Consensus-Driven Configuration Plane for Network Integrity

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Compromising a configuration device in a network can allow attackers to reconfigure end devices, compromising network security and operation.

Innovation Solution

Implement a consensus-driven configuration plane using an orchestration proxy that requires matching configuration commands from multiple devices before sending changes to end devices, ensuring integrity through read-only memory and partial passwords.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If configuration commands are sent directly from configuration devices to end devices, then configuration changes can be applied quickly, but network security is compromised if a configuration device is compromised

Engineering Contradiction:

Improvenetwork securityVSAvoidconfiguration plane complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

An intermediary layer (configuration plane with multiple configuration devices) is introduced between the control plane and data plane. This intermediary requires consensus from multiple configuration devices before applying configuration changes, preventing single-point compromise while maintaining controlled configuration deployment

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The configuration plane is segmented into multiple independent configuration devices instead of relying on a single configuration device. Each configuration device can independently propose configuration changes, and consensus among multiple devices is required, distributing trust and preventing single-point failure

Inventive Principle:

Principle #1Segmentation

2Reliability

If multiple configuration devices are used to ensure security through consensus, then network security is improved, but configuration deployment time increases

Engineering Contradiction:

Improveconfiguration integrityVSAvoidconfiguration deployment time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

Configuration changes are validated and consensus is reached among multiple configuration devices before being deployed to end devices. This preliminary consensus-building phase ensures integrity while allowing batch processing of validated configurations to minimize deployment time

Inventive Principle:

Principle #10Preliminary action

3Reliability

If configuration commands are validated through consensus, then unauthorized changes are prevented, but the complexity of configuration management increases

Engineering Contradiction:

Improveconfiguration authenticityVSAvoidconfiguration management complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The configuration plane implements feedback mechanisms where configuration devices communicate consensus status and validation results. This automated feedback loop manages the complexity of multi-device consensus by providing structured communication and decision-making protocols

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS12445434B2Systems and methods to improve network security via consensus-driven configuration plane

Publication Date: 2025.10.14 CENTURYLINK INTELLECTUAL PROPERTY LLC

AI summary

Configuration changes to the configurations of end devices in a network may be made by configuration devices, which may set up connections with the end devices and send configuration commands to the end devices. In such a system, the compromising of a configuration device may make it possible for an attacker to reconfigure end devices. Systems and methods to improve network security via a consensus-driven configuration plane are provided.