Method and apparatus for initializing security information on a network device

• US 7,240,191 B2
• Filed: 02/01/2002
• Issued: 07/03/2007
• Est. Priority Date: 02/01/2002
• Status: Expired due to Fees

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Robinson, Michael C.
• Primary Examiner(s): Vu; Kim
• Assistant Examiner(s): Ha; Leynna
• Application Number:
  US10/062,382
• Publication Number:
  US 20030149892A1
• Time in Patent Office: 1,978 Days
• Field of Search: 713200-201, 713165-167, 380228-229, 380/232, 380 28- 30, 380/202, 380/279, 380281-285, 726 1- 7, 726/14, 726 17- 19, 726/21, 726/27, 726/30, 709/100, 709/200, 709/203, 709223-225, 709227-229
• US Class Current: 713/151
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A method and apparatus for initializing security information for a network device. Two protocols are used. A first protocol, which has no encryption capability, is used to create an initial account. However, the initial account corresponds to a second protocol, and this second protocol does have encryption capability. A security parameter which is used to encrypt data and which corresponds to the initial account is transmitted by the network device to the network management application. The security parameter may be transmitted from the network device to the network management application openly via the first protocol. The network management application then uses this security parameter to encrypt sensitive security information needed for initially configuring the network device. The encrypted security information can now be transmitted securely over the network to the network device by means of the second protocol. Thereby, the network device can be initially configured with the requisite security information in an easy-to-use and relatively secure manner.

Claims

1. A method for a network manager to securely configure a network device over a network, comprising:

coupling to said network device;

creating a temporary account having an encryption key, wherein an unsecured first protocol is used to create said temporary account, wherein said temporary account corresponds to a secured second protocol that supports encryption, and wherein said secured second protocol is capable of transmitting encrypted security information;

transmitting said encryption key unencrypted to said network manager over said network in accordance with said unsecured first protocol;

encrypting said security information using said encryption key;

transmitting encrypted security information over said network to said network device in accordance with said secured second protocol;

initializing said network device with said security information;

deleting said temporary account after said network device has been initialized with said security information; and

clearing said encryption key after said encryption key has been sent to said network manager over said network.

2. The method of claim 1, wherein said unsecured first protocol comprises SNMPv1 and said second protocol comprises SNMPv3.

3. The method of claim 1 further comprising:

authenticating transmissions over said network in accordance with said second protocol.

4. The method of claim 1, wherein said security information includes an 802.11 access point key.

5. The method of claim 1 further comprising:

creating initial account objects corresponding to said temporary account.

6. The method of claim 5, wherein said initial account objects comprise user, authentication key, privacy key, and context data.

7. The method of claim 6 further comprising clearing said initial account objects after said initial account objects have been transmitted to said network administration application.

8. A method for a network manager to securely configure a network device, comprising:

coupling to said network device;

creating a temporary account by using a unsecured first protocol, wherein said temporary account includes an encryption key in accordance with a secured second protocol that supports encryption, and wherein said secured second protocol is capable of transmitting encrypted security information;

transmitting said encryption key from said network device over said network to said network manager in plain text;

encoding security information corresponding to said encryption key;

configuring said network device in an encoded manner with security information, wherein said security information is encoded according to said encryption key and transmitted to said network device in accordance with said secured second protocol;

clearing said encryption key;

destroying said temporary account after said network device has been configured.

9. The method of claim 8, wherein said unsecured first protocol corresponds to SNMPv1 and said second protocol corresponds to SNMPv3.

10. The method of claim 8 further comprising:

creating objects corresponding to said account, wherein said objects include user, authentication key, privacy key, and context corresponding to said account;

transmitting said objects over said network to said manager in plain text.

11. The method of claim 8, wherein said security information includes an 802.11 access point key.

12. An apparatus for configuring a network device over a network, comprising:

means for coupling to said network device;

means for creating a temporary account having an encryption key, wherein an unsecured first protocol is used to create said temporary account, wherein said temporary account corresponds to a secured second protocol that supports encryption, and wherein said secured second protocol is capable of transmitting encrypted security information;

means for transmitting said encryption key to a network manager over said network in accordance with said unsecured first protocol;

means for encrypting transmissions from said network manager to said network device according to said encryption key;

means for initializing said network device with said security information by said network manager over said network in an encrypted mode in accordance with said secured second protocol;

means for clearing said encryption key;

means for destroying said temporary +account after said network device has been configured.

13. The apparatus for configuring a network device of claim 12, further comprising:

means for authenticating transmissions from said network manager to said network device in accordance with said second protocol.

14. The apparatus of claim 13, wherein said unsecured first protocol comprises SNMPv1 and said second protocol comprises SNMPv3.

15. A computer-readable medium having stored thereon instructions for configuring a network device over a network, comprising:

coupling to said network device;

creating a temporary SNMPv3 account by using SNMPv1, wherein said SNMPv3 accounts includes an encryption key in accordance with said SNMPv3 protocol that supports encryption, and wherein said secured SNMPv3 protocol is capable of transmitting encrypted security information;

transmitting an object corresponding to said temporary SNMPv3 account over said network by using SNMPv1;

encrypting said encryption key according to said object;

transmitting said encryption key to said network device;

configuring said network device with said encryption key by using SNMPv3; and

destroying said initial SNMPv3 account after said network device has been configured.

16. The computer-readable medium of claim 15, wherein said security parameter comprises an 802.11 access point key.