Authentication and authorization for simple network management protocol (SNMP)

• US 20070180086A1
• Filed: 02/01/2006
• Published: 08/02/2007
• Est. Priority Date: 02/01/2006
• Status: Active Grant

• Current Assignee: Samsung Electronics Co. Ltd.
• Original Assignee: Samsung Electronics Co. Ltd.
• Inventors: Parks, Gary, Fang, Scott, Bhat, Kong
• Granted Patent: US 7,877,469 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

A system is provided that includes a manager device that executes a Simple Network Management Protocol (SNMP) manager. The system also includes an agent device coupled to the manager device. The agent device executes a SNMP agent that selectively provides access to managed data. The SNMP manager enables a user to issue a login command. The SNMP agent processes the login command and, if the user is authenticated, allows the user to access the managed data using a session identifier.

Claims

1. A system, comprising:

a manager device operable to execute a Simple Network Management Protocol (SNMP) manager; and

an agent device operable to execute a SNMP agent, the SNMP agent in communication with the SNMP manager and selectively providing access including for the SNMP manager to managed data,

wherein the SNMP manager is operable to issue a login command to the SNMP agent and wherein the SNMP agent processes the login command and, if the login command is authenticated, allows access to the managed data.

2. The system of claim 1 wherein the SNMP agent accesses the managed data based on a session identifier contained in an SNMP message sent by the SNMP manager, and wherein the SNMP agent ignores a community name provided with the login command.

3. The system of claim 1 further comprising an authentication server, wherein the SNMP agent forwards a user identifier and password provided with the login command to the authentication server and wherein the authentication server attempts to authenticate a user based on the user identifier and password.

4. The system of claim 3 wherein the SNMP agent generates a table containing at least one user identifier and associated password, each user identifier and associated password being indexed by a separate session identifier.

5. The system of claim 3 wherein, if the user is authenticated, the authentication server provides an authorization level for the user to the SNMP agent.

6. The system of claim 5 wherein the SNMP agent tracks a list of logged-in users and each user'"'"'s authorization level.

7. The system of claim 5 wherein the authorization level provides non-global read-only (RO) access rights to the managed data.

8. The system of claim 5 wherein the authorization level provides non-global read-write (RW) access rights to the managed data.

9. The system of claim 5 wherein the authorization level restricts use of predetermined SNMP commands.

10. The system of claim 1 wherein, after logging-in, a subsequent request is permitted by placing the session identifier in a community name data field of the request.

11. A storage medium that stores a Simple Network Management Protocol (SNMP) data packet, the SNMP data packet comprising:

a community name data field;

a login command data field;

a user identifier data field; and

a password data field,

wherein a login command contained in the login command data field causes a SNMP agent to ignore a value in the community name data field and to process values in the user identifier data field and the password data field for authentication.

12. The storage medium of claim 11 wherein the SNMP data packet further comprises a session identifier data field and wherein, if the values in the user identifier data field and the password data field are authenticated, a valid session request is recognized by placing a value of the session identifier data field in the community name data field.

13. A method, comprising:

issuing a command using a Simple Network Management Protocol (SNMP) data packet;

ignoring a SNMP community name; and

authenticating a user associated with the command.

14. The method of claim 13 wherein authenticating the user comprises authenticating a user identifier and associated password provided with the command.

15. The method of claim 13 further comprising, if a user is authenticated, providing an authorization level for the user.

16. The method of claim 15 wherein providing an authorization level for the user comprises providing non-global access rights to managed data.

17. The method of claim 15 wherein providing an authorization level for the user comprises restricting user of at least one SNMP command.

18. The method of claim 13 further comprising updating a list of logged-in users and tracking an authorization level associated with each logged-in user.

19. The method of claim 13 further comprising, after a successful login, issuing a subsequent SNMP request by placing a session identifier in a community name data field of the request.

20. The method of claim 19 further comprising encrypting a value in the community name data field using a public key derived from object identifiers (OlDs) provided in a message packet protocol data unit (PDU).