A network device certificate verification method based on SNMP protocol

Abstract

This invention discloses a network device certificate verification method based on the SNMP protocol, applied between network devices and a Network Management System (NMS). The method includes the following steps: S1. Configure the network device; S2. Configure the node to store the SNMP service framework of the network device; S3. Generate and save the device's public and private key pair; S4. Apply for the device's public key certificate from a CA and import and save it; S5. Verify network device access; S51. Verify the validity of the device certificate; S52. Verify whether the network device holds the private key paired with the certificate; S6. If verification is successful, the device can access the network; otherwise, it cannot. This invention should enable rapid verification of the validity of the device certificate and whether the device holds the private key paired with the certificate after intranet access or device restart.

Description

Technical Field

[0001] This invention relates to the field of network device management technology, and specifically to a network device certificate verification method based on the SNMP protocol. Background Technology

[0002] With the rapid development of the internet, various cybersecurity threats are also increasing daily, causing huge losses to enterprises and users. Especially in recent years, my country has strengthened its legislation and management of cybersecurity. Since the implementation of the Cybersecurity Law, various regions have been strengthening cybersecurity construction. Digital certificates, due to their high security and obvious advantages, are being used more and more widely in the internet field. For example, in network device management, various network devices, such as switches, routers, firewalls, and VPN servers, require digital certificates from administrators to verify whether these devices have valid certificates and private keys when connecting to the internal network or reconnecting after a shutdown and restart for various reasons, for security reasons.

[0003] For administrators to manage devices within the intranet in a unified manner, the Simple Network Management Protocol (SNMP) is needed. SNMP, a widely used network management standard protocol in TCP / IP networks, provides a unified interface, enabling unified management of network devices from different types and manufacturers. The SNMP protocol is embedded in multiple local devices, such as routers, switches, servers, firewalls, and wireless access points accessible via their IP addresses. SNMP provides a universal mechanism for relaying management information between network devices in single-vendor and multi-vendor LAN or WAN environments.

[0004] SNMP has three versions. SNMPv1 and SNMPv2 have relatively simple SMI and MIBs and contain many security vulnerabilities. SNMPv3 primarily enhances security by employing USM and VACM technologies and adding secure management methods and remote control. USM provides authentication and encryption functions, while VACM determines whether a user is allowed access to a specific MIB object and the access method. An MIB is a database that specifies the variables maintained by the managed device; each network device (Agent) has its own MIB. The SNMPv3 architecture introduces a user-based security model to ensure message security and a view-based access control model for access control (USM). SNMPv3 uses the SNMP SET command to configure MIB objects, enabling dynamic configuration of SNMP agents. This dynamic configuration method supports adding, deleting, and modifying entities locally or remotely.

[0005] However, how to apply the SNMP protocol to quickly verify the validity of device certificates and whether the device holds the private key paired with the certificate after intranet access or device restart is still a problem that our technical personnel urgently need to solve at this stage. Summary of the Invention

[0006] The technical problem to be solved by the present invention is to provide a network device certificate verification method based on the SNMP protocol, so as to quickly verify the validity of the device certificate and whether the device holds the private key paired with the certificate after intranet access or device restart.

[0007] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows.

[0008] A network device certificate verification method based on the SNMP protocol, applied between network devices and a network management system (NMS), includes the following steps:

[0009] S1. Configure network devices;

[0010] S2. Configure the SNMP service framework for storing nodes in network devices;

[0011] S3. Generate and save the device's public and private key pair;

[0012] S4. Request the device public key certificate from the CA and import and save it;

[0013] S5. Network device access verification;

[0014] S51. Verify the validity of the equipment certificate;

[0015] S52. Verify whether the network device holds the private key paired with the certificate;

[0016] S6. If the verification is successful, the device can join the network; otherwise, it cannot join the network.

[0017] Preferably, step S1 includes the following steps:

[0018] S11. Install Agent service;

[0019] S12. Install SNMP service;

[0020] S13. Create an SNMPv3 user.

[0021] Preferably, step S2 includes the following steps:

[0022] S21. Define three custom MIB nodes;

[0023] S22. Write the logic processing code;

[0024] S23. Compile into a binary dynamic link library;

[0025] S24. Configure the dynamic link library into the SNMP service framework.

[0026] Preferably, the three MIB nodes in step S21 include a node for storing device certificates, a node for storing random numbers sent by NMS to the Agent, and a node for storing the result of hashing the random numbers and signing them with the certificate private key. Each of the three MIB nodes is assigned an object identifier (OID).

[0027] Preferably, step S51 includes the following steps:

[0028] S511.NMS sends a GET Request to request the device certificate content;

[0029] S512. The network device responds to the NMS with the request result via GET Response;

[0030] S513.NMS Verify Device Certificates.

[0031] Preferably, step S52 includes the following steps:

[0032] S521.NMS sends a SET Request to the network device, sending a random number to the network device;

[0033] S522. The network device responds to the NMS with the request result via SET Request;

[0034] S523.SNMPAgent saves the random number;

[0035] S524.SNMPAgent hashes the random number using a hash algorithm.

[0036] S525. Sign the hash result using the network device's private key;

[0037] S526. Save the signature result;

[0038] S527.NMS sends another GET Request to obtain the signature;

[0039] S528.SNMPAgent sends a GET Response to the NMS in response to the GET request and returns the signature result;

[0040] S529.NMS verifies the obtained signature result data using the device public key obtained from the device certificate.

[0041] The technological advancements achieved by this invention are as follows, thanks to the adoption of the above technical solutions.

[0042] This invention is applied between network devices and network management systems (NMS), enabling rapid verification of the validity of device certificates and whether the device holds the private key paired with the certificate after intranet access or device restart. Attached Figure Description

[0043] Figure 1 This is a flowchart of the present invention;

[0044] Figure 2 This is a flowchart of step S1 of the present invention;

[0045] Figure 3 This is a flowchart of step S2 of the present invention;

[0046] Figure 4 The flowcharts for steps S3 and S4 of the present invention are shown below;

[0047] Figure 5 This is a flowchart of step S51 of the present invention;

[0048] Figure 6 This is a flowchart of step S52 of the present invention. Detailed Implementation

[0049] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments.

[0050] A network device certificate verification method based on the SNMP protocol is applied between network devices and the Network Management System (NMS). Figure 1 As shown, it includes the following steps:

[0051] S1. Configure network devices.

[0052] like Figure 2 As shown, the specific steps include:

[0053] S11. Install Agent service.

[0054] S12. Install SNMP service.

[0055] S13. Create an SNMPv3 user.

[0056] To manage network devices via the SNMP protocol, you first need to install the Agent service and the SNMP service on the network device. The Agent service is used to communicate with the NMS, and the SNMP service is used to manage the network device. Since this method uses SNMPv3 to manage devices, you need to create a read-write SNMPv3 user on the network device with a security level of authPriv (both authentication and encryption). The NMS can use this user to operate the MIB nodes in the network device.

[0057] S2. Configure the SNMP service framework for storing nodes in network devices.

[0058] like Figure 3 As shown, the specific steps include:

[0059] S21. Define three custom MIB nodes.

[0060] S22. Write the logic processing code.

[0061] S23. Compile into a binary dynamic link library.

[0062] S24. Configure the dynamic link library into the SNMP service framework.

[0063] The MIB nodes operated by the user cannot be pre-defined nodes in the network device, because these nodes each have their own Object Identifier (OID). An OID is a globally unique value that identifies an object, ensuring its correct location and management during communication and information processing. Therefore, the administrator needs to define new MIB nodes and assign them new OIDs to avoid affecting other nodes. This method requires defining three MIB nodes: one storing the device certificate (OID 1.3.6.1.4.1.310.1.1.0); one storing the random number sent by NMS to the Agent (OID 1.3.6.1.4.1.320.1.1.0); and one storing the hashed result of the random number and the certificate's private key signature (OID 1.3.6.1.4.1.330.1.1.0). These three MIB nodes will be referred to as node 310, node 320, and node 330, respectively.

[0064] After creating the MIB node, you need to write the logic processing code for the OID and compile it into a binary dynamic link library. Finally, add the dynamic link library to the existing SNMP service framework through a configuration file.

[0065] S3. Generate and save the device public and private key pair.

[0066] Before a network device can access the intranet, the administrator needs to generate a public-private key pair for the device and save the device private key to a specific location on the network device (different implementations of SNMPAgent (i.e., the name of the software module that implements the SNMP protocol in the network device) can customize the storage location of the private key file, which is generally a storage path under the operating system).

[0067] S4. Request the device public key certificate from the CA and import and save it.

[0068] The device public key certificate is issued by an authorized CA certification center, and finally the device public key certificate and the device private key paired with the device public key certificate are stored in a specific location in the network device.

[0069] S5. Network device access verification.

[0070] S51. Verify the validity of the equipment certificate.

[0071] like Figure 5 As shown, the specific steps include:

[0072] S511.NMS sends a GET Request to request the device certificate content.

[0073] S512. The network device responds to the NMS with the request result via GET Response.

[0074] S513.NMS Verify Device Certificates.

[0075] When verifying the validity of a device certificate, the NMS first sends a GET Request to request the device certificate content stored on network device 310 node; the network device responds to the NMS with a GET Response. The NMS then parses the obtained device certificate file and uses the CA's public key to verify the certificate's validity period, signature validity, and status, thereby determining the validity of the device certificate.

[0076] S52. Verify whether the network device holds the private key for the certificate pairing.

[0077] like Figure 6 As shown, the specific steps include:

[0078] S521.NMS sends a SET Request to the network device, sending a random number to the network device.

[0079] S522. The network device responds to the NMS with the request result via SET Request.

[0080] S523.SNMPAgent saves the random number.

[0081] S524.SNMPAgent hashes the random number using a hash algorithm.

[0082] S525. Sign the hash result using the private key of the network device.

[0083] S526. Save the signature result.

[0084] S527.NMS sends a GET Request request again to obtain the signature.

[0085] S528.Agent (in this invention, "SNMPAgent" can be used instead of "Agent") sends a GETResponse to the NMS to respond to the GET request and returns the signature result.

[0086] S529.NMS verifies the obtained signature result data using the device public key obtained from the device certificate.

[0087] When verifying whether a network device possesses the private key paired with the certificate, a challenge-response mechanism is used to obtain the result. First, the NMS sends a SET Request to the device, sending a random number. The SNMPAgent stores this random number on node 320. Upon receiving the request, the SNMPAgent first performs a hash operation on the random number, then uses the network device's private key to sign the hash result, storing the signature on node 330. The NMS then sends a GET Request to retrieve the value from node 330. The Agent responds to the GET request with a GET Response, returning the signature result. Finally, the NMS verifies the signature using the device's public key obtained from the device certificate. Successful verification proves that the network device possesses the private key.

[0088] S6. If the verification is successful, the network device can access the network; otherwise, it cannot access the network.

[0089] When in use, this invention is applied between network devices and the Network Management System (NMS), enabling rapid verification of the validity of device certificates and whether the device holds the private key paired with the certificate after intranet access or device restart.

Claims

1. A network device certificate verification method based on the SNMP protocol, characterized in that: This method is applied between network devices and the Network Management System (NMS), and includes the following steps: S1. Configure network devices; S2. Configure the SNMP service framework for storing nodes in network devices; S3. Generate and save the device's public and private key pair; S4. Request the device public key certificate from the CA and import and save it; S5. Network device access verification; S51. Verify the validity of the equipment certificate; S511.NMS sends a GET Request to request the device certificate content; S512. The network device responds to the NMS with the request result via GET Response; S513.NMS Verification Device Certificate; S52. Verify whether the network device holds the private key paired with the certificate; S521.NMS sends a SET Request to the network device, sending a random number to the network device; S522. The network device responds to the NMS with the request result via SET Request; S523.SNMP Agent saves the random number; S524.SNMP Agent hashes the random number using a hash algorithm. S525. Sign the hash result using the network device's private key; S526. Save the signature result; S527.NMS sends another GET Request to obtain the signature; S528. The SNMP Agent sends a GET Response to the NMS in response to the GET request and returns a signed result; S529.NMS verifies the obtained signature result data using the device public key obtained from the device certificate; S6. If the verification is successful, the device can join the network; otherwise, it cannot join the network.

2. The network device certificate verification method based on the SNMP protocol according to claim 1, characterized in that: Step S1 includes the following steps: S11. Install Agent service; S12. Install SNMP service; S13. Create an SNMPv3 user.

3. The network device certificate verification method based on the SNMP protocol according to claim 1, characterized in that: Step S2 includes the following steps: S21. Define three custom MIB nodes; S22. Write the logic processing code; S23. Compile into a binary dynamic link library; S24. Configure the dynamic link library into the SNMP service framework.

4. The network device certificate verification method based on the SNMP protocol according to claim 3, characterized in that: The three MIB nodes mentioned in step S21 include a node for storing device certificates, a node for storing random numbers sent by NMS to the Agent, and a node for storing the result of hashing the random numbers and signing them with the certificate private key. Each of the three MIB nodes is assigned an object identifier (OID).

Images