Secure remote management appliance

• US 7,886,340 B2
• Filed: 01/12/2009
• Issued: 02/08/2011
• Est. Priority Date: 06/13/2002
• Status: Active Grant

• Current Assignee: Intellectual Ventures II LLC (Intellectual Ventures LLC)
• Original Assignee: Engedi Technologies, Inc.
• Inventors: Carley, Jeffrey Alan
• Primary Examiner(s): Truong, Thanhnga B
• Application Number:
  US12/352,161
• Publication Number:
  US 20090150977A1
• Time in Patent Office: 757 Days
• Field of Search: 726/11, 726/3, 726/6, 726/14, 709/220, 709/238, 709/223
• US Class Current: 726/3
• CPC Class Codes: H04L 12/10 Current supply arrangements
• CPC Class Codes: H04L 41/0246 Exchanging or transporting network management information using the Internet; Embedding network management web servers in network elements; Web-services-based protocols
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/0803 Configuration setting
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 41/344 Out-of-band transfers
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/065 related to network devices
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04M 3/2263 Network management
• CPC Class Codes: H04M 3/303 and using PCM multiplexers, e.g. pair gain systems

Abstract

A computer network management system with an embedded processor, an analog communication means and a digital interface for network management provides a system for remotely and securely managing a network. Backup power in the form of an uninterrupted power supply, or other power means as appropriate, allows the modem to provide power outage notification to a remote site. The system further provides authentication and authorization capabilities for security purposes.

Claims

1. An apparatus for controlling access to management applications on devices in a communication network and securely conveying device management traffic to and from said management applications in a distributed computer network including one or more management information communication partners, one or more devices, and one or more communication networks, said apparatus comprising:

one or more processor;

a memory element;

one or more management connection means;

one or more in-band connection means; and

one or more out-of-band connection means;

said management information communication partners selected from the group comprising;

one or more network servers providing services that assist with managing one or more of said devices in said distributed computer network; and

one or more administrators managing one or more of said devices in said distributed computer network;

said management connection means configured for operatively coupling with managed devices thereby enabling the conveyance of said device management traffic to and from said managed devices;

said managed devices selected from the group comprising one or more of said devices in the distributed computer network;

said in-band connection means configured for operatively coupling with one or more of said communication networks thereby enabling the conveyance of said device management traffic to and from said management information communication partners;

said out-of-band connection means configured for operatively coupling with one or more of said communication networks thereby enabling the conveyance of said device management traffic to and from said management information communication partners;

wherein said apparatus is configured for conveying said device management traffic between one or more of said management information communication partners and one or more of said managed devices;

wherein said device management traffic is conveyed between said management applications and said management information communications partners utilizing either one or more of said in-band connection means or one or more of said out-of-band connection means;

wherein one or more of said in-band connection means comprises the primary means for conveying said device management traffic and one or more of said out-of-band connection means comprises the secondary means for conveying said device management traffic;

wherein, when one or more of said primary means for conveying said device management traffic is available, said primary means is utilized for conveying said device management traffic, and wherein one or more of said secondary means for conveying said device management traffic is utilized for conveying said device management traffic when said one or more primary means for conveying said device management traffic is not available for conveying said device management traffic.

2. The apparatus of claim 1, wherein said management connection means is selected from the group comprising:

one or more console connections; and

one or more dedicated management segments.

3. The apparatus of claim 1, wherein said apparatus is configured for blocking traffic to said managed devices that is not from said management information communications partners.

4. The apparatus of claim 1, wherein said device management traffic utilizes one or more of the communications protocols selected from the group comprising:

Internet Control Message Protocol (ICMP);

TELNET;

Secure Shell (SSH);

Hypertext Transfer Protocol (HTTP);

Hypertext Transfer Protocol over Secure Socket Layer (HTTPS);

Domain Name Services (DNS);

Network Time Protocol (NTP);

Simple Network Management Protocol (SNMP);

SYSLOG;

Remote Authentication Dial-In User Services (RADIUS); and

Terminal Access Controller Access Control System (TACACS+).

5. The apparatus of claim 1, wherein said apparatus conveys said device management traffic that utilizes a protocol from a group of selected protocols and blocks said device management traffic that utilizes protocols not included in said group of selected protocols.

6. The apparatus of claim 1, wherein said in-band connection means conveys said device management traffic utilizing one or more of the protocols selected from the group comprising:

Internet Protocol (IP);

Transmission Control Protocol (TCP);

User Datagram Protocol (UDP); and

Internet Control Message Protocol (ICMP).

7. The apparatus of claim 6, wherein said apparatus secures said device management traffic conveyed over said in-band connection means utilizing one or more of the protocols selected from the group comprising:

Internet Security protocol (IPSec); and

Secure Socket Layer (SSL).

8. The apparatus of claim 7, wherein said out-of-band connection means conveys said device management traffic utilizing one or more of the protocols selected from the group comprising:

Internet Protocol (IP);

Transmission Control Protocol (TCP);

User Datagram Protocol (UDP); and

Internet Control Message Protocol (ICMP).

9. The apparatus of claim 8, wherein said apparatus secures said device management traffic conveyed over said out-of-band connection means utilizing one or more of the protocols selected from the group comprising:

Internet Security protocol (IPSec); and

Secure Socket Layer (SSL).

10. The apparatus of claim 2, wherein said dedicated management segment comprises a back-to-back Ethernet connection between said apparatus and said managed device.

11. The apparatus of claim 2, wherein said dedicated management segment comprises a switched infrastructure dedicated to management connections.

12. The apparatus of claim 2, wherein said dedicated management segment comprises a Virtual Local Area Network (VLAN) dedicated to management connections.

13. The apparatus of claim 1, wherein said communication network operatively coupled to said in-band connection means is selected from the group comprising:

serial connection; and

Local Area Network (LAN) connection.

14. The apparatus of claim 1, wherein said communication network operatively coupled to said out-of-band connection means is selected from the group comprising:

Public Switched Telephone Network (PSTN);

Digital Subscriber Line (DSL);

Integrated Service Digital Network (ISDN);

Local Area Network (LAN) connection; and

Serial Connection.

15. The apparatus of claim 1, wherein said device management traffic is conveyed between said apparatus and an Access Control Server (ACS) for authentication of said management information communication partners.

16. The apparatus of claim 15, wherein said device management traffic can be conveyed over either said in-band connection means or said out-of-band connection means.

17. The apparatus of claim 1, wherein said device management traffic is conveyed between said apparatus and an Access Control Server (ACS) for authorization information concerning said management information communication partners.

18. The apparatus of claim 17, wherein said device management traffic can be conveyed over either said in-band connection means or said out-of-band connection means.

19. The apparatus of claim 1, wherein said apparatus monitors the status of one or more said in-band connection means and said apparatus reports on status changes of said in-band connection means by conveying the status change information over an available said in-band connection means or said out-of-band connection means to one or more said management information communication partners.

20. The apparatus of claim 1, wherein said apparatus monitors the status of one or more said out-of-band connection means and said apparatus reports on status changes of said out-of-band connection means by conveying the status change information over an available said in-band connection means or said out-of-band connection means to one or more said management information communication partners.

21. The apparatus of claim 1, wherein said apparatus monitors the status of one or more Public Switched Telephone Network (PSTN) connection means not in continuous use by periodically placing said PSTN connection means in an off-hook state and monitoring said PSTN connection means for dial-tone, and

wherein, when said appliance does not detect said dial-tone when said appliance places said PSTN connection means in said off-hook state, said appliance conveys status information to one or more said management information communication partners utilizing an available said in-band connection means or said out-of-band connection means.