Patent Application
20090100259
The present disclosure relates to the network communication field, and in particular, to a management network security framework and an information processing method.
The statements in this section merely provide background information related to the present disclosure and may not constitute prior art.
With rapid development of the Internet and the emergence of new technologies and applications, the Internet becomes an important platform for people to learn knowledge and information, communicate ideas, tap potentials and do entertainment. However, the network security problems are bringing about massive losses every year. Network security problems are challenging the current economic and social stability and harassing people's work, study and life grimly. Network security problems have become urgent problems to be solved with respect to the Internet.
Network security problems include information modifying, information disclosing, and identify masquerading. Information modifying illegally modifying the packets by a malicious node during transmission. Information disclosing includes intercepting and manipulating the packets illegally during transmission. Identity Masquerading includes when a malicious node masquerades as a legal node to join the protocol communication.
The traditional management network security is based on the security mechanism of the management protocol. Namely, the management protocol provides confidentiality and integrity assurance for protocol data, and the security mechanisms such as user authentication and access control. For example, the Simple Network Management Protocol (SNMP) R3 uses its own User-based Security Model (USM) and View-based Access Control Model (VACM) to provide relevant security features.
The traditional management network security framework comes in two modes: shared, and exclusive, as shown in
In the exclusive mode in
A solution to management network security in the related art is: On the basis of the shared mode in
As shown in act 1, an SSH session channel is established.
When an SNMP user needs to send an SNMP request through the SNMP engine to access a device, the SNMP user uses an SSH transfer protocol to establish a secure transfer connection for the SNMP user first. The secure transfer connection provides data confidentiality and integrity assurance. Afterward, the SNMP user is authenticated through an SSH user authentication protocol. If the authentication succeeds, the SSH connection protocol will establish a communication channel between the SNMP engines, and correlate the SNMP user with the established communication channel. As a result, an SSH session channel is established.
As shown in act 2, an SSH subsystem is started.
After the SSH session channel is established, the SNMP is started by the SNMP engine as a subsystem of the SSH.
As shown in act 3, management information is exchanged.
After the SSH session channel is established and the SSH subsystem is started, management information can be exchanged between the management station and the managed device through the SSH protocol.
As shown in act 4, a user is added.
When a new SNMP user who uses the same management station engine needs to access the same device mentioned above, the new SNMP user performs step 1 to step 3, and then needs to establish a new independent SSH session channel and a new independent SSH subsystem.
In the process of implementing the present disclosure, the inventor finds out that in the solution under the related art, in order to correlate a communication channel with an SNMP user, the communication channels between the management station and the same managed device increase with the rise of user quantity, and the system overhead is high.
A management network security framework includes a management station and a managed device. The management station is operable to establish a secure transfer channel between the management station and the managed device and exchange information with the managed device through the secure transfer channel. The managed devices are adapted to establish a secure transfer channel between the management station and the managed devices, authenticate the management station, and exchange information with the management station through the secure transfer channel.
A method for processing information of a management network security framework includes: establishing a secure transfer channel between the management station and the managed device, and authenticating the management station; and using the secure transfer channel to exchange information between the management station and the managed device.
The technical solution of the present disclosure reveals that, a secure transfer channel is established between the management station and the managed device; the managed device authenticates the management station; and information is exchanged between the management station and the managed device through the secure transfer channel. In this way, only one communication channel is required between the management station and the same managed device, thus saving system overhead.
The disclosures will become more fully understood from the detailed description given herein below for illustration only, and thus is not limitative of the disclosure, and wherein:
The following description is merely exemplary in nature and is not intended to limit the present disclosure, application, or uses.
The present embodiments relate to a management network security framework and an information processing method. In one embodiment, an information processing method includes layering an upper-layer management protocol and a lower-layer security protocol, introducing a Authentication Authorization Accounting (AAA) system into the security framework, and authenticating the management station through the lower-layer security protocol. Authentication and authorization is performed for the user through the upper-layer management protocol. Accordingly, a layered management network security framework is provided.
As shown in
The management station includes one or more managed devices. Security parameters are negotiated between a lower-layer security protocol client in the management station and a lower-layer security protocol server in the managed device, and the authentication information for authenticating the management station is carried in the negotiation. The management station establishes a secure transfer channel between the management station and the managed device, creates at least two management channels between the management station and the managed device through a lower-layer security protocol channel, and performs authentication and authorization for the user on the upper-layer management protocol. A management station includes a lower-layer security protocol client, an upper-layer management protocol client, and an AAA client.
The lower-layer security protocol client negotiates security parameters with the lower-layer security protocol server in the managed devices and creates a lower-layer security protocol transfer channel with the managed device. The authentication information for authenticating the management station is carried in the negotiation.
The upper-layer management protocol client sends a packet carrying authentication information and/or authorization information to the upper-layer management protocol server in the managed devices through a lower-layer security protocol transfer channel. After performing user information authentication and access control authorization for the user, the upper-layer management protocol performs information interaction with the managed device by using the lower-layer security protocol transfer channel as initiated by the user. An upper-layer management protocol client includes a management channel processing module.
The management channel processing module creates and maintains the at least two management channel in the lower-layer security protocol transfer channel. One security transfer channel can carry one or more management channels. The at least two management channels may be in either the host-user mode or the host-host mode. The at least one management channel in the host-user mode is designed to transfer the user-related management information. The at least one management channel in the host-host mode is designed to transfer the user-unrelated management information, such as alarms and logs.
The AAA client sends a packet carrying the authentication information and/or authorization information to the AAA server. The AAA client requests to authenticate and/or authorize the user.
The Managed device sends a management station authentication request to the AAA server after negotiating the security parameters between the lower-layer security protocol server and the lower-layer security protocol client in the management station and establishes a lower-layer security protocol transfer channel between the managed device and the management station. The Managed device includes an upper-layer management protocol server, an AAA client, and a lower-layer security protocol client.
The upper-layer management protocol server receives a packet carrying the authentication information and/or authorization information from the upper-layer management protocol client in the management station, sends an authentication packet and/or an authorization packet to the AAA client, and, after performing user information authentication and access control authorization for the user, performs information interaction with the management station by using the lower-layer security protocol transfer channel as initiated by the user.
The lower-layer security protocol server negotiates the security parameters with the lower-layer security protocol client in the management station, sends a management station authentication request to the AAA client, and creates a lower-layer security protocol transfer channel between the lower-layer security protocol server and the management station.
The AAA client transfers the authentication request sent by the lower-layer security protocol server to the AAA server; transfers the packet carrying the authentication information and/or authorization information sent by the upper-layer management protocol server to the AAA server, and requests to authenticate and/or authorize the user.
The AAA server authenticates the management station according to the received authentication request and performs user information authentication or access control authorization for the user according to the packet carrying the authentication information or authorization information.
The previous managed device also includes an AAA server, which is configured to authenticate the management station according to the authentication request sent by the lower-layer security protocol server and perform user information authentication and/or access control authorization for the user according to the packet carrying the authentication information and/or authorization information sent by the upper-layer management protocol server.
The upper-layer management protocols include SNMP, NETCONF (network configuration protocol), and new upper-layer management protocols that will emerge in the future. Lower-layer security protocols include Transport Layer Security (TLS), SSH and new lower-layer security management protocols that will emerge in the future. AAA servers include Diameter servers, Radius servers, and new authentication & authorization servers that will emerge in the future. AAA clients include Diameter clients, Radius clients, and new clients that will emerge in the future.
As shown in
As shown in act 3-1, the management station negotiates security parameters with the managed device through a lower-layer security protocol.
Before the upper-layer management protocol begins working, the lower-layer security protocol client in the management station negotiates security parameters with the lower-layer security protocol server in the managed devices to determine the security parameters required for ensuring data confidentiality and integrity, including keys and encryption algorithms. The previous negotiation process also determines the authentication information, for example, management engine identifier for authenticating the management station.
As shown in act 3-2, the AAA server authenticates the management station.
After the security parameters are negotiated between the management station and the managed device through a lower-layer security protocol, the lower-layer security protocol server in the managed devices obtains the management station authentication information, and sends a management station authentication request to the AAA server. If the authentication fails, the lower-layer security protocol server will notify the authentication failure causes to the lower-layer security protocol client, and terminate the subsequent operation. If the authentication succeeds, a lower-layer security protocol transfer channel will be established between the lower-layer security protocol client in the management station and the lower-layer security protocol server in the managed devices, and will be available to the upper-layer management protocol.
As shown in act 3-3, the AAA server authenticates the user information.
After the lower-layer security protocol transfer channel is established, the management station needs to authenticate the user information to ensure that the user identity is legal to the management station. There are two authentication modes.
The first authentication mode (Authentication mode 1) relates to mark 3 and mark 4 in
The second authentication mode (Authentication mode 2) relates to mark 3′ in
If the previous authentication request for the user fails, the upper-layer management protocol will terminate the management operations involved in the user authentication; otherwise, the procedure proceeds to act 3-4.
As shown in act 3-4, the AAA server performs access control authorization for the user.
After the lower-layer security management channel is established and the user information is authenticated, the AAA server will check the user access control rights through an upper-layer management protocol in either of the following two modes:
The first mode (Mode 1) relates to mark 3 and mark 4 in
The second mode (Mode 2) relates to mark 3′ in
If the previous authorization request for the user fails, the upper-layer management protocol will terminate the management operations involved in the user authorization; otherwise, the procedure proceeds to act 3-5.
As shown in act 3-5, the management station creates at least two management channels in the lower-layer security protocol transfer channel for exchanging management information between the management station and the managed device.
After the lower-layer security protocol transfer channel is established and the user is authenticated and authorized successfully, as initiated by the user, the management station exchanges management information with the managed device through the lower-layer security protocol transfer channel in the mode specified by the protocol.
The lower-layer security protocol transfer channel may be shared by multiple users under the same management station. For the users with different access control rights under the same management station, it is necessary to repeat act 3-3 and act 4-4.
In the practical application, the AAA server and the AAA client under the present disclosure may exist as logical functions only instead of physical entities. The work involved in authentication and authorization is implemented by the managed device.
The management station may establish at least two management channels in the lower-layer security protocol transfer channel. One security transfer channel can carry one or more management channels, and the at least two management channels are established and maintained through the management protocol. The at least two management channels under the present disclosure may be in either the host-user mode (mode 1) or the host-host mode (mode 2).
The at least one management channel in the host-user mode is designed to transfer the user-related management information, which is about the configuration operations such as SNMP read operation, SNMP write operation, NETCONF read command, and NETCONF edit command. For example, if an SNMP read operation is initiated by a user, the managed device must authenticate the user and check whether the user has the right of initiating the operation. Therefore, this type of operation is user-related. The user authentication is unrelated to the management station or the managed device. The authentication of each user is independent. Therefore, the user authentication cannot be bound to the lower-layer security protocol transfer channel, and can only be bound to each management channel.
The at least one management channel in the host-host mode is designed to transfer the user-unrelated management information such as alarms and logs. Such management information includes: SNMP alarm information, NETCONF alarm information, and SYSLOG log information. The at least one management channel in the host-host mode is not directly related to users, but a credit relationship must exist between the hosts (management station and managed devices). Therefore, the at least one management channel in the host-host mode must adopt the host-to-host authentication mode. Moreover, the authentication of the entities at both sides is bound to both the management channel and the lower-layer security protocol transfer channel, for example, the TLS host authentication is applied directly. The authenticated identity is bound to both the lower-layer security protocol transfer channel and the at least one management channel in the host-host mode.
A lower-layer security protocol transfer channel may include multiple management channels in the host-host mode and the host-user mode concurrently. Namely, a lower-layer security protocol transfer channel may carry the management data of multiple users and the management data in the host-to-host mode concurrently.
In one embodiment, a secure transfer channel is established between the management station and the managed device, the managed device authenticates the management station, and information is exchanged between the management station and the managed device through the secure transfer channel. Only one communication channel is required between the management station and the same managed device, thus saving system overhead.
One embodiment performs layering of the upper-layer management protocol and the lower-layer security protocol, introduces an AAA system, and combines them organically; and provides a basic security model for various management protocols. Therefore, the management protocols that will emerge in the future can be integrated into this security framework conveniently.
The present disclosure proposes to establish a management channel between the management station and the managed device and separate the management channel for alarms from the management channel for configuration information, thus simplifying the creation of alarm management channels and the authentication process.
Although the disclosure has been described through some preferred embodiments, the disclosure is not limited to such embodiments. It is apparent that those skilled in the art can make various modifications and substitutions to the disclosure without departing from the spirit and scope of the disclosure. The disclosure is intended to cover the modifications and substitutions provided that they fall in the scope of protection defined by the following claims or their equivalents.
| Number | Date | Country | Kind |
|---|---|---|---|
| 200610086418.4 | Jun 2006 | CN | national |
| 200610167202.0 | Dec 2006 | CN | national |
This application is a continuation of International Application No. PCT/CN2007/070134, filed on Jun. 19, 2007. This application claims the benefit of Chinese Application No. 200610086418.4, filed on Jun. 19, 2006. The disclosure of the above applications is incorporated herein by reference in their entirety.
| Number | Date | Country | |
|---|---|---|---|
| Parent | PCT/CN2007/070134 | Jun 2007 | US |
| Child | 12337835 | US |
