Network Switch Provisioning Mode for Secure Fabric Integration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network management systems face challenges in securely integrating new devices into a network fabric without compromising the security of the entire network, as manual configuration of security certificates is error-prone and time-consuming, and existing methods require manual intervention, which can lead to network vulnerabilities.
Innovation Solution
Implementing a method that allows network devices to automatically switch between provisioning and lockdown modes, where in provisioning mode, trust is assumed without encryption, and in lockdown mode, security is enforced using automatically generated and verified security certificates, simplifying the process of adding new devices to a secure network fabric.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual configuration of security certificates is used, then network security is enforced, but the process is error-prone and time-consuming
Solution Approach 1:
The system performs preliminary actions by automatically generating and installing security certificates on network devices before they are fully integrated into the network. The controller pre-configures certificates on devices in a provisioning mode, so that when devices are added to the network fabric, security is already enforced without requiring manual administrator intervention during the critical integration phase.
Solution Approach 2:
The system enables self-service by allowing network devices to automatically receive and install their own security certificates from the controller without requiring manual administrator intervention. The automated certificate management system handles generation, distribution, and installation of certificates autonomously, eliminating human error and reducing time consumption.
2Reliability
If manual intervention is used for security configuration, then security certificates can be installed, but network vulnerabilities increase due to human error
Solution Approach 1:
The system eliminates human intervention in security certificate management by implementing automated certificate generation, distribution, and installation. The controller automatically manages the entire certificate lifecycle on network devices, removing the human error factor that creates network vulnerabilities while maintaining reliable security enforcement.
Solution Approach 2:
The system implements feedback mechanisms where the controller continuously monitors and manages security certificates on network devices. The automated system verifies certificate installation success and maintains up-to-date security credentials, providing continuous feedback loops that prevent vulnerabilities from occurring due to manual configuration errors.
3Ease of operation
If automated certificate management is implemented, then the process is simplified, but system complexity increases
Solution Approach 1:
The system merges certificate management functions into the existing network controller infrastructure. By integrating certificate generation, distribution, and installation capabilities into the controller that already manages network devices, the system simplifies operations for administrators while consolidating complexity into a centralized management point rather than adding distributed complexity across individual devices.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods, systems, and computer programs are presented for creating a secure network fabric and for adding trusted devices to an existing secure network fabric. One method includes an operation for setting a switch into a provisioning mode where the switch does not enforce secure communications. While the switch is in provisioning mode, the method performs operations including establishing a connection from the switch to a provisioning controller, sending a certificate signing request (CSR) from the switch to the provisioning controller, and receiving, from the provisioning controller, a security certificate generated by a certificate authority. The method further includes an operation for entering a lockdown mode by the switch after receiving the security certificate, where the switch, while in lockdown mode, secures communications utilizing the security certificate.