an alias if the assigned message digest is located on the database, the declaring being performed by the requesting NMS;

wherein the steps of the locating the assigned message digest and the declaring the device are performed whenever the device is submitted for management to at least one NMS.

12. The method of claim 11 additionally comprising registering with the NMS the set of OIDs with the device;

conducting an SNMP set on a MsgDigestCreate variable to instruct the device to compute the message digest;

computing the message digest by the device and storing the computed message digest in an MIB variable; and

computing the message digest by the NMS.

13. A system for detecting aliases in a network having a plurality of devices and at least one Network Management System (NMS), each device being identified with a message digest, the system comprising

a retrieving module for retrieving the message digest from a device;

a locating module for locating the retrieved message digest in a database of message digests; and

a declaring module for declaring the device as an alias if the retrieved message digest is located on the database of message digests.

14. The system as recited in claim 13, wherein the retrieving module comprises

a registration module for registering a set of Object Identifiers (OIDs) associated with the device, the set of OIDs being used for computation of the message digest;

a create message digest module for computing the message digest using the stored set of OIDs;

a message digest module for storing the computed message digest;

a flag module for identifying a change in the value of an OID belonging to the set of OIDs;

and

an updation module for updating each NMS about the change in the values of the set of OIDs.

15. The system of claim 14 wherein said NMS comprises an inventory module for storing the set of OIDs.

16. The system as recited in claim 13, wherein the locating module comprises

a database module for storing message digests of zero or more devices on the network;

and

a comparison module for comparing the retrieved message digest with the message digests stored in the database module.

17. A system for detecting aliases in a network, the system comprising

at least one device;

each device comprising

a registration module for registering a set of Object Identifiers (OIDs) associated with the device;

a create message digest module for computing the message digest using the stored set of OIDs;

a message digest module for storing the computed message digest as an MIB variable;

a flag module for identifying a change in the value of an OID belonging to the set of OIDs;

an updation module for updating each NMS about the change in the value for any of the set of OIDs;

at least one Network Management System (NMS), each NMS comprising

a database module for storing message digests of zero or more devices on the network;

an inventory module for storing the registered set of OIDs;

a comparison module for comparing the retrieved message digest with the message digests stored in the database; and

a declaring module for declaring the device as an alias if the retrieved message digest is located on the database of message digests.

18. An apparatus for detecting aliases in a network, the network comprising at least one device and at least one Network management system (NMS), the apparatus comprising

a processor;

and

a machine readable medium including instruction executable by the processor comprising

one or more instruction means for requesting a device for a message digest, the message digest being computed by using a set of Object Identifiers (OIDs) associated with the device;

one or more instruction means for retrieving the message digest from the device;

one or more instruction means for locating the retrieved message digest in a database of message digests located on the requesting NMS; and

one or more instruction means for declaring the device as an alias if the retrieved message digest is located on the database.

19. A machine-readable medium including instructions executable by the processor comprising

one or more instruction means for requesting a device for a message digest, the message digest being computed by using a set of Object Identifiers (OIDs) associated with the device;

one or more instruction means for retrieving the message digest from the device;

one or more instruction means for locating the retrieved message digest in a database of message digests located on the requesting NMS; and

one or more instruction means for declaring the device as an alias if the retrieved message digest is located on the database.

20. A computer data signal embodied in a carrier wave comprising an alias detection signal, wherein, the alias detection signal is used for detecting aliases on the basis of a message digest, the message digest being an identifier to a device, the message digest being computed using a set of Object Identifiers (OIDs) associated with the device.