Network equipment security default configuration method, device, equipment and medium

Abstract

The invention discloses a network equipment security default configuration method and device, equipment and a storage medium, and relates to the technical field of computers, and the method comprises the following steps: receiving identity identification information of target network equipment; determining target configuration data corresponding to the target network equipment according to the identity identification information; performing multiple encryption and signature processing on the target configuration data to generate a security configuration data packet; sending the security configuration data packet to the target network equipment, so that the target network equipment executes configuration; receiving a result feedback of executing verification from the target network equipment after the application configuration; and if the result feedback indicates that the verification fails, sending a configuration reset instruction to the target network equipment. According to the method, reliable configuration of the security default of the network equipment can be realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a network device security default configuration method, device, equipment and medium. BACKGROUND

[0002] At present, large-scale network construction has become the infrastructure support as the digital transformation accelerates. Switches, routers and other network devices, as important nodes for data transmission and exchange, have continued to increase in deployment scale and density. Zero Touch Provisioning (ZTP) technology, which can complete device initialization configuration without manual on-site intervention, has become the core solution to the problem of rapid online of large-scale network devices and is widely used in network construction of key industries such as finance, government and energy. As the basic configuration for the first operation after the device starts, the default configuration directly determines whether the device can normally access the management network and implement core business functions, and its secure and reliable import is the key prerequisite for the landing of Zero Touch Provisioning.

[0003] The current mainstream Zero Touch Provisioning (ZTP) scheme generally relies on DHCP (Dynamic Host Configuration Protocol) server to allocate network parameters and TFTP (Trivial File Transfer Protocol) server to transmit configuration files to realize the automatic distribution of configuration, but the existing ZTP scheme has problems such as lack of security and limited flexibility, which ultimately leads to the inability of the existing scheme to realize the secure default configuration of network devices.

[0004] Therefore, there is an urgent need for a method that can realize the secure default reliable configuration of network devices. SUMMARY

[0005] The present application provides a network device security default configuration method, device, equipment and medium, which can realize the secure default reliable configuration of network devices.

[0006] To achieve the above purpose, the present application adopts the following technical scheme: In a first aspect, the present application provides a network device security default configuration method, comprising: receiving identity information of a target network device; determining target configuration data corresponding to the target network device according to the identity information; performing multiple encryption and signature processing on the target configuration data to generate a secure configuration data packet; sending the secure configuration data packet to the target network device for the target network device to perform configuration; receiving a result feedback from the target network device after the target network device performs verification after applying the configuration; if the result feedback indicates that the verification fails, sending a configuration reset instruction to the target network device.

[0007] In some possible implementation manners, the target configuration data is subjected to multiple encryption and signature processing to generate a secure configuration data packet, including: performing first-level encryption on the target configuration data using a first key to obtain first-level ciphertext; generating a random salt value and performing second-level encryption on the first-level ciphertext using the random salt value as a key to obtain second-level ciphertext; encrypting the random salt value using a second key to obtain encrypted salt value; generating a digital signature based on the second-level ciphertext and the encrypted salt value; encapsulating the second-level ciphertext, the encrypted salt value, and the digital signature into the secure configuration data packet.

[0008] In some possible implementation manners, the first key is a preset fixed master key, and the second key is an encryption key.

[0009] In some possible implementation manners, the result feedback is obtained by the target network device by executing a preset automated verification script; the automated verification script includes network connectivity verification and target protocol function state verification.

[0010] In some possible implementation manners, the configuration reset instruction is used to trigger the target network device to execute a native configuration reset command corresponding to the target network device to restore to a factory state.

[0011] In some possible implementation manners, the method further includes: if the result feedback indicates that the verification succeeds, recording a configuration completion state of the target network device; if the result feedback indicates that the verification fails, receiving and recording error logs returned by the target network device after the configuration reset instruction is sent.

[0012] In some possible implementation manners, the identity information includes unique device identification information and device certificate; the unique device identification information includes a device serial number and a media access control address, and the device certificate is used to preverify the identity legitimacy of the target network device.

[0013] In a second aspect, the present application provides a network device secure default configuration apparatus, including: an information receiving module configured to receive identity information of a target network device; a data determining module configured to determine target configuration data corresponding to the target network device according to the identity information; The package generation module is configured to perform multiple encryption and signature processing on the target configuration data to generate a secure configuration data package; The data sending module is configured to send the secure configuration data package to the target network device for the target network device to perform configuration; The feedback receiving module is configured to receive a result feedback from the target network device after the target network device performs verification after applying the configuration. The reset module is configured to send a configuration reset instruction to the target network device if the result feedback indicates that the verification fails.

[0014] In a third aspect, the present application provides a computing device, comprising a memory and a processor; The one or more computer programs comprise instructions; and when the instructions are executed by the processor, the computing device performs the method according to any one of the first aspect.

[0015] In a fourth aspect, the present application provides a computer readable storage medium for storing a computer program, the computer program being used to perform the method according to any one of the first aspect.

[0016] In a fifth aspect, the present application provides a computer program product, comprising one or more computer instructions, when the computer instructions are executed by a computer, the computer performs the method according to any one of the first aspect.

[0017] From the above technical solutions, the present application has at least the following beneficial effects: In the present application, by receiving the identity information of the target network device, important basis is provided for subsequent determination of exclusive target configuration data, customized configuration requirements of different device models and application scenarios are met, configuration adaptability is improved, efficient support is provided for device rapid identification and access in large-scale network deployment, and operation and maintenance cost is reduced; then, according to the identity information, target configuration data corresponding to the target network device is determined, complete adaptation of configuration and device hardware specifications and business requirements is realized, functional abnormalities caused by incompatibility of general configuration and devices are avoided, flexible adjustment of configuration data according to device batch, deployment area, business type and other dimensions is also realized, differentiated requirements of different devices in large-scale network are adapted, and flexibility and expansibility of network deployment are improved; further, the target configuration data is subjected to multiple encryption and signature processing to generate a secure configuration data packet, the configuration data exists in the form of ciphertext throughout, the security protection level of the configuration data is strengthened, and strict security requirements are met; the secure configuration data packet is sent to the target network device for the target network device to perform configuration, automatic data packet pushing and receiving are realized, and configuration delivery can be completed without on-site operation; the result feedback of the verification performed by the target network device after applying the configuration is received, rapid fault positioning is realized, and fault troubleshooting efficiency is greatly improved; if the result feedback indicates that the verification fails, a configuration reset instruction is sent to the target network device, the pain point of device disconnection caused by configuration error in the traditional scheme is solved, and high reliability of zero-touch deployment is ensured. The present application realizes flexible adjustment of configuration data by introducing target configuration data, and improves flexibility and expansibility of network deployment. Furthermore, by introducing multiple encryption and signature processing means, the legality of the configuration data is ensured, and reliable configuration of network device security default is finally realized.

[0018] It should be understood that the description of technical features, technical solutions, advantages or similar language in the present application does not imply that all features and advantages can be realized in any single embodiment. On the contrary, it can be understood that the description of a feature or advantage means that the specific technical feature, technical solution or advantage is included in at least one embodiment. Therefore, the description of technical features, technical solutions or advantages in the specification does not necessarily refer to the same embodiment. Furthermore, the technical features, technical solutions and advantages described in the present application can be combined in any appropriate manner. Those skilled in the art will understand that the embodiments can be implemented without one or more specific technical features, technical solutions or advantages of a particular embodiment. In other embodiments, additional technical features and advantages can be identified in specific embodiments that do not embody all embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0019] Figure 1 An application environment diagram of a network device security default configuration method provided by an embodiment of the present application; Figure 2 A flowchart illustrating a network device security default configuration method provided in an embodiment of this application; Figure 3 A structural diagram of a network device security default configuration device provided in an embodiment of this application; Figure 4 This is a schematic diagram of a computing device provided in an embodiment of this application. Detailed Implementation

[0020] The terms "first," "second," and "third," etc., used in this application specification and accompanying drawings are used to distinguish different objects, not to limit a specific order.

[0021] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design. Specifically, the use of the terms "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0022] To ensure clarity and conciseness in the description of the following embodiments, a brief introduction to the related technologies is given first: In the current context of accelerated digital transformation, large-scale network construction has become a core infrastructure support. Network devices such as switches and routers, as key nodes for data transmission and exchange, are seeing their deployment scale and density continuously increase. Zero-touch deployment (ZTP) technology, with its advantage of completing device initialization configuration without manual on-site intervention, has become an important solution to the challenge of rapidly deploying large-scale network devices. It is widely used in network construction across various industries. The default configuration, as the basic configuration for the first operation after device startup, directly determines whether the device can normally access the management network and realize core business functions. Its secure and reliable implementation is a key prerequisite for the successful implementation of ZTP.

[0023] Current mainstream Zero-Touch Platform (ZTP) solutions generally rely on DHCP servers to allocate network parameters and TFTP servers to transfer configuration files, achieving automated configuration distribution. These solutions, by pre-setting server addresses and configuration file paths, allow devices to automatically obtain network information and download configuration scripts upon power-up. This replaces the traditional method of manually logging into the CLI (Command-Line Interface) and entering commands for each device, improving deployment efficiency to some extent and meeting the configuration needs of small to medium-sized networks or simple scenarios. However, existing solutions often store and transmit configuration files in plaintext, and the configuration content mainly includes basic network parameters, simple service switches, and other general commands, without being customized for individual device differences or complex business scenarios.

[0024] However, with the expansion of network scale and the increase in business complexity, the inherent defects of the existing ZTP solution have become increasingly prominent, severely restricting the reliable implementation of secure default configurations for network devices: First, security is lacking. Configuration files and sensitive information (such as management passwords and management IP addresses) are transmitted in plaintext over the network, making them extremely vulnerable to theft or tampering, failing to meet the security compliance requirements of critical industries. Second, reliability is insufficient. There is a lack of a mechanism to verify the effectiveness of configuration applications. If the configuration contains complex protocol instructions that depend on hardware status (such as multicast port binding) or contains parameter errors (such as an incorrect gateway address), the device will lose connection with the management network after application, creating a "bricked" risk that requires manual on-site reset, resulting in extremely high maintenance costs. Third, flexibility is limited. It cannot achieve differentiated configuration distribution based on unique identifiers such as device serial numbers (SN) and MAC addresses. General configuration templates are difficult to adapt to the needs of different models and business scenarios, easily leading to configuration incompatibility or functional failure. These problems collectively prevent the existing solution from achieving reliable secure default configurations for network devices.

[0025] In view of this, embodiments of this application provide a method for secure default configuration of network devices. To make the technical solution of this application clearer and easier to understand, the application scenarios of the technical solution of this application are described below with reference to the accompanying drawings. Figure 1 As shown in the figure, this figure is a schematic diagram of an application scenario provided by an embodiment of this application.

[0026] In this application scenario, the configuration management platform 104 is the control and management center, responsible for receiving device identity information, matching exclusive configuration data, generating encrypted secure configuration data packets, receiving verification result feedback from the devices, and issuing configuration reset commands. The communication network, as the medium for data transmission, is the interaction channel between the configuration management platform and the target network device, such as an HTTPS secure communication channel, to ensure data transmission security. The target network device 102 is the main entity for receiving and executing configurations, such as switches and routers, responsible for reporting identity information, receiving secure configuration data packets, executing configurations, completing verifications and providing feedback results, and executing configuration resets when verification fails. The target network device reports its identity information to the configuration management platform through the communication network, the configuration management platform generates and issues secure configuration data packets, and the target network device, after executing the configuration, feeds back the verification results to the configuration management platform, forming a closed-loop interaction between the platform, network, and device, supporting the automated and highly reliable import of secure default configurations for network devices.

[0027] To make the technical solution of this application clearer and easier to understand, the following describes a network device security default configuration method provided by an embodiment of this application, using the configuration management platform 104 as the execution subject, in conjunction with the above application scenario. Figure 2As shown, this figure is a flowchart of a network device security default configuration method provided in an embodiment of this application. The network device security default configuration method includes: S201. Receive the identity information of the target network device.

[0028] The target network device is the network terminal to be deployed with the default configuration, which can refer to devices such as switches and routers that support Zero Touch Provisioning (ZTP).

[0029] Identification information is a combination of information used to uniquely identify a device and verify its legitimacy, including unique device identification information and device certificates.

[0030] Unique device identification information is a globally unique set of hardware / system identifiers pre-set at the factory, including the device serial number and media access control address.

[0031] Device certificates are digital certificates issued by trusted authorities or pre-installed by manufacturers. They contain device identity information, public keys, and other data, and are used to pre-verify the identity and legitimacy of the target network device.

[0032] Identity verification is the process by which the configuration management platform verifies the device certificate after receiving the device's identity information.

[0033] For example, to accurately identify device identities and verify legitimacy, laying a solid foundation for subsequent differentiated configuration distribution and secure transmission, when a target network device (such as a switch) is powered on, the automated agent embedded in the firmware first checks the device configuration status. If it determines that the configuration is empty (no default configuration is deployed), it automatically triggers the identity information reporting process. The target network device transmits combined identity information to the configuration management platform through an HTTPS (Hypertext Transfer Protocol Secure) secure communication channel. This information includes both a unique device identifier pre-installed at the factory, such as the device serial number (SN) and media access control (MAC) address, used to accurately identify a single device, and a device certificate issued by a trusted authority or pre-installed by the manufacturer, serving as proof of the device's legitimacy.

[0034] S202. Based on the identity information, determine the target configuration data corresponding to the target network device.

[0035] The target configuration data is a set of default configurations specific to the target network device, including basic network parameters such as IP (Internet Protocol) address and subnet mask, performance configurations such as CPU (Central Processing Unit) rate limit thresholds, security policies such as SSH (Secure Shell) service on / off, and specific protocol commands such as IGMP snooping related configurations. It is presented in the form of CLI (Command-Line Interface) command set to adapt to the device model, application scenario, or deployment requirements.

[0036] For example, to achieve differentiated and precise configuration distribution, after the configuration management platform receives the identity information reported by the target network device through the HTTPS channel and completes the pre-verification of identity legitimacy, it will initiate the matching and generation process of exclusive configuration data. The configuration management platform pre-stores a massive number of configuration templates adapted to different device models, batches, and application scenarios, as well as the association mapping rules between device information and configuration templates. Among them, the device serial number (SN) is the most core matching dimension. Due to its global uniqueness, it can accurately pinpoint the exclusive configuration requirements of a single device, while the MAC address serves as an auxiliary identifier to further ensure matching accuracy. Based on the SN in the identity information, the configuration management platform will retrieve the corresponding configuration mapping relationship, extract the adapted basic configuration template, and then combine it with the device's application scenario (such as multicast requirements in the financial industry, network security policies in government affairs), hardware parameters (such as the number of ports, performance specifications), and other related information to supplement personalized configuration parameters, such as IGMP snooping restrictions for specific VLANs, exclusive management IP addresses, customized CPU rate limiting thresholds, etc. Finally, it integrates and generates target configuration data (in the form of a CLI command set) that includes basic network parameters, performance optimization commands, security policies, and specific protocol configurations.

[0037] For example, for a switch with the serial number "ABC123456" used for multicast services, the configuration management platform will match configuration data containing proprietary commands such as "ip igmp snooping vlan 1 limit group 1000" and "mrouter-port interface Port-Channel1" to ensure that the configuration is fully compatible with the actual use and hardware status of the device. This step completely solves the shortcomings of traditional ZTP (Zero Touch Provisioning) solutions in achieving fine-grained configuration distribution. By accurately binding identity identifiers with configuration data, each device can obtain a customized default configuration, avoiding the problem of incompatibility between general configurations and devices, and laying the foundation for subsequent secure encrypted transmission and precise application execution. It is a key prerequisite for achieving customized and highly adaptable configuration deployment.

[0038] Optionally, after receiving the information, the configuration management platform does not directly enter the configuration matching stage. Instead, it first performs a pre-verification of identity legitimacy: extracting information such as the issuing authority and public key signature from the device certificate, and verifying the validity of the certificate using a pre-set trusted public key (such as the vendor's public key) to confirm that it has not been tampered with, has not expired, and that the issuing entity is legitimate. If the pre-verification passes, the platform will proceed to the subsequent dedicated configuration matching and secure configuration package (SCP) generation process; if the verification fails (e.g., invalid certificate, missing identity information), the process will be immediately terminated and an alarm will be returned to the device, rejecting subsequent configuration distribution operations. Compared to the traditional ZTP solution's lack of identity verification, this step, through dual verification of a unique identifier and a legitimate certificate, not only eliminates the security risk of unauthorized devices accessing and obtaining configurations, but also achieves refined identification based on device identity. This provides a crucial prerequisite for subsequent processes such as differentiated configuration injection and multi-encrypted transmission, ensuring the security and accuracy of configuration deployment from the source.

[0039] S203. Perform multiple encryption and signature processing on the target configuration data to generate a secure configuration data packet.

[0040] One possible approach involves using a first key to perform a first-level encryption on the target configuration data to obtain a first-level ciphertext; generating a random salt value and using the random salt value as a key to perform a second-level encryption on the first-level ciphertext to obtain a second-level ciphertext; using a second key to encrypt the random salt value to obtain an encrypted salt value; generating a digital signature based on the second-level ciphertext and the encrypted salt value; and encapsulating the second-level ciphertext, the encrypted salt value, and the digital signature into a secure configuration data packet.

[0041] Optionally, the first key is a preset fixed master key; the second key is an encryption key.

[0042] Among them, multi-layer encryption refers to the multiple encryption operations performed to ensure data security. It can refer to a combination of encryption processes such as first-level encryption, second-level encryption, and salt encryption, which enhances data confidentiality through multiple layers of protection.

[0043] Signature processing is the process of generating a unique digital identifier based on the data content. It is used to verify whether the data has been tampered with during transmission and whether it comes from a legitimate source. This can be achieved through methods such as SHA256 hashing and base64 calculation.

[0044] Secure configuration data packets are standardized data carriers generated after multiple encryption and signature processes. They contain encrypted configuration data, encryption salt values, digital signatures, and other content to ensure the security of configuration transmission and storage.

[0045] The first key is a pre-set fixed master key, which is pre-set by the system and securely stored on the device and the configuration management platform, and is used to perform the first level of encryption on the target configuration data.

[0046] The first-level ciphertext is the intermediate encrypted data obtained after encrypting the target configuration data with the first key, and it is the object of the second-level encryption.

[0047] Random salt is a cryptographically secure random string that is dynamically generated by the configuration management platform. As a key for the second level of encryption, its randomness can prevent the same original data from producing the same ciphertext after encryption, thus improving the ability to resist cracking.

[0048] Level 2 ciphertext is encrypted data obtained by encrypting Level 1 ciphertext with a random salt value. It is the important encrypted configuration content that is finally encapsulated in the secure configuration data packet.

[0049] The second key is a fixed encryption key used to encrypt the random salt value itself, preventing the ciphertext from being cracked due to salt leakage.

[0050] The encryption salt is the encrypted data obtained by encrypting a random salt value with a second key. It is used together with the second-level ciphertext to generate a digital signature and is also sent with the data packet for decryption by the device.

[0051] A digital signature is a unique identifier generated based on a second-level ciphertext and a cryptographic salt value. It is calculated through SHA256 hashing and base64 and is used to verify the integrity and legitimacy of data packets.

[0052] For example, to ensure the secure transmission and storage of configuration data, a combination of multi-layered encryption and digital signatures is used to build a strong security defense from three dimensions: confidentiality, integrity, and legitimacy. After the configuration management platform completes the accurate matching and generation of the target configuration data, a standardized multi-layered encryption and signature process will be initiated: First, the configuration management platform generates a cryptographically secure initialization vector, which, combined with a pre-set fixed master key (the first key), performs the first level of encryption on the target configuration data using the AES-CBC-256 encryption mode, converting the plaintext configuration into first-level ciphertext and initially blocking the risk of sensitive information leakage. Next, the configuration management platform dynamically generates a random salt value, which is used as the key. Through lightweight encryption operations, such as appending the salt value to the end of the first-level ciphertext, a second level of encryption is performed to obtain the second-level ciphertext. The randomness of the salt value is used to prevent duplicate ciphertext from being generated after encrypting the same configuration data. To enhance resistance to brute-force attacks, a fixed encryption key is used, specifically a second key, to encrypt the random salt value using AES-CBC-256, generating an encrypted salt value. This prevents the salt value from being stolen during transmission, which could lead to ciphertext decryption. To verify data integrity and legitimacy, the configuration management platform performs a SHA256 hash operation on the second-level ciphertext and the encrypted salt value. The generated hash value is then subjected to base64 computation to form a unique digital signature. This signature can be used by the device to verify whether the data packet has been tampered with and whether it comes from a legitimate configuration management platform. Finally, the configuration management platform packages the second-level ciphertext, the encrypted salt value, the initialization vector, and the digital signature into a standardized secure configuration data packet.

[0053] Throughout the process, both the first and second keys are pre-set security keys, known only to the configuration management platform and the target network device. The encryption process uses the AES-CBC-256 encryption algorithm, which conforms to industry security standards. The digital signature further ensures that the data is immutable and traceable. The resulting secure configuration data packet can effectively avoid security risks such as plaintext leakage and data tampering in traditional configuration transmission, meeting the needs of industry scenarios with extremely high data security requirements.

[0054] S204. Send the security configuration data packet to the target network device so that the target network device can perform the configuration.

[0055] The execution configuration process involves the target network device receiving a secure configuration data packet, decrypting it to restore the plaintext configuration, and then executing the configuration instructions line by line through the device's command-line interface. This ultimately achieves the automated deployment of basic network parameters, security policies, protocol functions, and more.

[0056] For example, to ensure data security and achieve accurate delivery of configuration data, laying the foundation for subsequent automated configuration execution by devices, after the configuration management platform generates the secure configuration data package, it will initiate the distribution process based on the device's configuration acquisition mode: If the device's automated agent successfully connects to the cloud configuration server via an HTTPS secure communication channel (i.e., cloud-first mode), the configuration management platform will directly push the latest version of the generated secure configuration data package to the target network device through the HTTPS channel after confirming that the device's identity and legitimacy have passed pre-verification. The encrypted transmission characteristics of HTTPS can prevent data packages from being stolen or tampered with on the public network or internal network; If the target network device cannot connect to the cloud server due to network failure or other reasons, it will switch to local degradation mode, that is, when reading the pre-built secure configuration data package from the local vendor partition, the distribution action of the configuration management platform will be completed autonomously by the target network device. That is, the device's automated agent directly retrieves the secure configuration data package that was pre-stored in the secure storage partition at the factory, without the need for real-time push from the platform, ensuring the continuity of configuration deployment.

[0057] Throughout the entire transmission process, the secure configuration data packet remains encrypted without any plaintext conversion. Only the target network device (which has passed identity verification and possesses the corresponding decryption key) can subsequently decrypt and use it, effectively avoiding the security risks of plaintext transmission of configuration files in traditional ZTP solutions. At the same time, the distribution strategy in this step precisely matches the dual-mode configuration acquisition logic on the device side, ensuring that the latest configuration can be obtained when the network is working smoothly, while solving the deployment interruption problem when the network is abnormal. This ensures that the target network device can stably receive configuration data, providing reliable data support for subsequent decryption, configuration execution, and verification rollback processes.

[0058] It should be noted that after receiving the security configuration data packet, the target network device performs security verification and decryption on the security configuration data packet. For example, it verifies the signature of the security configuration data packet based on the preset public key and performs signature verification. If the verification fails, the alarm is terminated. It also decrypts the encrypted salt value to obtain the original salt value. Then, it decrypts the salt value to obtain the first-level ciphertext. Finally, it decrypts the first-level ciphertext to obtain the plaintext configuration.

[0059] S205. Receive feedback from the target network device on the result of the verification performed after application configuration.

[0060] Optionally, the result feedback is obtained by the target network device by executing a preset automated verification script; the automated verification script includes network connectivity verification and target protocol function status verification.

[0061] It should be noted that if the result feedback indicates successful verification, the target network device configuration completion status is recorded; if the result feedback indicates failed verification, the error log returned by the target network device is received and recorded after sending the configuration reset command.

[0062] Among them, the result feedback is the verification result notification returned by the target network device to the configuration management platform after completing the configuration application and automated verification. It is divided into two categories: verification success and verification failure, and is an important basis for the configuration management platform to make subsequent execution decisions.

[0063] Application configuration is the process by which the target network device decrypts the security configuration data packet to restore the plaintext configuration and then executes the configuration commands line by line through the device's command-line interface.

[0064] The automated verification script is a verification program pre-installed in the automated agent on the target network device. It includes two main modules: basic network verification and target protocol function status verification, which are used to detect the actual effectiveness of the configured application.

[0065] Network connectivity verification is the basic verification module of the automated verification script. It checks whether the device can access the management network normally by executing the Ping command (such as ping the gateway address 192.168.1.1) to ensure that the network-level configuration is effective.

[0066] Target protocol function status verification is an important verification module of the automated verification script. By executing device-specific commands (such as show ip igmp snooping mrouter), it checks whether the configurations of important protocols such as multicast and SSH are truly adapted to the device hardware status and effective.

[0067] The configuration completion status is the device status recorded by the configuration management platform when the result feedback is successful. It indicates that the target configuration data has been accurately applied and taken effect, and the device can be put into normal operation.

[0068] The configuration reset command is a command sent by the configuration management platform to the target network device when the result is a verification failure. It is used to trigger the device to execute native configuration reset commands, such as set default.

[0069] Error logs are detailed fault records generated after the target network device fails to verify and performs a configuration rollback, such as "IGMP mrouter port not found". They contain information such as the fault type and the configuration items involved, and are used to assist maintenance personnel in troubleshooting problems.

[0070] For example, in order to achieve real-time confirmation of the configuration's effectiveness while providing clear evidence for handling abnormal situations, the target network device does not immediately end the process after executing the plaintext configuration through the device-side automated proxy. Instead, it waits for the network protocol status to stabilize (to avoid misjudgments due to protocol insecurity). Then, it starts a pre-built automated verification script to perform dual verification: on the one hand, it verifies network connectivity by performing operations such as pinging the gateway to confirm that the basic network parameters such as the device management IP and subnet mask are configured accurately and that the device can access the management network normally; on the other hand, it verifies the target protocol function status by executing device-specific commands to check the actual effectiveness of key protocol configurations. For example, for multicast configuration, it executes the `show ip igmp snooping mrouter` command to verify whether the Port-Channel1 port is in the operational state, ensuring that the configuration is not only executed but also adapts to the device hardware status and meets business requirements.

[0071] After verification, the automated agent on the target network device will send a result feedback to the configuration management platform via an HTTPS secure communication channel, clearly indicating whether the verification was successful or failed. Upon receiving the feedback, the configuration management platform will execute the corresponding actions: If the feedback indicates successful verification, it means the target configuration data has been fully adapted to the device and is effective. The configuration management platform will record the configuration completion status of the target network device, marking the normal completion of the zero-touch deployment process, and the target network device can be officially launched. If the feedback indicates verification failure, the configuration management platform will first send a configuration reset command to the target network device, triggering the target network device to execute the native `set default` command, quickly clearing erroneous configurations and restoring it to a factory-manageable state, eliminating the risk of "bricking" the device. Subsequently, it will receive and properly store the detailed error logs returned by the target network device. The logs contain key information such as the fault type and involved configuration items, providing maintenance personnel with a clear direction for troubleshooting, significantly shortening the average repair time, and ensuring the efficiency of subsequent problem rectification.

[0072] The entire process, through the collaborative design of automated verification on the device side and result processing on the platform side, completely solves the defect of the traditional ZTP solution lacking a configuration verification mechanism, realizes the upgrade of configuration deployment from the end of issuance to the closed loop of effectiveness, and further enhances the reliability and traceability of the deployment process.

[0073] It should be noted that the "bricking" risk refers to the risk that network devices (such as switches and routers) may completely lose their basic management functions and become unusable, like a "brick," after software upgrades or configuration updates due to errors in the process or serious problems with the configuration itself.

[0074] S206. If the result feedback indicates that the verification failed, a configuration reset command is sent to the target network device.

[0075] Optionally, the configuration reset command is used to trigger the target network device to execute the native configuration reset command corresponding to the target network device, so as to restore it to the factory state.

[0076] The configuration reset command is a control command sent by the configuration management platform to the target network device when verification fails, in order to trigger the device to start the configuration rollback process and clear the erroneous configuration.

[0077] The native configuration reset command is a system-level command that is pre-installed at the factory for the target network device (such as a switch). It does not require additional development and can be executed by relying on the device's native functions, providing fast and stable configuration clearing capabilities.

[0078] Restoring to factory settings is the final result after the device executes the native configuration reset command. This means clearing all currently applied erroneous configurations and restoring the device to its factory default state. In this state, the device retains basic manageable capabilities (such as the default communication interface and preset keys) to ensure that it can still be accessed by the configuration management platform and avoid becoming "bricked".

[0079] For example, to ensure the reliability of configuration deployment and prevent devices from becoming unusable, when the configuration management platform receives a verification failure response from the target network device (such as a gateway ping failure in basic network verification or a multicast port not being in operational state in protocol function verification), it immediately initiates an exception handling process: the configuration management platform sends a configuration reset command to the target network device through an HTTPS secure communication channel. This command requires no complex parameters; it serves only as a clear trigger signal to ensure the device can accurately identify and respond. The purpose of the configuration reset command is to trigger the target network device to execute its own pre-built native configuration reset command (such as the switch's `set default` command), rather than relying on external tools or additional configuration scripts. This design, which relies on the device's native functionality, ensures the stability and compatibility of the reset operation while avoiding rollback failures due to the failure of external dependencies. Upon receiving the instruction, the target network device will quickly execute the native configuration reset command, clearing all applied erroneous configurations (including basic network parameters, protocol policies, security settings, etc.) and automatically restoring it to its factory default state. At this time, the target network device will retain its basic manageable capabilities from the factory, such as the default communication interface, pre-set security keys, and identity information, ensuring that the configuration management platform can still access the device through the original communication channel, completely eliminating the risk of the device becoming "bricked" due to configuration errors in traditional solutions.

[0080] The entire process requires no on-site human intervention, achieving an automated closed loop from verification failure to device recovery to a manageable state. This significantly reduces the operation and maintenance costs in large-scale network deployments (no need to send personnel to reset the equipment on-site) and provides a safe and reliable foundation for subsequent troubleshooting and reconfiguration, further enhancing the practicality and stability of zero-contact deployment.

[0081] It should be noted that the operational state refers to the working state of a hardware interface, logical interface, or protocol function that has not only been configured and enabled in the software (configured / admin up), but has also been successfully established physically or logically and can transmit data normally; the set default command clears the current operating configuration of the device and immediately restores it to the factory default startup configuration.

[0082] Based on the above, the network device security default configuration method receives the identity information of the target network device, providing a crucial basis for subsequently determining the specific target configuration data. This meets the customized configuration needs of different device models and application scenarios, improving configuration adaptability and providing efficient support for rapid device identification and access control in large-scale network deployments, thus reducing operation and maintenance costs. Furthermore, based on the identity information, the method determines the target configuration data corresponding to the target network device, achieving complete compatibility between the configuration and device hardware specifications and business requirements. This avoids functional abnormalities caused by incompatibility between general configurations and devices. It also allows for flexible adjustment of configuration data based on dimensions such as device batch, deployment area, and business type, adapting to the differentiated needs of different devices in large-scale networks and improving the flexibility of network deployment. Scalability; furthermore, the target configuration data undergoes multiple encryption and signature processing to generate secure configuration data packets, ensuring that the configuration data exists in encrypted form throughout the process, thus strengthening the security protection level of the configuration data and meeting stringent security requirements; the secure configuration data packets are sent to the target network devices for configuration execution, achieving automated data packet push and reception, enabling configuration delivery without on-site operation; receiving feedback from the target network devices after applying the configuration and performing verification results enables rapid fault location, greatly improving troubleshooting efficiency; if the feedback indicates verification failure, a configuration reset command is sent to the target network device, solving the pain point of device disconnection due to configuration errors in traditional solutions, ensuring high reliability of zero-contact deployment. This solution, by introducing target configuration data, enables flexible adjustment of configuration data, improving the flexibility and scalability of network deployment; furthermore, by introducing multiple encryption and signature processing methods, the legitimacy of the configuration data is guaranteed, ultimately achieving reliable default configuration of network devices.

[0083] The above text combined Figures 1 to 2The network device security default configuration method provided in the embodiments of this application has been described in detail. The apparatus and device provided in the embodiments of this application will be described below with reference to the accompanying drawings.

[0084] This application also provides a network device security default configuration device, such as... Figure 3 As shown in the figure, this is a schematic diagram of a network device security default configuration device provided in an embodiment of this application. The device includes: Information receiving module 301 is used to receive the identity information of the target network device; The data determination module 302 is used to determine the target configuration data corresponding to the target network device based on the identity information; The packet generation module 303 is used to perform multiple encryption and signature processing on the target configuration data to generate a secure configuration data packet. The data sending module 304 is used to send security configuration data packets to the target network device so that the target network device can perform configuration. The feedback receiving module 305 is used to receive feedback from the target network device after the application configuration performs the verification result; The reset module 306 is used to send a configuration reset command to the target network device if the result feedback indicates that the verification failed.

[0085] In some possible implementations, the package generation module 303 is specifically used for: The target configuration data is encrypted using the first key to obtain the first-level ciphertext; a random salt value is generated and used as the key to encrypt the first-level ciphertext to obtain the second-level ciphertext; the random salt value is encrypted using the second key to obtain the encrypted salt value; a digital signature is generated based on the second-level ciphertext and the encrypted salt value; the second-level ciphertext, the encrypted salt value, and the digital signature are encapsulated into a secure configuration data packet.

[0086] In some possible implementations, the first key is a pre-set fixed master key; the second key is an encryption key.

[0087] In some possible implementations, the result feedback is obtained by the target network device by executing a preset automated verification script; the automated verification script includes network connectivity verification and target protocol function status verification.

[0088] In some possible implementations, the configuration reset command is used to trigger the target network device to execute the native configuration reset command corresponding to the target network device, so as to restore it to the factory state.

[0089] In some possible implementations, the network device security default configuration device also includes: The recording module is used to record the configuration completion status of the target network device if the result feedback indicates successful verification; if the result feedback indicates failure verification, it receives and records the error log returned by the target network device after sending the configuration reset command.

[0090] In some possible implementations, the identity information includes unique device identification information and device certificate; the unique device identification information includes the device serial number and media access control address, and the device certificate is used to pre-verify the identity and legitimacy of the target network device.

[0091] The network device security default configuration device according to the embodiments of this application can correspondingly execute the method described in the embodiments of this application, and the other operations and / or functions of each module / unit of the network device security default configuration device are respectively for implementing Figure 2 For the sake of brevity, the corresponding processes of each method in the illustrated embodiments will not be described in detail here.

[0092] This application also provides a computing device. For example... Figure 4 As shown in the figure, this is a schematic diagram of a computing device provided in an embodiment of this application. The computing device 400 includes a bus 401, a processor 402, a communication interface 403, and a memory 404. The processor 402, the memory 404, and the communication interface 403 communicate with each other via the bus 401.

[0093] Bus 401 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, Figure 4 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0094] Processor 402 can be any one or more of the following processors: central processing unit (CPU), graphics processing unit (GPU), microprocessor (MP), or digital signal processor (DSP).

[0095] Communication interface 403 is used for communication with external devices.

[0096] Memory 404 may include volatile memory, such as random access memory (RAM). Memory 404 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0097] The memory 404 stores executable code, which the processor 402 executes to perform the aforementioned network device security default configuration method.

[0098] Specifically, in achieving Figure 3 In the case of the illustrated embodiment, and Figure 3 When the modules or units of the network device security default configuration device described in the embodiment are implemented in software, the execution... Figure 3 The software or program code required for the functions of each module / unit can be partially or wholly stored in memory 404. Processor 402 executes the program code corresponding to each unit stored in memory 404 and executes the aforementioned network device security default configuration method.

[0099] This application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that a computing device can store, or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to execute the aforementioned network device security default configuration method.

[0100] This application also provides a computer program product comprising one or more computer instructions. When the computer instructions are loaded and executed on a computing device, all or part of the processes or functions described in this application are generated.

[0101] The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, or data center to another website, computer, or data center via wired (e.g., coaxial cable, fiber optic) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0102] When the computer program product is executed by a computer, the computer executes any of the aforementioned methods of the network device security default configuration method. The computer program product can be a software installation package; when any of the aforementioned methods of the network device security default configuration method is required, the computer program product can be downloaded and executed on the computer.

[0103] The descriptions of the processes or structures corresponding to the above figures each have their own emphasis. For parts of a process or structure that are not described in detail, please refer to the relevant descriptions of other processes or structures.

[0104] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be covered within the scope of protection of this application.

Claims

1. A method for secure default configuration of network devices, characterized in that, The method includes: Receive the identity information of the target network device; Based on the identity information, determine the target configuration data corresponding to the target network device; The target configuration data is subjected to multiple encryption and signature processes to generate a secure configuration data packet; The security configuration data packet is sent to the target network device so that the target network device can perform the configuration. Receive feedback on the verification results performed by the target network device after application configuration; If the feedback result indicates that the verification failed, a configuration reset command is sent to the target network device.

2. The method according to claim 1, characterized in that, The process of performing multiple encryption and signature operations on the target configuration data to generate a secure configuration data packet includes: The target configuration data is encrypted using the first key to obtain the first-level ciphertext. A random salt value is generated, and the random salt value is used as a key to perform a second-level encryption on the first-level ciphertext to obtain the second-level ciphertext. The random salt value is encrypted using the second key to obtain the encrypted salt value; A digital signature is generated based on the second-level ciphertext and the encrypted salt value; The second-level ciphertext, the encrypted salt value, and the digital signature are encapsulated into a secure configuration data packet.

3. The method according to claim 2, characterized in that, The first key is a preset fixed master key; the second key is an encryption key.

4. The method according to claim 1, characterized in that, The result feedback is obtained by the target network device through the execution of a preset automated verification script; the automated verification script includes network connectivity verification and target protocol function status verification.

5. The method according to claim 1, characterized in that, The configuration reset command is used to trigger the target network device to execute the native configuration reset command corresponding to the target network device, so as to restore it to the factory state.

6. The method according to claim 1, characterized in that, The method further includes: If the feedback result indicates successful verification, then record the target network device configuration completion status; If the feedback result indicates that the verification failed, then after sending the configuration reset command, the error log returned by the target network device will be received and recorded.

7. The method according to claim 1, characterized in that, The identity information includes unique device identification information and device certificate; the unique device identification information includes device serial number and media access control address, and the device certificate is used to pre-verify the identity and legitimacy of the target network device.

8. A network device security default configuration device, characterized in that, The device includes: The information receiving module is used to receive the identity information of the target network device; The data determination module is used to determine the target configuration data corresponding to the target network device based on the identity information; The packet generation module is used to perform multiple encryption and signature processing on the target configuration data to generate a secure configuration data packet; A data sending module is used to send the security configuration data packet to the target network device so that the target network device can perform configuration. The feedback receiving module is used to receive feedback from the target network device after the application configuration is performed and the verification result is performed. The reset module is used to send a configuration reset command to the target network device if the result feedback indicates that the verification failed.

9. A computing device, characterized in that, Including memory and processor; The memory stores one or more computer programs, the one or more computer programs including instructions; when the instructions are executed by the processor, the computing device performs the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store a computer program for performing the method as described in any one of claims 1 to 7.

Images