SYSTEMS AND METHODS FOR NETWORK MANAGEMENT USING SECURE MESH COMMAND AND CONTROL FRAMEWORK

• US 20100223473A1
• Filed: 02/27/2009
• Published: 09/02/2010
• Est. Priority Date: 02/27/2009
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Likins, Adrian Karstan, Vidal, Seth Kelby, DEHAAN, MICHAEL PAUL
• Granted Patent: US 9,313,105 B2
• Time in Patent Office: Days
• US Class Current: 713/180
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: H04L 41/02 Standardisation; Integration
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

Embodiments relate to systems and methods for network management using a secure mesh command and control framework. A network management server can communicate with a set of supervisory hosts, which in turn communicate with an underlying set of targets. The set of targets can have associated digital certificates which can be authenticated by common certificate authorities. A controlled target can authenticate one or more other target requesting access to the controlled target via the trusted common certificate authority. One authenticated target can therefore mesh on a trusted basis with another target to perform installation, monitoring, testing, or other activities directly on the target of interest, without channeling commands through an intervening supervisory host.

Claims

1. A method of distributing a network command, comprising;

generating at least one network command via a set of targets;

authenticating a security credential for at least one target in the set of targets to identify at least one trusted target;

establishing a secure channel between the at least one trusted target and at least one controlled target in the set of targets;

validating the authorization of the at least one trusted target to execute the network command via an access control list; and

communicating command data to the at least one controlled target from the at least one trusted target.

2. The method of claim 1, wherein the security credential comprises a digital certificate.

3. The method of claim 2, wherein the authenticating a security credential comprises authenticating the digital certificate via the at least one certificate authority.

4. The method of claim 1, wherein the secure channel comprises a secure socket layer.

5. The method of claim 1, wherein the communicating the command data comprises communicating the command data from the at least one trusted target to at least one additional target via the at least one trusted target.

6. The method of claim 1, wherein the command data comprises at least one of an inventory command, a test command, a setup command, a configuration command, a trend command, and a security command.

7. The method of claim 1, wherein the authenticating a security credential for at least one trusted target in the set of targets comprises authenticating a security credential for a plurality of trusted targets in the set of targets.

12. The system of claim 1, wherein the communicating the command data comprises communicating the command data from the at least one trusted target to the at least one additional target via the at least one trusted target.

8. A mesh network system, comprising:

an interface to a set of targets in a network; and

at least one trusted target; and

at least one controlled target, the at least one controlled target communicating with the at least one trusted target via the interface and being configured to

receive a request for the initiation of a at least one network command from the at least one trusted target,

initiate the authentication of a security credential of the at least one trusted target, and

validate the authorization of the at least one trusted target to execute the network command via an access control list.

9. The system of claim 8, wherein the security credential comprises a digital certificate.

10. The system of claim 9, wherein the authenticating a security credential comprises authenticating the digital certificate via the at least one certificate authority.

11. The system of claim 8, wherein the secure channel comprises a secure socket layer.

13. The system of claim 8, wherein the command data comprises at least one of an inventory command, a test command, a setup command, a configuration command, a trend command, and a security command.

14. The system of claim 8, wherein the authenticating a security credential for at least one trusted target in the set of targets comprises authenticating a security credential for a plurality of trusted targets in the set of targets.

15. A network command communicated to a controlled target machine, the network command being generated by a method comprising:

generating at least one network command via a set of targets;

authenticating a security credential for at least one target in the set of targets to identify at least one trusted target;

establishing a secure channel between the at least one trusted target and at least one controlled target in the set of targets;

validating the authorization of the at least one trusted target to execute the network command via an access control list; and

communicating command data to the at least one controlled target from the at least one trusted target.

16. The network command of claim 15, wherein the security credential comprises a digital certificate.

17. The network command of claim 16, wherein the authenticating a security credential comprises authenticating the digital certificate via the at least one certificate authority.

18. The network command of claim 15, wherein the secure channel comprises a secure socket layer.

19. The network command of claim 15, wherein the command data comprises at least one of an inventory command, a test command, a setup command, a configuration command, a trend command, and a security command.