NETCONF Datastore Encryption via DS-SEC Plugin
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
NETCONF datastores in communication networks are currently unencrypted, making critical configuration information human-readable and accessible to unauthorized users, posing a security risk.
Innovation Solution
Implementing NETCONF Datastore Security (DS-SEC) by enabling encryption through a software plugin that generates local encryption keys and supports algorithms like AES_128, allowing devices to indicate support for DS-SEC and enabling/disabling encryption via Remote Procedure Calls (RPCs) with a controller.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If NETCONF datastore is stored as clear content for human readability, then ease of operation is improved, but security is worsened due to unauthorized access and tampering risks
Solution Approach 1:
The patent introduces an encryption intermediary layer between the NETCONF datastore and access requests. Encryption keys act as mediators that transform readable configuration data into encrypted form during transmission and storage, then transform it back to readable form only for authorized operations. This resolves the contradiction by maintaining human readability when needed while protecting against unauthorized access through the encryption intermediary.
2Object-affected harmful factors
If encryption is implemented for NETCONF datastore security, then security is improved, but device complexity is worsened due to additional encryption functions
Solution Approach 1:
The patent implements a universal encryption capability that serves multiple functions: protecting NETCONF datastore during transmission, securing configuration data at rest, and enabling secure key management. The same encryption infrastructure handles both data encryption and key protection, reducing overall system complexity despite the added security functionality. This multi-functional approach allows one encryption system to address multiple security requirements simultaneously.
3Object-affected harmful factors
If encryption keys are stored locally on the device, then security is improved by preventing external key access, but reliability is worsened if keys are lost or corrupted
Solution Approach 1:
The patent creates a secure, isolated environment for key storage using a hardware security module or secure element that acts as an inert, protected space. This secure environment protects keys from external access attempts while maintaining key integrity through hardware-level protections against corruption. The inert nature of the secure storage environment prevents both external attacks and internal software from compromising the keys, thus resolving the contradiction between security and reliability.
Data Source
AI summary
Methods and devices for encrypting Network Configuration Protocol (NETCONF) datastore in communication networks are disclosed. One of the methods is performed by a device using NETCONF. The method comprises enabling a function for NETCONF Datastore Security (DS-SEC). The method further comprises publishing a first indication indicating that the device supports the NETCONF DS-SEC function.