Automatic access to network devices using various authentication schemes

• US 20070056031A1
• Filed: 08/11/2006
• Published: 03/08/2007
• Est. Priority Date: 08/19/2005
• Status: Active Grant

• Current Assignee: Riverbed Technology, LLC (Riverbed Technology Incorporated)
• Original Assignee: OPNET Technologies Incorporated (Riverbed Technology Incorporated)
• Inventors: Sivaramakrishna Iyer, Krishnan
• Granted Patent: US 8,230,491 B2
• Time in Patent Office: Days
• US Class Current: 726/12
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0813 characterised by the conditions triggering a change of settings
• CPC Class Codes: H04L 41/085 Retrieval of network configuration; Tracking network configuration history
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 69/18 Multiprotocol handlers, e.g. single devices capable of handling multiple protocols

Abstract

An access discovery method and system discovers and stores the proper access protocol for each device on a network. The discovery process includes progressively sequencing through state transitions until a successful access protocol sequence is determined, and an access script corresponding to this sequence is stored for subsequent access to the device. Preferably, the protocol-discovery algorithm is modeled as a state table that includes a start state and two possible terminal states: success and failure. A state machine executes the state table until a terminal state is reached; if the terminal state is a failure, the system backtracks to attempt an alternative sequence. The process continues until the success state is reached or until all possible sequences are executed without success. An exemplary state model is provided that has been shown to be effective for modeling network devices from a variety of vendor devices.

Claims

1. A system comprising:

an access protocol model that is configured to model a plurality of access protocols, and

an access protocol discovery module that is configured to use the access protocol model to discover an access protocol that is suitable for accessing a device on a network.

2. The system of claim 1, wherein

the access protocol discovery module is configured to store an access script corresponding to the access protocol for accessing the device.

3. The system of claim 2, including

an accessing system that is configured to use the access script for subsequent access to the device.

4. The system of claim 3, wherein

the accessing system is configured to enable the access protocol discovery module when attempting to access an other device on the network.

5. The system of claim 1, wherein

the access protocol model is configured to model the plurality of access protocols as a state machine model.

6. The system of claim 5, wherein

the state machine model includes a plurality of states, and

each access protocol is defined by a sequence of transitions between select states.

7. The system of claim 6, wherein

the states include:

a Connect state that serves as an initial state of the sequence,

a Username state wherein an identification of a user is communicated to the device,

a Password state wherein a password of the user is communicated to the device,

an Enable state wherein a command is communicated to the device, requesting that a higher level of access by enabled, and

an Enable Password state wherein a second password of the user is communicated to the device to gain the higher level of access.

8. The system of claim 7, wherein

the states include:

a Success state that identifies a final state of the sequence that defines an access protocol.

a Failure state that identifies a final state of a sequence that does not define an access protocol.

9. The system of claim 6, wherein

the state machine model includes a plurality of action-response pairs that define the transitions between the states.

10. The system of claim 9, wherein

upon entering at least one state of the plurality of states, the access protocol discovery module is configured to:

execute an action of an action-response pair corresponding to a transition from the state,

receive a device response from the device, and

transition to a next state based on whether the device response corresponds to an expected response of the action-response pair.

11. The system of claim 10, wherein

the expected response corresponds to a plurality of transitions from the state, and

the access protocol discovery module is configured to transition to the next state based on a priority associated with each of the plurality of transitions.

12. The system of claim 6, wherein

at least one state includes a plurality of possible transitions, and

each transition of the possible transitions includes a parameter that affects an order in which the possible transitions are selected for consideration within the state.

13. The system of claim 12, wherein

the access protocol discovery module is configured to modify the parameter that affects the order in which the possible transitions are selected for consideration based on prior access attempts.

14. A method comprising:

providing an access protocol model that is configured to model a plurality of access protocols, and

attempting to access a device on a network by processing the access protocol model to discover an access protocol that is suitable for accessing the device.

15. The method of claim 14, including

storing an access script corresponding to the access protocol for accessing the device.

16. The method of claim 15, including

accessing the device based on the access script.

17. The method of claim 14, wherein

the access protocol model is configured to model the plurality of access protocols as a state machine model.

18. The method of claim 17, wherein

the state machine model includes a plurality of states, and

each access protocol is defined by a sequence of transitions between select states.

19. The method of claim 18, wherein

the states include:

a Connect state that serves as an initial state of the sequence,

a Username state wherein an identification of a user is communicated to the device,

a Password state wherein a password of the user is communicated to the device,

an Enable state wherein a command is communicated to the device, requesting that a higher level of access by enabled, and

an Enable Password state wherein a second password of the user is communicated to the device to gain the higher level of access.

20. The method of claim 19, wherein

the states include:

a Success state that identifies a final state of the sequence that defines an access protocol.

a Failure state that identifies a final state of a sequence that does not define an access protocol.

21. The method of claim 18, wherein

the state machine model includes a plurality of action-response pairs that define the transitions between the states.

22. The method of claim 21, including

processing the state machine model by:

entering a state of the plurality of states,

executing an action of an action-response pair corresponding to a transition from the state,

receiving a device response from the device, and

transitioning to a next state based on whether the device response corresponds to an expected response of the action-response pair.

23. The method of claim 22, wherein

the expected response corresponds to a plurality of transitions from the state, and

transitioning to the next state is based on a priority associated with each of the plurality of transitions.

24. The method of claim 18, wherein

at least one state includes a plurality of possible transitions, and

each transition of the possible transitions includes a parameter that affects an order in which the possible transitions are selected for consideration within the state.

25. The method of claim 24, including

modifying the parameter that affects the order in which the possible transitions are selected for consideration based on prior access attempts.

26. A computer program stored on a computer readable medium, which, when executed by a processor, causes the processor to:

receive an access protocol model that is configured to model a plurality of access protocols, and

attempt to access a device on a network by processing the access protocol model to discover an access protocol that is suitable for accessing the device.

27. The computer program of claim 26, which causes the processor to:

store an access script corresponding to the access protocol for accessing the device.

28. The computer program of claim 26, wherein

the access protocol model is configured to model the plurality of access protocols as a state machine model.

29. The computer program of claim 28, wherein

the state machine model includes a plurality of states, and

each access protocol is defined by a sequence of transitions between select states.

30. The computer program of claim 29, wherein

the states include:

a Connect state that serves as an initial state of the sequence,

a Username state wherein an identification of a user is communicated to the device,

a Password state wherein a password of the user is communicated to the device,

an Enable state wherein a command is communicated to the device, requesting that a higher level of access by enabled, and

an Enable Password state wherein a second password of the user is communicated to the device to gain the higher level of access.

31. The computer program of claim 30, wherein

the states include:

a Success state that identifies a final state of the sequence that defines an access protocol.

a Failure state that identifies a final state of a sequence that does not define an access protocol.

32. The computer program of claim 29, wherein

the state machine model includes a plurality of action-response pairs that define the transitions between the states.

33. The computer program of claim 32, which causes the processor to

process the state machine model by:

entering a state of the plurality of states,

executing an action of an action-response pair corresponding to a transition from the state,

receiving a device response from the device, and

transitioning to a next state based on whether the device response corresponds to an expected response of the action-response pair.

34. The computer program of claim 33, wherein

the expected response corresponds to a plurality of transitions from the state, and

transitioning to the next state is based on a priority associated with each of the plurality of transitions.

35. The computer program of claim 29, wherein

at least one state includes a plurality of possible transitions, and

each transition of the possible transitions includes a parameter that affects an order in which the possible transitions are selected for consideration within the state.

36. The computer program of claim 35, which causes the processor to

adjust the parameter that affects the order in which the possible transitions are selected, based on prior access attempts.