Secure management access control for computers, embedded and card embodiment

• US 8,474,016 B2
• Filed: 11/29/2007
• Issued: 06/25/2013
• Est. Priority Date: 06/13/2002
• Status: Active Grant

• Current Assignee: Intellectual Ventures II LLC (Intellectual Ventures LLC)
• Original Assignee: Infinite Bay Telecom Limited Liability Company (Intellectual Ventures LLC)
• Inventors: Carley, Jeffrey Alan
• Primary Examiner(s): Truong, Thanhnga B
• Application Number:
  US11/946,976
• Publication Number:
  US 20080072291A1
• Time in Patent Office: 2,035 Days
• Field of Search: 726/6, 726/18, 726 2- 3, 709/236, 709/203, 709/208, 709225-226, 709/229, 710/17, 710/107, 710/108, 710/119, 710/305, 713/300, 713/310, 713/320, 713/330, 713/340
• US Class Current: 726/3
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A computer network management apparatus and method for remotely managing a networked device. The apparatus and method includes a management processor which is in direct communication with the networked device. The apparatus and method provides access for remotely and securely managing a networked device. The apparatus and method further separates management communications from user communications to ensure the security of the management communications. The apparatus and method further includes network and power monitoring and notification systems. The apparatus and method further provides authentication and authorization capabilities for security purposes.

Claims

1. An apparatus, comprising:

a processor configured to control one or more functions of a network device having a network interface, wherein the network device is configured to receive data requests and an encrypted form of management requests via the network interface, wherein the management requests are from a remote administrator;

a first bus; and

a bus controller coupled to the processor via the first bus, wherein the bus controller is also coupled to a second bus of the network device that is distinct from the first bus, wherein the bus controller is configured to receive the encrypted form of the management requests from the second bus, and to convey the encrypted form of the management requests to the processor via the first bus;

wherein the processor is configured to decrypt the encrypted form of the management requests, wherein the network device includes a processor configured to facilitate operation of the network device, and wherein the processor of the apparatus is distinct from the processor included in the network device.

2. The apparatus of claim 1, wherein the apparatus is configured to provide a command line interface to the remote administrator, and wherein the apparatus is configured to receive one or more commands to control the one or more functions of the network device.

3. The apparatus of claim 1, wherein the bus controller is a peripheral component interconnect (PCI) controller.

4. The apparatus of claim 1, wherein the apparatus is configured to receive power via a first power circuit, wherein the network device is configured to receive power via a second power circuit, and wherein the apparatus is configured to cycle the power received by the network device via the second power circuit.

5. The apparatus of claim 4, wherein the apparatus is configured to:

determine whether the network device is receiving power via the second power circuit; and

provide an indication, to the remote administrator, when the network device is not receiving power via the second power circuit.

6. The apparatus of claim 1, wherein the processor is configured to establish a first virtual private network connection with the remote administrator, and wherein the processor is configured to receive the management requests via the first established connection.

7. The apparatus of claim 6, wherein the processor is configured to establish a second virtual private network connection with an access control server configured to authenticate the remote administrator, and wherein the processor is configured to receive, via the second established connection, an indication of whether the remote administrator is authorized to administer the network device.

8. The apparatus of claim 1, wherein the apparatus is configured to implement a firewall that restricts traffic received from the second bus.

9. The apparatus of claim 1, wherein the apparatus is a component within the network device.

10. The apparatus of claim 1, wherein the apparatus is a card configured to be inserted into the network device via a card interface.

11. The apparatus of claim 1, wherein the network device is a network router that includes a plurality of network interfaces, and wherein the processor is dedicated to controlling one or more functions of the network router.

12. A method, comprising:

receiving, by a bus controller of a management device, an encrypted form of management requests via a first bus of a network device having a network interface, wherein the network device received the encrypted form of the management requests and data requests via the network interface, wherein the management requests are from a remote administrator;

conveying the encrypted form of management requests from the bus controller to a processor of management device via a second bus of the management device, wherein the network device includes a processor configured to facilitate operation of the network device, and wherein the processor of the management device is distinct from the processor included in the network device;

decrypting, by the processor, the encrypted form of the management requests; and

controlling, by the processor, one or more functions of the network device according to the management requests.

13. The method of claim 12, wherein the one or more functions are associated with a domain name service protocol.

14. The method of claim 12, wherein the one or more functions are associated with a network time protocol.

15. The method of claim 12, wherein the one or more functions are associated with a network management protocol.

16. The method of claim 12, further comprising:

establishing, by the management device, a virtual private network connection with an access control server configured to authenticate the remote administrator.

17. The method of claim 12, further comprising:

receiving, by the management device, additional management requests from the remote administrator via a network interface of the management device, and wherein the additional management requests are not received via the first bus of the network device.

18. The method of claim 17, wherein the network interface of the management device is a telephone-line interface.

19. The method of claim 12, further comprising:

receiving, by the management device, power via a first power circuit separate from a second power circuit of the network device; and

cycling, by the management device, power from the second power circuit to reset the network device.

20. The method of claim 12, wherein the management device is a card including the processor and the bus controller, wherein the card is configured to be inserted into the network device via a card interface.

21. The method of claim 12, wherein the network device is a network router that includes a plurality of network interfaces, and wherein the processor is dedicated to controlling one or more functions of the network router.