Network Device Configuration Payload Separation Policy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Security-conscious entities face challenges in securely returning network devices for repair or replacement, as standard wiping methods are ineffective and may expose sensitive information to malicious parties.
Innovation Solution
Implementing a configuration payload separation policy that generates a unique key for encrypting and decrypting data during the network device's boot sequence, stores this key in a secure location, and encrypts the configuration payload before storing it in an external non-volatile memory.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of repair
If standard wiping methods are used to prepare network devices for return, then the device can be easily prepared for replacement, but sensitive information may be exposed to malicious parties
Solution Approach 1:
The patent segments the storage system into internal non-volatile memory and external non-volatile memory, separating configuration payloads into distinct storage locations. The configuration payload is stored in external non-volatile memory while the unique key is stored in internal non-volatile memory, ensuring that even if the device is wiped or compromised, the configuration data remains protected through physical separation of data and keys.
Solution Approach 2:
The patent extracts the configuration payload from the internal non-volatile memory and places it in external non-volatile memory. This extraction removes sensitive configuration data from the device's internal storage, making it inaccessible when the device is returned for repair or replacement, while the external memory can be physically separated or encrypted.
2Ease of operation
If configuration payload is stored in internal non-volatile memory, then data is readily accessible, but sensitive information can be obtained when equipment is returned to another party
Solution Approach 1:
The patent introduces external non-volatile memory as an intermediary storage layer between the internal memory and the configuration payload. This intermediary storage location allows the configuration payload to be stored securely outside the device's internal memory while maintaining accessibility through the unique key stored in internal memory. The external memory acts as a mediator that protects data both during normal operation and when the device is returned.
Solution Approach 2:
The patent performs preliminary encryption of the configuration payload with a unique key before storing it in external non-volatile memory. This preliminary action ensures that even if the external memory is accessed without proper authentication, the data remains encrypted and inaccessible. The unique key is stored separately in internal non-volatile memory, providing a preliminary security measure that prevents data exposure during device return.
3Stability of the object's composition
If unique key is stored in non-volatile memory, then key persistence is achieved, but the key may be accessed by malicious parties when device is returned
Solution Approach 1:
The patent segments the storage of the unique key and configuration payload into separate memory locations. The unique key is stored in internal non-volatile memory while the configuration payload is stored in external non-volatile memory. This segmentation ensures that the key remains persistent for authentication purposes but is physically separated from the sensitive configuration data, reducing the risk of complete data exposure when the device is returned.
Data Source
AI summary
Disclosed are systems, apparatuses, methods, and computer-readable media for configuration payload separation policies. According to at least one example, a method is provided for device function. The method includes: during a boot sequence of a network device, generating a unique key for encrypting and decrypting data; identifying a secure location in the network device for storing the unique key; storing the unique key in the secure location; encrypting a configuration payload with the unique key; storing the encrypted configuration payload in an external non-volatile memory; and, in response to a request to access data within the configuration payload, decrypting the encrypted configuration payload using the unique key.