Out-of-band remote management station

• US 8,745,219 B2
• Filed: 12/18/2012
• Issued: 06/03/2014
• Est. Priority Date: 06/13/2002
• Status: Expired due to Term

• Current Assignee: Intellectual Ventures II LLC (Intellectual Ventures LLC)
• Original Assignee: Infinite Bay Telecom Limited Liability Company (Intellectual Ventures LLC)
• Inventors: Carley, Jeffrey A.
• Primary Examiner(s): Bengzon, Greg C
• Application Number:
  US13/718,933
• Publication Number:
  US 20130111566A1
• Time in Patent Office: 532 Days
• Field of Search: None
• US Class Current: 709/224
• CPC Class Codes: H04L 12/10 Current supply arrangements
• CPC Class Codes: H04L 41/0246 Exchanging or transporting network management information using the Internet; Embedding network management web servers in network elements; Web-services-based protocols
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/0803 Configuration setting
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 41/344 Out-of-band transfers
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/065 related to network devices
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04M 3/2263 Network management
• CPC Class Codes: H04M 3/303 and using PCM multiplexers, e.g. pair gain systems

Abstract

A management system for a computer data network comprises a remote management station connected to an analog communication system and connected to a device console port of a co-located computer device. The remote management station comprises (a) an embedded processor, (b) a connecting means to the analog communication system, and (c) a connecting means to the device console port. The remote management station is configured to detect a user connecting to or disconnecting from the device console port via the remote management station. The remote management station is configured for one or more of the following: (a) logging the user off the device console port when the user disconnects or is disconnected from the console port; (b) logging a previous user off the device console port before allowing a new user to access the device console port; or (c) monitoring messages sent to the device console port

Claims

1. A management device, comprising:

a first interface configured to receive, via a first network, a request to manage a network device;

a second interface configured to receive, via a second network, an encrypted request to manage the network device that is conveyed through the network device, wherein the second interface is configured to couple to the network device, and to communicate with an authentication server via the second network to determine whether a request to manage the network device is authorized;

a third interface configured to couple to a console port of the network device;

wherein the management device is configured, in response to a request to manage the network device being authorized, to;

receive management commands for the network device via the second interface, wherein the management commands are executable by the network device to change configuration settings of the network device;

convey the received management commands to the network device via the third interface; and

receive responses to the management commands from the network device via the third interface.

2. The management device of claim 1, wherein the first interface includes a communication device configured to communicatively couple to a telecommunication network.

3. The management device of claim 1, wherein the management device is further configured to receive management commands for the network device via the first interface.

4. The management device of claim 1, wherein the management device is configured to notify an administrator in response to detecting a power failure.

5. The management device of claim 1, wherein the management device is configured to convey the received management commands within one or more packets via the third interface.

6. The management device of claim 1, wherein the management device is configured to filter what management commands are conveyed to the network device.

7. The management device of claim 1, wherein the management device is configured to log management commands forwarded to the console port of the network device via the third interface.

8. A method, comprising:

a management device receiving an encrypted request to permit an administrator to manage a network device communicatively coupled to the management device;

in response to receipt of the request, the management device contacting an authentication server via a data network to determine whether the administrator is authorized to manage the network device;

the management device receiving management commands issued by the administrator, wherein the management commands are executable by the network device, wherein the management commands are conveyed to the management device through the network device; and

in response to determining that the administrator is authorized, the management device conveying the management commands to a console port of the network device to facilitate management of the network device, wherein the management commands are conveyed via an interface of the management device, wherein the interface is coupled to the console port.

9. The method of claim 8, further comprising:

the management device receiving, via a telecommunication network, a request to manage the network device;

the management device detecting an inability to communicate with the authentication server via the data network; and

the management device contacting the authentication server via the telecommunication network.

10. The method of claim 9, wherein the management device uses public-key encryption to contact the authentication server via the telecommunication network.

11. The method of claim 8, wherein the management device receives the request via a telecommunication network interface of the management device, and wherein the method further comprises:

the management device detecting a failure associated with the telecommunication network interface; and

the management device notifying an administrator of the failure via the data network.

12. The method of claim 8, wherein receiving the request includes:

the management device receiving a telephone call to establish a telephone connection;

the management device determining to answer the call based on received caller identification information associated with the call; and

the management device receiving the request via the telephone connection.

13. The method of claim 8, wherein the management device receives the management commands via a secure shell protocol and conveys the management commands as clear text.

14. The method of claim 8, wherein the management commands are associated with a network time protocol (NTP).

15. A management device, comprising:

a processor configured to facilitate controlling access to a console port of a network routing device by a remote administrator; and

a data network interface, wherein the management device is configured to communicate with an authentication server via the data network interface to authenticate the remote administrator to determine to cause management commands of the remote administrator to be conveyed to the console port, wherein the management commands include commands executable to change a configuration setting of the network routing device, wherein the data network interface is configured to receive an encrypted management request and management commands for the network routing device that are conveyed through the network routing device.

16. The management device of claim 15, wherein the management device is configured to:

detect a communication failure associated with the data network interface;

in response to detecting the communication failure, send an authentication request for the administrator to the authentication sever via a terminal of the administrator; and

receive, via the terminal, a corresponding response to the authentication request.

17. The management device of claim 16, wherein the authentication request includes a challenge for the authentication server, and wherein the corresponding response includes a hash responsive to the challenge.

18. The management device of claim 15, wherein the management commands are associated with a simple network management protocol (SNMP).

19. The management device of claim 15, wherein the management device is configured to cycle power provided to the network device from a power supply.

20. The management device of claim 15, wherein the authentication server is configured to implement an access control server (ACS).

21. The management device of claim 15, wherein the management device is configured to receive encrypted management commands from the administrator via a telecommunication network connection.

22. The management device of claim 15, wherein the management device is configured to receive encrypted management commands from the administrator via a secure internet protocol tunnel established over the data network.