Proxy method and system for secure wireless administration of managed entities

• US 20060285692A1
• Filed: 06/02/2006
• Published: 12/21/2006
• Est. Priority Date: 12/19/2002
• Status: Active Grant

• Current Assignee: Avocent Huntsville Corporation (Vertiv Holdings Co.)
• Original Assignee: Sonic Mobility Inc. (Vertiv Holdings Co.)
• Inventors: Van Schaick, Allan, Doree, Jim, Kerstens, Kevin
• Granted Patent: US 7,421,735 B2
• Time in Patent Office: Days
• US Class Current: 380/270
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/067 using one-time keys cryptographic mechanisms or cryptographic arrangements for generation of one-time passwords H04L9/0863
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• CPC Class Codes: H04L 67/08 specially adapted for terminal emulation, e.g. Telnet
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/08 Access security

Abstract

A method, system and apparatus are described for avoiding the use of a web-server or generic security when providing network administration services remotely to managed entities using wireless technology. Instead a true Proxy device, not operating as a web-server, is used to preprocess all command traffic from wireless input devices (WID). The intervention between the WID and the managed entities of the Proxy isolating the managed entities from the WID, enhanced by encoding using a novel messaging protocol, further enhanced by a novel security model based on multiple pre-shared keys and algorithms together with identifiers and passwords that are not transmitted, achieves several bandwidth and security advantages including the ability to deliver TELNET services across the Internet and behind a firewall.

Claims

1. A system, for securing communication between a WID and a Proxy having access to an encrypted service database for storing information respecting said WID and information respecting at least one User of said WID, comprising:

an identifier for said WID, stored encrypted on said WID and stored unencrypted in said service database,

a password for said WID, stored encrypted on said WID and in said service database,

a secret key pre-shared between said WID and said Proxy,

a site key for encrypting said service database and decrypting said password for said WID stored encrypted in said service database,

a communications key algorithm using both said identifier for said WID and said password for said WID, for the purpose of generating a communications key,

a first message for the purpose of said WID requesting a connection to said Proxy, said first message comprising two parts, one part including said identifier for said WID encrypted with said secret key, and a second part including an encoded command and parameters for said command, said second part encrypted with said communications key,

a session key for encrypting messages after a session is established,

at least one token for validating messages within a session, and

a second message for the purpose of said Proxy providing to said WID said token and said session key, said second message encrypted with said communications key, whereupon the receipt of said token and said session key said WID is enabled to provide at least one further message to said Proxy by returning said token within said message to said Proxy.

2. The system as claimed in claim 1 further comprising:

an identifier for said at least one User of said WID, stored unencrypted in said service database

a password for said at least one User of said WID, stored as a hash value in said service database,

a hash value resulting from hashing said identifier for said User with said password for said User, said hash value for substituting in place of said password for said User, and

a third message for the purpose of securely authenticating and authoring said User.

3. A method of abstracting Identifiers for the purpose of keeping the Identifiers secret longer by making them more difficult to guess, crack, or otherwise improperly access for enhancing the security used to control User access to wireless network administration services, having a site key, a communication key algorithm, and a hashing algorithm comprising the steps:

assign an identifier to said device,

assign a device password to said device,

apply said device password as a seed to said communication key algorithm and

generate a communication key,

encrypt said device password using said site key and store said device password only in

encrypted form,

assign a separate identifier to said User,

accept a separate User password selected by said User,

apply said User password as a seed to said hashing algorithm and generate a hash value,

delete said User password,

transmit said hash value in lieu of said User password.