WO2007030989A1

WO2007030989A1 - A network management system and the method thereof

Info

Publication number: WO2007030989A1
Application number: PCT/CN2006/000988
Authority: WO
Inventors: Fuyou Miao
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2005-09-14
Filing date: 2006-05-16
Publication date: 2007-03-22
Also published as: CN100484027C; CN1933418A

Abstract

A network management system includes: the SNMP agent module; the SNMP manager module; the session channel establishing apparatus, which is separately connected with the SNMP agent module and the SNMP manager module, is used for establishing the session channel between the SNMP agent module and the SNMP manager module with the secure shell SSH protocol. Also a network management method includes: establish the session channel between the SNMP agent module of the managed device and the SNMP manager module of the manager station with the secure shell SSH protocol; the SNMP agent module and the SNMP manager module make use of the session channel to exchange the data. The invention can reduce the complexity of SNMP management.

Description

Network management system and method

Technical field

The present invention relates to the field of network management technologies, and in particular, to a network management system and method. Background technique

To solve the problem of router management on the Internet, IETF (Internet Engineering Task

Force, Internet Engineering Task Force) proposed SNMP (Simple Network Management Protocol). Currently, SNMP has been used to manage network devices such as servers, workstations, routers, switches, network hubs, and personal computers. SNMP enables network administrators to manage network operations, identify and resolve network problems, and plan for network development. In the SNMP network management system, the S:NMP agent module (agent) is in the managed device for monitoring the operation of the managed device; the SNMP management module (manager) is located at the network management station, and the managed device is obtained through the SNMP agent module. Run the situation and send the administrator's configuration data to the managed device.

SNMP has now evolved to the third version of SNMP V3. Compared with the previous two versions, the security management mode has been added to SNMP V3, and USM (User-based Security Model) has been introduced into its structure. The USM is a module embedded in SNMP. The other modules send the security requirements and security parameters (security name, key, and security level) of the packets to the USM. The USM processes the packets based on these parameters, including the data source. Verification, data integrity and confidentiality.

The USM model needs to configure information such as the key and user name between every two SNMP agents and the network management station. When the number of managed devices and management stations is large, not only the amount of configuration data increases sharply, but also the maintenance of these data is also Very difficult.

In the SNMP network management mode of the USM, the USM account or the USM key cannot be used in common with other network management systems, which greatly increases the management complexity of SNMP. For example, if a user has an SSH (Secure Shell) management account, even if the SSH management object and the SNMP management object of the user are the same, the SSH account cannot be used in the prior art of the USM. In SNMP management, the USM account must be re-established for the user in SNMP, which inevitably increases SNMP. The complexity of security management.

Summary of the invention

In view of this, the main object of the present invention is to propose a network management system to reduce the complexity of SNMP security management.

Another object of the present invention is to provide a network management method to reduce the complexity of SNMP security management.

In order to achieve the above object, the present invention provides the following technical solutions:

A network management system includes: an SNMP agent module and an SNMP management module, and the system further includes:

a session channel establishing device, respectively connected to the SNMP agent module and the SNMP management module, configured to establish, between the SNMP agent module and the SNMP management module, the SNMP agent module and the SNMP by using a secure shell SSH protocol The management channel performs a session channel for data interaction.

The session channel establishing device includes: an SSH client and an SSH server connected thereto, where

The SSH client is further connected to the SNMP management module, configured to establish an SSH transmission connection with the SSH server according to the request of the SNMP management module, and initiate a user authentication request to the SSH server;

The SSH server is further connected to the SNMP agent module, and is configured to verify the user authentication request sent by the SSH client, establish a session channel with the SSH client on the SSH transmission connection, and start the SNMP agent module connected thereto as a child. system.

Optionally, the SNMP management module and the SSH client are in the same process. Optionally, the SNMP agent module and the SSH server connected thereto are located in different processes on the same device.

The number of the SSH server and the SNMP agent module are the same, one or more, and corresponding to the connection.

When there are multiple SSH servers, the SSH client is connected to each SSH server. Optionally, the system further includes:

The authentication server is connected to the SSH server, and is configured to verify the user authentication request forwarded by the SSH server, and send the verification result to the SSH server.

When there are multiple SSH servers, the authentication server is connected to each SSH server. A network management method for a management station to manage managed devices through a simple network management protocol, the method comprising:

A. Establish a session channel between the SNMP agent module on the managed device and the SNMP management module on the management station through the secure shell SSH protocol;

B. The SNMP agent module and the SNMP management module exchange data by using the session channel. The step A includes:

The SSH client establishes an SSH connection with the SSH server according to the request of the SNMP management module.

The SSH client initiates a user authentication request to the SSH server by using the SSH transport connection.

The SSH server verifies the user authentication request;

After the verification is passed, the SSH server establishes a session channel with the SSH client and starts the SNMP agent module.

The steps of establishing an SSH transmission connection between the SSH client and the SSH server include:

The SSH client initiates an SSH transport connection creation request to the SSH server.

The SSH server listens for the transport connection creation request and creates an SSH transport connection with the SSH client based on the transport connection creation request.

The method further includes:

After the SSH server detects the SSH client connection creation request from the SSH client, it provides a digital signature to the SSH client.

The SSH client checks the digital signature. The step of the SSH client initiating a user authentication request to the SSH server is specifically as follows:

The SSH client initiates a password authentication request to the SSH server.

The steps of the SSH server to start the SNMP agent module include:

The SSH client sends a request to start the SNMP proxy module to the SSH server.

The SSH server initiates the request to start the SNMP agent module as a subsystem and redirects the standard input and output of the SNMP agent to the session channel.

Preferably, the method further comprises: pre-establishing a connection between the authentication server and the SSH server.

The step of verifying the user authentication request by the SSH server includes: after receiving the user authentication request initiated by the SSH client, the SSH server sends the user authentication request to the authentication server;

The authentication server verifies the user authentication request and sends the verification result to the SSH server.

As can be seen from the above technical solution: In the network management system of the present invention, the SSH client establishes an SSH transmission connection with the SSH server, and initiates a user authentication request to the SSH server; the SSH server, the user The authentication request is verified, a session channel with the SSH client is established according to the SSH transport connection, and the SNMP agent module is started; the SNMP agent module exchanges data with the SNMP management module according to the session channel. Since SSH is also a secure shell access tool, SNMP accounts and accounts accessed by the command line interface can be shared. Therefore, after the application of the present invention, the SNMP account is no longer required to be reconfigured, but the SSH account can be directly applied to the SNMP management, thereby greatly reducing the complexity of the SNMP security management.

In addition, in the present invention, an authentication server is employed, and centralized maintenance of user accounts on the authentication server does not require configuration of user information on each managed device, thereby greatly simplifying the configuration. For example, if a user is added and the user can manage the managed device 1, the managed device 2, and the managed device 3, then only the account information of the user needs to be configured on the authentication server, and it is indicated that the account can manage the three. The devices are configured, and the same account number is no longer required to be configured on the managed device 1, the managed device 2, and the managed device 3. Because every user in the network It is often possible to manage a large number of devices, the number of which may be hundreds. If the user is configured one by one, it needs to be configured hundreds of times, and the application of the present invention only needs to be configured once, so the invention is also greatly reduced. The workload of the account configuration.

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a schematic block diagram of a system of the present invention;

2 is a schematic block diagram of a first embodiment of the system of the present invention;

3 is a schematic block diagram of a second embodiment of the system of the present invention;

4 is a schematic block diagram of a third embodiment of the system of the present invention;

Figure 5 is a flow chart showing the implementation of the method of the present invention;

FIG. 6 is a flowchart of establishing a session channel between an SNMP agent module and an SNMP management module in the method of the present invention.

DETAILED DESCRIPTION OF THE INVENTION In order to make those skilled in the art better understand the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

The core of the invention is to establish a session channel between the SNMP agent module and the SNMP management module through an SSH (Secure Shell) transmission protocol, and the SNMP agent module and the SNMP management module use the session channel for data interaction, thereby implementing an SNMP network. management.

Those skilled in the art know that the SSH protocol is a security protocol based on the application layer and the transport layer. It is mainly composed of a transport layer protocol, a user authentication protocol, and a connection protocol to jointly implement the security and confidentiality mechanism of SSH. The transport layer protocol provides security measures such as authentication, confidentiality, and integrity checks, and it provides data compression. The user authentication protocol is used to implement identity authentication between the server and the client user. The connection protocol allocates multiple encrypted channels to some logical channels, which run on top of the user authentication layer protocol.

Use SSH to execute shell programs and commands on the server, divided into three categories: shell, executable, and subsystem. The subsystem (Subsystem) is a process running by the SSH server (SSH daemon, sshd). When the channel is established in the connection protocol after the user authentication is passed, the process is started, and the process redirects its standard input and output (STDIN and STDOUT). Go to the newly established channel. Because the communication between the user and the subsystem is redirected to the SSH connection protocol On the channel Channel, so the subsequent communication between the process and the user is protected by SSH.

Figure 1 is a block diagram of the system of the present invention:

The system includes: an SNMP agent module 101, an SNMP management module 103, and a session channel establishing means 11. The SNMP agent module 101 is located on the managed device, the SNMP management module 103 is located on the network management device, and the session channel establishing device 11 is connected to the SNMP agent module 101 and the SNMP management module 103, respectively.

The session channel establishing device 11 is configured to establish a session channel between the SNMP agent module and the SNMP management module by using the secure shell SSH protocol, so that the SNMP agent module and the SNMP management module can perform secure data interaction through the session channel, for example, SNMP management. The module obtains the running status of the managed device through the SNMP agent module, and sends the configuration data to the managed device, thereby implementing management of the network device. These managed network devices can be servers, workstations, routers, switches, and the like.

Figure 2 shows a block diagram of the first embodiment of the system according to the invention:

As shown in FIG. 2, the system includes: an SNMP agent module 101, an SSH server 102,

The SSH client 104 is connected to the SNMP management module 103, the SSH client 104 is further connected to the SSH server 102, and the SSH server 102 is further connected to the SNMP agent module 101. The SSH client 104 is used by the SSH client 104. Establishing an SSH transmission connection with the SSH server 102, and initiating a user authentication request to the SSH server 102. The SSH server 102 is configured to verify the user authentication request, and establish a session channel with the SSH client 104 on the SSH transmission connection. And the SNMP agent module 101 is started as a subsystem; the SNMP agent module 101 uses the session channel to exchange data with the SNMP management module 103.

The SNMP agent module 101 is located in the managed device, and may preferably be a process. The SNMP agent module 101 monitors the running status of the managed device, and sends the running status of the managed device to the SNMP management module 103 through the session channel established by the SSH server 102 and the SSH client 104, and the configuration sent by the management module 103. The data is forwarded to the managed device.

When the network management device needs to perform data interaction with the device, the SNMP management module 103 initiates a transmission connection creation request to the SSH client 104, and the SSH client 104 receives the request. The transport connection creation request is sent to the SSH server 102. The SSH server 102 listens for a transport connection creation request from the SSH client 104, wherein the listening port may not use the IANA (Internet Assigned Number Authority) assigned to the well-known port of the SSH. If the SSH server 102 is listening for a transport connection creation request from the SSH client 104, the SSH server 102 runs the SSH transport protocol, creates an SSH transport connection with the SSH client 104, and provides a digital signature to the SSH client 104; SSH server 102. The user authentication request sent by the SSH client 104 is verified, wherein the user authentication request sent by the SSH client 104 is preferably a password authentication risk request. The SSH server 104 checks the password according to a certain policy to complete the user authentication function. Upon completion of the user authentication, the SSH server 102 responds to the session channel connection setup request from the SSH client 104 to create an interactive session channel, and activates the SNMP agent module 101 as a subsystem, and the SNMP agent module 101 The standard input and output (STDIN and STDOUT) are redirected to the created interactive session channel and the data between the SNMP agent module 101 and the SNMP management 103 is transmitted using the interactive session channel.

The SNMP management module 103 initiates a transport connection creation request to the SSH client 104, and the SSH client 104 sends the transport connection creation request to the SSH server 102 to create an SSH transport connection with the SSH client 104. After creating the interactive session channel, the SNMP management module 103 sends a data transfer request to the SSH client 104, and the SSH client 104 sends the data transfer request to the SSH server 102 to send data to the SSH client 104 or from the SSH client. 104 receives data. The SNMP management module 103 is usually in the same process as the SSH client 104, and may also be located in different processes of the same device. Preferably, the SNMP management module 103 is located on the management station; and preferably the SNMP agent module 101 and the SSH server 102 are located. On the same device.

The SSH client 104 is configured to initiate a transport protocol creation request to the SSH server 102, check the digital signature of the SSH server 102, and initiate a user authentication request to the SSH server 102. The SSH client 104 is further configured to initiate a session channel connection establishment to the SSH server 102. Requesting and instructing the SSH server 102 to start the SNMP agent module 101 as a subsystem; acquiring data from the SNMP management module 103 and transmitting the obtained data to the SSH server 102, or from SSH The server 102 receives the data and sends the received data to the SNMP management module 103.

The SSH client 104 can connect to only one SSH server 102 or multiple SSH servers 102.

Figure 3 shows a block diagram of a second embodiment of the system of the present invention:

As shown in FIG. 3, the SSH server includes a first SSH server 203, an nth SSH server 202, and an SNMP agent module includes a first SNMP agent module 201.

SNMP agent module 204. (where n is a positive integer not less than 2). The SSH client 205 is connected to the first SSH server 203 nth SSH server 202; the first SSH server 203 is connected to the respective SNMP agent module; the SSH client 205 is connected to the SNMP management module 206.

SSH client 205 is the same as the first SSH server 203 nth SSH server

202 initiates a transport protocol creation request and forwards to the first SSH server 203, respectively.

The SSH server 202 initiates a user authentication request; the first SSH server 203 authenticates the received user authentication request by the nth SSH server 202; the SSH client 205 also initiates an interactive session to the first SSH server 203, the nth SSH server 202, respectively. a channel connection establishment request, and instructing the first SSH server 203 to start the first SNMP agent module 201 to start the nth SNMP agent module 204 as a subsystem for the subsystem nth SSH server 202; and the SSH client 205 acquires data from the SNMP management module 203 The obtained data is sent to the first SSH server 203, the nth SSH server 202, or the first SSH server 203, the nth SSH server 202, and the data is sent to the SNMP management module 206.

Figure 4 shows a block diagram of a third embodiment of the system of the present invention:

As shown in FIG. 4, the system further includes an authentication server 311, which is respectively connected to the first SSH server 303 and the second SSH server 306 nth SSH server 308. After receiving the user authentication request initiated by the SSH client connected to the first SSH server 303 and the second SSH server 306, the nth SSH server 308 sends the user authentication request to the authentication server 311, and the authentication server 311 receives the received authentication request. Each user authentication request is verified, and the verification result is sent to the first SSH server 303, the second SSH server 306, the nth SSH server 308, and the first SSH service. The 303, the second SSH server 306, and the nth SSH server 308 respectively determine whether the user authentication is legal according to the verification result.

In Figure 4, the authentication server is used, and user authentication is centrally maintained on the authentication server, so that user information does not need to be configured on each managed device and management station, thus greatly simplifying the relationship between the managed device and the management station. The configuration of information such as keys and user names also reduces the workload of configuration data maintenance.

FIG. 5 is a flowchart of an implementation of the method of the present invention, including the following steps:

Step 501: Establish a secure session channel between the SNMP agent module on the managed device and the SNMP management module on the management station through the SSH protocol.

Since the SSH protocol is a security protocol based on the transport layer, its application is mainly implemented by connecting a protocol and calling user authentication. Therefore, in the method of the present invention, the SSH protocol is used to improve the security of the SNMP, and the SSH protocol is used as the transmission protocol of the SNMP protocol, and the SSH client connected to the SNMP management module and the SSH server connected to the SNMP agent module are used for interaction. Establish a secure session channel between the SNMP agent module and the SNMP management module on the management station. The specific establishment process of the session channel will be described in detail later.

Step 502: The SNMP agent module and the SNMP management module exchange data by using the session channel.

After the session channel is established, the SNMP agent module can interact with the SNMP management module. Therefore, the SNMP agent module can send the operation status of the managed device to the SNMP management module; the SNMP management module can also send the configuration data of the administrator to the SNMP agent module, and the SNMP agent module sends the data to the managed device.

FIG. 6 shows a flow of establishing a session channel between an SNMP agent module and an SNMP management module in the method of the present invention, including the following steps:

Step 601: Establish an SSH transmission connection between the SSH client and the SSH server. The SSH client first initiates an SSH transport connection creation request to the SSH server. After the SSH server listens to the transport connection creation request, it creates an SSH transport connection. To further improve security, the SSH server can also provide a digital signature to the SSH client, which checks the digital signature. After the check is successful, the SSH client initiates a user authentication request to the SSH server, where the initiated user authentication request may be a password authentication request. Step 602: The SSH client initiates a user authentication request to the SSH server through the established SSH transmission connection.

Step 603: The SSH server verifies the user authentication request.

Step 604: After the verification is passed, the SSH server establishes a session channel with the SSH client on the SSH transport connection, and starts the SMP proxy module as a subsystem.

When the session channel is established, the SSH client sends a request to start the SMP proxy module to the SSH server; the SSH server starts the SNMP agent module as a subsystem according to the request, and redirects the STDIN and STDOUT of the SNMP agent to the created session channel.

In the above process, when multiple management stations need to manage the same device, multiple SSH servers need to be started on the device. Each SSH server needs to start the SNMP agent module as a subsystem, and each SSH server corresponds to a management station. . At the same time, these SSH server modules must use different TCP (Transfer Control Protocol) ports.

In the above process, the application of SSH to manage network devices is described. However, the present invention is not limited thereto, and the present invention can also be used simultaneously with the USM.

The above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

Rights request

A network management system, comprising: an SNMP agent module and an SNMP management module, wherein the system further comprises: a session channel establishing device, which is respectively connected to the SNMP agent module and the SNMP management module, and is used for A session channel for data interaction between the SNMP agent module and the SNMP management module is established between the SNMP agent module and the SNMP management module through the secure shell SSH protocol.

2. The network management system according to claim 1, wherein the session channel establishing means comprises: an SSH client and an SSH server connected thereto, wherein

3. The network management system according to claim 2, wherein the SNMP management module and the SSH client are located in the same process.

4. The network management system according to claim 2, wherein the SNMP agent module and the SSH server connected thereto are located in different processes on the same device.

The network management system according to claim 2, wherein the number of the SSH server and the SNMP agent module are the same, one or more, and - a corresponding connection.

6. The network management system according to claim 2, wherein

When there are multiple SSH servers, the SSH client is connected to each SSH server.

7. The network management system according to claim 2, wherein the system is - 12- One step includes:

8. The network management system according to claim 7, wherein:

When there are multiple SSH servers, the authentication server is connected to each SSH server.

A network management method, which enables a management station to manage managed devices through a simple network management protocol, wherein the method includes:

B. The SNMP agent module and the SNMP management module exchange data by using the session channel.

The network management method according to claim 9, wherein the step A comprises:

The SSH server verifies the user authentication request;

11. The network management method according to claim 10, wherein the establishing

The steps of connecting the SSH client to the SSH server for SSH transmission include:

The network management method according to claim 10, wherein the method further comprises: - 13 - After the SSH server listens to the SSH client's SSH transport connection creation request, it provides a digital signature to the SSH client.

The SSH client checks the digital signature.

The network management method according to claim 10, wherein the step of the SSH client initiating a user authentication request to the SSH server is specifically:

The SSH client initiates a password authentication request to the SSH server.

The network management method according to claim 10, wherein the step of the SSH server starting the SNMP agent module comprises:

Based on the request, the SSH server starts the SNMP agent module as a subsystem and redirects the standard input and output of the SNMP agent to the session channel.

The network management method of claim 10, wherein the method further comprises:

Establish a connection between the authentication server and the SSH server in advance.

The network management method according to claim 15, wherein the step of verifying the user authentication request by the SSH server comprises:

After receiving the user authentication request initiated by the SSH client, the SSH server sends the user authentication request to the authentication server.