Network communication method, network communication system, network communication apparatus and program using SNMP with improved security

• US 9,300,546 B2
• Filed: 12/20/2011
• Issued: 03/29/2016
• Est. Priority Date: 12/27/2010
• Status: Active Grant

• Current Assignee: Seiko Epson Corporation (Seiko Group)
• Original Assignee: Seiko Epson Corporation (Seiko Group)
• Inventors: Ogata, Hideaki, Takahashi, Yoichi
• Primary Examiner(s): Algibhah, Hamza
• Assistant Examiner(s): EDWARDS, JAMES A
• Application Number:
  US13/330,777
• Publication Number:
  US 20120166608A1
• Time in Patent Office: 1,561 Days
• Field of Search: 709/223
• US Class Current: 1/1
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

A method for network communication under SNMP includes: producing an access request when a first device accesses management information stored in a second device, the request containing additional information including identification information of the first device or identification information of a user of the first device in a value field included in a data field that contains an identifier field and the value field; transmitting the access request to the second device; and permitting the transmitted access request so that the number of devices or users accessing the second device may not exceed a predetermined number on the basis of the identification information of the first device or the user contained in the transmitted access request and identification information of a device or a user accessing the management information.

Claims

1. A method for network communication between a first device and a second device connected each other via a network under Simple Network Management Protocol, the method comprising:

producing an access request when the first device accesses management information stored in the second device, the access request being compliant with Simple Network Management Protocol and containing;

a data unit composed of a data list which includes a plurality of a data, the data including an object identifier and a value;

the object identifier field in which an object identifier is included for storing identification information of a target device; and

a value field which includes a capsulated information which is also compliant with Simple Network Management Protocol, the value field including an additional information field and a data list field, the additional information field including at least one of the identification information of the first device, identification information of a user of the first device for the access request;

transmitting the access request to the second device; and

permitting the access request as determined by the second device so that at least one of the number of accesses by devices or the number of accesses by users may not exceed a predetermined number, the determination being made based on at least one of the identification information of the first device and/or the identification information of the user contained in the transmitted request for accessing the management information,

wherein at least one of the identification information of the first device and the identification information of a user of the first device is not compliant with Simple Network Management Protocol.

2. The method for network communication according to claim 1, wherein the object identifier field in the access request transmitted by the first device includes information indicating presence of additional information in the access request, and the value field therein stores the identification information and the value data of a target device.

3. The network communication method according to claim 2, further comprising:

encrypting identification information and value data of the target device in the access request transmitted by the first device, wherein information on the encryption is included in the additional information in the access request, and

decryption the encrypted data on the basis of the information on encryption.

4. The method for network communication according to claim 1, wherein the predetermined number is one.

5. The method for network communication according to claim 1, wherein, upon permission of the access requested by the first device, the second device stores identification information of the first device or the user in the access request as identification information of a device or a user accessing the second device.

6. The method for network communication according to claim 1, wherein

the additional information in the access request transmitted by the first device includes information for authenticating a sender of the access request, and

the second device performs an authentication process on the basis of the information for authentication.

7. The method for network communication according to claim 6, wherein the information for authentication includes a code which is generated on the basis of the transmitted access request.

8. The network communication method according to claim 1, wherein the encryption function includes an encryption algorithm and encryption parameters.

9. A network communication system, comprising:

a first device; and

a second device connected to the first device via a network under Simple Network Management Protocol, wherein

the first device produces an access request when the first device accesses management information stored in the second device, the access request being compliant with Simple Network Management Protocol and containing;

a data unit composed of a data list which includes a plurality of a data, the data including an object identifier and a value;

the object identifier field in which an object identifier is included for storing identification information of a target device;

a value field which includes a capsulated information which is also compliant with Simple Network Management Protocol, the value field including an additional information field and a data list field, the additional information field including at least one of the identification information of the first device, identification information of a user of the first device for the access request;

transmits the access request to the second device; and

wherein the second device permits the access request transmitted by the first device by determining that at least one of the number of accesses by devices or the number of accesses by users may not exceed a predetermined number, the determination being based on at least one of the identification information of the first device or the identification information of the user contained in the transmitted request for accessing the management information, and

wherein at least one of the identification information of the first device and the identification information of a user of the first device is not compliant with Simple Network Management Protocol.

10. A network communication apparatus communicating with a device connected each other via a network under Simple Network Management Protocol, wherein the network communication apparatus produces an access request when the communication apparatus accesses management information stored in the device, the access request being compliant with Simple Network Management Protocol and containing:

a data unit composed of a data list which includes a plurality of a data, the data including an object identifier and a value;

the object identifier field in which an object identifier is included for storing identification information of a target device; and

a value field which includes a capsulated information which is also compliant with Simple Network Management Protocol, the value field including an additional information field and a data list field, the additional information field including at least one of the identification information of the first device, identification information of a user of the first device for the access request; and

transmits the access request to the device,

wherein when the communication apparatus receives an access request similar to the access request having been transmitted, the network communication apparatus permits the access request having been transmitted by determining that at least one of the number of accesses by devices or the number of accesses by users may not exceed a predetermined number, the determination being based on at least one of the identification information of the first device or the identification information of the user contained in the transmitted request for accessing the management information, and

wherein at least one of the identification information of the first device and the identification information of a user of the first device is not compliant with Simple Network Management Protocol.