Method and apparatus for authenticating nodes in a communications network

A node for use in a communications network representing a first node in the network, said first node comprising:

• a port for connecting to a communications link to a second node, wherein the first node receives a first network management message and a second network management message from the second node via the port;
• a trust indicator for indicating a status of the second node according to whether the first node regards the second node as trusted or untrusted, wherein the first node discards at least selected network management messages received over said communications link from the second node while the first node regards the second node as untrusted;
• an authentication mechanism operable to perform an authentication protocol with the second node, said authentication protocol including receiving at least one message from the second node over said communications link, wherein said at least one message is discarded if it does not form part of the authentication protocol, and wherein the status of the second node is set to trusted if the authentication protocol is successful, such that network management messages received from the second node over said communications link are no longer discarded;
• and
• a discarding mechanism operable to discard the first network management message in response to determining that the second node is untrusted, and to not discard the second network management message in response to determining that the second node is trusted, thereby protecting the communications network against malicious nodes.

A computer program product comprising program instructions that when loaded into a first node in a communications network cause the first node to protect the communications network against malicious nodes, wherein the second node is connected by a communications link to a port of the first node, said protecting being performed by the method of:

• setting a status of the second node as untrusted at the first node;
• receiving a first network management message at the first node from the second node;
• in response to determining that the second node's status is set to untrusted, discarding the first network management message, thereby protecting the communications network against malicious nodes;
• performing an authentication protocol with the second node, said authentication protocol including receiving at least one message from the second node over said communications link, wherein said at least one message is discarded if it does not form part of the authentication protocol;
• in response to determining that the authentication protocol was successful, setting the status of the second node as trusted;
• receiving a second network management message at the first node from the second node;
• in response to determining that the second node's status is set to trusted, not discarding the second network management message.