Managing network components using USB keys

• US 20080281953A1
• Filed: 05/07/2007
• Published: 11/13/2008
• Est. Priority Date: 05/07/2007
• Status: Active Grant

• Current Assignee: DigiCert Incorporated
• Original Assignee: Mocana Corporation (DigiCert Incorporated)
• Inventors: Blaisdell, James
• Granted Patent: US 8,214,885 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066

Abstract

Devices and methods for managing a communications network include using USB keys to provision and management components in the network by having the network component establish a connection to a network administrator device, such as a laptop, PDA, or desktop workstation. A first USB key is used to provision a network component so that it has the necessary security information to interact with a second USB key, used to enable actual management of the component. Once the component has the security information, the second USB key is inserted and certain callback data are made available to the component. It uses this data to make a “call” or connection to an administrator'"'"'s device. The callback data may be an IP address of the device, an e-mail address, VoIP data, instant messaging data, dial-up data, and so on. Once the connection, initiated and established by the network component, is made the administrator can begin managing the component.

Claims

1. A network management apparatus comprising:

a first storage device containing public key data relating to a network, the data including root certificate authority data and a plurality of IP addresses; and

a second storage device containing network data and instructional scripts guiding certain operations of a network component when the second storage device is inserted into the network component, wherein the network data and the instructional scripts on the second storage device are signed using the public key data stored on the first storage device.

2. A network management apparatus as recited in claim 1 wherein the first storage device further contains network attribute data.

3. A network management apparatus as recited in claim 1 wherein the first storage device further contains security certificate data.

4. A network management apparatus as recited in claim 1 wherein the first storage device further contains DNS server names and addresses.

5. A network management apparatus as recited in claim 1 wherein the first storage device further contains gateway data.

6. A network management apparatus as recited in claim 1 wherein the second storage device further contains callback data.

7. A network management apparatus as recited in claim 6 wherein the callback data includes an IP address of a network administrative computing device to enable an IP connection between the computing device and the network component.

8. A network management apparatus as recited in claim 6 wherein the callback data includes voice-over-IP data to enable a voice-over-IP call from the network component to the administrative computing device.

9. A network management apparatus as recited in claim 1 wherein the second storage device further contains network component data, including component manufacture data, component type, and model data.

10. A network management apparatus as recited in claim 9 wherein the second storage device further contains network component IP address and protocols.

11. A network management apparatus as recited in claim 9 wherein the second storage device further contains shutdown data.

12. A network management apparatus as recited in claim 1 wherein the first and second storage devices are USB keys.

13. A network management apparatus as recited in claim 1 wherein the first and second storage devices are U3 keys.

24. A method as recited in claim 1B wherein the first and second storage devices are USB keys.

14. A method of managing a network comprising:

storing public-key information relating to a network onto a first portable storage device;

storing network data and scripts onto a second portable storage device;

provisioning a network component by using the first storage device;

managing the network component using the second storage device and an administration component, wherein the network component initiates and establishes a connection with the administration component; and

disconnecting with the administration component by discontinuing use of the second storage device.

15. A method as recited in claim 14 wherein storing public key information comprises:

storing one or more of root certificate authority data, IP addresses, gateway data, and network access information.

16. A method as recited in claim 14 further comprising:

retrieving the public key information from a network administration workstation.

17. A method as recited in claim 14 wherein storing network data and scripts further comprises:

storing callback data on the second storage device, wherein the callback data includes a network administration device IP address, voice-over-IP data, instant messaging data, and dial-in data.

18. A method as recited in claim 14 further comprising:

applying a digital signature to the data stored on the second portable storage device.

19. A method as recited in claim 14 wherein provisioning a network component further comprises:

reading data on the first portable storage device at the network component and executing the data on the network component, wherein the network component is configured to safely accept data stored on the second storage device.

20. A method as recited in claim 14 wherein provisioning a network component further comprises:

providing the network component with public key information relating to the network.

21. A method as recited in claim 14 wherein managing the network component using the second storage device further comprises:

providing the network component with callback data allowing the component to connect with the administrative component.

22. A method as recited in claim 14 further comprising:

verifying the signature of the network data and scripts on the second storage device before the data and scripts are executed or read by the network component.

23. A method as recited in claim 14 wherein disconnecting further comprises:

removing the second storage device from the network component.

25. A method of managing components in a network comprising:

inserting a first USB key into a network component to authenticate a technician device to the network component;

establishing a connection between the component and the device using the first USB key, wherein the network component initiates the connection with the device;

inserting a second USB key into the network component;

retrieving network component data for the purpose of managing the network component; and

managing the network component using the second USB key.