Method, system and computer program for the secured management of network devices

• US 20060253577A1
• Filed: 05/29/2003
• Published: 11/09/2006
• Est. Priority Date: 05/29/2003
• Status: Abandoned Application

• Current Assignee: Pirelli & C SPA, Telecom Italia S.p.A.
• Original Assignee: Pirelli & C SPA, Telecom Italia S.p.A.
• Inventors: Castaldelli, Luca, Moreo, Davide, Polano, Marco
• Application Number:
  US10/558,835
• Publication Number:
  US 20060253577A1
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838

Abstract

A method of managing communications between a first system and a second system in a communication network, includes the steps of negotiating at least one cipher key between the first and second systems, and communicating information between the first and second systems using the SNMP protocol and the cipher key. Negotiation of the cipher key is carried out as a ciphered transaction and security processes are preferably adopted to cipher the sensitive information exchanged over the SNMP protocol. Preferably the cipher key is allotted a limited duration in time and a new cipher key is negotiated when such a duration is completed.

Claims

1-29. -29. (canceled)

30. A method of managing communications between a first system and a second system in a communication network, comprising the steps of:

negotiating at least one cipher key between said first and second systems, and

communicating information between said first and second systems using the SNMP protocol and said cipher key,

the step of negotiating said at least one cipher key being carried out as a ciphered transaction.

31. The method of claim 30, comprising the step of using a ciphering process in negotiating said at least one cipher key.

32. The method of claim 31, wherein said ciphering process is selected from the group consisting of the Hughes algorithm, the Diffie-Hellman algorithm, the ElGamal algorithm, and the Merkle-Hellman algorithm.

33. The method of claim 32, wherein said ciphering process is based on the Hughes algorithm.

34. The method of claim 30, comprising the step of making said cipher key available to both said first and second systems by using a security process.

35. The method of claim 34, wherein said security process is selected from the group consisting of the 3DES algorithm, digital signatures, public or private key digital certificates, and RSA.

36. The method of claim 34, wherein said security process is the 3DES algorithm.

37. The method of claim 30, comprising the step of allotting a pre-defined time duration to said cipher key.

38. The method of claim 37, wherein said duration is less than 30 minutes.

39. The method of claim 37, comprising the step of making said duration selectively adjustable.

40. The method of claim 30, comprising the steps of:

generating a first negotiation key,

ciphering said first negotiation key by using a negotiation cipher algorithm and a respective key;

sending said ciphered first negotiation key from said first system to said second system;

deciphering said first negotiation key at said second system by using said respective key;

generating at said second system a second negotiation key from said first negotiation key;

ciphering said second negotiation key by using said negotiation cipher algorithm and said respective key;

transmitting said ciphered second negotiation key from said second system to said first system;

deciphering said second negotiation key at said first system by using said negotiation cipher algorithm and said respective key; and

generating said at least one cipher key at said first and at said second systems based on said second negotiation key.

41. The method of claim 40, comprising the step of configuring said first system and said second system as an element manager and a network access device, respectively, in a telecommunication network.

42. The method of claim 40, comprising the steps of:

configuring said first system and said second system as a network access device and an element manager, respectively, in a telecommunication network; and

sending from said element manager to said network access device a message indicating start of communication, thus prompting sending said ciphered first negotiation key from said network access device to said element manager.

43. The method of claim 40, wherein said negotiation cipher algorithm is a 3DES algorithm.

44. The method of claim 40, comprising the step of generating said first negotiation key and said second negotiation key by using the Hughes algorithm.

45. The method of claim 44, comprising the step of generating said first negotiation key and said second negotiation key starting from a respective, randomly generated number and two parameters jointly shared by said first and second systems.

46. The method of claim 40, comprising at least one step selected from the group consisting of:

sending said ciphered first negotiation key from said first to said second system by using a SNMP protocol, and

sending said ciphered second negotiation key from said second system towards said first system by using a SNMP protocol.

47. The method of claim 40, wherein said respective key is a 128-bit key.

48. The method of claim 30, comprising:

identifying in said information to be communicated between said first and said second system a set of sensitive information;

ciphering said sensitive information by using an information protection method;

transmitting said information including said ciphered sensitive information from said first to said second system; and

deciphering said sensitive information at said second system by using said information protection method.

49. The method of claim 48, comprising the step of making said cipher key available to both said first and second systems by using a security process and the step of selecting said security process identical to said information protection method.

50. The method of claim 49, wherein said security process and said information protection method are the 3DES algorithm.

51. The method of claim 30, comprising the step of defining an MIB variable to include said cipher key.

52. The method of claim 30, comprising the step of defining a respective MIB variable conveying a time duration of said cipher key.

53. The method of claim 30, comprising the step of allotting a defined time duration to said cipher key.

54. The method of claim 53, wherein said defined time duration is less than 30 minutes.

55. The method of claim 53, comprising the steps of:

detecting said cipher key having completed said allotted duration time; and

negotiating between said first and said second systems at least one new cipher key.

56. A system configured to operate as said first system in the method of any one of claims 30, 31, 34, 37, 39-42, 44-46, 48, 49, 51-53 and 55.

57. A system configured to operate as said second system in the method of any one of claims 30, 31, 34, 37, 39-42, 44-46, 48, 49, 51-53 and 55.

58. A computer program product directly loadable in the memory of at least one computer and including software code portions for implementing the steps of the method of any one of claims 30, 31, 34, 37, 39-42, 44-46, 48, 49, 51-53 and 55.