Patent Application
20140041012
This invention relates to a network management system for the management of remote networks located behind a firewall. More particularly, this invention relates to a system for the management of access points located behind a firewall whereby, the access point is authenticated by the network management system and the authenticated access point will then be connected to a web server without the need for the authentication process to be repeated.
Network elements such as access points, computers, servers, which may collectively be identified as managed devices, are conventionally managed by a network management system that monitors the configuration, performance and any faults in the managed devices. Whenever necessary, the network management system may transmit scripts to the managed devices. These scripts may contain instruction sets that will assist the managed devices to overcome any faults that may arise or these scripts may provide for the updating of the managed devices configurations.
As a security precaution, most managed devices typically reside behind a firewall. The firewall acts as an intermediary between the managed devices and computers/servers located external to the network of the managed devices. The firewall acts to inhibit unwanted access to or from the managed devices on the internal network. However, the presence of the firewall may also prevent the remote management of the managed devices, as the firewall will block incoming instructions and/or data that may be used to effect the remote management of the managed devices.
Several different internet protocols have been developed to enable the management and monitoring of managed devices located behind firewalls. These protocols often include objects and procedures for accessing information associated with a network attached device. The Simple Network Management Protocol (SNMP) is a relatively well-known management protocol that is used for managing and monitoring managed devices. SNMP includes a set of standards for network management including a protocol, database structure specification and a set of data objects. However, the implementation of a SNMP management system is not practical as a SNMP requires three basic components: an agent, a manager and a management information base. Thus, it would be advantageous if a simpler network management system could be provided for the management of access points located behind a firewall.
A system for the remote management of a computer network through a firewall is disclosed in U.S. Pat. No. 8,161,162 B1 as published on 17 Apr. 2012 in the names of Mark J. Sutherland et al. This patent discloses the remote management of a computer located behind a firewall. Communications between the remote managing server and the computer are carried out using Transmission Control Protocol and Internet Protocol (TCP/IP) such as Hypertext Transport Protocol (HTTP) and Hypertext Transport Protocol Secure (HTTPS). The managed computers are programmed to initiate communication with the remote server at regular intervals. If the remote server determines that a managed computer requires updates, the remote server will send the necessary instructions via the established communication protocol to the respective managed computer.
A method and system for updating a browser's content is described in U.S. Pat. No. 7,987,246 B2 as published on 26 Jul. 2011 in the names of Michael Tsuji, et al. This patent discloses a system for changing/updating the content on a client's computer. The system does so by first establishing a HTTP connection between the client's computer and a remote application server. Once the HTTP connection is established, the remote application server creates a HyperText Markup Language (HTML) template. The application server then appends instruction sets, commands and any other forms of commands that are to be executed by the client's computer into this HTML template. The template is then transmitted to the client's computer and the receiving computer then implements the template's contents.
Another system for managing devices located behind a firewall is disclosed in US Patent Publication No. 2011/0252117 A1 published on 13 Oct. 2011 in the names of Swee Huat Sng et al. This publication discloses a system and a method for accessing a computer that is disposed behind a firewall. The system discloses that a HTTP connection between the computer and the remote server is established when the computer transmits a HTTP request to the remote server. The remote server then processes the received request and generates a script containing instruction sets when so required. The generated script is then appended to a HTTP response and transmitted to the computer.
These documents disclose systems and methods for managing devices through a firewall. However, these documents do not disclose of systems or methods to authenticate or authorize managed devices. These documents also do not disclose the subsequent rejection actions that may take place when a managed device is deemed invalid by the network management system. Therefore, those skilled in the art are constantly looking for ways to manage devices located behind a firewall in a secure and efficient manner.
The above and other problems in the art are solved and an advance in the art is made in accordance with this invention. A first advantage of a network management system in accordance with embodiments of this invention is that this network management system will verify the identity of an access point and based on the outcome of the verification process, instruct a controller server within the network management system to carry out an action. A second advantage of a network management system in accordance with this invention is that access points that are deemed invalid will not occupy the network management system's resources as subsequent data packets transmitted by these invalid access points will automatically receive a HTTP status code 404 response. A third advantage of a network management system in accordance with in this invention is that access points that are deemed valid will be able to directly access the network management system's databases. Subsequent data packets from these valid access points will be directed straight to a web server for subsequent processing.
A system and method for implementing a network management system in accordance with an embodiment of this invention is provided in the following manner. A first access point establishes a connection with a firewall. Once the connection is established, the first access point then generates and transmits a first data packet to the firewall. The firewall then receives and transmits the first data packet to a controller server. The controller server will then verify the identity of the first access point based on the information contained in the received first data packet. The controller server will then carry out an action based on the outcome of the controller server's verification process.
In accordance with one of the embodiments of this invention, in order to determine the validity of the first access point, the controller server compares the information contained within the first data packet with information contained in a first database accessible by the controller server. If the controller server determines that the first access point is not a valid access point, the controller server will only transmit the first data packet to an authentication server. When the authentication server receives the first data packet, the authentication server will generate an access rejection packet. The access rejection packet will contain instructions for the action that is to be carried out by the controller server. The authentication server will then transmit the access rejection packet to the controller server. Upon receipt of the access rejection packet, the controller server will then implement the instructions contained within.
In accordance with the embodiment of this invention, the instructions will instruct the controller server to carry out an action in the following manner. The controller server will generate a Hypertext Transfer Protocol (HTTP) status code 404 and transmit the HTTP status code 404 to the first access point via the firewall. The controller server will automatically direct any data packets that are subsequently transmitted by first access point to a web server. Upon receipt of the data packets directed by the controller server, the web server will automatically generate a HTTP status code 404 and transmit the generated HTTP status code 404 to the first access point via the firewall.
In accordance with another embodiment of this invention, in order to determine the validity of the first access point, the controller server compares the information contained within the first data packet with information contained in a first database accessible by the controller server. If the controller server determines that the first access point is a valid access point, the controller server will generate an access request code. The access request code together with the first data packet will then be transmitted to an authentication server. When the authentication server receives the access request code together with the first data packet, the authentication server will generate an access acceptance packet. The access acceptance packet will contain instructions for the action that is to be carried out by the controller server. The authentication server will then transmit the access acceptance packet to the controller server. Upon receipt of the access acceptance packet, the controller server will then implement the instructions contained within.
In accordance with an embodiment of this invention, the instructions will instruct the controller server to carry out an action in the following manner. The controller server will query a database server that is operationally coupled to the controller server and to a web server to retrieve a configuration of the first access point. The database server will then store the retrieved configuration in a memory maintained by the database server. The configuration will then be transmitted to the controller server. The controller server will then direct the retrieved configuration to the web server. The web server will store the configuration of the first access point in a second database maintained by the web server. After that, the controller server will transmit a first status code to the first access point. When the first access point receives the first status code, the first access point will then transmit a second data packet to the firewall. The controller server will then instruct the firewall to automatically direct the received second data packet and subsequent data packets from the first access point to the web server.
In accordance with the embodiment of this invention, when the web server receives the second data packet, the web server will compare information contained in the second data packet with information in the second database to select a script that is to be executed by the first access point. The web server will then transmit the selected script to the first access point. The first access point may then execute the received script. The script may contain a variety of instructions that may be implemented by the first access point. In accordance with some of these embodiments, the script may contain instructions for the first access point to change its transmitting power.
In accordance with another embodiment of this invention, when the web server receives the second data packet, the web server may direct the second data packet from the web server to the database server that is operationally coupled to the web server and to the controller server. The database server may compare the information in the second data packet with the configuration information of the first access point stored in the memory of the database server to determine the validity of the configuration of the first access point. If the database server determines that the configuration of the first access point is not valid, the database server will retrieve a first configuration from the database. The database server will then transmit the first configuration to the web server. The web server will then append the first configuration to a script, and transmit the script to the first access point. Upon receiving the script, the first access point will then execute the instructions contained in the received script.
In accordance with another embodiment of this invention, when the web server receives the second data packet, the web server may direct the second data packet from the web server to the database server that is operationally coupled to the web server and to the controller server. The database server may compare the information in the second data packet with the configuration information of the first access point stored in the memory of the database server to determine the validity of the configuration of the first access point. If the database server determines that the configuration of the first access point is valid, the database server may instruct the web server to generate a first status code. The web server will then transmit the first status code to the first access point.
In accordance with an embodiment of this invention, the first status code generated by the web server or the controller server may comprise Hypertext Transfer Protocol (HTTP) status code 200.
In accordance with an embodiment of this invention, the connection between the first access point and the firewall may comprise a Hypertext Transfer Protocol (HTTP) application protocol.
In accordance with an embodiment of this invention, the first access point may comprise a wireless router.
In accordance with an embodiment of this invention, the first data packet and the second data packet may comprise Hypertext Transfer Protocol (HTTP) request verbs.
In accordance with an embodiment of this invention, the information contained in the first data packet may comprise the first access point's Media Access Control (MAC) address.
In accordance with an embodiment of this invention, the access rejection packet may comprise a RADIUS Access Reject data packet, the access request code may comprise a RADIUS Access Request data packet, and the access acceptance packet may comprise a RADIUS Access Accept data packet.
The above advantages and features of a method and apparatus in accordance with this invention are described in the following detailed description and are shown in the drawings:
This invention relates to a network management system for the management of remote networks located behind a firewall. More particularly, this invention relates to a system for the management of access points located behind a firewall whereby, the access point is authenticated by the network management system and the authenticated access point will then be connected to a web server without the need for the authentication process to be repeated. Instructions may then be transmitted from the network management system to the authenticated access point, instructing the access point to carry out a predetermined set of instruction routines or commands.
Processing system 300 includes Central Processing Unit (CPU) 305. CPU 305 is a processor, microprocessor, or any combination of processors and microprocessors that execute instructions to perform the processes in accordance with the present invention. CPU 305 connects to memory bus 310 and Input/Output (I/O) bus 315. Memory bus 310 connects CPU 305 to memories 320 and 325 to transmit data and instructions between the memories and CPU 305. I/O bus 315 connects CPU 305 to peripheral devices to transmit data between CPU 305 and the peripheral devices. One skilled in the art will recognize that I/O bus 315 and memory bus 310 may be combined into one bus or subdivided into many other busses and the exact configuration is left to those skilled in the art.
A non-volatile memory 320, such as a Read Only Memory (ROM), is connected to memory bus 310. Non-volatile memory 320 stores instructions and data needed to operate various sub-systems of processing system 300 and to boot the system at start-up. One skilled in the art will recognize that any number of types of memory may be used to perform this function.
A volatile memory 325, such as Random Access Memory (RAM), is also connected to memory bus 310. Volatile memory 325 stores the instructions and data needed by CPU 305 to perform software instructions for processes such as the processes for providing a system in accordance with this invention. One skilled in the art will recognize that any number of types of memory may be used to provide volatile memory and the exact type used is left as a design choice to those skilled in the art.
I/O device 330, keyboard 335, display 340, memory 345, network interface 350 and any number of other peripheral devices connect to I/O bus 315 to exchange data with CPU 305 for use in applications being executed by CPU 305. I/O device 330 may be any device that transmits and/or receives data from CPU 305. Keyboard 335 is a specific type of I/O device that receives user input and transmits the input to CPU 305. Display 340 receives display data from CPU 305 and displays images on a screen for a user to see. Memory 345 is a device that transmits and receives data to and from CPU 305 for storing data to a media. Network interface 350 connects CPU 305 to a network for transmission of data to and from other processing systems.
At step 430, controller server 210 transmits a query to database server 230 to retrieve the present configuration of access point 101. Database server 230 which is operationally coupled to controller server 210 then retrieves the present configuration of access point 101 from a database located in database server 230. The retrieved record is then stored in a memory at database server 230 so that the record may be easily accessed by future processes at step 435. Process 400 then transmits the retrieved/stored configuration of access point 101 to controller server 210 at step 440. At step 445, controller server 210 redirects and transmits the retrieved configuration to web server 220. Web server 220 then stores the retrieved configuration in an internal database at step 450. Once this is done, process 400 proceeds to step 455 whereby a status code is transmitted by controller server 210 to access point 101 via firewall 105. The status code transmitted at this step may comprise of a HTTP Response OK code such as HTTP Status Code 200 and an authentication code. At step 456, access point 101 receives the status code transmitted by controller server 210. Access point 101 then analyzes the received status code. If the received status code indicates that access point 101 may continue transmitting data packets to network management system 110, access point 101 transmits the next data packet via firewall 105 to network management system 110. In an embodiment of this invention, subsequent data packets transmitted by access point 101 will contain the earlier received authentication code. One skilled in the art will recognize that the status code transmitted and received at steps 455 and 456 respectively may comprise of any HTTP Status Codes as long as the status code or authentication code provides an indicator to access point 101 that network management system 110 is in a ready state to receive subsequent data packets. Additionally, one skilled in the art will also recognize that the authentication code received and transmitted by access point 101 may be alphabet characters, alphanumeric characters or any other set of ANSI characters that may be received and transmitted by access point 101. In an embodiment of this invention, the HTTP status code may comprise of HTTP status code 200.
In step 456, access point 101 transmits the second data packet to network management system 110 via firewall 105. The second data packet may be transmitted in the format of a HTTP Get Request which contains additional information about access point 101 together with the earlier received authentication code. In an embodiment of this invention, the additional information may contain the Media Access Control (MAC) address of access point 101. In an embodiment of this invention, the authentication code may include the identification number of the data packet. In the described embodiment, the identification number may contain the number 2. The authentication code will be used to inform network management system 110 that the data packet originated from an authorized/validated access point. Process 400 then proceeds to step 460 whereby the second data packet is automatically directed to web server 220 without having to go through the authentication procedures set out in step 415. At step 465, if an action is required of access point 101, process 400 proceeds to step 470 before proceeding to step 475. Alternatively, if network management system 110 determines that no further action is required of access point 101, process 400 will directly proceed to step 475. At step 475, network management system 110 waits to receive subsequent data packets from access point 101. If after a predetermined period, network management system 110 does not receive any data packets from access point 101, access point 101 shall be deemed inactive. Subsequent data packets transmitted from access point 101 which is considered as inactive will then have to repeat the process for authenticating an access point and for determining the subsequent action that is to be carried out, i.e. process 400. Alternatively, if access point 101 continues transmitting data packets, access point 101 will be deemed active and process 400 will instead proceed to step 460 whereby subsequent data packets received from access point 101 are assessed in step 465.
An automatic rejection process 600 for performing step 420 is illustrated in further detail in
An automatic redirection process 800 for performing step 425 for validated access points is illustrated in further detail in
In
The above is a description of a manner for implementing network management system in an efficient and effective manner. It is envisioned that those skilled in the art can and will design alternative systems that infringe upon this invention as set forth in the following claims.
| Number | Date | Country | Kind |
|---|---|---|---|
| PI 2012003455 | Jul 2012 | MY | national |
