Networking Device Configuration Security via Resource Hash Validation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing networking devices are vulnerable to unauthorized configuration modifications due to vulnerabilities in web applications, which can lead to adverse business impacts and financial losses.

Innovation Solution

A configuration management service that verifies the current state of resources associated with a configuration web application by calculating representative values using cryptographic hash functions, ensuring that only validated and trusted states allow configuration modifications.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If web application user interface is used to configure networking device settings, then ease of operation is improved, but security against unauthorized modifications deteriorates

Engineering Contradiction:

Improveconfiguration accessibilityVSAvoidconfiguration security

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The system performs preliminary validation of the web application code and resources before allowing configuration operations. A configuration management service validates the integrity of web application resources using cryptographic hash functions before the web application is instantiated, ensuring that only authorized and unmodified code can execute configuration changes.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

A configuration management service is introduced as an intermediary between the web application and the networking device configuration system. This service validates the integrity of web application resources and controls whether the web application can modify device settings, thereby securing the configuration process while maintaining web-based accessibility.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If web application resources are allowed to be modified, then adaptability is improved, but vulnerability to unauthorized changes increases

Engineering Contradiction:

Improveconfiguration flexibilityVSAvoidunauthorized modification risk

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system changes the state parameter of web application resources from unvalidated to validated through cryptographic hash verification. The configuration management service checks hash values of resources against expected values, and only when validation succeeds does the system allow the web application to access and modify device configurations.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS12244594B2Secure configuration management interfaces for networking devices

Publication Date: 2025.03.04 SALESFORCE INC

AI summary

Devices, systems and methods are provided for remotely managing configuration of a networking device. One method of managing configuration of a networking device involves obtaining resources associated with one or more graphical user interface (GUI) displays of a web application for configuring the networking device, receiving a request to access the web application, and in response to the request, determining a representative value for the resources as a function of a current state of the resources, obtaining a reference value for the resources that reflects a validated state of the resources, and instantiating the web application using the resources when the representative value matches the reference value.