SNMPv1 v2c Security via Community Name Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Simple Network Management Protocol (SNMP) versions 1 and 2c lack effective authentication and encryption mechanisms, making them vulnerable to unauthorized access and information leakage, while SNMPv3 is overly complex and does not address simultaneous access issues, leading to difficulties in securing management information communication.
Innovation Solution
A network communication method using an extension message within the SNMP protocol that includes identification information and authentication/encryption details, limiting simultaneous access to one device/user and performing authentication and decryption processes to ensure secure communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If SNMPv1 or SNMPv2c protocol is used for network communication, then the protocol is simple and widely compatible, but authentication security is weak because community names are transmitted in plain text and encryption function is not provided
Solution Approach 1:
The patent segments the community name into multiple parts and distributes these parts across multiple messages. The management apparatus divides the community name into first and second parts, sending them in separate GETREQUEST messages. The agent apparatus reconstructs the full community name by combining these parts only after verifying authentication tokens, thereby preventing plain text transmission of the complete community name while maintaining SNMPv1/v2c compatibility
Solution Approach 2:
The patent implements preliminary authentication by exchanging authentication tokens (authentication information) before transmitting the actual community name. The management apparatus sends an authentication token in the first GETREQUEST message, and the agent apparatus verifies this token before processing subsequent messages containing the community name parts. This preliminary action ensures that only authenticated entities can retrieve the community name parts, preventing unauthorized access while maintaining protocol simplicity
2Device complexity
If SNMPv1 or SNMPv2c protocol is used for network communication, then the protocol structure is simple, but information security is vulnerable to eavesdropping because management information is transmitted in plain text
Solution Approach 1:
The patent segments management information into multiple parts and transmits them across multiple messages. Critical information such as the community name is divided into first and second parts, with each part transmitted in separate GETREQUEST messages. This segmentation ensures that even if one message is intercepted, the complete information cannot be reconstructed, thereby preventing information leakage while maintaining the simple SNMP protocol structure
Solution Approach 2:
The patent introduces authentication tokens as intermediary elements that mediate between the management apparatus and the agent apparatus. These tokens act as intermediaries that must be verified before the actual management information is transmitted. The authentication token serves as a mediator that protects the subsequent transmission of community name parts and management information, preventing eavesdropping without requiring complex encryption protocols
3Ease of manufacture
If SNMPv1 or SNMPv2c protocol is used for network communication, then the protocol is easy to implement, but exclusive access function is not provided allowing simultaneous accesses from multiple users
Solution Approach 1:
The patent implements preliminary authentication by verifying authentication tokens before allowing access to management information. The management apparatus sends authentication information in advance within the first GETREQUEST message, and the agent apparatus verifies this authentication information before processing subsequent access requests. This preliminary action ensures that only authenticated users can access the system, providing exclusive access control while maintaining the simplicity of the SNMP protocol implementation
Solution Approach 2:
The patent implements a feedback mechanism where the agent apparatus verifies authentication tokens and provides feedback by either accepting or rejecting access requests. The authentication verification process creates a feedback loop that confirms whether the user is authorized before allowing access to management information. This feedback mechanism ensures reliable access control while keeping the implementation straightforward by using existing SNMP message structures
4Reliability
If SNMPv3 protocol is used to provide advanced authentication and encryption functions, then information security is improved, but the processing load becomes excessive for some devices
Solution Approach 1:
The patent segments the authentication and information transmission process into multiple simple steps using basic SNMP GETREQUEST messages. Instead of implementing complex SNMPv3 encryption and authentication protocols, the patent divides the community name into parts and transmits them across multiple messages with simple token verification. This segmentation approach achieves enhanced security through process complexity rather than protocol complexity, thereby reducing processing load on devices while maintaining strong security
Solution Approach 2:
The patent uses simple token copying and verification instead of complex cryptographic operations. The authentication token is copied from the management apparatus to the agent apparatus and verified through simple comparison operations. This copying approach replaces heavy cryptographic processing with lightweight string matching, significantly reducing processing load while maintaining authentication security
Data Source
AI summary
A method for network communication under SNMP includes: producing an access request when a first device accesses management information stored in a second device, the request containing additional information including identification information of the first device or identification information of a user of the first device in a value field included in a data field that contains an identifier field and the value field; transmitting the access request to the second device; and permitting the transmitted access request so that the number of devices or users accessing the second device may not exceed a predetermined number on the basis of the identification information of the first device or the user contained in the transmitted access request and identification information of a device or a user accessing the management information.