Method and apparatus for protecting a network from attack

• US 7,366,893 B2
• Filed: 08/07/2002
• Issued: 04/29/2008
• Est. Priority Date: 08/07/2002
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: Intelliden, Inc. (International Business Machines Corporation)
• Inventors: Tindal, Glen D., Schenk, Jeffery A.
• Primary Examiner(s): TRAN, ELLEN C
• Application Number:
  US10/213,949
• Publication Number:
  US 20040030923A1
• Time in Patent Office: 2,092 Days
• Field of Search: 726/15, 726/6, 726/14, 713/153, 713/150, 713/100
• US Class Current: 713/153
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A method and apparatus to initializing a network device is described. In one embodiment, the present invention includes the step of: retrieving an initial communications address from a local memory of the network device; transmitting a secure identifier to the initial communications address verifying the authenticity of the secure identifier; retrieving a configuration record from a configuration record repository, the retrieved configuration record being associated with the network device that corresponds to the secure identifier; receiving the configuration record at the network device; and installing the configuration record at the network device.

Claims

1. A method for initializing a network device, the method comprising the steps of:

retrieving an initial communication address from a local memory of the network device;

transmitting a secure identifier to the initial communications address, the secure identifier identifying the network device;

verifying the authenticity of the secure identifier;

retrieving a configuration record from a configuration record repository, the configuration record indicating which features of the network device are to be enabled, and the configuration record repository including at least one separate configuration record for each of a plurality of network devices, each of the at least one separate configuration records enabling a corresponding one of the plurality of network devices to be reconfigured in the event an attacker alters configurations of the plurality of network devices, the retrieved configuration record being associated with the network device that corresponds to the secure identifier, each of the plurality of network devices being capable of having multiple configuration records, wherein each of the multiple configuration records for each of the plurality of network devices represents different configurations at different time frames;

receiving at least an indication of the configuration record at the network device; and

installing the at least an indication of the configuration record at the network device.

2. The method of claim 1, further comprising the step of:

loading the network device with the initial communications address.

3. The method of claim 1, further comprising:

loading the network device with the secure identifier.

4. The method of claim 1, further comprising the step of:

reading a key stored on the network device; and

generating the secure identifier using the record key.

5. The method of claim 1, wherein the secure identifier comprises:

a digital certificate.

6. The method of claim 1, wherein the step of verifying comprises the step of:

retrieving a key from the configuration record that was retrieved from the configuration record repository, wherein the key is associated with the network device.

7. The method of claim 1, wherein the secure identifier is a first secure identifier, the method further comprising the steps of:

receiving a second secure identifier from a network management unit;

verifying the authenticity of the received second secure identifier; and

responsive to verifying the authenticity of the second secure identifier, accepting configuration instructions for installation.