Electrical computers and digital processing systems: support – Multiple computer communication using cryptography – Central trusted authority provides computer authentication
Reexamination Certificate
1999-04-22
2003-08-19
Darrow, Justin T. (Department: 2132)
Electrical computers and digital processing systems: support
Multiple computer communication using cryptography
Central trusted authority provides computer authentication
C713S162000, C713S182000, C713S152000, C380S264000
Reexamination Certificate
active
06609197
ABSTRACT:
FIELD OF THE INVENTION
The present invention relates to configuring network devices. More specifically, it relates to a method and system for secure emergency access to network devices.
BACKGROUND OF THE INVENTION
During the manufacturing process, many network devices incorporate a password to allow access to the network device. The password allows configuration parameters on the network device to be changed. The configuration parameters typically cannot be changed without using the password.
Many network devices are password protected to prevent tampering of information in the network device. For example, a password may be used to prevent routing tables in a router from being tampered with. As is known in the art, a router routes data packets to an appropriate device on a network topology. A password may also be used to protect configuration parameters in a telephony switching hub from tampering. As is known in the art, a telephony switch hub switches data among multiple channels and/or time slots.
From time-to-time, an owner of network device may lose or forget a password associated with a network device. A lost or forgotten password prevents an owner from modifying configuration parameters in a network device. There are several methods known in the art to allow an owner of a network device to replace a lost or forgotten password.
An owner of a network device may call technical support for a company that is selling the network device. A network device typically is operated by a specific version of computer software. Technical support personal may provide an emergency or backdoor password to the owner of the network device. The emergency or backdoor password is typically generated or retrieved based on a specific version of computer software being used in the network device. However, there are problems associated with using such a method to provide emergency or backdoor passwords. If the emergency or backdoor passwords become generally known, such as being posted on a computer bulletin board, the Internet, a newsgroup, other publication, any network device running the specific version of computer software becomes vulnerable to malicious tampering by unauthorized persons. A company selling network devices for which a specific version of computer software has been compromised, may have to provide software or firmware updates to all customers who have purchased the network devices. This is very expensive to the company selling the network devices.
Another problem associated with providing emergency or backdoor passwords based on a particular version of computer software is that the computer software and password may be used to “clone” another network device, without paying for a legitimate copy of computer software used on the network device.
Thus, it is desirable to a method to protect network devices with password yet allow emergency access to the network device. The method should allow a unique password to be generated for each network device. The password would be useable only on the network device and not all network devices running the same version of computer software.
SUMMARY OF THE INVENTION
In accordance with preferred embodiments of the present invention, some of the problems associated with secure emergency access to network devices are overcome. A method and system for secure emergency access to a network device is provided.
One aspect of the invention includes a method for creating a unit-specific password for a specific network device. The method includes obtaining a unique serial number for a specific network device. A global password used for a type of network device that includes the specific network device is obtained. An encrypted unit-unique password is generated for the network device with the unique serial number and the global password. The encrypted unit-unique password is stored in non-volatile storage on the network device.
Another aspect of the invention includes a method for providing an emergency unit-specific password for a specific network device. This method includes obtaining a unique serial number for a specific network device. A global password used for network devices that include the specific network device is obtained. An encrypted emergency unit-specific password is generated for the specific network device with the unique serial number and the global password. The encrypted emergency unit-specific password is valid only on the specific network device with the unique serial number.
Another aspect of the invention includes a method for using an encrypted emergency unit-specific password for a specific network device. This method includes obtaining an encrypted emergency unit-specific password on a specific network device. An encrypted unit-unique password is obtained for the specific network device from non-volatile storage on the specific network device. The encrypted unit-unique password includes a unique serial number and a global password used for a type of network device that includes the specific network device. A test is conducted to determine whether the encrypted emergency unit-specific password matches the encrypted unit-unique password for the specific network device. If the passwords match, access is allowed to configuration parameters on the specific network device. If the passwords do not match, access is denied to configuration parameters on the specific network device.
Another aspect of the invention includes an emergency password system. The emergency password system includes an original encrypted unit-unique password, an emergency encrypted unit-specific password, and an emergency encrypted unit-specific password generator. However, more or fewer components can also be used in the emergency password system, and the present invention is not limited to this emergency password system.
The methods and system described herein may be used to provide secure emergency access to network devices. Secure emergency access helps close security holes for providing access to configuration parameters in a network device by using an encrypted unit-unique password.
REFERENCES:
patent: 5237610 (1993-08-01), Gammie et al.
patent: 5677953 (1997-10-01), Dolphin
patent: 5708963 (1998-01-01), Mobley et al.
patent: 6173402 (2001-01-01), Chapman
Acomb Stanford K.
Ketcham Carl C.
3Com Corporation
Darrow Justin T.
McDonnell & Boehnen Hulbert & Berghoff
LandOfFree
Method and system for secure emergency access to network... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Method and system for secure emergency access to network..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Method and system for secure emergency access to network... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3078487