Security method for operator access control of network management system

• US 20040168089A1
• Filed: 02/13/2004
• Published: 08/26/2004
• Est. Priority Date: 02/19/2003
• Status: Abandoned Application

• Current Assignee: Samsung Electronics Co. Ltd.
• Original Assignee: Samsung Electronics Co. Ltd.
• Inventors: Lee, Hyun-Sook
• Application Number:
  US10/777,602
• Publication Number:
  US 20040168089A1
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

To access control without changing a presently used version of a system application protocol, an operator enters an ID and a password of the operator for user authentication, and, if the user authentication is successful, the operator will have access to an application layer of a system managed using either TCP/IP or UDP/IP. The application layer is adapted to be accessed using a security module to confirm whether or not an IP address of a terminal used by the operator is a preset IP address. In a network operating a version of a network management interface not equipped with a security function, the security deficiency of the system is alleviated by simply adding the security module without effecting a version upgrade process.

Claims

1. A security method for operator access control of a network management system, the method comprising:

performing an Internet Protocol (IP) filtering to determine whether or not an inputted Internet Protocol address of an external operator is a preset Internet Protocol address using one of either a Transmission Control Protocol/Internet protocol (TCP/IP) or a User Datagram Protocol/Internet protocol (UDP/IP); and

connecting the external operator to a communication system by either inputting an Identifier/Password or by setting communities upon a determination that the Internet Protocol address of the external operator is a preset Internet Protocol address.

2. The security method according to claim 1, wherein performing an Internet Protocol (IP) filtering comprises:

a) creating a row after setting a filtering range for objects that are implemented by a Management Information Base (MIB);

b) selecting whether to discard or accept a Simple Network Management Protocol (SNMP) packet to be inputted or outputted;

c) selectively accepting a request for the Simple Network Management Protocol (SNMP) packet if the row is used as an egress policy, while not outputting a response packet; and

d) selectively outputting the response packet for the Simple Network Management Protocol (SNMP) packet if the row is used as an ingress policy, while not allowing accepting the request for the Simple Network Management Protocol (SNMP) packet.

3. The security method according to claim 2, wherein creating a row after setting a filtering range for objects that are implemented by a Management Information Base (MIB) comprises:

e) determining a PolicyId (PId) as to whether or not to adopt a certain packet processing method;

f) finding a row in a FilterPolicy table, the row having a relevant value based on the determined PolicyId value;

g) reading a pointer value of the row found in the FilterPolicy table; and

h) finding a relevant row in a FilterIp table using the previously read pointer value as an index number, and then determining whether or not operator access is permitted based on conditions for an Internet Protocol (IP) address and a port number set in the relevant row to process a packet.

4. The security method according to claim 3, wherein the FilterIp table, in which items of the conditions for determining whether or not the operator access is permitted are recorded, comprises:

an index number field using a pointer value corresponding to the policyId as an index, an Internet Protocol (IP) address field, an Internet Protocol (IP) address mask field, a port number field, a protocol field, a control field, and a row status field.

5. The security method according to claim 4, wherein a syntax of each of the index number field, the port number field, the protocol field, the control field and the row status field is of an integer type, and

a syntax of each of the Internet Protocol (IP) address field and the Internet Protocol (IP) address mask field is of an Internet Protocol (IP) address type.

6. The security method according to claim 1, where the external operator comprises one of a telnet terminal or an Element Management System (EMS) server.

7. A program storage device, readable by machine, tangibly embodying a program of instructions executable by the machine to perform a security method for operator access control of a network management system, the method comprising:

performing an Internet Protocol (IP) filtering to determine whether or not an inputted Internet Protocol address of an external operator is a preset Internet Protocol address using one of either a Transmission Control Protocol/Internet protocol (TCP/IP) or a User Datagram Protocol/Internet protocol (UDP/IP); and

connecting the external operator to a communication system by either inputting an Identifier/Password or by setting communities upon a determination that the Internet Protocol address of the external operator is a preset Internet Protocol address.

8. The program storage device according to claim 7, wherein performing an Internet Protocol (IP) filtering comprises:

a) creating a row after setting a filtering range for objects that are implemented by a Management Information Base (MIB);

b) selecting whether to discard or accept a Simple Network Management Protocol (SNMP) packet to be inputted or outputted;

c) selectively accepting a request for the Simple Network Management Protocol (SNMP) packet if the row is used as an egress policy, while not outputting a response packet; and

d) selectively outputting the response packet for the Simple Network Management Protocol (SNMP) packet if the row is used as an ingress policy, while not allowing accepting the request for the Simple Network Management Protocol (SNMP) packet.

9. The program storage device according to claim 8, wherein creating a row after setting a filtering range for objects that are implemented by a Management Information Base (MIB) comprises:

e) determining a PolicyId (PId) as to whether or not to adopt a certain packet processing method;

f) finding a row in a FilterPolicy table, the row having a relevant value based on the determined PolicyId value;

g) reading a pointer value of the row found in the FilterPolicy table; and

h) finding a relevant row in a FilterIp table using the previously read pointer value as an index number, and then determining whether or not operator access is permitted based on conditions for an Internet Protocol (IP) address and a port number set in the relevant row to process a packet.

10. The program storage device according to claim 9, wherein the FilterIp table, in which items of the conditions for determining whether or not the operator access is permitted are recorded, comprises:

an index number field using a pointer value corresponding to the policyId as an index, an Internet Protocol (IP) address field, an Internet Protocol (IP) address mask field, a port number field, a protocol field, a control field, and a row status field.

11. The program storage device according to claim 10, wherein a syntax of each of the index number field, the port number field, the protocol field, the control field and the row status field is of an integer type, and a syntax of each of the Internet Protocol (IP) address field and the Internet Protocol (IP) address mask field is of an Internet Protocol (IP) address type.

12. The program storage device according to claim 7, where the external operator comprises one of a telnet terminal or an Element Management System (EMS) server.