Facilitates authentication of routing modules associated with one or more network devices to allow zero-touch provisioning

Abstract

The network device may receive a redundant identifier certificate associated with a redundant routing module, and may provide a primary identifier certificate associated with a primary routing module associated with the network device to a boot device. The network device may establish a secure connection with the boot device based on the boot device verifying the authenticity of the primary routing module via the primary identifier certificate. The network device may provide a redundant routing module identifier associated with the redundant routing module to the boot device via a secure connection, and may receive a signed certificate chain associated with the redundant routing module from the boot device via a secure connection. The network device may verify the signed certificate chain, and may verify the redundant identifier certificate associated with the redundant routing module based on verifying the signed certificate chain.

Description

Technical Field

[0001] The present invention relates to the field of computers, and more particularly, to supporting authentication of routing modules associated with one or more network devices to enable zero-touch provisioning.

[0002] CROSS-REFERENCE TO RELATED APPLICATIONS

[0003] This application claims the benefit of Indian Provisional Application No. 202041027789 filed on June 30, 2020, entitled “Facilitating authentication of a routing module associated with one or more network devices to enable zero-touch provisioning”, the entire contents of which are expressly incorporated herein by reference. Background Art

[0004] Zero touch provisioning (ZTP) is a technique for provisioning a network device when it boots in a factory default state. Provisioning can include updating the boot image, establishing an initial configuration, and executing any scripts to handle auxiliary needs. After provisioning, the network device is able to establish connections with other network devices.

[0005] A virtual chassis is a collection of network devices connected together to form a single logical network device. The collection of network devices may be connected via respective virtual chassis interfaces configured to transmit virtual chassis specific control traffic between the network devices in the collection of network devices. Summary of the invention

[0006] In some implementations, a method includes: receiving, by a main routing module, a redundant identifier certificate associated with a redundant routing module; establishing, by the main routing module, a secure connection with a boot device; providing, by the main routing module and via the secure connection, a redundant routing module identifier associated with the redundant routing module to the boot device; and optionally: receiving, by the main routing module and via the secure connection from the boot device an error message indicating that the redundant routing module is not authorized; or receiving, by the main routing module and via the secure connection from the boot device a signed certificate chain associated with a network device including the redundant routing module, verifying, by the main routing module, the signed certificate chain, and verifying, by the main routing module, the redundant identifier certificate associated with the redundant routing module based on verifying the signed certificate chain.

[0007] In some implementations, a network device includes one or more memories; and one or more processors for: receiving a redundant identifier certificate associated with a redundant routing module; establishing a secure connection with a boot device; providing a redundant routing module identifier associated with the redundant routing module to the boot device via the secure connection; and selectively: receiving an error message from the boot device via the secure connection indicating that the redundant routing module is not authorized; or receiving a signed certificate chain associated with the redundant routing module from the boot device via the secure connection, verifying the signed certificate chain, and verifying the redundant identifier certificate associated with the redundant routing module based on verifying the signed certificate chain.

[0008] In some implementations, a non-transitory computer-readable medium storing instructions includes one or more instructions that, when executed by one or more processors of a first network device and a second network device forming a virtual chassis, cause the one or more processors to: receive a redundant identifier certificate associated with the second network device; establish a secure connection with a boot device; provide a redundant routing module identifier associated with the second network device to the boot device via the secure connection; and selectively: receive an error message from the boot device via the secure connection indicating that the second network device is not authorized; or receive a signed certificate chain associated with the second network device from the boot device via the secure connection, verify the signed certificate chain, and verify the redundant identifier certificate associated with the second network device based on verifying the signed certificate chain. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1A-1G is a diagram of an example implementation described herein.

[0010] Figure 2 is a diagram of an example environment in which systems and / or methods described herein may be implemented.

[0011] Figure 3-Figure 4 yes Figure 2 A diagram of example components of one or more devices.

[0012] Figure 5-Figure 7 is a flow diagram of an example process involving supporting authentication of a routing module associated with one or more network devices to enable zero-touch provisioning. DETAILED DESCRIPTION

[0013] The following detailed description of example implementations refers to the accompanying drawings. The same reference numerals in different drawings may identify the same or similar elements.

[0014] Zero Touch Provisioning (ZTP) may be useful for provisioning network devices when deployed from a factory default state. Network operators who deploy network devices configured for ZTP may reduce errors during installation by automating the provisioning process and may reduce the expense of manually provisioning network devices by field operators. When a network device is coupled to a power source, the network device may communicate with a boot device to obtain boot information (also referred to as "provisioning information") for provisioning the network device.

[0015] In some cases, a network device and / or a virtual chassis (e.g., a collection of network devices connected together to form a single logical network device) may include a primary routing module and one or more redundant routing modules. ZTP allows a network device including a primary routing module to communicate with a boot device to configure the primary routing module with boot information. As part of the ZTP process, the boot device may communicate with the network device including the primary routing module to verify the authenticity of the primary routing module (e.g., to authenticate the primary routing module as a verified boot information recipient) before providing the boot information to the primary routing module.

[0016] However, in many cases, the boot device cannot be directly connected to the (multiple) network devices including one or more redundant routing modules to verify the authenticity of the one or more redundant routing modules. In this case, even if the boot device cannot verify the authenticity of the one or more redundant routing modules, the main routing module forwards the boot information to the one or more redundant routing modules to configure the one or more redundant routing modules using the boot information. In some cases, this allows malicious participants to deceive or imitate the redundant routing modules, which allows malicious participants to obtain boot information from the main routing module. Therefore, malicious participants may use malicious attacks to target (multiple) network devices (e.g., change or adjust one or more security settings of (multiple) network devices to destroy (multiple) network devices, such as by stealing virtual private network (VPN) keys associated with (multiple) network devices). This can affect the performance of (multiple) network devices, which can cause (multiple) network devices to waste computing resources (e.g., processor resources, memory resources, networked resources, etc.) to identify and / or investigate malicious attacks and / or correct any damage that may be caused by malicious attacks.

[0017] Some implementations described herein provide a main routing module that can verify the authenticity of one or more redundant routing modules before allowing the redundant routing module to be configured using boot information. In some implementations, the main routing module can obtain a redundant identifier certificate associated with the redundant routing module and send the redundant routing module identifier to a boot device. The boot device can identify the redundant routing module based on the redundant routing module identifier, and determine that the redundant routing module is authorized to receive boot information. The boot device can send a signed certificate chain (e.g., a signed trust anchor certificate) associated with a network device including a redundant routing module to the main routing module. The main routing module can verify the signed certificate chain and can use the signed certificate chain to verify the authenticity of the redundant routing module. Therefore, after verifying the authenticity of the redundant routing module, the main routing module can send the boot information to the redundant routing module to allow the redundant routing module to be configured using the boot information.

[0018] In this way, the primary routing module and / or the boot device supports authentication of one or more redundant routing modules, and thereby improves the security associated with configuring one or more redundant routing modules using boot information. This can reduce the likelihood that any network device associated with the primary routing module and / or one or more redundant routing modules will be subject to malicious attacks by malicious actors (e.g., attempts to spoof and / or mimic redundant routing modules). This saves computing resources (e.g., processor resources, memory resources, networked resources, etc.) of the network device that would otherwise be consumed to identify and / or investigate the malicious attack and / or correct any damage that may be caused by the malicious attack.

[0019] Figure 1A-1G is a diagram of one or more example implementations 100 described herein. Figure 1A As shown, an environment associated with (multiple) example implementations 100 may include a network device and / or a boot device. The network device may include a main routing module and one or more redundant routing modules. In some implementations, the redundant routing modules may be associated with a line card or another component of the network device. The network device and / or the boot device may be included in a network, such as a cellular network, a local area network (LAN), a core network, an access network, a wide area network (WAN) such as the Internet, a cloud network, etc.

[0020] like Figure 1BAs shown, an environment associated with (multiple) example implementations 100 may include a virtual chassis (e.g., a representation of multiple network devices as a single logical network device) and / or a boot device. The virtual chassis may include a primary routing module and one or more redundant routing modules (e.g., distributed across multiple network devices that include the virtual chassis). In some implementations, multiple network devices may be interconnected via one or more connections (e.g., via a direct connection, via an indirect connection, etc.). Additionally, or alternatively, a particular network device (e.g., a network device that includes a primary routing module) may be connected to a boot device (e.g., via a direct connection and / or an indirect connection). In some implementations, multiple network devices and / or boot devices may be included in a network.

[0021] As further described herein, the boot device can support verifying the authenticity of a primary routing module and one or more redundant routing modules, regardless of whether the primary routing module and the one or more redundant routing modules are included in a single network device or distributed across multiple network devices, such as in a virtual chassis. Figure 1C-1G The description applies to Figure 1A Description of the environment and Figure 1B A description of the environment.

[0022] like Figure 1C As shown, and reference number 105, the redundant routing module can send the redundant identifier certificate to the main routing module. For example, the redundant routing module and / or the main routing module can establish a connection (e.g., a communication session) between the redundant routing module and the main routing module to allow the redundant routing module to send the redundant identifier certificate to the main routing module. In some implementations, the connection may be a secure connection between the redundant routing module and the main routing module, such as a secure socket layer (SSL) connection. The redundant routing module can send the redundant identifier certificate to the main routing module in the following situations: when the network device including the redundant routing module is powered on, when the network device including the redundant routing module is added to the network, when the network device including the redundant routing module is connected to the network device including the main routing module, etc.

[0023] The redundant identifier certificate may include a secure device identifier (DevID) and / or another type of identifier that identifies the redundant routing module. In some implementations, the redundant identifier certificate may be issued by a certificate authority (CA) and / or another type of secure credential generation device.

[0024] like Figure 1C As further shown, and referenced numeral 110, the master routing module and / or the boot device can establish a secure connection between the master routing module and the boot device. In some implementations, the secure connection can be an SSL connection between the master routing module and the boot device.

[0025] In some implementations, (e.g., as part of establishing a secure connection between the master routing module and the boot device) the boot device can verify the authenticity of the master routing module based on a primary identifier certificate of the master routing module. The primary identifier certificate can include a DevID or another type of identifier that identifies the master routing module. In some implementations, the primary identifier certificate can be issued by a CA and / or another type of security credential generation device. For example, the master routing module can send the primary identifier certificate to the boot device, and the boot device can process the primary identifier certificate (e.g., using a certificate chain associated with the CA, such as a trust anchor certificate chain) to verify the primary identifier certificate associated with the master routing module (e.g., the primary identifier certificate identifies the master routing module).

[0026] like Figure 1D As shown, and with reference numeral 115, the primary routing module can provide a redundant routing module identifier to the boot device. The redundant routing module identifier can be a redundant identifier certificate and / or another type of identifier that identifies the redundant routing module (e.g., a serial number associated with the redundant routing module, a text string, etc.). For example, the primary routing module can send the redundant routing module identifier to the boot device via a secure connection between the primary routing module and the boot device.

[0027] like Figure 1D As further shown, and with reference to reference numeral 120, the boot device may determine whether the redundant routing module is authorized (e.g., to receive boot information). In some implementations, the boot device may determine whether the redundant routing module is associated with a certificate chain (e.g., a trust anchor certificate chain) based on the redundant routing module identifier. For example, the boot device may search a data structure (e.g., included in or accessible to the boot device) based on the redundant routing module identifier, the data structure including a plurality of certificate chains to identify a certificate chain associated with the redundant routing module.

[0028] In some implementations, when the certificate chain is associated with a network device including a redundant routing module, the redundant routing module can be associated with the certificate chain. In some implementations, when the certificate chain is a signed certificate chain (e.g., a signed trust anchor certificate chain) signed by the network device, the certificate chain can be associated with the network device. The network device can sign the certificate chain using a private key associated with the network device, using an owner certificate associated with the network device, etc.

[0029] When the boot device successfully identifies the certificate chain associated with the redundant routing module (e.g., identifies a signed certificate chain signed by the network device that includes the redundant routing module), the boot device can determine that the redundant routing module is authorized. The boot device and / or the primary routing module can therefore perform the operations described herein with respect to Figure 1E-1FAlternatively, when the boot device cannot identify the certificate chain associated with the redundant routing module, the boot device may determine that the redundant routing module is not authorized. The boot device and / or the primary routing module may therefore perform the operations described herein with respect to Figure 1G One or more functions related to the

[0030] like Figure 1E As shown, and reference numeral 125, the boot device may send a certificate chain associated with the redundant routing module to the primary routing module. For example, the boot device may send a signed certificate chain signed by a network device (which includes the redundant routing module) to the primary routing module via a secure connection between the primary routing module and the boot device.

[0031] like Figure 1E As shown, and with reference to numeral 130, the master routing module can verify the signed certificate chain (e.g., determine that the signed certificate chain originates from the network device). For example, the master routing module can verify the signature of the network device included in the signed certificate chain by using a public key associated with the network device (e.g., verify that the signed certificate chain is signed using a private key associated with the network device), by using an ownership credential associated with the network device (e.g., verify that the signed certificate chain is signed using an owner certificate associated with the network device), etc.

[0032] like Figure 1E As further shown, and with reference to numeral 135, the primary routing module (e.g., after verifying the signed certificate chain) can verify the authenticity of the redundant routing module. For example, the primary routing module can process the redundant identifier certificate using the signed certificate chain to verify that the redundant identifier certificate is associated with the redundant routing module (e.g., the redundant identifier certificate identifies the redundant routing module). In some implementations, the primary routing module can establish a new connection (e.g., a secure connection, such as an SSL connection) with the redundant routing module to retrieve the redundant identifier certificate from all primary routing modules to verify that the redundant identifier certificate is associated with the redundant routing module.

[0033] like Figure 1F As shown, and with reference numeral 140, the boot device can send boot information associated with the network to the primary routing module (e.g., after the boot device verifies the authenticity of the primary routing module). For example, the boot device can send the boot information to the primary routing module via a secure connection between the primary routing module and the boot device. In this way, the primary routing module can be configured with the boot information.

[0034] like Figure 1FAs further shown, and with reference numeral 145, the primary routing module can send the boot information to the redundant routing module (e.g., after the primary routing module verifies the authenticity of the redundant routing module). For example, the primary routing module can send the boot information to the redundant routing module via a connection between the primary routing module and the redundant routing module. In this way, the redundant routing module can be configured with the boot information.

[0035] After the primary routing module and the redundant routing module are configured using the boot information, the primary routing module may perform one or more functions (e.g., one or more routing functions) based on the boot information. In some implementations, the primary routing module and / or the redundant routing module may determine that the primary routing module is or is about to become non-operable. For example, a network device including the primary routing module may need to perform a reboot process to resolve an operational error that may cause the primary routing module to be offline for a period of time. Therefore, the primary routing module and / or the redundant routing module may cause the redundant routing module to perform one or more functions until the primary routing module becomes operational again (e.g., until the network device including the primary routing module becomes online again).

[0036] Alternatively, Figure 1G As shown, and reference numeral 150, the boot device may send (eg, as described herein with respect to Figure 1D As described with reference numeral 120, after determining that the redundant routing module is not authorized) an error message indicating that the redundant routing module is not authorized. For example, the boot device can send the error message to the primary routing module via a secure connection between the primary routing module and the boot device. Figure 1G As further shown, and with reference to numeral 155, the primary routing module (e.g., based on receiving an error message) may prevent verification of the authenticity of the redundant routing module based on the error message (e.g., may prevent verification of the redundant identifier certificate) and / or may prevent provisioning of the redundant routing module using boot information.

[0037] As indicated above, Figure 1A-1G are provided as examples. Other examples may differ from the reference Figure 1A-1G As described. Figure 1A-1G The number and arrangement of the devices shown are provided as examples. In practice, Figure 1A-1G Those shown may have additional devices, fewer devices, different devices, or devices arranged differently. Figure 1A-1G Two or more devices shown in FIG. 1 may be implemented in a single device, or in Figure 1A-1G The single device shown in may be implemented as multiple, distributed devices. Additionally, or alternatively, in Figure 1A-1G The collection of devices (eg, one or more devices) shown in FIG. 1 may perform the operations described by Figure 1A-1G One or more functions performed by another set of devices shown.

[0038] Figure 2 2 is a diagram of an example environment 200 in which the systems and / or methods described herein may be implemented. Figure 2 As shown, environment 200 may include a plurality of network devices 210 (e.g., network device 210-1 through network device 210-N, collectively referred to as "network device 210," and individually referred to as "network device 210"), boot device 220, and network 230. The devices of environment 200 may be connected to each other via wired connections, wireless connections, or a combination of wired and wireless connections.

[0039] The network device 210 includes one or more devices capable of receiving, storing, generating, processing, forwarding and / or transmitting information in the manner described herein. For example, the network device 210 may include a firewall, a router, a gateway, a switch, a hub, a bridge, a reverse proxy, a server (e.g., a proxy server), a security device, an intrusion detection device, a load balancer, or a similar type of device. In some implementations, the network device 210 may be a physical device implemented in a housing (such as a chassis). In some implementations, the network device 210 may be a virtual device implemented by one or more computer devices in a cloud computing environment or a data center. In some implementations, the network device 210 may include a main routing module and / or one or more redundant routing modules.

[0040] Boot device 220 includes one or more devices capable of storing, processing and / or routing information (such as the information described herein). In some implementations, boot device 220 may include a communication interface that allows boot device 220 to receive information from network device 210 and / or transmit information to network device 210. In some implementations, boot device 220 may be a server device, a DHCP server device, a data storage device, or a similar device. In some implementations, boot device 220 may include and / or maintain a data structure that includes multiple certificate chains.

[0041] The network 230 includes one or more wired and / or wireless networks. For example, the network 230 may include a cellular network (e.g., a long term evolution (LTE) network, a 2G network, a 5G network, a new radio (NR) network, a code division multiple access (CDMA) network, etc.), a public land mobile network (PLMN), a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), a telephone network (e.g., a public switched telephone network (PSTN)), Ethernet, VPN (e.g., VPLS, EVPN, VPWS, L2VPN, L4VPN, etc.), a private network, an ad hoc network, an intranet, the Internet, a fiber-based network, a cloud computing network, etc., and / or a combination of these or other types of networks.

[0042] Figure 2 The number and arrangement of devices and networks shown are provided as one or more examples. Figure 2 Those shown, there may be additional devices, fewer devices and / or networks, different devices and / or networks, or differently arranged devices and / or networks. Figure 2 Two or more devices shown in FIG. 1 may be implemented in a single device, or in Figure 2 The single device shown in can be implemented as multiple, distributed devices. Additionally, or alternatively, a collection of devices (eg, one or more devices) of environment 200 can perform one or more functions described as being performed by another collection of devices of environment 200.

[0043] Figure 3 300. Device 300 may correspond to network device 210, boot device 220, etc. In some implementations, network device 210, boot device 220, etc. may include one or more devices 300 and / or one or more components of device 300. Figure 3 As shown, the device 300 may include one or more input components 310-1 to 310-A ​​(A≥1) (hereinafter collectively referred to as input component 310, and individually referred to as input component 310), a switching component 320, one or more output components 330-1 to 330-B (B≥1) (hereinafter collectively referred to as output component 330, and individually referred to as output component 330) and a controller 340.

[0044] The input component 310 can be one or more attachment points for a physical link, and can be one or more entry points for incoming traffic (such as packets). The input component 310 can process incoming traffic, such as by performing data link layer encapsulation or decapsulation. In some implementations, the input component 310 can transmit and / or receive packets. In some implementations, the input component 310 may include an input line card that includes one or more packet processing components (e.g., in the form of an integrated circuit), such as one or more interface cards (IFCs), packet forwarding components, line card control components, input ports, processors, memory, and / or input queues. In some implementations, the device 300 may include one or more input components 310.

[0045] The switching component 320 can interconnect the input component 310 and the output component 330. In some implementations, the switching component 320 can be implemented via one or more crossbars, via a bus, and / or using a shared memory. Before the packet from the input component 310 is ultimately planned for delivery to the output component 330, the shared memory can be used as a temporary buffer to store the packet. In some implementations, the switching component 320 can enable the input component 310, the output component 330, and / or the controller 340 to communicate with each other.

[0046] The output component 330 can store packets and can plan packets for transmission on an output physical link. The output component 330 can support data link layer encapsulation or decapsulation, and / or various higher-level protocols. In some implementations, the output component 330 can transmit and / or receive packets. In some implementations, the output component 330 may include an output line card, which includes one or more packet processing components (e.g., in the form of an integrated circuit), such as one or more interface cards (IFCs), packet forwarding components, line card control components, output ports, processors, memories, and / or output queues. In some implementations, the device 300 may include one or more output components 330. In some implementations, the input component 310 and the output component 330 can be implemented by a collection of the same components (e.g., and the input / output component can be a combination of the input component 310 and the output component 330).

[0047] The controller 340 includes a processor in the form of, for example, a CPU, a GPU, an APU, a microprocessor, a microcontroller, a DSP, an FPGA, an ASIC, and / or another type of processor. The processor is implemented in hardware, firmware, or a combination of hardware and software. In some implementations, the controller 340 may include one or more processors that can be programmed to perform a function.

[0048] In some implementations, the controller 340 may include RAM, ROM, and / or another type of dynamic or static storage device (e.g., flash memory, magnetic storage, optical storage, etc.) that stores information and / or instructions for use by the controller 340.

[0049] In some implementations, the controller 340 can communicate with other devices, networks, and / or systems connected to the device 300 to exchange information about the network topology. The controller 340 can create a routing table based on the network topology information, can create a forwarding table based on the routing table, and can forward the forwarding table to the input component 310 and / or the output component 330. The input component 310 and / or the output component 330 can use the forwarding table to perform a route lookup for incoming and / or outgoing packets.

[0050] The controller 340 may perform one or more processes described herein. The controller 340 may perform these processes in response to executing software instructions stored by a non-transitory computer readable medium. A computer readable medium is defined herein as a non-transitory memory device. A memory device includes a memory space within a single physical storage device or a memory space extended across multiple physical storage devices.

[0051] The software instructions may be read into the memory and / or storage components associated with the controller 340 from another computer-readable medium or from another device via a communication interface. When executed, the software instructions stored in the memory and / or storage components associated with the controller 340 may cause the controller 340 to perform one or more processes described herein. Additionally, or alternatively, hardwired circuitry may be used in place of or in combination with software instructions to perform one or more processes described herein. Therefore, the implementations described herein are not limited to any particular combination of hardware circuitry and software.

[0052] Figure 3 The number and arrangement of the devices shown in FIG. 1 are provided as examples. In practice, compared to Figure 3 Those shown, device 300 may include additional components, fewer components, different components, or components that are arranged differently. Additionally, or alternatively, a collection of components (e.g., one or more components) of device 300 can perform one or more functions described as being performed by another collection of components of device 300.

[0053] Figure 4 4 is a diagram of example components of device 400, which may correspond to network device 210, boot device 220, etc. In some implementations, network device 210, boot device 220, etc. may include one or more devices 400 and / or one or more components of device 400. Figure 4As shown, device 400 may include a bus 410 , a processor 420 , a memory 430 , a storage component 440 , an input component 450 , an output component 460 , and a communication interface 470 .

[0054] Bus 410 includes components that enable wired and / or wireless communications between components of device 400. Processor 420 includes a central processing unit, a graphics processing unit, a microprocessor, a controller, a microcontroller, a digital signal processor, a field programmable gate array, an application-specific integrated circuit, and / or other types of processing components. Processor 420 is implemented in hardware, firmware, or a combination of hardware and software. In some implementations, processor 420 includes one or more processors that can be programmed to perform functions. Memory 430 includes random access memory, read-only memory, and / or another type of memory (e.g., flash memory, magnetic memory, and / or optical memory).

[0055] Storage component 440 stores information and / or software related to the operation of the device. For example, storage component 440 may include a hard disk drive, a disk drive, an optical disk drive, a solid state disk drive, a laser disk, a digital versatile disk, and / or another type of non-transient computer readable medium. Input component 450 enables device 400 to receive input, such as user input and / or perceived input. For example, input component 450 may include a touch screen, a keyboard, a key, a mouse, a button, a microphone, a switch, a sensor, a global positioning system component, an accelerometer, a gyroscope, an actuator, etc. Output component 460 enables device 400 to provide output, such as via a display, a speaker, and / or one or more light emitting diodes. Communication interface 470 enables device 400 to communicate with other devices, such as via wired connection and / or wireless connection. For example, communication interface 470 may include a receiver, a transmitter, a transceiver, a modem, a network interface card, an antenna, etc.

[0056] Device 400 can perform one or more processes described herein. For example, a non-transitory computer-readable medium (e.g., memory 430 and / or storage component 440) can store a set of instructions (e.g., one or more instructions, codes, software codes, program codes, etc.) for execution by processor 420. Processor 420 can execute a set of instructions to perform one or more processes described herein. In some implementations, the execution of a set of instructions by one or more processors 420 enables one or more processors 420 and / or device 400 to perform one or more processes described herein. In some implementations, hard-wired circuits can replace instructions or be used in combination with instructions to perform one or more processes described herein. Therefore, the implementation described herein is not limited to any special combination of hardware circuits and software.

[0057] Figure 4 The number and arrangement of components shown in are provided as examples. Figure 4 , device 400 may include additional components, fewer components, different components, or components that are arranged differently. Additionally, or alternatively, a collection of components (e.g., one or more components) of device 400 may perform one or more functions described as being performed by another collection of components of device 400.

[0058] Figure 5 is a flow chart associated with an example process 500 for enabling authentication of a routing module associated with one or more network devices to enable zero-touch provisioning. Figure 5 One or more process blocks of may be performed by a network device (e.g., network device 210-1). In some implementations, Figure 5 One or more process blocks of may be performed by another device or a collection of devices separate from or including the network device, such as another network device (e.g., network device 210-2, network device 210-N, etc.), a boot device (e.g., boot device 220), etc. Additionally or alternatively, Figure 5 One or more process boxes may be executed by: one or more components of the device 300 (such as the input component 310, the switching component 320, the output component 330, the controller 340, etc.), one or more components of the device 400 (such as the processor 420, the memory 430, the storage component 440, the input component 450, the output component 460, the communication interface 470, etc.), etc.

[0059] like Figure 5 As shown, process 500 may include receiving a redundant identifier certificate associated with a redundant routing module (block 510). For example, as described above, a network device may receive a redundant identifier certificate associated with a redundant routing module.

[0060] like Figure 5 As further shown, process 500 may include establishing a secure connection with a boot device (block 520). For example, as described above, the network device may establish a secure connection with the boot device.

[0061] like Figure 5 As further shown, process 500 includes providing a redundant routing module identifier associated with a redundant routing module to a boot device via a secure connection (block 530). For example, as described above, a network device may provide a redundant routing module identifier associated with a redundant routing module to a boot device via a secure connection.

[0062] like Figure 5As further shown, process 500 may include selectively receiving an error message indicating that the redundant routing module is not authorized from a boot device via a secure connection (block 540). For example, a network device may selectively receive an error message indicating that the redundant routing module is not authorized from a boot device via a secure connection.

[0063] Alternatively, Figure 5 As further shown, process 500 may include selectively receiving a signed certificate chain associated with a network device including a redundant routing module from a boot device via a secure connection, verifying the signed certificate chain, and based on verifying the signed certificate chain, verifying a redundant identifier certificate associated with the redundant routing module (block 550). For example, as described above, the network device may selectively receive a signed certificate chain associated with a network device including a redundant routing module from a boot device via a secure connection, verifying the signed certificate chain, and based on verifying the signed certificate chain, verifying a redundant identifier certificate associated with the redundant routing module.

[0064] Process 500 may include additional implementations, such as any single implementation or any combination of implementations described below, and / or in conjunction with one or more other processes described elsewhere herein.

[0065] In a first implementation, process 500 includes when an error message is received from a boot device, a redundant routing module is configured with the boot information.

[0066] In a second implementation, alone or in combination with the first implementation, process 500 includes sending boot information to the redundant routing module after verifying the redundant identifier certificate.

[0067] In a third implementation, alone or in combination with one or more of the first and second implementations, the primary routing module and the redundant routing module are included in a single network device.

[0068] In a fourth implementation, alone or in combination with one or more of the first to third implementations, the primary routing module is associated with a first network device and the redundant routing module is associated with a second network device different from the first network device.

[0069] In a fifth implementation, alone or in combination with one or more of the first to fourth implementations, the signed certificate chain includes a signed trust anchor certificate chain.

[0070] In a sixth implementation, alone or in combination with one or more of the first to fifth implementations, verifying the signed certificate chain includes verifying a signature of a network device included in the signed certificate chain.

[0071] although Figure 5An example block diagram of process 500 is shown. In some implementations, compared to Figure 5 In addition to those depicted in , process 500 may include additional blocks, fewer blocks, different blocks, or blocks that are arranged differently. Additionally, or alternatively, two or more blocks in the blocks of process 500 may be executed in parallel.

[0072] Figure 6 is a flow chart associated with an example process 600 for enabling authentication of a routing module associated with one or more network devices to allow zero-touch provisioning. Figure 6 One or more process blocks of may be performed by a network device (e.g., network device 210-1). In some implementations, Figure 6 One or more process blocks of may be performed by another device or a collection of devices separate from or including the network device, such as another network device (e.g., network device 210-2, network device 210-N, etc.), a boot device (e.g., boot device 220), etc. Additionally or alternatively, Figure 6 One or more process boxes may be executed by: one or more components of the device 300 (such as the input component 310, the switching component 320, the output component 330, the controller 340, etc.), one or more components of the device 400 (such as the processor 420, the memory 430, the storage component 440, the input component 450, the output component 460, the communication interface 470, etc.), etc.

[0073] like Figure 6 As shown, process 600 may include receiving a redundant identifier certificate associated with a redundant routing module (block 610). For example, as described above, a network device may receive a redundant identifier certificate associated with a redundant routing module.

[0074] like Figure 6 As further shown, process 600 may include establishing a secure connection with a boot device (block 620). For example, as described above, the network device may establish a secure connection with the boot device.

[0075] like Figure 6 As further shown, process 600 may include providing a redundant routing module identifier associated with a redundant routing module to a boot device via a secure connection (block 630). For example, as described above, a network device may provide a redundant routing module identifier associated with a redundant routing module to a boot device via a secure connection.

[0076] like Figure 6As further shown, process 600 may include selectively receiving an error message indicating that the redundant routing module is not authorized from a boot device via a secure connection (block 640). For example, as described above, the network device may selectively receive an error message indicating that the redundant routing module is not authorized from a boot device via a secure connection.

[0077] Alternatively, Figure 6 As further shown, process 600 may include selectively receiving a signed certificate chain associated with the redundant routing module from a boot device via a secure connection, verifying the signed certificate chain, and verifying a redundant identifier certificate associated with the redundant routing module based on verifying the signed certificate chain (block 650). For example, as described above, the network device may selectively receive a signed certificate chain associated with the redundant routing module from a boot device via a secure connection, verify the signed certificate chain, and verify the redundant identifier certificate associated with the redundant routing module based on verifying the signed certificate chain.

[0078] Process 600 may include additional implementations, such as any single implementation or any combination of implementations described below, and / or in conjunction with one or more other processes described elsewhere herein.

[0079] In a first implementation, the secure connection is a Secure Sockets Layer connection.

[0080] In a second implementation, alone or in combination with the first implementation, the network device and the redundant routing module are included in a virtual chassis that includes the network device and another network device, wherein the other network device performs the functionality of the redundant routing module.

[0081] In a third implementation, alone or in combination with one or more of the first and second implementations, process 600 includes determining that the network device is non-operational after verifying the redundant identifier certificate; and causing the redundant routing module to perform the functions of the network device until the network device becomes operational.

[0082] In a fourth implementation, alone or in combination with one or more of the first to third implementations, a redundant routing module is associated with a line card of a network device.

[0083] In a fifth implementation, alone or in combination with one or more of the first to fourth implementations, the redundant identifier certificate is issued by a certificate authority among the plurality of certificate authorities.

[0084] In a sixth implementation, alone or in combination with one or more of the first to fifth implementations, process 600 includes verifying a signed certificate chain via an owner certificate and ownership credential mechanism.

[0085] although Figure 6 An example block diagram of process 600 is shown. In some implementations, compared to Figure 6 Those depicted, process 600 may include additional blocks, fewer blocks, different blocks, or blocks that are arranged differently. Additionally, or alternatively, two or more blocks of process 600 may be performed in parallel.

[0086] Figure 7 is a flow chart associated with an example process 700 for enabling authentication of a routing module associated with one or more network devices to enable zero-touch provisioning. Figure 7 One or more process blocks of may be performed by a first network device (e.g., network device 210-1) and / or a second network device (e.g., network device 210-2) forming a virtual chassis. In some implementations, Figure 7 One or more process blocks of may be performed by another device or a collection of devices separate from or including the network device, such as another network device (e.g., network device 210-3, network device 210-N, etc.), a boot device (e.g., boot device 220), etc. Additionally or alternatively, Figure 7 One or more process boxes may be executed by: one or more components of the device 300 (such as the input component 310, the switching component 320, the output component 330, the controller 340, etc.), one or more components of the device 400 (such as the processor 420, the memory 430, the storage component 440, the input component 450, the output component 460, the communication interface 470, etc.), etc.

[0087] like Figure 7 As shown, process 700 may include receiving a redundant identifier certificate associated with a second network device (block 710). For example, as described above, the first network device and / or the second network device may receive a redundant identifier certificate associated with the second network device.

[0088] like Figure 7 As further shown, process 700 may include establishing a secure connection with the boot device (block 720). For example, as described above, the first network device and / or the second network device may establish a secure connection with the boot device.

[0089] like Figure 7 As further shown, process 700 may include providing the redundant routing module identifier associated with the second network to the boot device via the secure connection (block 730). For example, as described above, the first network device and / or the second network device may provide the redundant routing module identifier associated with the second network to the boot device via the secure connection.

[0090] like Figure 7As further shown, process 700 may include selectively receiving an error message indicating that the second network device is not authorized from the boot device via the secure connection (block 740). For example, as described above, the first network device and / or the second network device may selectively receive an error message indicating that the second network device is not authorized from the boot device via the secure connection.

[0091] Alternatively, Figure 7 As further shown, process 700 may include selectively receiving a signed certificate chain associated with the second network device from the boot device via the secure connection, verifying the signed certificate chain, and verifying the redundant identifier certificate associated with the second network device based on verifying the signed certificate chain (block 750). For example, as described above, the first network device and / or the second network device may selectively receive a signed certificate chain associated with the second network device from the boot device via the secure connection, verify the signed certificate chain, and verify the redundant identifier certificate associated with the second network device based on verifying the signed certificate chain.

[0092] Process 700 may include additional implementations, such as any single implementation or any combination of implementations described below, and / or in conjunction with one or more other processes described elsewhere herein.

[0093] In a first implementation, process 700 includes preventing verification of a redundant routing module when an error message is received from a boot device.

[0094] In a second implementation, alone or in combination with the first implementation, process 700 includes receiving boot information by the first network device and from the boot device when the signed certificate chain is received.

[0095] In a third implementation, alone or in combination with one or more of the first and second implementations, the signed certificate chain includes a signed trust anchor certificate chain.

[0096] In a fourth implementation, alone or in combination with one or more of the first to third implementations, verifying the signed certificate chain includes verifying a signature of the second network device included in the signed certificate chain.

[0097] In a fifth implementation, alone or in combination with one or more of the first to fourth implementations, process 700 includes, after verifying the redundant identifier certificate, determining that the first network device is non-operational; and causing the second network device to perform the functions of the first network device until the first network device becomes operational.

[0098] although Figure 7 An example block diagram of process 700 is shown. In some implementations, compared to Figure 7Those depicted, process 700 may include additional blocks, fewer blocks, different blocks, or blocks that are arranged differently. Additionally, or alternatively, two or more blocks of process 700 may be performed in parallel.

[0099] Example 1. A method comprising:

[0100] receiving, by the primary routing module, a redundant identifier certificate associated with the redundant routing module;

[0101] The main routing module establishes a secure connection with a boot device;

[0102] providing, by the primary routing module and via the secure connection to the boot device, a redundant routing module identifier associated with the redundant routing module; and

[0103] Selectively:

[0104] receiving, by the primary routing module and from the boot device via the secure connection, an error message indicating that the redundant routing module is not authorized; or

[0105] A signed certificate chain associated with a network device including the redundant routing module is received by the main routing module and from the boot device via the secure connection, the signed certificate chain is verified by the main routing module, and based on verifying the signed certificate chain, the redundant identifier certificate associated with the redundant routing module is verified by the main routing module.

[0106] Example 2. The method according to Example 1 further includes:

[0107] When the error message is received from the boot device, the redundant routing module is prevented from being configured with boot information.

[0108] Example 3. The method according to Example 1 further includes:

[0109] After verifying the redundant identifier certificate, boot information is sent to the redundant routing module.

[0110] Example 4. The method according to Example 1, wherein the main routing module and the redundant routing module are included in a single network device.

[0111] Example 5. The method of Example 1, wherein the primary routing module is associated with a first network device, and the redundant routing module is associated with a second network device different from the first network device.

[0112] Example 6. The method of example 1, wherein the signed certificate chain comprises a signed trust anchor certificate chain.

[0113] Example 7. The method of example 1, wherein verifying the signed certificate chain comprises:

[0114] A signature of the network device included in the signed certificate chain is verified.

[0115] Example 8. A network device, comprising:

[0116] one or more memories; and

[0117] One or more processors for:

[0118] receiving a redundant identifier certificate associated with a redundant routing module;

[0119] Establishing a secure connection to the boot device;

[0120] providing, via the secure connection, to the boot device a redundant routing module identifier associated with the redundant routing module; and

[0121] Selectively:

[0122] receiving an error message from the boot device via the secure connection indicating that the redundant routing module is not authorized; or

[0123] A signed certificate chain associated with the redundant routing module is received from the boot device via the secure connection, the signed certificate chain is verified, and the redundant identifier certificate associated with the redundant routing module is verified based on verifying the signed certificate chain.

[0124] Example 9. A network device according to Example 8, wherein the secure connection is a secure socket layer connection.

[0125] Example 10. The network device of Example 8, wherein the network device and the redundant routing module are included in a virtual chassis including the network device and another network device,

[0126] The other network device performs the function of the redundant routing module.

[0127] Example 11. The network device of Example 8, wherein the one or more processors are further configured to:

[0128] After verifying the redundant identifier certificate, determining that the network device is non-operational; and

[0129] The redundant routing module is caused to perform the functions of the network device until the network device becomes operational.

[0130] Example 12. The network device of Example 8, wherein the redundant routing module is associated with a line card of the network device.

[0131] Example 13. A network device according to Example 8, wherein the redundant identifier certificate is issued by a certificate authority among a plurality of certificate authorities.

[0132] Example 14. The network device of Example 8, wherein when verifying the signed certificate chain, the one or more processors are configured to:

[0133] The signed certificate chain is verified via an owner certificate and ownership credential mechanism.

[0134] Example 15. A non-transitory computer-readable medium storing instructions, the instructions comprising:

[0135] One or more instructions that, when executed by one or more processors of a first network device and a second network device forming a virtual chassis, cause the one or more processors to:

[0136] receiving a redundant identifier certificate associated with the second network device;

[0137] Establishing a secure connection to the boot device;

[0138] providing, via the secure connection, to the boot device a redundant routing module identifier associated with the second network device; and

[0139] Selectively:

[0140] receiving an error message from the boot device via the secure connection indicating that the second network device is not authorized; or

[0141] A signed certificate chain associated with the second network device is received from the boot device via the secure connection, the signed certificate chain is verified, and the redundant identifier certificate associated with the second network device is verified based on verifying the signed certificate chain.

[0142] Example 16. The non-transitory computer readable medium of Example 15, wherein the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:

[0143] When the error message is received from the boot device, the second network device is prevented from being configured with boot information.

[0144] Example 17. The non-transitory computer readable medium of Example 15, wherein the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:

[0145] When the signed certificate chain is received, boot information is received by the first network device and from the boot device.

[0146] Example 18. The non-transitory computer-readable medium of Example 15, wherein the signed certificate chain comprises a signed trust anchor certificate chain.

[0147] Example 19. The non-transitory computer-readable medium of Example 15, wherein the one or more instructions that cause the one or more processors to verify the signed certificate chain cause the one or more processors to:

[0148] A signature of the second network device included in the signed certificate chain is verified.

[0149] Example 20. The non-transitory computer readable medium of Example 15, wherein the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:

[0150] After verifying the redundant identifier certificate, determining that the first network device is non-operational; and

[0151] The second network device is caused to perform the functions of the first network device until the first network device becomes operational. The foregoing disclosure provides illustration and description, but is not intended to be exhaustive or to limit implementation to the precise form disclosed. Modifications and variations may be made based on the above disclosure or may be obtained from the practice of implementation.

[0152] As used herein, the term "component" is intended to be broadly interpreted as hardware, firmware, or a combination of hardware and software.

[0153] It is apparent that the systems and / or methods described herein can be implemented in different forms of hardware, firmware, or a combination of hardware and software. The actual dedicated control hardware or software code used to implement these systems and / or methods does not limit the implementation. Therefore, the operation and behavior of the systems and / or methods herein are described without reference to special software code - it should be understood that, based on the description herein, software and hardware can be used to implement the systems and / or methods.

[0154] Even though particular combinations of features are recited in the claims and / or disclosed in the specification, these combinations are not intended to limit the disclosure of the various implementations. In fact, many of these features may be combined in ways not specifically recited in the claims and / or disclosed in the specification. Although each dependent claim listed below may only directly depend on one claim, the disclosure of the various implementations includes each dependent claim in combination with every other claim in the claim set.

[0155] Unless explicitly described as such, the elements, behaviors or instructions used herein should not be interpreted as critical or necessary. Likewise, as used herein, the articles "one" and "an" are intended to include one or more items, and can be used interchangeably with "one or more". Further, as used herein, the article "the" is intended to include one or more items referenced in conjunction with the article "the", and can be used interchangeably with "one or more". In addition, as used herein, the term "set" is intended to include one or more items (e.g., related items, unrelated items, combinations of related items and unrelated items, etc.), and can be used interchangeably with "one or more". When only intended to an item, the phrase "only one" or similar terms are used. In addition, as used herein, the terms "have", "have", "have" etc. are intended to be open-ended items. Further, unless otherwise explicitly stated, the phrase "based on" is intended to mean "based at least in part on". Additionally, as used herein, the term "or" when used in a sequence is intended to be inclusive and may be used interchangeably with "and / or" unless expressly stated otherwise (e.g., if used in conjunction with "any of" or "only one of the following").

Claims

1. A computer-implemented method comprising: receiving, by the primary routing module, a redundant identifier certificate associated with the redundant routing module; The main routing module establishes a secure connection with a boot device; providing, by the primary routing module and via the secure connection to the boot device, a redundant routing module identifier associated with the redundant routing module; When the certificate chain associated with the redundant routing module is not identified, resulting in the redundant routing module not being authorized to receive boot information, receiving, by the primary routing module and from the boot device via the secure connection, an error message indicating that the redundant routing module is not authorized; as well as When the signed certificate chain associated with the redundant routing module is identified, resulting in the redundant routing module being authorized to receive the boot information, the signed certificate chain associated with the network device including the redundant routing module is received by the main routing module and from the boot device via the secure connection, the signed certificate chain is verified by the main routing module, and based on the verification of the signed certificate chain, the redundant identifier certificate associated with the redundant routing module is verified by the main routing module.

2. The method according to claim 1, further comprising: When the error message is received from the boot device, the redundant routing module is prevented from being configured using the boot information.

3. The method according to claim 1, further comprising: After verifying the redundant identifier certificate, the boot information is sent to the redundant routing module.

4. The method of claim 1, wherein the primary routing module and the redundant routing module are included in a single network device.

5. The method of claim 1, wherein the primary routing module is associated with a first network device and the redundant routing module is associated with a second network device different from the first network device.

6. The method of claim 1, wherein the signed certificate chain comprises a signed trust anchor certificate chain.

7. The method of claim 1 , wherein verifying the signed certificate chain comprises: A signature of the network device included in the signed certificate chain is verified.

8. A network device comprising: one or more memories; as well as One or more processors for: receiving a redundant identifier certificate associated with a redundant routing module; Establishing a secure connection to the boot device; providing, via the secure connection, to the boot device a redundant routing module identifier associated with the redundant routing module; When the certificate chain associated with the redundant routing module is not identified, resulting in the redundant routing module being unauthorized to receive boot information, receiving an error message from the boot device via the secure connection indicating that the redundant routing module is not authorized; as well as When the signed certificate chain associated with the redundant routing module is identified, resulting in the redundant routing module being authorized to receive the boot information, the signed certificate chain associated with the redundant routing module is received from the boot device via the secure connection, the signed certificate chain is verified, and based on the verification of the signed certificate chain, the redundant identifier certificate associated with the redundant routing module is verified.

9. The network device of claim 8, wherein the secure connection is a Secure Sockets Layer connection.

10. The network device according to claim 8, wherein the network device and the redundant routing module are included in a virtual chassis including the network device and another network device, The other network device performs the function of the redundant routing module.

11. The network device of claim 8, wherein the one or more processors are further configured to: After verifying the redundant identifier certificate, determining that the network device is non-operational; and The redundant routing module is caused to perform the functions of the network device until the network device becomes operational.

12. The network device of claim 8, wherein the redundant routing module is associated with a line card of the network device.

13. The network device of claim 8, wherein the redundant identifier certificate is issued by a certificate authority among a plurality of certificate authorities.

14. The network device of claim 8, wherein when verifying the signed certificate chain, the one or more processors are configured to: The signed certificate chain is verified via an owner certificate and ownership credential mechanism.

15. A non-transitory computer-readable medium storing instructions, the instructions comprising: One or more instructions that, when executed by one or more processors of a first network device and a second network device forming a virtual chassis, cause the one or more processors to: receiving a redundant identifier certificate associated with the second network device; Establishing a secure connection to the boot device; providing, via the secure connection, to the boot device a redundant routing module identifier associated with the second network device; When the certificate chain associated with the redundant routing module is not identified, resulting in the redundant routing module being unauthorized to receive boot information, receiving an error message from the boot device via the secure connection indicating that the second network device is not authorized; When the signed certificate chain associated with the redundant routing module is identified, resulting in the redundant routing module being authorized to receive the boot information, the signed certificate chain associated with the second network device is received from the boot device via the secure connection, the signed certificate chain is verified, and based on the verification of the signed certificate chain, the redundant identifier certificate associated with the second network device is verified.

16. The non-transitory computer readable medium of claim 15, wherein the one or more instructions, when executed by the one or more processors, further cause the one or more processors to: When the error message is received from the boot device, the second network device is prevented from being configured using the boot information.

17. The non-transitory computer readable medium of claim 15, wherein the one or more instructions, when executed by the one or more processors, further cause the one or more processors to: The boot information is received by the first network device and from the boot device when the signed certificate chain is received.

18. The non-transitory computer-readable medium of claim 15, wherein the signed certificate chain comprises a signed trust anchor certificate chain.

19. The non-transitory computer-readable medium of claim 15, wherein the one or more instructions that cause the one or more processors to verify the signed certificate chain cause the one or more processors to: A signature of the second network device included in the signed certificate chain is verified.

20. The non-transitory computer readable medium of claim 15, wherein the one or more instructions, when executed by the one or more processors, further cause the one or more processors to: After verifying the redundant identifier certificate, determining that the first network device is non-operational; and The second network device is caused to perform the functions of the first network device until the first network device becomes operational.

Images