Device administration with public key infrastructure
A device access management server may facilitate secure access of a target device by an accessing device. The secure remote access of the target device by the accessing device may be facilitated by a public key infrastructure (PKI) certificate issued and/or validated by the device access management server.
1 . A method of operating server equipment that provides public key infrastructure services to facilitate access of a target device by an accessing device for performing device administration, the method comprising:
receiving, from the accessing device, a certificate generation request;
providing, to the accessing device and based on the certificate generation request, a public key certificate containing user identity information for the accessing device;
receiving, from the target device, the public key certificate, the received public key certificate being a version of the provided public key certificate obtained by the target device in an access request for performing device administration;
validating the received public key certificate; and
providing, to the target device, an indication of the received public key certificate being valid, wherein the target device is configured to provide access to the accessing device for performing device administration based on the indication.
2 . The method defined in claim 1 further comprising:
authenticating a user identity of the accessing device based on the received certificate generation request, wherein the public key certificate is provided to the accessing device based on the user identity being successfully authenticated.
3 . The method defined in claim 2 , wherein authenticating the user identity of the accessing device comprises providing, to an external identity provider server, verifiable user identity information and receiving, from the external identity provider server, an indication of successful authentication.
4 . The method defined in claim 1 further comprising:
maintaining the provided public key certificate in a certificate database, wherein the received public key certificate is validated at least in part by using the certificate database.
5 . The method defined in claim 4 , wherein the received public key certificate is validated based on checking whether the received public key certificate has been revoked and whether the received public key certificate has expired.
6 . The method defined in claim 1 further comprising:
receiving, by the server equipment and from the accessing device, an indication to request access to the target device for performing device administration; and
providing, by the server equipment to the target device, the access request for performing device administration.
7 . The method defined in claim 6 further comprising:
establishing a communication path through the server equipment between the accessing device and the target device after the target device has granted access to the accessing device.
8 . The method defined in claim 1 , wherein the public key certificate is usable by the accessing device to authenticate network access and is usable by the accessing device to gain administrative access to the target device.
9 . The method defined in claim 8 , wherein the public key certificate comprises an extension that includes an indication of client authentication.
10 . The method defined in claim 9 , wherein the public key certificate comprises a validity time period.
11 . The method defined in claim 1 , wherein the accessing device is an administrator device, wherein the user identity information is indicative of administrator-level access for the administrator device, and wherein the target device is a network device.
12 . The method defined in claim 1 , wherein performing device administration comprises the accessing device supplying the target device with configuration data, the accessing device supplying the target device with a control signal, the accessing device supplying the target device with networking information, the accessing device receiving performance metrics from the target device, the accessing device receiving log information from the target device, or the accessing device receiving operational data from the target device.
13 . A method of operating an accessing device to obtain access to a target device for device administration, the method comprising:
sending, to a device access management server, a certificate generation request;
receiving, from the device access management server, a public key certificate containing user identity information for the accessing device;
storing, on memory circuitry of the accessing device, the received public key certificate; and
requesting, using the stored public key certificate, access to the target device for device administration, wherein the target device is a network device that forwards network traffic between hosts and wherein requesting access to the target device for device administration comprises sending, to the network device, an access request that includes the stored public key certificate.
14 . The method defined in claim 13 further comprising:
providing user login credentials for authentication by an identity provider system, wherein the public key certificate is received after the user login credentials have been successfully authenticated.
15 . The method defined in claim 13 , wherein the network device is a multi-layer switch.
16 . The method defined in claim 13 , wherein the access request is sent to the network device using the device access management server.
17 . A method of operating a target device to provide access to an accessing device for device administration, the method comprising:
receiving, by the target device, an access request by the accessing device for device administration, the access request containing a public key certificate;
sending, to a device access management server, a certificate validation request containing the public key certificate;
receiving, from the device access management server, an indication of the public key certificate being valid; and
providing access for device administration to the accessing device based on the indication of the public key certificate being valid.
18 . The method defined in claim 17 , wherein the access request is received from the accessing device via the device access management server.
19 . The method defined in claim 18 , wherein providing access for device administration to the access device comprises transmitting or receiving information through a communication path through the device access management server between the target device and the accessing device.
20 . The method defined in claim 17 , wherein the target device is a network device and wherein the public key certificate is indicative of a user identity having administrator-level access.