(51) Int Cl.: H04L 12/24 ( ) H04L 29/06 ( ) H04L 29/08 ( )

Transcription

1 (19) TEPZZ_88Z Z9B_T (11) EP B1 (12) EUROPEAN PATENT SPECIFICATION (4) Date of publication and mention of the grant of the patent: Bulletin 14/32 (21) Application number: (22) Date of filing: (1) Int Cl.: H04L 12/24 (06.01) H04L 29/06 (06.01) H04L 29/08 (06.01) (86) International application number: PCT/US06/ (87) International publication number: WO 06/ ( Gazette 06/47) (4) Smart-switch management module system and method Smart-Switch-Verwaltungsmodulsystem und -Verfahren Système de module de gestion à commutation intelligente et procédé associé (84) Designated Contracting States: BE DE GB () Priority: US (43) Date of publication of application: Bulletin 08/04 (73) Proprietor: Avocent Fremont Corp. Fremont, CA 9438 (US) (72) Inventors: DE OLIVEIRA, Henrique, Gobbi Fremont, CA 9438 (US) HOLT, Graham Pleasanton, CA 9488 (US) PASSOS, Ivan Fremont, CA 9438 (US) WHITE, David, Ian Livermore, CA 9 (US) (74) Representative: Franzolin, Luigi et al Studio Torta S.p.A. Via Viotti, Torino (IT) (6) References cited: US-A US-A EP B1 Note: Within nine months of the publication of the mention of the grant of the European patent in the European Patent Bulletin, any person may give notice to the European Patent Office of opposition to that patent, in accordance with the Implementing Regulations. Notice of opposition shall not be deemed to have been filed until the opposition fee has been paid. (Art. 99(1) European Patent Convention). Printed by Jouve, 7001 PARIS (FR)

2 1 EP B1 2 Description Field of Invention [0001] This invention relates to the field of computer network management and specifically to methods for accessing and managing computer, networking, and telecommunication systems equipment that may utilize both In-Band and Out-of-Band techniques and protocols for remote management access. Background of the Invention [0002] Information Technology professionals commonly use tools to remotely access and control network nodes such as computer servers. These typical remote access tools permit the IT professional to manage and restore the operations of the network nodes remotely. Typically, these remote access tools are divided in two categories: In-band Tools and Out-of-band Tools. An Inband Tool communicates with the Managed Device relying on the same network interface utilized by the Managed Device for connection to the data network. An Outof-band management tool communicates with the Managed Device using a separate access media (such as a serial console port or the keyboard-video-mouse interface) that is used exclusively for management. Out-ofband Tools permit the supervisor to access the Managed Device even when the Managed Device loses network connectivity. [0003] In In-band solutions, the Managed Device and the Remote Access Client communicate using well known network protocols, such as Remote Desktop Protocol (RDP), Secure Shell (SSH) and Virtual Network Computing (VNC). In-band Tools allow network administrator to view and interact with the Managed Device using a simple program (the "Viewer" or Remote Access Client) on another computer anywhere on the network (Intranet, Internet and/or Extranet). The two computers need not be of the same type, so for example one can use and In-band Tool to view a Linux server on your Windows PC at home. Figure 1 shows how In-Band Tools work. [0004] In-band solution comprises three different components. The Remote Access Service which resides in the Managed Device; the Remote Access Client, which resides in the Client Node; and the Network, which is used as a communication path between the Server and the Client applications. Due to this architecture, any Inband Tool requires the proper functioning of all three components to work. If the Managed Device is not functioning properly the Remote Access Service software will not be able to work properly and thus the Client Software will not be able to access the Managed Device. Likewise, if there is a problem in the Network, the Remote Access Client will not be able to reach the Remote Access Service making the solution unusable. For these reasons Inband Tools are normally used for routine maintenance where there is little or no risk of an error occurring in any of the three components. [000] In-Band tools are included in all major Operating System. People are used to having these tools ready at no additional cost. Other important characteristics are performance and efficiency. Since In-Band Tools include a component that is embedded inside the Managed Device then the Server-Client communication can be optimized and closely coupled to the normal local user interface which minimized latency and bandwidth requirements. Many solutions both open source and commercial are offered today that allow In-band remote access such as Citrix Metaframe, Tarantella, PC Anywhere, OpenSSH, SecureCRT. [0006] In-band Tools, however, become ineffective whenever the Network path associated with the Managed Device fails or the Managed Device loses network connectivity. To overcome this limitation, tools were created that enable the remote access to the out-of-band management ports of the Managed Device. These Out-ofband Tools use interfaces such as serial console and KVM ports to generate management data. Figure 2 shows how out-of-band tools work. [0007] In-Band Tools such as RDP or SSH are normally used for day to day maintenance of managed devices since they allow for almost instant secure remote access to systems and allow the operator to perform any duties as if they were at the system locally. They are normally network optimized and provide a combination of low bandwidth utilization (compared to Out-of-Band protocols such as KVM/IP) and very good performance with very little latency. The Remote Access Client software required to utilize these protocols are low cost and, in many cases, are included with the Client Node Operating System, which leads to a low cost of usage. The major disadvantage of In-Band Tools is that they require the Managed Device and the Network to be in a stable condition and so cannot be used in situations where the connection to the Managed Device has been lost. [0008] In contrast Out-of-Band Tools are normally used for emergency access to systems that are not available through In-Band Tools or for high risk management tasks that may cause some interruption to the In-Band Flow such as changing an IP address or routing table configuration or operations that require a system restart. An Out-of-Band solution comprises three components. The Out-of-band Device, which interfaces with the outof-band interface of the Managed Device and converts the data to a format suitable for transmission over the network; the Remote Access Client, which resides in the Client node and communicates with the Out-of-Band Device; and the Out-of-Band Network, which is used as a communication path between the Out-of-band Device and the Remote Access Client. Note that, in some cases, the Out-of-Band device can reside inside the Managed Device such as a service processor embedded onto a motherboard, but it is still a different entity altogether and its function does not rely on the Managed Device. Out- 2

3 3 EP B1 4 of-band Devices in use today include Console Servers, like the Cyclades AlterPath ACS and the Lantronix SecureLinx; KVM over IP switches, like the Cyclades Alter- Path KVM/net and the Avocent DS Series; and BMC (Baseboard Management Controller), like HP ilo and IPMI. [0009] Out-of-band solutions are more expensive than In-band solutions. Out-of-band tools usually require more network bandwidth and often do not perform well over high latency-low bandwidth networks. There is also a limitation on the number of simultaneous connections. Outof-band Devices usually have a limitation on the number of simultaneous management sessions it can provide and, increasing this number is expensive. [00] Out-of-Band Tools access the Managed Device using a dedicated management connection and so even when the system is unstable the Out-of-Band connection is normally still available. Since Out-of-Band Tools are required to convert signals from one form to a form suitable for secure transmission over TCP/IP, the network bandwidth requirement may be higher than when using In-Band Tools, performance of the Remote Access Client is lower, latency is introduced and the cost of deployment of the necessary infrastructure may be higher than for In-Band Tools. [0011] Covering all remote access requirements in the most effective and efficient way requires a combined approach using both In-Band and Out-of-Band Tools. Some companies have provided solutions that allow this such as the SSL-UAG+ product from Xceedium. This approach however exhibits several key limitations as fol- lows:- The user must have access to multiple Remote Access Clients (Viewers) in order to use each of the different In-Band and Out-of-Band Tools. The user must be trained to use different Remote Access Clients and trained to make choices as to which method of access to use. This leads to both increased cost of deployment and ownership and also to increased operator error. The user must decide which Tool (In-band or Outof-Band) to utilize at any given time. [0012] This can lead to a loss of personnel productivity due to connections being unavailable or to Out-of-Band connections being unnecessarily blocked by another user. Network bandwidth may be used inefficiently by operators choosing an Out-of-band Tool when an Inband Tool is available. An operator will unexpectedly loose connectivity to a managed asset and will be required to restart the connection using an alternative protocol. This will be confusing and will lead to higher occurrences of operator error [0013] Thus, it is desirable to provide a smart switch module that combines tools with in-band access and tools with out-of-band access while overcoming the limitations of the conventional solutions that combine both in-band and out-of-band tools, and it is to this end that the present invention is directed. [0014] The invention is defined by independent claims 1 and 6. Summary of the Invention [001] US 03/ discloses a secure remote management appliance allowing access to remote nodes to be manager through in-band or out-of-band connections. [0016] A smart switch module comprises a system and method for intelligently and automatically switching between network management data flows to provide continuous remote access to one or more managed system(s) reducing the complexity of remote management solutions, optimizing network bandwidth, providing optimum access and response times, and maximizing availability of management resources. The system provides continuous access to the one or more managed system(s) by combining in-band tools, which generally require lower network bandwidth and provide better response time with less latency when the system under management is in-service, with out-of-band tools that provide continued access to the system under management when the network interface or operating system become unstable or the system in placed by an operator or falls unexpectedly to an Out-of-Service condition. [0017] The system includes a plurality of different remote management access protocols including but not limited to Remote Desktop Protocol (RDP), Virtual Network Computing (VNC), X Windows (X11), Digital Keyboard Video Mouse (KVM/IP), Secure Shell (SSH), Telnet, Serial Console, Serial over LAN (SOL), IPMI, and other remote management access protocols yet to be developed that are within the scope of the invention. [0018] Monitoring services ascertain the availability of each protocol that may be used for any system under management and a decision engine that evaluates the suitability of each protocol for the current session based on the condition of the network, the system under management and the administrator s current connection options settings. The protocol are monitored during any session and will switch to an alternative session protocol (using the decision engine) if the current session protocol becomes unavailable or if a more efficient session protocol becomes available. [0019] Several advantages over conventional systems exist. For example, the network bandwidth is optimized by selecting more efficient protocols such as In-Band when they are available and switching to the less optimal protocols such as Out-of-Band only when dictated by the condition of the system under management. In addition, the response time and latency in the management inter- 3

4 EP B1 6 face is minimized by selecting the most optimal protocols such as In-Band when they are available and switching to less optimal protocols such as Out-of-Band only when dictated by the condition of the system under management. The system also maximizes the continuity of the connection by switching between connection methods and protocols dictated by the availability of each protocol. User contention is minimized by making more efficient use of the available network bandwidth and using less intensive protocols when they are available. In addition, the management Infrastructure cost is minimized by optimizing the use of expensive Out-of-Band technologies and operator training and operator error is minimized by providing seamless switching between protocols since the operator does not need to know which protocol or which software application he needs to use to access a system. [00] The Smart Switch module may be implemented in several different manners, all of which are within the scope of the invention. For example, the smart switch module may be implemented as a software module or application that may be installed directly to an administrator s workstation or as a software module or application that can be used as a plug in to a larger centralized management system such as HP OpenView, IBM Tivoli, IBM Director, Microsoft System Management Server. The smart switch module may also be implemented as a software module integrated into an appliance that includes Out-of-Band physical access media such as, for example, a software module integrated with a KVM/IP switch. Alternatively, the smart switch module may be implemented as a software module integrated with an access management gateway appliance such as Cyclades AlterPath Manager, Xceedium SSL-UAG+, Avocent DSView, Raritan Command Center. The smart switch also may be implemented using an application specific integrated circuit (ASIC). Brief Description of the Drawings [0021] Figure 1 illustrates the use of In-Band Tools; Figure 2 illustrates the use of Out-of-Band tools; Figure 3 illustrates a smart switch module in accordance with the invention in which two management flows from the module to the managed device are illustrated; Figure 4 illustrates a conventional Out-of-Band access solution using KVM/IP; Figure illustrates a conventional In-Band access solution using RDP; Figure 6 illustrates an embodiment of the smart switch module in accordance with the invention; Figure 7 is a block diagram of the smart switch module in accordance with the invention; Figure 8 is a flow diagram of a method for network management in accordance with the invention using the smart switch module; Figure 9 is a flow diagram showing a method for establishing a connection from the smart switch module; and Figure is a flow diagram showing a method for the monitoring of established connections using the smart switch module in accordance with the invention. Detailed Description of a Preferred Embodiment [0022] The invention is particularly applicable to a remote management solution for Microsoft Windows servers that utilize a remote KVM/IP system for Out-of-Band access and use Remote Desktop Protocol RDP for In- Band access and it is in this context that the invention will be described. It will be appreciated, however, that the system and method in accordance with the invention has greater utility since 1) the system may be used with any existing interfaces and protocols as well as any newly developed interfaces and protocols; and 2) the system may be implemented in various manners that are within the scope of the invention. [0023] Figure 3 illustrates a smart switch system in accordance with the invention. The smart switch module receives a first management data flow 22 and a second management data flow 24 from the system to a managed device (now shown). In this example, one flow 22 is using In-Band access to the system under management and the other flow 24 is using Out-of-Band access to the same system (via an Out-of-Band device not shown). In accordance with the invention, the system selects between the flows and delivers a smart flow 26 to the user application independently from the flow being used to communicate with the system under management at any time. Thus, the module provides continuous access to the one or more managed system(s) by combining in-band tools, which generally require lower network bandwidth and provide better response time with less latency when the system under management is inservice, with out-of-band tools that provide continued access to the system under management when the network interface or operating system become unstable or the system in placed by an operator or falls unexpectedly to an Out-of-Service condition. To better understand the smart switch module in accordance with the invention, a typical out-of-band system and an in-band system are now described. [0024] Figure 4 is a diagram illustrating a conventional 4

5 7 EP B1 8 Out-of-Band system for Microsoft Windows systems that utilizes KVM/IP technology and a KVM/IP switch. In the diagram, each managed device/system (server S1- Sn in this example) has a physical connection between its Keyboard, Video, and mouse connectors and the KVM/IP appliance that acts as a multiplexer to provide access to any of the servers in a well known manner. One or more local users, such as local users LU1 and LU2, are physically connected to the KVM/IP switch using dedicated Keyboard-Video-Mouse connections and may access each of the servers individually by navigating through a menu system that is embedded in the KVM/IP switch. One or more remote users, such as remote users RU1 and RU2, may establish connections to the KVM/IP switch using a typical web browser over an Ethernet connection or the Internet and navigate through a menu system in the KVM/IP switch to select a server to which the remote user would like to connect. At this point, a KVM/IP viewer application (not shown, but well known) is launched in the remote user workstation (physically located at the location of the remote user) that establishes a connection to the KVM/IP switch and through to the server. A limitation of this conventional out-of-band system is that only a limited number of users may access the systems so that simultaneous access to all systems is not possible in a cost effective manner. This conventional solution is further limited in that the network bandwidth required for the KVM/IP protocol is relatively high and the nature of KVM/IP means that the operator experiences latency and lack of synchronization with for example the mouse pointer which leads to inefficient use of the systems. [002] Figure is a diagram representing a conventional In-Band system for Microsoft Windows systems that utilizes the well known Remote Desktop Protocol (RDP) to provide remote access to the operator. In this diagram, one or more managed devices/systems, such as one or more servers S1 - Sn, is connected to a production or management network using Ethernet or remotely using a dial up connection with PPP. One or more remote users, such as remote user RU1 and RU2, are also connected to the network and may access the servers using an embedded RDP client viewer over a TCP/IP connection. This in-band system has benefits over KVM/IP (Figure 4) in that the protocol is more efficient for transmission over the network which leads to lower bandwidth utilization and better response time. The close coupling of the protocol to the operating system s own video subsystem also means that complete synchronization is possible which leads to a more efficient user experience. The limitation of this in-band system, however, is that is it only available when the operating system/network are running and so cannot provide any coverage for Out-of-Band or Out-of-Service conditions. [0026] In order to provide an effective management access solution a combination of the two approaches (In- Band and Out-of-Band) must be used. Without the use of the invention as described below, a combination of the two approaches (In-Band and Out-of-Band) leads to management difficulties and human error since the administrator must deal with two different remote access systems, and must make decisions on which system to use at any given time. The smart switch module in accordance with the invention overcomes this problem to provide a combination of in-band and out-of-band remote access while reducing management difficulties. [0027] Figure 6 is a diagram representing an embodiment of the smart switch system and in particular, a smart switch module in accordance with the invention. In accordance with the invention, the out-of-band access (KVM in the example shown here) and in-band access (RDP in the example shown here) are combined in one solution and the invention is used to provide a single client viewer that can monitor the In-Band and Out-of-Band connection status and dynamically switch between the two access modalities to provide the most effective and efficient access to the systems under management. In this embodiment, one or more managed devices/systems, such as servers S1 - Sn in this example, may be connected directly to the smart switch module using well known dedicated Keyboard, Video and Mouse (KVM) connections 42. The systems under management may also connected to a production and/or management network 44 which may transport well known Remote Desktop Protocol (RDP) traffic through a connection 46, such as Ethernet or dial up connection using PPP, to the smart switch module. Typical systems being managed using KVM and RDP are Microsoft Windows 00 which includes a Keyboard Video and Mouse interface in the hardware and includes two instances of RDP protocol service. Typical KVM access devices also known as KVM/IP switches are produced by Cyclades Corporation in the AlterPath KVMnet, and Avocent in the DSR series switches. RDP client applications are implemented as standard in Windows XP and other Windows platforms ass well as being available for Linux and Unix in the Remote Desktop project. One or more local users 48, such as local users LU1 and LU2 in this example, may be connected to the smart switch module using dedicated Keyboards, Video, Mouse cables 0 and one or more remote users 2, such as remote users RU1 and RU2 in this example, may be connected over the connection 46 using a typical web browser. In accordance with the invention, each local or remote user is accessing the system using a typical computer system with sufficient computing power and memory to perform the interactions with the smart switch module. The users computer systems may include, for example, personal computers, workstations, terminals, PDAs, wireless devices, cellular phones, etc. Each user s computer system may be known as a management station. [0028] A user (whether remote or local) may then log into the smart switch module and is presented with a menu indicating the systems that the particular user is allowed to access. In accordance with the invention, multiple user are able to simultaneously access the managed

6 9 EP B1 devices. The user may then select the system that he/she wishes to connect to and then the smart switch module will launch a viewer application (on the user s computer) to allow the user to access the graphical interface of the system under management. The user viewer application will not connect directly to the system under management but instead will connect to an instance of the smart switch module which is residing inside the smart switch module. The smart switch module will continuously and automatically (without user actions) monitor the In-Band and Out-of-Band service availability of the system under management and in combination with user and system wide preferences will decide which path to take in connecting to the system under management. [0029] In an exemplary scenario, the system preferences may indicate that RDP should be used in preference to KVM/IP whenever it is available. This preference will provide the users with simultaneous access to all systems under management with the lowest bandwidth utilization. This preference also provides the best user experience in terms of response time and synchronization. In this scenario the smart switch module is configured to utilize KVM/IP when the RDP service is not available. In this scenario, a remote user may establish a connection to the smart switch module and select a managed device/system to which the user would like to connect. The smart switch module then launches a viewer application in the user computer system that connects back to the smart switch module. The smart switch module may then examine the properties configuration (described above) and, seeing that RDP is the preferred connection method, probes the managed device (a particular server) to establish the existence of an available RDP service for the particular managed device. If the service is available, the connection is established using RDP. If the service is not available, a KVM/IP session may be established since the preferences also allow KVM/IP to be used when the RDP service is not available. Even if the RDP protocol is available and used for the connection, the smart switch module will continue to monitor the service and in the case of any interruption will switch automatically and transparently to a KVM/IP session. Due to the nature of the Microsoft Windows operating system the user may be required to login to the system under management again but this behavior will vary based on the attributes and capabilities of the system under management. [00] Figure 7 is a block diagram illustrating a computer system 60 software implementation of the smart switch module in accordance with the invention. In this implementation, the smart switch module is implemented as a software module/application being executed by an appliance. The smart switch module may also be installed directly to an administrator s workstation or it can be used as a plug in to a larger centralized management system such as HP OpenView, IBM Tivoli, IBM Director, Microsoft System Management Server. The smart switch module also may be integrated into an appliance that includes Out-of-Band physical access media, such as the software module integrated with a KVM/IP switch. The module also may be a software module integrated with an access management gateway appliance such as Cyclades AlterPath Manager, Xceedium SSL-UAG+, Avocent DSView, Raritan Command Center. The module may also be implemented as an application specific integrated circuit (ASIC). The module may also be implemented in a service processor gateway in accordance with the invention. [0031] The computer system may have various well known components that are not shown in Figure 7 including a display device and various input/output peripherals. The computer system 60 also has a CPU 62 and a persistent storage device 64, such as a magnetic disk drive, optical disk drive, tape drive, non-volatile memory, etc., and temporary memory 66, such as DRAM or SRAM or flash memory, wherein the CPU, persistent storage device and temporary memory are coupled together. The persistent storage device stores one or more software applications modules while the temporary memory stores one or more software applications/modules while the modules/applications are being executed by the CPU as is well known. In order to implement the smart switch module in accordance with the invention, the one or more software modules may be resident in the temporary memory 66 and may be executed by the CPU 62. In particular, the computer system may execute a typical operating system 68 and a smart switch software application 70. The smart switch software application 70 may include a monitor module 72, an engine module 74, one or more protocol adapters 76 and one or more viewers 78. The monitor module may monitor the network management services to ascertain the availability of each protocol that may be used for any system under management. The engine module 74 evaluates the suitability of each protocol for the current session based on the condition of the network, the system under management and the administrator s current connection options settings and selects the protocol/service. In accordance with the invention, the invention continues to monitor the protocol during any session and will switch to an alternative session protocol (using the decision engine) if the current session protocol becomes unavailable or if a more efficient session protocol becomes available. The protocol adapters 76 permit the smart switch module to interface with and connect to the various different network management protocols. In accordance with the invention, additional protocol adapters may be incorporated into the system at any time so that the system is able to handle any new protocols. The one or more viewers 78 permit the smart switch module to provide viewer applications to each user of the system. [0032] The flow diagrams described below demonstrate the functionality of the smart switch module (SSM) in accordance with the invention. The flow diagrams assume a scenario where two connection protocols are 6

7 11 EP B1 12 available but it will be appreciated that the invention can be extended to any number of connection protocols. [0033] Figure 8 is a flow diagram that illustrates a method 80 for smart switching in accordance with the invention. In accordance with the invention, the smart switch module ("SSM") waits for a connection request to start the method. On receiving a connection request (step 82), the SSM runs an establish connection algorithm (step 84) which is described in more detail below with reference to Figure 8. This algorithm checks system preferences (located in a preference database 8) and service availability to decide which connection methods and protocols to use (e.g., an in-band protocol or an out-of-band protocol). If a connection cannot be established (step 86) then an error is returned to the user (step 88) and the method is completed. If a connection is established then the SSM will return and launch a viewer application (step 90) and begin to monitor the connection (step 92) which is described in more detail with reference to Figure. If the connection is terminated by the user (step 94) (based on a connection termination request) then the connection is closed (step 96) and the method is completed. If a connection switch request is received (step 98) from the monitor connection module (See Figure 7) then a connection switch is attempted (step 0). Once the secondary session is established, the SSM returns to the monitoring loop in step 92. If the switch of connection cannot be completed (step 2) then in the case where the secondary connection was chosen because of failure in the primary an error is returned (step 4) since no connection is available at this point. If the secondary was selected due to preferences but it is not available and the primary connection is still available then no switch will occur and the SSM will return to the monitoring loop in step 92. Now, the method for establishing the connection in accordance with the invention will be described. [0034] Figure 9 is a flow diagram that illustrates a method 1 of the actions taken by the smart switch module during the establish connection phase. Note that the smart switch module in this embodiment is a software module that represents a piece of the functionality of the smart switch appliance. Once a connection is requested, the SSM queries the system preferences (step 112) in the preferences database 8 to determine which connection types may be used for a particular user and which ones are preferred for the particular user in which conditions. If the preferred or primary connection type is available (step 114) then a connection is established using the primary protocol (step 118) and a connection is returned (step 122). A preferred method for checking the availability of a connection uses a well known network service availability probe. If the primary connection is not available, then the secondary connection type is checked for availability (step 116). If this secondary connection is available then the secondary connection is established (step 1) and a connection is returned (step 122). If the secondary is also not available then an error is returned (step 124). [003] Figure is a flow diagram that illustrates a method 1 of the action taken by the SSM during the connection monitoring phase. The SSM probes the current connection to determine its status (step 132). Preferably, the status of the connection may be monitored directly by the protocol adapters or may use an external network service availability probe such as big brother to monitor the status of the connection. The status is checked (step 134) and if the connection is no longer available then the module returns a connection status NOT OK (step 136) and terminates the method. If the connection is OK then the module checks to see if a termination request was received from the user viewer (step 138). If the terminate request was received then the module returns a connection terminated (step 1) and terminates. Next the module checks to see if the user viewer requested a connection change (step 142) when the smart switch module is integrated into the user computer. If the user viewer requested a connection change, then a CONNECTION SWITCH is returned (step 144) and the module terminates. Next the preferences are read (step 146) and a check is made to determine if the current connection is the preferred one (step 148). If the current connection is the preferred connection, then the connection OK is returned (step 10) and the module terminates. If the current connection is not the preferred connection, then CONNECTION SWITCH is returned (step 144) and the module terminates. [0036] While the foregoing has been with reference to a particular embodiment of the invention, it will be appreciated by those skilled in the art that changes in this embodiment may be made without departing from the invention, the scope of which is defined by the appended claims. Claims 1. A remote management system for remotely managing a plurality of network nodes, the system comprising: A) a management station that executes software to remotely control and monitor remote network nodes of said plurality of network nodes on a single viewer application; and B) a smart switch module appliance, located between the management station and the remote network nodes, wherein each of said plurality of network nodes is accessible for control by said management station via said smart switch module appliance using a remote access protocol automatically selected by the smart switch module appliance from at least i) an in-band remote access protocol, and ii) an out-of-band remote access protocol, said remote access protocol for a particular 7

8 13 EP B1 14 remote network node being chosen by the smart switch module appliance based on a set of criteria including: a) system-wide preferences, and b) connection option settings made at the management station, and c) a set of preference data associated with a user, at least one of said criteria including a setting for network response time, and at least one of said criteria comprising an availability of an in-band remote access protocol and an availability of a out-of-band remote access protocol; wherein: same viewer, whether the smart switch module changed to the in-band remote access protocol or the out-of band remote access protocol; and b) said smart switch module appliance continuously repeats b3) and b4) each time another of the in-band remote access protocol and out-of-band remote access protocol is currently determined to more optimally meet the set of criteria for communication between the system under management and the management station; and b1) said smart switch module appliance provides the viewer application at the management station access to a particular remote network node using said selected remote access protocol, said particular remote network node being controlled and monitored being a system under management, and b2) said smart switch module appliance continues to support communication between the system under management and the viewer application at the management station whether the currently-selected remote access protocol for communication between the system under management and the management station is the in-band remote access protocol or the out-of-band remote access protocol; and b3) having selected a remote access protocol for communication between the system under management and the management station, said smart switch module appliance continuously and automatically, without user action, monitors the in-band and out-ofband service availability of the system under management, to determine whether the currently-selected remote access protocol for communication between the system under management and the management station optimally meets said set of criteria; and b4) said smart switch module appliance automatically changes the currently-selected remote access protocol for communication between the system under management and the management station to the other of the in-band remote access protocol and outof-band remote access protocol when said other of the in-band remote access protocol and out-of band remote access protocol is currently determined to more optimally meet said set of criteria for communication between the system under management and the management station, and thereafter continues to support seamlessly communication between the system under management and the management station using the wherein the management station remotely controls and monitors the system under management through the smart switch module seamlessly through the viewer, using the currentlyselected remote access protocol. 2. The system of claim 1 further comprising a management gateway appliance wherein the smart switch module further comprises a plurality of instructions embedded into an application specific integrated circuit ASIC residing at the management gateway appliance. 3. The system of claim 2, where the management gateway appliance is a Keyboard-Video-Mouse switch using one or more of the following list of remote access protocols: Remote Desktop Protocol RDP, Virtual Network Computing VNC, Independent Computing Architecture ICA, X-windows X.11, and Intelligent Platform Management Interface IPMI. 4. The system of any of claim 1, wherein the smart switch module further comprises: a monitor module that monitors a connection status of the in-band remote access protocol and the out-of-band remote access protocol to determine the availability of each protocol; a decision engine that selects one of the in-band remote access protocol or the out-of-band remote access protocol based on the set of criteria, a set of protocol adapters that permit the smart switch module to interface with a plurality of remote access protocols, and a set of viewer applications capable of providing a user interface for the monitoring and controlling of the remote network node.. The system of any of claims, herein the smart switch module further comprises computer instructions executed at the management station. 6. A method of remotely managing a plurality of network nodes using a management station that executes 8

9 1 EP B1 16 software to remotely monitor and control a remote network node as a system under management, and a smart switch module appliance, located between the management station and the remote network node, wherein each of said plurality of network nodes is accessible for control by said management station via said smart switch module appliance using a remote access protocol automatically selected by the smart switch module appliance from at least i) an inband remote access protocol, and ii) an out-of-band remote access protocol, the method comprising: A) opining a common viewer at the management station; B) setting connection option settings at the management station - including a setting for network response time; C) automatically selecting, at the smart module, a remote access protocol from i) an in-band remote access protocol to access a remote network node and ii) an out-of-band remote access protocol to access the remote network node, said selecting being based on a set of predetermined criteria including said remote access protocol for a particular remote network node being chosen by the smart switch module appliance based on a set of criteria including: a) systemwide preferences, and b) connection option settings made at the management station, and c) a set of preference data associated with a user, at least one of said criteria including a setting for network response time, and at least one of said criteria comprising an availability of an inband remote access protocol and an availability of a out-of-band remote access protocol; D) accessing, using the smart switch module, the remote network node, as the system under management, using the selected remote access protocol; E) at the management station through the common viewer, remotely monitoring and controlling the system under management through the smart switch module using the selected remote access protocol; F) at the smart switch module, continuously testing whether the selected remote access protocol optimally meets the set of predetermined criteria; G) at the smart switch module, automatically changing the remote access protocol to another remote access protocol other than the selected remote access protocol anytime said another remote access protocol is currently determined to more optimally meet the set of predetermined criteria; and H) continuing to communicate seamlessly between the management station and the system under management, using the same common viewer when the smart switch module changes to said another remote access protocol. 7. The method of claim 6, wherein automatically selecting the remote access protocol further comprises monitoring the selected remote access protocol and, if the selected remote access protocol cannot be used to continue to control the remote network node, automatically selecting another remote access protocol based on the set of predetermined criteria. 8. The method of claim 6 further comprising providing a viewer application that provides a user interface for remotely monitoring and controlling the remote network node through the smart switch module. Patentansprüche 1. Fernverwaltungssystem für die Fernverwaltung mehrerer Netzwerkknoten, wobei das System aufweist: A) eine Verwaltungsstation, welche Software zur Fernsteuerung und - überwachung von Remote-Netzwerkknoten der mehreren Netzwerkknoten auf einer Single-Viewer-Anwendung ausführt; und B) ein Smart-Switch-Modul-Gerät, das zwischen der Verwaltungsstation und den Remote- Netzwerkknoten angeordnet ist, wobei jeder der mehreren Netzwerkknoten zur Steuerung durch die Verwaltungsstation über das Smart-Switch-Modul-Gerät unter Verwendung eines Fernzugriffsprotokolls zugängig ist, welches von dem Smart-Switch-Modul-Gerät automatisch unter zumindest i) einem In-Band- Fernzugriffsprotokoll und ii) einem Out-of-Band- Fernzugriffsprotokoll gewählt wird, wobei das Fernzugriffsprotokoll für einen bestimmten Remote-Netzwerkknoten von dem Smart-Switch- Modul-Gerät auf der Grundlage eines Satzes von Kriterien gewählt wird, welche umfassen: a) systemweite Präferenzen und b) einen Satz von Präferenzdaten, welche einem Benutzer zugeordnet sind, wobei mindestens eines der Kriterien eine Einstellung für die Netzwerkreaktionszeit umfasst und mindestens eines der Kriterien die Verfügbarkeit eines In-Band-Fernzugriffsprotokolls und die Verfügbarkeit eines Out-of- Band-Fernzugriffsprotokolls umfasst; wobei b1) das Smart-Switch-Modul-Gerät der Viewer-Anwendung an der Verwaltungsstation Zugang zu einem bestimmten Remote-Netzwerkknoten unter Verwendung 9

10 17 EP B1 18 des gewählten Fernzugriffsprotokolls gewährt, wobei der gesteuerte und überwachte bestimmte Remote-Netzwerkknoten ein unter Verwaltung stehendes System ist, b2) das Smart-Switch-Modul-Gerät fortfährt, die Kommunikation zwischen dem verwalteten System und der Viewer-Anwendung an der Verwaltungsstation zu unterstützen, egal ob das aktuell gewählte Fernzugriffsprotokoll für die Kommunikation zwischen dem verwalteten System und der Verwaltungsstation das In-Band-Fernzugriffsprotokoll oder das Out-of-Band- Fernzugriffsprotokoll ist; und b3) nach der Wahl eines Fernzugriffsprotokolls für die Kommunikation zwischen dem verwalteten System und der Verwaltungsstation, das Smart-Switch-Modul-Gerät kontinuierlich und automatisch, ohne User- Aktion, die In-Band- und Out-of-Band-Service-Verfügbarkeit des verwalteten Systems überwacht, um festzustellen, ob das aktuell gewählte Fernzugriffsprotokoll für die Kommunikation zwischen dem verwalteten System und der Verwaltungsstation den Satz von Kriterien optimal erfüllt; und b4) das Smart-Switch-Modul-Gerät das aktuell gewählte Fernzugriffsprotokoll für die Kommunikation zwischen dem verwalteten System und der Verwaltungsstation zu dem anderen Protokoll, dem In-Band-Fernzugriffsprotokoll oder dem Out-of-Band-Fernzugriffsprotokoll, ändert, wenn aktuell festgestellt wird, dass das andere Protokoll, das In-Band-Fernzugriffsprotokoll oder das Out-of-Band-Fernzugriffsprotokoll, den Satz von Kriterien für die Kommunikation zwischen dem verwalteten System und der Verwaltungsstation optimaler erfüllt, und anschließend fortfährt, die Kommunikation zwischen dem verwalteten System und der Verwaltungsstation unter Verwendung des selben Viewers nahtlos zu unterstützen, egal ob das Smart-Switch-Modul-Gerät zu dem In-Band-Fernzugriffsprotokoll oder dem Out-of-Band-Fernzugriffsprotokoll gewechselt hat; und b) das Smart-Switch-Modul-Gerät kontinuierlich b3) und b4) jedes Mal wiederholt, wenn aktuell festgestellt wird, dass ein anderes Protokoll, das In-Band-Fernzugriffsprotokoll oder das Out-of-Band-Fernzugriffsprotokoll, den Satz von Kriterien für die Kommunikation zwischen dem verwalteten System und der Verwaltungsstation optimaler erfüllt; und wobei die Verwaltungsstation das verwaltete System durch das Smart-Switch-Modul unter Verwendung des aktuell gewählten Fernzugriffsprotokolls übergangslos durch den Viewer fernsteuert und -verwaltet. 2. System nach Anspruch 1, ferner mit einem Verwaltungsgateway-Gerät, wobei das Smart-Switch-Modul ferner mehrere Befehle aufweist, welche in einer anwendungsspezifischen integrierten Schaltung ASIC eingebettet sind, die in dem Verwaltungsgateway-Gerät vorgesehen ist. 3. System nach Anspruch 2, bei welchem das Verwaltungsgateway-Gerät ein Tastatur-Video-Maus- Schalter ist, welcher eines oder mehrere aus der folgenden Liste von Fernzugriffsprotokollen verwendet: Remote Desktop Protocol RDP, Virtual Desktop Computing VNC, Independent Computing Architecture ICA, X-windows X.11 und Intelligent Platform Management Interface IPM. 4. System nach Anspruch 1, bei welchem das Smart- Switch-Modul ferner aufweist: ein Monitormodul, welches einen Verbindungsstatus des In-Band-Fernzugriffsprotokolls und des Out-of-Band-Fernzugriffsprotokolls überwacht, um die Verfügbarkeit jedes Protokolls zu bestimmen; eine Entscheidungs-Engine, welche ein Protokoll, das In-Band-Fernzugriffsprotokoll oder das Out-of-Band-Fernzugriffsprotokoll, auf der Grundlage des Satzes von Kriterien wählt, einen Satz Protokolladapter, die es dem Smart- Switch-Modul ermöglichen, sich mit mehreren Fernzugangsprotokollen zu verbinden; und einen Satz Viewer-Anwendungen, die in der Lage sind, ein User-Interface für das Überwachen und Steuern des Remote-Netzwerkknotens bereitzustellen.. System nach Anspruch 1, bei welchem das Smart- Switch-Modul ferner Computerbefehle aufweist, welche an der Verwaltungsstation ausgeführt werden. 6. Verfahren zur Fernverwaltung mehrerer Netzwerkknoten unter Verwendung einer Verwaltungsstation, welche Software ausführt, die zur Fernsteuerung und -überwachung eines Remote-Netzwerks als verwaltetes System dient, und eines Smart-Switch- Modul-Geräts, das zwischen der Verwaltungsstation und dem Remote-Netzwerkknoten angeordnet ist, wobei jeder der mehreren Netzwerkknoten zur Steuerung durch die Verwaltungsstation über das Smart- Switch-Modul-Gerät unter Verwendung eines Fernzugriffsprotokolls zugängig ist, welches von dem Smart-Switch-Modul-Gerät automatisch unter zu-

11 19 EP B1 mindest i) einem In-Band-Fernzugriffsprotokoll und ii) einem Out-of-Band-Fernzugriffsprotokoll gewählt wird, wobei das Verfahren aufweist: A) das Öffnen eines Common-Viewers an der Verwaltungsstation; B) das Einstellen von Verbindungsoptionseinstellungen an der Verwaltungsstation, einschließlich einer Einstellung für die Netzwerkreaktionszeit; C) das automatische Wählen, am Smart-Modul, eines Fernzugriffsprotokolls i) einem In-Band- Fernzugriffsprotokoll für den Zugriff auf einen Remote-Netzwerkknoten und ii) einem Out-of- Band-Fernzugriffsprotokoll für den Zugriff auf einen Remote-Netzwerkknoten, wobei das Wählen auf einem Satz vorbestimmter Kriterien erfolgt, welche das Fernzugriffsprotokoll für einen bestimmten Remote-Netzwerkknoten einschließen, welches von dem Smart-Switch-Module-Gerät auf der Basis eines Satzes von Kriterien gewählt wird, welche umfassen: a) systemweite Präferenzen und b) einen Satz von Präferenzdaten, welche einem Benutzer zugeordnet sind, wobei mindestens eines der Kriterien eine Einstellung für die Netzwerkreaktionszeit umfasst und mindestens eines der Kriterien die Verfügbarkeit eines In-Band-Fernzugriffsprotokolls und die Verfügbarkeit eines Out-of- Band-Fernzugriffsprotokolls umfasst; D) das unter Verwendung des Smart-Switch- Moduls erfolgende auf den Remote-Netzwerkknoten als verwaltetes System unter Verwendung des gewählten Fernzugriffsprotokolls; E) das an der Verwaltungsstation über den Common-Viewer erfolgende Fernüberwachen und -steuern des verwalteten Systems durch das Smart-Switch Modul unter Verwendung des gewählten Fernzugriffsprotokolls; F) das am Smart-Switch Modul erfolgende kontinuierliche Prüfen, ob das gewählte Fernzugriffsprotokoll den Satz der vorbestimmten Kriterien optimal erfüllt; G) das am Smart-Switch-Modul erfolgende automatische Ändern des Fernzugriffsprotokolls in ein von dem gewählten Fernzugriffsprotokoll verschiedenes anderes Fernzugriffsprotokoll jedes Mal, wenn aktuell festgestellt wird, dass das andere Fernzugriffsprotokoll den Satz der vorbestimmten Kriterien optimaler erfüllt; und H) das Fortsezen der übergangslosen Kommunikation zwischen der Verwaltungsstation und dem verwalteten System unter Verwendung des selben Common-Viewers, wenn das Smart- Switch-Modul zu dem anderen Fernzugriffsprotokoll wechselt Verfahren nach Anspruch 6, bei welchem das automatische Wählen des Fernzugriffsprotokolls ferner das Überwachen des gewählten Fernzugriffsprotokolls und, wenn das gewählte Fernzugriffsprotokoll nicht zum Fortsetzen des Steuerns des Remote- Netzwerkknotens verwendet werden kann, automatisch ein anderes Fernzugriffsprotokoll basierend auf dem Satz der vorbestimmten Kriterien gewählt wird. 8. Verfahren nach Anspruch 6, ferner mit dem Vorsehen einer Viewer-Anwendung, welche ein User-Interface für die Fernüberwachung und - steuerung des Remote-Netzwerkknotens durch das Smart- Switch-Modul bereitstellt. Revendications 1. Système de gestion à distance destiné à gérer à distance une pluralité de noeuds de réseau, le système comprenant : A) une station de gestion qui exécute un logiciel pour contrôler et surveiller à distance des noeuds de réseau distants de ladite pluralité de noeuds de réseau sur une unique application de visualiseur ; et B) un appareil de module à commutation intelligente, situé entre la station de gestion et les noeuds de réseau distants ; dans lequel chaque noeud de ladite pluralité de noeuds de réseau est accessible afin d être commandé par ladite station de gestion par l intermédiaire dudit appareil de module à commutation intelligente, en utilisant un protocole d accès distant automatiquement sélectionné par l appareil de module à commutation intelligente parmi au moins i) un protocole d accès distant intrabande, et ii) un protocole d accès distant hors bande, ledit protocole d accès distant, pour un noeud de réseau distant spécifique, étant choisi par l appareil de module à commutation intelligente sur la base d un ensemble de critères incluant : a) des préférences à l échelle du système, et b) des paramètres d option de connexion mis en oeuvre au niveau de la station de gestion, et c) un ensemble de données de préférence associées à un utilisateur, au moins l un desdits critères incluant un paramètre de temps de réponse de réseau, et à moins l un desdits critères comprenant une disponibilité d un protocole d accès distant intrabande et une disponibilité d un protocole d accès distant hors bande ; dans lequel : b1) ledit appareil de module à commutation intelligente fournit, à l application de visua- 11

12 21 EP B liseur, au niveau de la station de gestion, l accès à un noeud de réseau distant spécifique, en utilisant ledit protocole d accès distant sélectionné, ledit noeud de réseau distant spécifique commandé et surveillé étant un système sous gestion ; et b2) ledit appareil de module à commutation intelligente continue de prendre en charge la communication entre le système sous gestion et l application de visualiseur, au niveau de la station de gestion, que le protocole d accès distant sélectionné en cours pour la communication entre le système sous gestion et la station de gestion soit le protocole d accès distant intrabande ou le protocole d accès distant hors bande ; et b3) ayant sélectionné un protocole d accès distant pour la communication entre le système sous gestion et la station de gestion, ledit appareil de module à commutation intelligente, de façon continue et automatique, sans intervention de l utilisateur, surveille la disponibilité de service intrabande et hors bande du système sous gestion, en vue de déterminer si le protocole d accès distant sélectionné en cours, pour la communication entre le système sous gestion et la station de gestion, répond de façon optimale audit ensemble de critères ; et b4) ledit appareil de module à commutation intelligente remplace automatiquement le protocole d accès distant sélectionné en cours pour la communication entre le système sous gestion et la station de gestion par l autre protocole parmi le protocole d accès distant intrabande et le protocole d accès distant hors bande, lorsque ledit autre protocole parmi le protocole d accès distant intrabande et le protocole d accès distant hors bande est à cet instant déterminé comme répondant de manière plus optimale audit ensemble de critères pour la communication entre le système sous gestion et la station de gestion, et, subséquemment, continue à prendre en charge de façon transparente la communication entre le système sous gestion et la station de gestion en utilisant le même visualiseur, que le module à commutation intelligente ait opté pour le protocole d accès distant intrabande ou le protocole d accès distant hors bande ; et b) ledit appareil de module à commutation intelligente répète continuellement les étapes b3) et b4) à chaque fois qu un autre protocole parmi le protocole d accès distant intrabande et le protocole d accès distant hors bande est déterminé à cet instant comme répondant de manière plus optimale à l ensemble de critères pour la communication entre le système sous gestion et la station de gestion ; et dans lequel la station de gestion commande et surveille à distance le système sous gestion à travers le module à commutation intelligente, de façon transparente, par le biais du visualiseur, en utilisant le protocole d accès distant sélectionné en cours. 2. Système selon la revendication 1, comprenant en outre un appareil de passerelle de gestion dans lequel le module à commutation intelligente comprend en outre une pluralité d instructions intégrées dans un circuit intégré à application spécifique, ASIC, résidant au niveau de l appareil de passerelle de gestion. 3. Système selon la revendication 2, où l appareil de passerelle de gestion est un commutateur claviervidéo-souris utilisant l un ou plusieurs des protocoles de la liste suivante de protocoles d accès distant : un protocole de bureau distant, RDP, un protocole d informatique virtuelle en réseau, VNC, un protocole d architecture informatique indépendante, ICA, un protocole X Windows, X.11, et un protocole d interface de gestion de plateforme intelligente, IPMI. 4. Système selon la revendication 1, dans lequel le module à commutation intelligente comprend en outre : un module de surveillance qui surveille un état de connexion du protocole d accès distant intrabande et du protocole d accès distant hors bande, en vue de déterminer la disponibilité de chaque protocole ; un moteur de décision qui sélectionne l un parmi le protocole d accès distant intrabande ou le protocole d accès distant hors bande sur la base de l ensemble de critères ; un ensemble d adaptateurs de protocoles permettant au module à commutation intelligente de s interfacer avec une pluralité de protocoles d accès distants ; et un ensemble d applications de visualiseur apte à fournir une interface utilisateur pour la surveillance et la commande du noeud de réseau distant.. Système selon la revendication I, dans lequel le module à commutation intelligente comprend en outre des instructions informatiques exécutées au niveau de la station de gestion. 6. Procédé de gestion à distance d une pluralité de noeuds de réseau utilisant une station de gestion qui exécute un logiciel pour surveiller et commander à 12

13 23 EP B1 24 distance un noeud de réseau distant en tant qu un système sous gestion, et un appareil de module à commutation intelligente, situé entre la station de gestion et le noeud de réseau distant, dans lequel chaque noeud de ladite pluralité de noeuds de réseau est accessible afin d être commandé par ladite station de gestion par l intermédiaire dudit appareil de module à commutation intelligente en utilisant un protocole d accès distant automatiquement sélectionné par l appareil de module à commutation intelligente parmi au moins i) un protocole d accès distant intrabande, et ii) un protocole d accès distant hors bande ; le procédé consistant à : A) ouvrir un visualiseur commun au niveau de la station de gestion ; B) définir des paramètres d option de connexion au niveau de la station de gestion, notamment un paramètre de temps de réponse de réseau ; C) sélectionner automatiquement, au niveau du module intelligent, un protocole d accès distant parmi i) un protocole d accès distant intrabande pour accéder à un noeud de réseau distant et ii) un protocole d accès distant hors bande pour accéder au noeud de réseau distant, ladite sélection étant basée sur un ensemble de critères prédéterminés incluant ledit protocole d accès distant pour un noeud de réseau distant spécifique qui est choisi par l appareil de module à commutation intelligente sur la base d un ensemble de critères incluant : a) des préférences à l échelle du système, b) des paramètres d option de connexion mis en oeuvre au niveau de la station de gestion, et c) un ensemble de données de préférence associées à un utilisateur, au moins l un desdits critères incluant un paramètre de temps de réponse de réseau, et au moins l un desdits critères comprenant une disponibilité d un protocole d accès distant intrabande et une disponibilité d un protocole d accès distant hors bande ; D) accéder, en utilisant le module à commutation intelligente, au noeud de réseau distant, en tant que système sous gestion, en utilisant le protocole d accès distant sélectionné ; E) au niveau de la station de gestion, à travers le visualiseur commun, surveiller et commander à distance le système sous gestion à travers le module à commutation intelligente en utilisant le protocole d accès distant sélectionné ; F) au niveau du module à commutation intelligente, tester de manière continue si le protocole d accès distant sélectionné répond de façon optimale à l ensemble de critères prédéterminés ; G) au niveau du module à commutation intelligente, remplacer automatiquement le protocole d accès distant par un autre protocole d accès distant distinct du protocole d accès distant sélectionné, à chaque fois que ledit autre protocole d accès distant est à cet instant déterminé comme répondant de manière plus optimale à l ensemble de critères prédéterminés ; et H) continuer de communiquer de manière transparente entre la station de gestion et le système sous gestion, en utilisant le même visualiseur commun lorsque le module à commutation intelligente a opté pour ledit autre protocole d accès distant. 7. Procédé selon la revendication 6, dans lequel la sélection automatique du protocole d accès distant consiste en outre à surveiller le protocole d accès distant sélectionné et, si le protocole d accès distant sélectionné ne peut pas être utilisé en vue de continuer à commander le noeud de réseau distant, sélectionner automatiquement un autre protocole d accès distant sur la base de l ensemble de critères prédéterminés. 8. Procédé selon la revendication 6, consistant en outre à fournir une application de visualiseur qui fournit une interface utilisateur pour surveiller et commander à distance le noeud de réseau distant à travers le module à commutation intelligente. 13

14 EP B1 14

15 EP B1 1

16 EP B1 16

17 EP B1 17

18 EP B1 18

19 EP B1 19

20 EP B1