JP2003122650A - Network managing system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a network managing system with a reinforced security function by minimizing the increase of processing loads by using the SNMPv1 which has become most popular at present. SOLUTION: A network managing device 100 makes an encryption processing part 106 encrypt an SNMP command and identification information according to a security level set in a security information table part 105, and prepares a packet including an SNMP-PDU, and transmits the packet to network equipment 200. On receiving the packet from the network equipment 200, the network managing device 100 makes a decoding processing part 111 decode the SNMP command and identification information included in the packet, and judges the matching of the identification information, and executes the SNMP command.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a network management system, and more particularly to a network management system with enhanced security.

[0002]

2. Description of the Related Art A conventional network management system uses an industry standard management protocol SNMPv1 (Simple Net) between a network management device and a network device.
work Management Protocol
Version 1, below, unless otherwise specified
Community name (identification information) is used when exchanging information using SNMPv1.
Access control was performed using.

More specifically, the community name is recognized only by the network management device. When acquiring information from a certain network device or changing a variable of a certain network device, the network management device causes the network device to add the community name set in the network device to the SNMP command. And sends it to the network device. The network device determines whether or not the community name added to the received SNMP command matches its own community name. If the community names match, the network device receives the received SNM.
Processing is performed according to the P command, and a response is returned to the network management device.

By the way, the network management device transmits the community name to the network device via the network. Therefore, the community name flowing through the network may be illegally obtained by a third party. If you use the illegally acquired community name,
It is also possible for a third party to illegally operate the network device. This is an important issue for network management.

Therefore, in order to solve the above problems, SNMPv2 / v3 (Version 2 / Ve)
version 3) has been proposed. SNMPv2 / v
In 3, in order to enhance the security, the whole SNMP packet is encrypted and transmitted to the network device by using the encryption technique. In such a case, SN on the network
Even if the MP packet is illegally acquired, the third party
Since the community name cannot be recognized, security can be enhanced.

[Problems to be Solved by the Invention] However, SNMPv2
In / v3, the entire SNMP packet is encrypted, so
Even the information having a relatively low security level such as the destination IP address and the content of the SNMP command has been encrypted. Therefore, there is a problem that the amount of information of the data to be encrypted increases and the processing becomes heavy. Therefore, at present, there are not many SNMPv2
The protocol using / v3 has not spread widely.

[0006] Therefore, an object of the present invention is to provide a network management system in which the increase in processing load is minimized and the security function is enhanced by using the most popular SNMPv1 at present.

[0007]

According to a first aspect of the present invention, there is provided a network management system in which a management device connected to a network uses a management command to manage communication equipment connected to the network. Is a management command generating means for generating a management command for giving a management operation instruction to the communication device, and an identification for the communication device to judge whether the management operation instruction is from an authorized operator. Encryption means for encrypting information,
A management command transmitting unit that transmits the identification information encrypted by the encryption unit to the communication device together with the management command, and the communication device decrypts the encrypted identification information transmitted from the management command transmitting unit. Decryption means to
Based on the identification information decrypted by the decryption means, the management operation determination means determines whether or not the management operation instruction based on the management command transmitted from the management command transmission unit is from an authorized operator. And management operation execution means for executing management operation based on the management command based on the judgment of the management operation judgment means.

With the configuration of the first invention, the network management system encrypts only the identification information, prevents the identification information from leaking to the outside, and enhances security. At this time, since information other than the identification information is not encrypted, it is possible to reduce the processing required for encryption, minimize the increase in processing load, and provide a network management system with enhanced security. .

A second invention is an invention subordinate to the first invention, wherein the management device further comprises a security information setting section for setting whether or not to encrypt the identification information for each identification information. The encryption means is characterized by encrypting the identification information based on the setting of the security information setting unit.

With the configuration of the second invention, the management device encrypts only the identification information for which confidentiality is set in advance. Therefore, since it is not necessary to encrypt all the identification information, it is possible to provide a network management system with enhanced security without increasing the processing load. Further, when a communication device having no decryption function is added to the network management system, the management device may set the communication device so that the identification information is not encrypted. In this way, a communication device without a decryption function can coexist in the network management system, which facilitates system introduction.

A third invention is an invention according to the first invention, wherein the encrypting means encrypts the management command together with the identification information, and the management command transmitting part identifies the identification encrypted by the encrypting means. The encrypted management command is transmitted to the communication device together with the information, the decryption means decrypts the encrypted management command based on the judgment of the management operation judging means, and the management operation executing means judges the decrypted management command. Perform management operations based on commands.

With the configuration of the third invention, the network management system encrypts the management command together with the identification information, but does not encrypt other information. Therefore, it is possible to minimize the increase in processing load and provide a network management system with higher security.

A fourth invention is an invention according to the third invention, wherein the management device further comprises a security information setting unit for setting whether or not to encrypt the management command for each identification information. The encryption means is characterized by encrypting the management command based on the setting of the security information setting section.

With the configuration of the above-mentioned fourth invention, the management device encrypts the identification information for which confidentiality is set in advance and the management command including it. Therefore, since it is not necessary to encrypt all the identification information and the management command, it is possible to provide a network management system with enhanced security without increasing the processing load. Further, when a communication device having no decryption function is added to the network management system, the management device may set the communication device so that the identification information and the management command are not encrypted. . By doing so, it is possible to allow a communication device without a decoding function to coexist in the network management system,
System introduction becomes easy.

A fifth invention is according to the first invention, and the communication device further comprises a response command generating means for generating a response command for responding to a management operation instruction from the management device, Management target encryption means for encrypting the management target identification information for the management device to determine whether or not the response command is from the management target communication device, and management encrypted by the management target encryption means The management device includes a response command transmission unit that transmits the target identification information together with the response command to the management device, and the management device further decrypts the encrypted management target identification information transmitted from the response command transmission unit. Of the response command transmitted from the response command transmission unit based on the management means and the management target identification information decrypted by the management target decryption means. Comprises a Managed determining means for determining whether or not from the device, based on the judgment of the managed determining means and response command execution means for executing a process based on the response command.

With the configuration of the fifth invention, the communication device encrypts only the identification information included in the response command transmitted to the management device, prevents the identification information from leaking to the outside, and enhances security. . At this time, since information other than the identification information is not encrypted, the processing required for encryption can be reduced and the increase in processing load can be minimized.
A network management system with enhanced security will be provided.

A sixth aspect of the invention is an invention according to the fifth aspect of the invention, wherein the communication device sets, for each management target identification information, security information for setting whether or not to encrypt the management target identification information. The management target encryption means further includes a setting unit, and encrypts the management target identification information based on the setting of the security information setting unit.

With the configuration of the sixth invention, the communication device encrypts only the identification information whose confidentiality is set in advance. Therefore, since it is not necessary to encrypt all the identification information, it is possible to provide a network management system with enhanced security without increasing the processing load.

A seventh invention is an invention according to the fifth invention, wherein the management target encryption means encrypts the response command together with the management target identification information, and the response command transmitting section
A response command encrypted together with the management target identification information encrypted by the management target encryption means is transmitted to the management device, and the management target decryption means transmits the response command encrypted based on the judgment of the management target judgment means. And the response command execution means executes processing based on the decrypted response command.

According to the configuration of the seventh invention, the network management system encrypts the response command together with the identification information, but does not encrypt other information. Therefore, it is possible to minimize the increase in processing load and provide a network management system with higher security.

An eighth invention is according to the seventh invention, wherein the communication device has a security information setting section for setting whether or not to encrypt the response command for each management target identification information. Further, the managed encryption means is characterized in that the response command is encrypted based on the setting of the security information setting section.

With the configuration of the eighth invention, the communication device encrypts the identification information for which confidentiality is set in advance and the response command including it. Therefore, since it is not necessary to encrypt all the identification information and the response command, it is possible to provide a network management system with enhanced security without increasing the processing load.

A ninth aspect of the present invention is a network management system in which a management device connected to a network manages the communication device in response to a command from the communication device connected to the network. Command generation means for generating a command for requesting management, and management target encryption means for encrypting management target identification information for the management device to determine whether or not the command is from a management target communication device And a command transmission unit for transmitting the management target identification information encrypted by the management target encryption means together with the command to the management device, and the management device is configured to send the encrypted management target transmitted from the command transmission unit. A command based on the management target decoding means for decoding the identification information and the management target identification information decoded by the management target decoding means Based on the judgment of the management target judgment means that judges whether the command transmitted from the receiver is from the communication device that is the management target of itself, and the judgment of the management target judgment means, execute the processing based on the command And a command executing means for executing.

According to the ninth aspect of the invention, the communication device encrypts only the identification information included in the autonomous command notified to the management device, prevents the identification information from leaking to the outside, and enhances security. Plan. At this time, since information other than the identification information is not encrypted, it is possible to reduce the processing required for encryption, minimize the increase in processing load, and provide a network management system with enhanced security. .

A tenth aspect of the present invention is a network management device for managing a communication device connected to a network by a management operation by a management command, and a management command for generating a management command for giving a management operation instruction to the communication device. Command generation means, encryption means for encrypting identification information for the communication device to determine whether the management operation instruction is from an authorized operator, and identification encrypted by the encryption means. A management command transmission unit that transmits information to the communication device together with the management command.

With the configuration of the tenth aspect of the invention, the network management device encrypts only the identification information, prevents the identification information from leaking to the outside, and enhances security. At this time, since the information other than the identification information is not encrypted, the processing required for the encryption can be reduced, and the increase of the processing load on the network management device can be minimized.

An eleventh aspect of the present invention is a communication device for transmitting a command to a network management device connected to a network to be managed by the network management device, the command generating command for receiving the management by the management device. A generation unit, a management target encryption unit that encrypts management target identification information for the network management apparatus to determine whether or not the command is from a communication target management device, and a management target encryption unit that encrypts the management target identification information. And a command transmitting unit for transmitting the converted management target identification information together with the command to the network management apparatus.

According to the eleventh aspect of the invention, the communication device encrypts only the identification information, prevents the identification information from leaking to the outside, and enhances security. At this time, since the information other than the identification information is not encrypted, the processing required for the encryption can be reduced, and the increase in the processing load on the communication device can be minimized.

[0029]

1 is a diagram showing the overall configuration of a network management system according to an embodiment of the present invention. The network management system according to the embodiment of the present invention includes three network devices 200 and one network management device 100. Although the number of the network devices 200 is three in FIG. 1, the number may be three or more or less than three. Further, although the number of the network management apparatus 100 is one, the number of the network management apparatuses 100 may be one or more. The network device 200 is a communication device referred to in the claims.

The network management device 100 monitors and controls the network device 200 via the network 300. Based on an instruction from the network management device 100, the network device 200 notifies the network management device 100 of the information held by itself, via the network 300. In addition, the network device 20
0 is the network management device 1 that autonomously reports failure information and the like.
00 is notified. Examples of the network device 200 managed by the network management device 100 include a router, a switching hub, a personal computer, and a printer. The network 300 is, for example,
For example, a LAN (Local Area Network) or the like.

Management information between the network management device 100 and the network device 200 (for example, MIB (Ma
(negotiation Information Base)
Object ID and its variables, fault information, etc.) is an industry standard management protocol, SNMP.
Is used. SNMP is a protocol for monitoring and managing devices connected to the network via the network. Network management device 100
And the network device 200 exchange management information by transmitting and receiving packets. The packet includes a destination address, an SNMP command, and identification information (also called a community name).

There are three types of SNMP commands. First
Indicates that the network management device 100 is the network device 2
This is a command for managing 00. The second is a command (hereinafter referred to as a response command) for the network device 200 to respond based on an instruction from the network management device 100. Thirdly, the network device 20
0 is the network management device 10 autonomously for failure information
This is a command for notifying 0 (hereinafter referred to as an autonomous notification command).

The identification information (community name) is a character string known only to the network administrator, and is set in each network device 200 and network management apparatus 100. Each network device 200 collates the identification information and determines whether the management operation instruction by the SNMP command is given by an operator having a proper authority. Network management device 10
The value 0 collates the identification information to determine whether the response command or the autonomous notification command is transmitted from the network device that is the management target of itself. The destination address is the address of the destination of the SNMP command and the identification information.

FIG. 2 shows a network management device 10 in a network management system according to an embodiment of the present invention.
It is a block diagram showing the functional composition of 0. 2, the network management device 100 includes a command generation processing unit 120, a command analysis processing unit 130, a packet transmission / reception unit 104, and a security information table unit 105.
An encryption processing unit 106, an encryption key management unit 107, a decryption processing unit 111, and a decryption key management unit 112.

As a security information table, the security information table section 105 associates the identification information and the security level with the addresses of the communication devices (the network device 200 and the network management device 100) existing on the network 300. Remember.
FIG. 3 is a diagram showing an example of the security information table stored in the security information table unit 105. In FIG. 3, the identification information consists of a character string predetermined by the network administrator. The identification information is a secret character string known only to the network administrator. Security levels are level "0" (security level of normal SNMP), level "1" (level "0")
It has three levels: security level with stronger security) and level "2" (security level with more security than level "1"). For example, security level "2" is set for devices such as routers that should be enhanced in security, and a simple PC
For example, the security level “0” may be set.
Further, the security level “0” is set to the network device 200 that does not use the public key cryptosystem (described later).

For example, in FIG. 3, the identification information of the communication device (here, the network device 200) whose address is "A" is "ABC", and the security level is "1". In FIG. 3, it is assumed that its own address is “M”. That is, the address of the network management device 100 is “M”. The identification information of the network management device 100 whose address is “M” is “MNO”. Network management device 10
The identification information corresponding to the address of 0 is the management target identification information in the claims. Since the network management apparatus 100 needs to further strengthen security, the security level is set to "2".

In FIG. 3, one identification information is set for the device in the security information table, but two or more identification information may be set separately. At this time, for example, in the read command, the identification information is set to “Public” as a character string that is known even by an operator who does not have special authority, and in the set command, the identification information is a character string only known to an operator who has special authority. You can use columns.

The encryption processing unit 106 encrypts the SNMP command or the identification information based on the instruction from the command generation processing unit. A public key cryptosystem is used for encryption. The encryption key management unit 107 determines whether each network device 2
The public key of 00 is stored.

The command generation processing unit 120 operates based on an operator's operation or a periodic information collection request.
An SNMP command for the network device 200 is generated. The command generation processing unit 120 that generated the SNMP command refers to the security information table unit 105 to check the security level of the destination network device 200, and according to the security level, the SNMP
The command and the identification information are encrypted (encryption according to the security level will be described later). The command generation processing unit 120 uses the SNMP command (encrypted SNMP command if encrypted) and identification information (encrypted identification information if encrypted)
-Generate a PDU (Protocol data unit) and give it to the packet transmitting / receiving unit 104. SNMP-
The PDU includes an SNMP command (encrypted SNMP command when encrypted) and identification information (encrypted identification information when encrypted). Also, the command generation processing unit 120 uses the SNMP-P
The destination address of the network device 200 that is the destination of the DU is given to the packet transmitting / receiving unit 104. Note that, here, in order to make the explanation easy to understand, the identification information and the SNM are
Although it is handled separately from the P command, the SNMP command actually includes the identification information. In any case,
The SNMP command and the identification information are included in the SNMP-PDU.

The packet transmission / reception unit 104 creates a packet from the SNMP-PDU given from the command generation processing unit 120 and the destination address, and transmits it to the destination network device. The packet transmitting / receiving unit 104 also receives a packet transmitted from the network device 200. The packet transmitting / receiving unit 104 sends the received packet to the command analysis processing unit 130.

The command analysis processing unit 130 extracts the destination address and the SNMP-PDU from the packet given from the packet transmitting / receiving unit 104, and the SNMP-PDU.
Analysis of. Specifically, the command analysis processing unit 130
Extracts the identification information (encrypted identification information if encrypted) and the SNMP command (encrypted SNMP command if encrypted) from the SNMP-PDU. The command analysis processing unit 130 refers to the security information table unit 105 to check the security level of the packet transmission source. The command analysis processing unit 130, according to the security level checked,
Identification information and SN encrypted in the decryption processing unit 111
Decrypt the MP command. Command analysis processing unit 13
0 determines whether the identification information included in the SNMP-PDU matches its own identification information, and executes the SNMP command included in the SNMP-PDU only when the identification information matches.

The decryption processing unit 111 receives the encrypted SNMP based on the instruction from the command analysis processing unit 130.
Decrypt the command or identification information. Decryption processing unit 1
11 uses its own private key stored in the decryption key management unit 112 when decrypting. The decryption key management unit 112
It remembers its own private key.

FIG. 4 is a block diagram showing a more detailed functional configuration of the command generation processing unit 120. In FIG. 4, the command generation processing unit 120 includes an SNMP command generation unit 101, an identification information generation unit 102, and an SNMP-
And a PDU generation unit 103.

The SNMP command generator 101 generates an SNMP command for the network device 200 based on an operation by an operator or a periodic information collection request. The SNMP command generation unit 101 refers to the security information table unit 105, and when the security level of the destination network device 200 is “2”, causes the encryption processing unit 106 to encrypt the SNMP command. The SNMP command generation unit 101 provides the identification information generation unit 102 with an SNMP command (in the case of encryption, an encrypted SNMP command) and a destination address to which the SNMP command is transmitted.

When the identification information generation unit 102 receives the SNMP command (encrypted SNMP command if encrypted) from the SNMP command generation unit 101, it refers to the security information table unit 105.
When the security level of the network device 200 corresponding to the destination address is “1” or “2”, the identification information generation unit 102 causes the encryption processing unit 106 to encrypt the identification information. The identification information generation unit 102 uses the SNMP command (in the case of encryption, the encrypted SNMP command),
The identification information (encrypted identification information when encrypted) and the destination address are given to the SNMP-PDU generation unit 103. It should be noted that the SNMP command may include identification information (the identification information may be treated as an argument of the SNMP command, and so on).

From the received SNMP command (encrypted SNMP command if encrypted) and identification information (encrypted identification information if encrypted), the SNMP-PDU generation unit 103 determines the SNMP-PDU. Is generated and the SNMP-PDU and the destination address are given to the packet transmitting / receiving unit 104.

FIG. 5 is a block diagram showing a more detailed functional configuration of the command analysis processing unit 130. In FIG. 5, the command analysis processing unit 130 includes an SNMP command analysis unit 108, an identification information analysis unit 109, and an SNMP-
And a PDU analysis unit 110.

The SNMP-PDU analysis unit 110 uses the packet provided from the packet transmission / reception unit 104 to obtain the SNMP.
-Retrieve the PDU. SNMP-PDU analysis unit 110
Analyzes the extracted SNMP-PDU and identifies the identification information (encrypted identification information if the identification information is encrypted) and the SNMP command (encrypted if the SNMP command is encrypted). Identification information) and supplies it to the identification information analysis unit 109.

The identification information analysis section 109 refers to the security information table section 105 to check its own security level. When the security level is “1” or “2”, the identification information analysis unit 109 causes the decryption processing unit 111 to decrypt the encrypted identification information. The identification information analysis unit 109 includes the security information table unit 1
05, it is determined whether or not the identification information matches its own identification information. When the identification information matches, the SNM
P command (encrypted S if encrypted)
(NMP command) to the SNMP command analysis unit 108. If the identification information does not match, the identification information analysis unit 109 discards the SNMP command.

The SNMP command analysis section 108 refers to the security information table section 105 to check the security level. If the security level is "2", S
The NMP command analysis unit 108 causes the decryption processing unit 111 to decrypt the encrypted SNMP command,
Execute the MP command.

FIG. 6 is a block diagram showing a functional configuration of the network device 200 in the network management system according to the embodiment of the present invention. The network device 200 receives the SNMP- from the network management device 100.
When the PDU is sent, a response command (which is a part of the SNMP command) for the PDU is returned to the network management device 100. In addition, the network device 200 is
When a failure occurs, an autonomous notification command (SNM
Network management device 10)
Send to 0.

In FIG. 6, the network device 200
Is a command generation processing unit 220, a command analysis processing unit 230, a packet transmission / reception unit 204, a security information table unit 205, an encryption processing unit 206, an encryption key management unit 207, a decryption processing unit 211, And a decryption key management unit 212.

The security information table unit 205, as a security information table, is associated with the address of the network management device 100 and its own address.
The identification information and the security level are stored. Figure 7
FIG. 6 is a diagram showing an example of a security information table stored in the security information table unit 205.
In FIG. 7, the identification information and the security level are the same as those in the network management device 100. In FIG. 7, its own address is assumed to be “A”. The address “M” is the network management device 1.
00 address. Identification information and security level are set corresponding to these addresses,
These match the settings in the security information table unit 105 of the network management device 100.

The encryption key management unit 207 stores the public key of the network management device 100 in association with the address of the network management device 100. Encryption processing unit 20
6 is based on the instruction from the command generation processing unit 220,
The SNMP command or the identification information is encrypted by referring to the public key of the encryption key management unit 207.

The decryption key management unit 212 stores its own secret key in association with its own address. Decryption processing unit 2
The reference numeral 11 refers to the decryption key management unit 212 based on the instruction from the command analysis processing unit 230 to decrypt the encrypted SNMP command or identification information.

The packet transmitting / receiving unit 204 receives the packet transmitted from the network management device 100,
It is given to the command analysis processing unit 230. Further, the packet transmitting / receiving unit 204 creates a packet based on the SNMP-PDU and the destination address given from the command generation processing unit 220, and transmits the packet to the network management device 100 corresponding to the destination address.

The command analysis processing section 230 uses the SNM included in the packet given from the packet transmitting / receiving section 204.
Parse the P-PDU and execute the SNMP command. The function of the command analysis processing unit 230 is the same as the function of the command analysis processing unit 130 of the network management device 100, and thus detailed description will be omitted. Further, FIG. 5 is referred to for the more detailed functional configuration of the command analysis processing unit 230.

The command generation processing section 220 generates an SNMP-PDU from the response command or autonomous notification command to the network management device 100 and the identification information. The command generation processing unit 220 uses the SNMP-P
The DU and the destination address are given to the packet transmitting / receiving unit 204. The function of the command generation processing unit 220 is the same as the function of the command generation processing unit 120 of the network management device 100, and thus detailed description will be omitted. Further, FIG. 4 is referred to for the more detailed functional configuration of the command generation processing unit 220.

FIG. 8 is a flowchart showing the operation of the command generation processing section 120 in the network management device 100. Hereinafter, the operation of the command generation processing unit 120 will be described with reference to FIG. First, the command generation processing unit 120 generates an SNMP command triggered by an operator's operation or a periodic information collection request (step S1001).

Next, the command generation processing section 120 refers to the security information table section 105 and refers to the SNM concerned.
The security level of the destination of the P command is acquired (step S1002). Next, the command generation processing unit 1
20 determines whether or not the acquired security level is “2” (step S1003).

In the judgment of step S1003,
When the security level is not “2”, that is, when the security level is “0” or “1”, the command generation processing unit 120 proceeds to the operation of step S1005. On the other hand, when the security level is “2”, the command generation processing unit 120 proceeds to the operation of step S1004, causes the encryption processing unit 106 to encrypt the SNMP command, and proceeds to the operation of step S1005.

In the operation of step S1005, the command generation processing section 120 refers to the security information table section 105 and acquires the identification information of the network device 200 of the transmission destination. Next, the command generation processing unit 120
Determines whether the security level of the destination network device 200 is "0" (step S10).
06).

In the determination at step S1006,
When the security level is “0”, the command generation processing unit 120 proceeds to the operation of step S1008. On the other hand, when the security level is not “0”, that is, when the security level is “1” or “2”, the command generation processing unit 120 causes the encryption processing unit 106 to encrypt the acquired identification information ( Step S100
7) and proceeds to the operation of step S1008.

In the operation of step S1008, the command generation processing section 120 has an SNMP command (encrypted SNMP command if encrypted) and identification information (encrypted identification information if encrypted).
SNMP-PDU is created from (step S100).
8). After that, the command generation processing unit 120, together with the created SNMP-PDU, sends the destination network device 20.
The destination address of 0 is given to the packet transmitting / receiving unit 104 (step S1009), and the operation is ended.

FIG. 9 is a flowchart showing the operation of the command analysis processing unit 130 in the network management device 100. Hereinafter, the operation of the command analysis processing unit 130 will be described with reference to FIG. First, the command analysis processing unit 130 receives a packet given from the packet transmitting / receiving unit 104 (step S2001).
The packet includes the SNMP-PDU and the destination address. The SNMP-PDU includes a response command from the network device 200 or an autonomous notification command.

Next, the command analysis processing unit 130 extracts the SNMP-PDU from the received packet and
The SNMP command (SNM included in the MP-PDU
If the P command is encrypted, the encrypted S
The NMP command) and identification information (encrypted identification information if the identification information is encrypted) are acquired (step S2002). Next, the command analysis processing unit 1
The 30 refers to the security information table unit 105 and acquires its own security level (step S
2003). Next, the command analysis processing unit 130 determines whether or not its own security level is “0” (step S2004).

In the judgment of step S2004,
When the own security level is “0”, the command analysis processing unit 130 proceeds to the operation of step S2006. On the other hand, when the self security level is not “0”, that is, the security level is “1” or “2”
If it is, the command analysis processing unit 130 causes the decryption processing unit 111 to decrypt the encrypted identification information (step S2005), and proceeds to the operation of step S2006.

In the operation of step S2006, the command analysis processing unit 130 refers to the security information table unit 105 to determine whether the identification information included in the received SNMP-PDU matches with its own identification information. to decide. If they do not match, the command analysis processing unit 130
Discards the received SNMP command (encrypted SNMP command if encrypted) (step S2008) and ends the operation. On the other hand, if they match, the command analysis processing unit 130 again refers to the security information table unit 105 to acquire its own security level (step S2007), and then the step S20.
The operation proceeds to 09.

In the operation of step S2009, the command analysis processing unit 130 determines whether or not its own security level is "2". When the own security level is “2”, the command analysis processing unit 130
Proceeds to the operation of step S2010, and the decoding processing unit 1
11 to cause the SNMP command to be decrypted, and step S20
Proceed to the operation of 11. On the other hand, when the own security level is not “2”, that is, when the security level is “0” or “1”, the command analysis processing unit 1
The process proceeds to step S2011 in step 30.

In the operation of step S2011, the command analysis processing unit 130 analyzes the SNMP command,
The management operation of the analyzed SNMP command is executed, and the operation ends.

FIG. 10 is a flow chart showing the operation of the command generation processing section 220 in the network device 200. Hereinafter, the operation of the command generation processing unit 220 will be described with reference to FIG. When the command generation processing unit 220 transmits a response command to the network management apparatus 100 or an autonomous notification command such as failure information to the network management apparatus 100, the command generation processing unit 220 starts activation and returns the response command or autonomous notification. A command is created (step S3001). Here, the response command is the SNM from the network management device 100.
As a result of executing the P command, the network management device 10
Created when a reply should be returned to 0.

After that, the command generation processing unit 220 causes the command generation processing unit 120 of the network management apparatus 100 to operate.
In the same manner as the above operation, the destination network management device 1
The security level of 00 is acquired by referring to the security information table unit 205, and when the security level is “2”, the SNMP command (here, a response command or an autonomous notification command) and the identification information are encrypted, When the security level is "1", only the identification information is encrypted, and when the security level is "0", the SNMP command and the identification information are not encrypted, and the SNMP-PDU is created and the Send to the packet transmitting / receiving unit 204 (step S
1001 to S1009). Steps S1001 to S10
The operation of 09 is the same as the operation of the command generation processing unit 120 of the network management device 100, and thus detailed description thereof will be omitted.

The operation of the command analysis processing section 230 in the network device 200 is as follows.
The operation is the same as that of the command analysis processing unit 130 at 0. Therefore, FIG. 9 is referred to for the operation of the command analysis processing unit 230. Command analysis processing unit 2
30 is the same as the command analysis processing unit 130 of the network management apparatus 100.
The identification information (encrypted identification information if encrypted) and the SNMP command (encrypted SNMP command if encrypted) included in the P-PDU are extracted (steps S2001 and S200).
2). The command analysis processing unit 230 checks its own security level. If the security level is “1” or “2”, the command analysis processing unit 230 decrypts the identification information so that the received identification information matches the own identification information. It is determined whether there is any (steps S2003 to S2006). The command analysis processing unit 230 determines that the SN
The MP command is decrypted and executed, and if they do not match, the SNMP command is discarded (step S2007).
~ S2011).

As described above, in the network management system according to the embodiment of the present invention, the network management device 100 and the network device 200 provide the identification information when the security levels of the transmission destination are "1" and "2". Encrypt. If the security level is higher, that is, "2", the SNMP command is further encrypted. The network management system according to the embodiment of the present invention is different from SNMPv2 / v3.
Since the identification information and the SNMP command may be encrypted as needed, the information amount of the data to be encrypted can be minimized. Therefore, it is possible to reduce an increase in processing load on the network device 200 and the network management apparatus 100 on the network management system. As a result, even on the existing SNMPv1,
It is possible to provide a network management system capable of minimizing the increase in processing load and enhancing the security of the network management system.

In the network management system according to one embodiment of the present invention, when the security level of the transmission destination is "1", the identification information is encrypted, so that the identification information can be kept secret. .

Further, in the network management system according to one embodiment of the present invention, when the security level of the transmission destination is "2", the SNMP command is encrypted, so it is possible to determine what kind of operation is being performed. It can be prevented from being known by the three parties. For example, the SNMP command may include a numerical value that a third party cannot know. In the network management system according to the embodiment of the present invention, it becomes possible to prevent such a numerical value from being known to a third party.

Here, a case where a new network device or network management device is installed in the network management system according to one embodiment of the present invention will be described.
In the following, a case where a new network device is installed will be described as a representative. When installing a new network device, the existing network device 200 and the network management apparatus 100 add the identification information and the security level associated with the address of the new network device to the security information table. Here, if the new network device does not adopt the public key cryptosystem, the public key and the secret key may be set in the network device and the new function shown in FIG. 6 may be added.

However, adding a new function as shown in FIG. 6 increases the load on the network device. Therefore, if the security level of the new network device is set to “0” in the existing network device 200 and the network management device 100, the identification information and the SNMP command transmitted to the new network device are set. Is not encrypted, the new network device can execute the SNMP command as it is. However, in this case, the SNMP command from the new network device to the network management apparatus 100 is not encrypted.

As described above, in the network management system according to the embodiment of the present invention, a new network device can be added without adding any function (public key cryptosystem, etc.) to the new network device. It is possible. This indicates that the network management system according to the embodiment of the present invention may include network devices 200 that do not adopt the public key cryptosystem. That is, the network management device 100 can manage both a network device that does not have a security function (public key cryptosystem) and a network device that has the security function.

The contents stored in the security information table section 105 of the network management apparatus 100 (identification information /
(Security level) and the stored contents (identification information / security level) of the security information table unit 105 of the network device 200 can be updated only by a privileged user, so that the identification information is prevented from leaking to the outside. Is possible.

Further, the stored contents (identification information / security level) of the security information table section 105 of the network device 200 may be changed from the network management apparatus 100 by remote control.

In the embodiment of the present invention, SNMP is used as the network management protocol. However, a management device connected to the network uses a command to access a communication device connected to the network. Any network management protocol may be used as long as it is controlled by an identifier known only to privileged users.

[0083]

As described above, according to the present invention, encryption is performed by encrypting only the identification information for the network device to determine whether the management operation instruction is from the authorized operator. It is possible to provide a network management system that can reduce the amount of processing required for the above, minimize the increase in processing load, and enhance security.

[Brief description of drawings]

FIG. 1 is a diagram showing an overall configuration of a network management system according to an embodiment of the present invention.

FIG. 2 is a block diagram showing a functional configuration of a network management device 100 in the network management system according to the embodiment of the present invention.

FIG. 3 is a diagram showing an example of a security information table stored in a security information table unit 105.

FIG. 4 is a block diagram showing a more detailed functional configuration of a command generation processing unit 120.

5 is a block diagram showing a more detailed functional configuration of a command analysis processing unit 130. FIG.

FIG. 6 is a block diagram showing a functional configuration of the network device 200 in the network management system according to the embodiment of the present invention.

7 is a diagram showing an example of a security information table stored in a security information table unit 205. FIG.

FIG. 8 is a flowchart showing an operation of the command generation processing unit 120 in the network management device 100.

9 is a flowchart showing an operation of the command analysis processing unit 130 in the network management device 100. FIG.

10 is a flowchart showing an operation of a command generation processing unit 220 in the network device 200. FIG.

[Explanation of symbols]

100 network management device 200 network equipment 300 networks 120, 220 Command generation processing unit 130,230 Command analysis processing unit 104,204 Packet transmitter / receiver 105,205 Security information table section 106, 206 encryption processing unit 107, 207 Encryption key management unit 111, 211 Decoding processing unit 112,212 Decryption key management unit 101 SNMP command generator 102 identification information generation unit 103 SNMP-PDU generation unit 108 SNMP command parser 109 identification information analysis unit 110 SNMP-PDU analysis unit

   ─────────────────────────────────────────────────── ─── Continued front page    F-term (reference) 5B085 AA08 AE02 AE06 AE09 AE23                       BA07                 5B089 GB02 JA35 KB03                 5J104 AA07 AA08 AA33 CA02 JA21                       KA01 LA03 PA07                 5K033 AA08 BA08 CB14 DB20

Claims (11)

[Claims] 1. A network management system in which a management device connected to a network uses a management command to manage a communication device connected to the network, wherein the management device controls the communication device to perform a management operation. Management command generation means for generating a management command for giving an instruction, and encryption for encrypting identification information for the communication device to judge whether or not the instruction for management operation is from an authorized operator Means and a management command transmission unit for transmitting the identification information encrypted by the encryption unit together with the management command to the communication device, wherein the communication device is an encryption transmitted from the management command transmission unit. Decrypting means for decrypting the encrypted identification information, and the management command based on the identification information decrypted by the decrypting means. Management operation determining means for determining whether or not the management operation instruction based on the management command transmitted from the transmitting unit is from an authorized operator; and the management operation determining means based on the determination by the management operation determining means. A network management system comprising: a management operation executing means for executing a management operation based on a command. 2. The management device further includes a security information setting unit that sets whether or not to encrypt the identification information for each identification information, and the encryption unit sets the security information setting unit. Characterized in that the identification information is encrypted based on
The network management system according to claim 1. 3. The encryption unit also encrypts the management command together with the identification information, and the management command transmission unit sends the encrypted management command together with the identification information encrypted by the encryption unit to the communication. The decryption means decrypts the encrypted management command based on the judgment of the management operation judgment means, and the management operation execution means executes the management operation based on the decoded management command. The network management system according to claim 1. 4. The management device further includes a security information setting unit that sets whether or not to encrypt the management command for each identification information, and the encryption unit sets the security information setting unit. The network management system according to claim 3, wherein the management command is encrypted based on the. 5. The communication device further comprises response command generating means for generating a response command for responding to a management operation instruction from the management apparatus, and the response command is from a communication target management device. Management target encryption means for encrypting the management target identification information for the management device to judge whether or not the management device, the management target identification information encrypted by the management target encryption means together with the response command, the management A management command decryption unit that decrypts the encrypted management target identification information transmitted from the response command transmission unit, and the management target, Based on the management target identification information decrypted by the decryption means, the response command transmitted from the response command transmission unit is set as the management target of its own. The management target determination means for determining whether or not it is from a device, and the response command execution means for executing processing based on the response command based on the determination of the management target determination means. The described network management system. 6. The communication device further includes a security information setting unit that sets whether or not to encrypt the management target identification information for each management target identification information, and the management target encryption unit includes the security information setting unit. The network management system according to claim 5, wherein the management target identification information is encrypted based on the setting of the security information setting unit. 7. The managed object encryption means encrypts the response command together with the managed object identification information, and the response command transmission section encrypts the managed object identification information encrypted by the managed object encryption means. The encrypted response command to the management device, the managed decryption means decrypts the encrypted response command based on the determination of the managed determination means, and the response command execution means decrypts The network management system according to claim 5, which executes a process based on the received response command. 8. The communication device further includes a security information setting unit that sets whether or not to encrypt the response command for each management target identification information, and the management target encryption unit includes the security information. The network management system according to claim 7, wherein the response command is encrypted based on the setting of the setting unit. 9. A network management system in which a management device connected to a network manages the communication device by a command from the communication device connected to the network, wherein the communication device is managed by the management device. Command generation means for generating a command for requesting a command, and management target encryption for encrypting management target identification information for the management device to determine whether the command is from a communication device to be managed And a command transmitting unit that transmits the management target identification information encrypted by the management target encryption unit to the management device together with the command, and the management device is transmitted from the command transmission unit. Management target decryption means for decrypting the encrypted management target identification information; Management target determining means for determining whether or not the command transmitted from the command transmitting unit is from a communication device to be managed by itself, based on the management target identification information; Command execution means for executing processing based on the command based on the determination,
Network management system. 10. A network management device for managing a communication device connected to a network by a management operation by a management command, the management command generating means generating a management command for giving a management operation instruction to the communication device. An encryption means for encrypting identification information for the communication device to determine whether the management operation instruction is from an authorized operator; and the identification information encrypted by the encryption means. And a management command transmitting unit that transmits the management command together with the management command to the communication device. 11. A communication device that transmits a command to a network management device connected to a network and is managed by the network management device, the command generation means generating a command for receiving the management by the management device. And a management target encryption unit that encrypts management target identification information for the network management device to determine whether the command is from a communication target management device, and the management target encryption unit. A communication device, comprising: a command transmission unit that transmits encrypted management target identification information together with the command to the network management device.