Method and system for detection of aliases in a network

• US 7,698,561 B2
• Filed: 08/12/2004
• Issued: 04/13/2010
• Est. Priority Date: 08/12/2004
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Nagendra, Ps, Kiran, Vishnu Ls
• Primary Examiner(s): Vu; Kimyen
• Assistant Examiner(s): Debnath; Suman
• Application Number:
  US10/917,604
• Publication Number:
  US 20060036866A1
• Time in Patent Office: 2,070 Days
• Field of Search: 713/181, 726/5, 726/6, 726/18
• US Class Current: 713/181
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/30 Managing network names, e.g. use of aliases or nicknames name-to-address mapping H04L61/45
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

The invention provides a method and system of detecting aliases in a network. The network comprises at least one device and at least one Network management system (NMS) for managing the devices. The NMS identifies each device available in the network with a message digest. The NMS retrieves the message digest of a device that is submitted for management. The NMS tries to locate the retrieved message digest with a database of message digests. In case the retrieved message digest is located on the database, the NMS declares the device as an alias. However, if the message digest is not located on the database, the NMS stores the message digest in the database and starts managing the device.

Claims

1. A method for detecting aliases in a network having a plurality of devices, the method comprising:

receiving a request from a device having a message digest, the message digest computed based on values for a set of object identifiers (OIDs) associated with the device, the OIDs being identifiers for describing the devices in a network management system (NMS);

receiving a message including the message digest from the device and not the values for the set of OIDs;

determining if the received message digest in the message is found in a database of message digests; and

determining the device as an alias if the received message digest is found in the database of message digests, the determination of the alias using the message digest without comparing values for the set of OIDs, the alias being when the device has already been registered and the values for the OIDs do not need to be downloaded and registered from the device; and

downloading the values for the OIDs if the message digest is not found in the database of message digests.

18. The method of claim 1, wherein the OIDs are included in a management information base (MIB), the MIB being a formal description of the devices in the NMS.

2. A method for detecting aliases in a network having a plurality of devices and at least one Network Management System (NMS) for managing the devices, the method comprising:

requesting a device having a message digest computed from values for a set of Object Identifiers (OIDs) associated with the device, the OIDs being identifiers for describing the devices in the at least one NMS;

retrieving a message including the message digest from the device and not the values for the set of OIDs;

locating the retrieved message digest in a database of stored message digests; and

declaring the device as an alias since the retrieved message digest is located in the database, the determination of the alias using the message digest without comparing values for the set of OIDs, the alias being when the device has already been registered and the values for the OIDs do not need to be downloaded and registered from the device; and

downloading the values for the OIDs if the message digest is not found in the database of message digests.

3. The method of claim 2, wherein the retrieving the message digest from the device comprises:

registering the set of OIDs associated with the device;

sending the registered set of OIDs to a requesting NMS; and

computing the message digest using the values of the set of OIDs.

4. The method of claim 2, wherein the retrieving the message digest comprises retrieving the message digest when there is a change in value of at least one OID belonging to the set of OIDs.

5. The method of claim 4 wherein said retrieving the message including the message digest when there is a change in value of at least one OID belonging to the set of OIDs comprises:

informing each NMS in the network about the change in the value of the set of OIDs associated with the device;

requesting the device for the list of OIDs on whose values the message digest is to be computed;

computing the message digest using the changed values of the set of OIDs; and

updating the database of each NMS that stores the message digest of the device with the computed message digest.

6. The method of claim 5 further comprising the step of adding the message digest in the database when the retrieved message digest is not found in the database.

7. The method of claim 6, wherein the adding the message digest in the database comprises

obtaining the set of OIDs;

obtaining values for the set of OIDs;

computing the message digest using the values of the set of OIDs; and

storing the computed message digest in the database belonging to a requesting NMS.

8. The method of claim 2, wherein the communication between the device and the NMS is based on a Simple Network Management Protocol (SNMP).

9. A method for detecting an attack on a network having a plurality of devices and at least one Network Management System (NMS) for managing the devices, the method comprising:

assigning a message digest to each device, the message digest being an identifier for the device, the assigning being performed by the NMS in coordination with each device, the message digest computed based on values associated with one or more OIDs associated with each device, the OIDs being identifiers for describing the devices in the at least one NMS;

retrieving a message including the message digest from a device and not the values for the set of OIDs;

locating the retrieved message digest in a database of message digests, the locating being performed by the NMS; and

declaring the device as being attacked if the retrieved message digest cannot be located on the database, the declaring being performed by the NMS, the declaring being determined using the message digest without comparing values for the set of OIDs, the declaring determined because the device has been registered and the values for the OIDs do not need to be downloaded and registered from the device; and

downloading the values for the OIDs if the message digest is not found in the database of message digests.

10. The method as recited in claim 9, wherein the assigning the message digest to the device comprises

sending a set of object identifiers (OIDs) associated with the device to the NMS, the sending being performed by the device;

and

computing the message digest using the values of the set of OIDs, the computing being performed by the NMS.

11. A method for detecting aliases in a network having a plurality of devices and at least one Network Management System (NMS) for managing the plurality of devices, the method comprising:

requesting a device for a set of Object Identifiers (OIDs) associated with the device, the requesting being performed by an NMS;

computing a message digest using values of the set of OIDs, the message digest being an identifier to the device, the computing being independently performed by the device and the requesting NMS, the OIDs being identifiers for describing the plurality of devices in the at least one NMS;

assigning the message digest to the device, the assigning being performed by the requesting NMS;

retrieving a message including the message digest from a device and not the values for the set of OIDs;

locating the assigned message digest in the database of message digests, the locating being performed by the requesting NMS; and

declaring the device as an alias if the assigned message digest is located on the database, the declaring being performed by the requesting NMS, the declaring of the device as the alias using the message digest without comparing values for the set of OIDs, the alias being when the device has already been registered and the values for the OIDs do not need to be downloaded and registered from the device; and

downloading the values for the OIDs if the message digest is not found in the database of message digests;

wherein the steps of the locating the assigned message digest and the declaring the device are performed whenever the device is submitted for management to at least one NMS.

12. The method of claim 11 additionally comprising registering with the NMS the set of OIDs with the device;

conducting an SNMP set on a MsgDigestCreate variable to instruct the device to compute the message digest;

computing the message digest by the device and storing the computed message digest in an MIB variable; and

computing the message digest by the NMS.

13. A system for detecting aliases in a network having a plurality of devices and at least one Network Management System (NMS), each device being identified with a message digest, the system comprising

a receiving module for receiving a request from a device having a message digest, the message digest computed based on values for a set of object identifiers (OIDs) associated with the device, the OIDs being identifiers for describing the devices in a network management system (NMS);

a retrieving module for receiving a message including the message digest from a device and not the values for the set of OIDs;

a locating module for determining if the retrieved message digest is found in a database of message digests; and

a declaring module for declaring the device as an alias if the retrieved message digest is found in the database of message digests, the declaring being determined using the message digest without comparing values for the set of OIDs, the alias being when the device has already been registered and the values for the OIDs do not need to be downloaded and registered from the device; and

a registration module for downloading the values for the OIDs if the message digest is not found in the database of message digests.

14. The system as recited in claim 13, wherein the retrieving module comprises

a registration module for registering the set of Object Identifiers (OIDs) associated with the device, the set of OIDs being used for computation of the message digest, the OIDs being identifiers for describing the devices in the at least one NMS;

a create message digest module for computing the message digest using the stored set of OIDs;

a message digest module for storing the computed message digest;

a flag module for identifying a change in the value of an OID belonging to the set of OIDs; and

an updation module for updating each NMS about the change in the values of the set of OIDs.

15. The system of claim 14 wherein said NMS comprises an inventory module for storing the set of OIDs.

16. The system as recited in claim 13, wherein the locating module comprises

a database module for storing message digests of zero or more devices on the network;

and

a comparison module for comparing the retrieved message digest with the message digests stored in the database module.

17. A system for detecting aliases in a network, the system comprising

at least one device;

each device comprising

a registration module for registering a set of Object Identifiers (OIDs) associated with the device;

a create message digest module for computing the message digest based on values for the stored set of OIDs, the OIDs being identifiers for describing devices in the at least one NMS;

a message digest module for storing the computed message digest as an MIB variable;

a flag module for identifying a change in the value of an OID belonging to the set of OIDs;

an updation module for updating each NMS about the change in the value for any of the set of OIDs;

at least one Network Management System (NMS), each NMS comprising a database module for storing message digests of zero or more devices on the network;

an inventory module for storing the registered set of OIDs;

a comparison module for receiving a message including the message digest from the device and not the values for the set of OIDs and comparing the retrieved message digest with the message digests stored in the database; and

a declaring module for declaring the device as an alias if the retrieved message digest is located on the database of message digests, the declaring being determined using the message digest without comparing values for the set of OIDs, the alias being when the device has already been registered and the values for the OIDs do not need to be downloaded and registered from the device; and

a registration modules for downloading the values for the OIDs if the message digest is not found in the database of message digests.