Systems and methods for provisioning network devices

Network devices are securely provisioned through authenticated ZTP servers. In some approaches, a storage device local to the network device includes information for connecting with and authenticating a local or remote ZTP server. This information may include a root of trust to use when connecting with a designated ZTP server. The ZTP server may be identified using either a dynamic host configuration protocol (DHCP) server or a network address specified in the local memory storage. In an approach, the local memory storage is a removable USB flash memory device inserted into the network device when the device is booted up. In another approach, the ZTP authentication information is stored within memory integrated within the network device. Once a ZTP server is connected to the network device, a secure connection may be established such as a secure transport layer session (TLS) utilizing the root of trust.

BACKGROUND

The present disclosure relates to automatically and securely provisioning network devices over a network.

DETAILED DESCRIPTION

In some computer networks, newly installed or existing network devices (e.g., switches, routers, etc.) require initial and/or periodic provisioning with updated configurations and software. In some cases, large numbers of such devices must be configured. Maintaining the security of such devices can be critical to maintaining the integrity of the network and preventing the network from being compromised by external threats. In some cases, each of these devices are provisioned by an onsite technician who installs and/or updates the configurations and software of each device individually. This process can require substantial amounts of time and costs, particularly if there are a large number of devices that require provisioning.

In some networks, a zero touch provisioning (ZTP) system is utilized in which a local secure ZTP server is connected to the network of devices that need provisioning. Each of the devices will be shipped and configured to establish a connection with a local ZTP server when initially turned on. After establishing the connection, the ZTP server will provision the connected device. The local ZTP server and the connected devices are typically firewalled from other networks, servers, and devices during the provisioning/updating process to prevent potential external interference with the process. Exposing a traditional ZTP system to an external untrusted network, for example, could potentially allow a malicious entity to impersonate the correct ZTP server. Thus, traditional ZTP provisioning may still require an onsite technician to install, manage, and/or monitor the local ZTP server during the provisioning process.

Methods and systems are described herein to address these problems and allow network devices to be securely provisioned through local and remote authenticated ZTP servers. In some approaches, a storage device local to the respective network device includes information for connecting with and authenticating a remote ZTP server. This information may include a root of trust to use when connecting with a designated ZTP server. The ZTP server may be identified using either a dynamic host configuration protocol (DHCP) server or a network address specified in the local memory storage. In an approach, the local memory storage is a removable USB flash memory device inserted into the network device when the device is booted up. In another approach, the ZTP authentication information is stored within memory integrated within the network device. Once a ZTP server is connected to the network device, a secure connection may be established such as a secure transport layer session (TLS) utilizing the root of trust.

In some approaches, the switch attempts to connect to a remote provisioning helper service (e.g., a cloud provisioning helper service located at a trusted server). The service may communicate with the device in order to authenticate the device such as by confirming a device serial number and/or using root of trust certificates and private/public encryption keys (e.g., a public key infrastructure (PKI) procedure). Serial number confirmation may be accomplished such as further described in the U.S. patent application 16/824,382, now U.S. Patent Application Publication 2021/0297259. The service may be part of or further direct the device to a separate trusted ZTP server or a remote site (e.g., Arista's CloudVision Portal (CVP) platform) before proceeding with secure provisioning. For example, once the device is authenticated by the service, the service may provide a certificate with which to further securely communicate with a local or remote ZTP server.

In an approach, different methods of provisioning the device are attempted in a sequential order such as based upon the level of security provided by each of the methods. For example, an approach first attempts to find a connected USB storage device as described above and, if no corresponding USB is discovered, the device then attempts to connect with a provisioning helper service as described and, if no such service can be connected with, the device attempts to connect with a local ZTP server directly using a specified IP address and, if that is unsuccessful, then attempt to connect to a ZTP server by relying on an available DHCP/DNS servers.

FIG. 1shows an illustrative network topology of a system for provisioning a switch, in accordance with some embodiments of the disclosure. A network20includes multiple switches including a switch35and a switch30being provisioned according to some embodiments. Switches30and35may be connected to multiple devices40and to each other through network20. Switch30may connect via a router25and the internet15to a remote ZTP server10via a network connection17. During a provisioning process (e.g., during an initial setup of a newly added switch), a portable memory device32(e.g., a USB memory flash drive) is directly interfaced with (e.g., inserted into) switch30. A network address for connecting to ZTP server10through the internet15may be programmed into memory device32and made accessible to network switch30. Further, a root encryption certificate (e.g., an x509 certificate) may also have been programmed into memory device32where it may be accessed by network switch30to authenticate ZTP server10. In some embodiments, the root encryption certificate may be signed by a trusted certification authority (CA) and include a public key with which to encrypt/decrypt data received/transmitted between the switch30and ZTP server10. Software operating on switch30may perform an authentication process utilizing the certificate. For example, the software may request that the ZTP server10send an encrypted message which can be decrypted using the root encryption certificate. Once the authentication process successfully authenticates the ZTP server10, the software may be programmed to trust and permit the ZTP server10to automatically provision switch30with new software and/or configurations.

FIG. 2Ashows an illustrative network topology of a system for provisioning a switch, in accordance with some embodiments of the disclosure. A network220includes a network switch230, devices245(e.g., computers, printers, servers, etc.) connected to the network through switch230, and a local secure ZTP server240accessible to the switch230. Network220is connected to the internet210through a router225and a network connection215. A cloud portal server200accessible via the internet is configured to provide a cloud provisioning helper service to switch230. Server200and its helper service may be associated with a trusted origin (e.g., the switch manufacturer). A portable memory device235may configured with information (e.g., an IP address) for connecting to cloud portal server200and/or to the local ZTP server240.

After connecting with server200, server200may receive a request from software operating on the switch230to authenticate the origin of the switch230such as by confirming the device serial number embedded in memory of switch230and/or using a trusted platform module (TPM) installed in the device. Systems and methods for such authentication are described, for example, in related applications U.S. patent application Ser. No. 16/824,381, now U.S. Pat. No. 11,178,249 and U.S. patent application Ser. No. 16/824382, now U.S. Patent Application Publication 2021/0297259, filed concurrently with the present application, the entire contents of each of which are herein incorporated by reference. In some embodiments, an orders management system may track a serial number of a device with a particular tenant upon distribution of the device. Once deployed in a network, a multi-tenant cloud provisioning service/helper may be used to authenticate and/or provision the switch according to the particular tenant associated with the device through the orders management system. In some embodiments, a trusted platform module (TPM) may be integrated into the device and, upon initialization, the device is configured to check for the presence of a TPM. In some embodiments, the multi-tenant cloud provisioning service and/or the software installed on the device accesses a CA encryption key or signed certificate (e.g., using PKI) installed on the device or in a removable memory device (e.g., USB drive), and uses the CA signature/key, the public EK, and the TPM to confirm that the device originated from the expected manufacturer.

After being authenticated, switch230programming may use information (e.g., IP addresses) from the portable memory device235to perform provisioning with the ZTP server240and/or cloud portal server200. In some embodiments, switch230may fail to recognize or connect with a memory device such as device235, after which switch230may then attempt to connect to server200, secure ZTP server240, and/or a remote ZTP server such as by establishing a connection utilizing a DHCP server212or using default IP addresses programmed into the memory (e.g., flash memory) or software initially installed in switch230.

FIG. 2Bshows an illustrative network topology of a system for provisioning a switch, in accordance with some embodiments of the disclosure. A network270includes a network switch260and devices275(e.g., computers, printers, servers, etc.) connected through the switch260, which are connected to the internet210through router265. A cloud provisioning helper server250and a provisioning server255are accessible via the internet210. Network switch260may be programmed to connect with the helper server250directly (e.g., via embedded IP addresses) or through a DHCP server212. The helper server250may be associated with a trusted source (e.g., switch manufacturer, Arista's CloudVision Portal (CVP) platform) and be programmed to authenticate the switch260(such as previously described) and then direct the switch260to the provisioning server255for switch provisioning.

The switch260may be programmed for provisioning by first determining whether an attached portable memory device (e.g., device235) is present such as described inFIG. 2Aand, if not available, then attempt to connect with a cloud portal server250. Provisioning server255may provide a dedicated service for provisioning network devices automatically in a secure manner. Server255and cloud portal server250may be multi-tenant servers configured to identify, authenticate, and/or provision devices with different configurations for different tenants automatically.

FIG. 3shows a diagram of an illustrative network device300in a provisioning system, in accordance with some embodiments of the disclosure. Control circuitry304may be based on any suitable processing circuitry, such as processing circuitry306. As referred to herein, processing circuitry should be understood to mean circuitry based on one or more microprocessors, microcontrollers, digital signal processors, programmable logic devices, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), etc., and may include a multi-core processor (e.g., dual-core, quad-core, hexa-core, octa-core, or any suitable number of cores). In some embodiments, processing circuitry is distributed across multiple separate processors or processing units, for example, multiple of the same type of processing units (e.g., two INTEL CORE i7 processors) or multiple different processors (e.g., an INTEL CORE i5 processor and an INTEL CORE i7 processor). In some embodiments, control circuitry304executes instructions for performing operational, communication, and provisioning functions in devices such as described inFIGS. 1 and 2A-2B. For example, control circuitry304may be integrated into network switch30ofFIG. 1and network switch30may process communications with ZTP server10via network interface310A-C, store the connection information received from memory device235(e.g., USB Flash memory) in storage308(i.e., volatile RAM312), and be programmed with startup/initializing software instructions and parameters for performing processing described inFIGS. 4-6in volatile RAM312and/or non-volatile RAM314.

Storage308may be an electronic storage device that is part of control circuitry304. As referred to herein, the phrase “electronic storage device” or “storage device” should be understood to mean any device for storing electronic data, computer software, instructions, and/or firmware, such as RAM, content-addressable memory (CAM), hard drives, optical drives, solid state devices, quantum storage devices, or any other suitable fixed or removable storage devices, and/or any combination of the same. The circuitry described herein may execute instructions included in software running on one or more general purpose or specialized processors. Multiple circuits may be provided to handle simultaneous processing functions. Further, other devices described herein (e.g., ZTP server10) may include the processing and storage components of device300and/or variations thereof.

FIG. 4is a flowchart of an illustrative process for provisioning a network device using a ZTP server, in accordance with some embodiments of the present disclosure. At block410, a network device obtains information (e.g., a network address) for connecting to a provisioning server (e.g., a ZTP server). In some embodiments, the information is obtained from a portable memory device (e.g., USB device32ofFIG. 1) inserted into the network device, from memory (e.g., flash memory) in the network device, or from initialization/operating software installed on the device and can include information for connecting to a ZTP server. At block415, the network device uses the connection information to connect to a ZTP server, which may be remote or local to a network to which the network device is connected. At block420, an encryption certificate (e.g., a root x509 certificate) or similar security token is obtained for purposes of authenticating the ZTP server. At block425, the network switch attempts to authenticate the ZTP server using the encryption certificate. This may be performed, for example, by software operating the switch requesting that the ZTP server decrypt/encrypt and confirm a message encrypted/decrypted by the switch software using the encryption certificate.

If authentication is successful (e.g., the message was successfully decrypted/encrypted by the ZTP server), the network device may further request and accept provisioning from the ZTP server at block430. If authentication is not successful, the network device may block or suspend provisioning at block435. In some embodiments, the authentication and provisioning process is performed during initialization of the network device. Initialization may be started when a device is first turned on or is reset by an operator. In some embodiments, the network device may be a switch, router, hub, or other network device being provisioned for use in a network.

FIG. 5is a flowchart of an illustrative process utilizing a cloud service for provisioning a network device, in accordance with some embodiments of the present disclosure. An initialization of a network device begins at block510. In some embodiments, the device initializes by attempting to establish a connection with a cloud provisioning helper server at block515, which may then identify/verify the device such as described herein. The cloud provisioning helper server may direct the network device to a ZTP server at block520. The network device may then attempt to authenticate the ZTP server using an encryption certificate installed on the device or provided by the helper server such as described herein. If the ZTP server is not authenticated, the network device may block or suspend provisioning with the ZTP server at block530. Otherwise, if authenticated, the network device continues with automatic provisioning using the ZTP server at block525.

As an alternative to using a ZTP server, the cloud provisioning helper server515may direct the network device to a trusted cloud provisioning server (e.g., via the internet) at block540. After establishing a connection with the provisioning server, the network device may proceed with being provisioned by the provisioning server at block545.

FIG. 6is a flowchart of an illustrative process utilizing multiple alternative provisioning methods, in accordance with some embodiments of the present disclosure. Initialization of the network device begins at block610such as in response to an initial turning on or resetting of the network device. During initialization of the network device, at block615, the network device automatically determines if a portable memory device (e.g., USB memory stick) is inserted and is programmed with information for connecting to and/or authenticating a secure ZTP server such as previously described. If a portable memory device is available with secure ZTP connection information, the device will attempt to authenticate the designated ZTP server at block620and, if authenticated, will use the ZTP server to automatically provision the device at block650.

If no such information from a portable memory device can be successfully obtained, the network device may subsequently attempt to connect to a trusted cloud provisioning helper server at block625using a known address programmed into the software or memory of the network device. If a provisioning helper is available, the provisioning helper server will automatically provision the device at block635.

If no provisioning helper server is available, the network device may then attempt to redirect provisioning by utilizing DHCP/DNS servers to connect with a local or remote ZTP server (e.g., over the internet) at block630. If the network device successfully connects to a ZTP server at block630, the network device may then attempt at block640to authenticate the ZTP server such as by using a public key infrastructure (PKI) procedure established between the network device and ZTP server. Additional authentication procedures may be implemented including IEEE 802.1x. In response to a failed authentication, the network device may suspend initialization or further redirect provisioning at block645.

In some embodiments, the network device being provisioned is an element of a tenant network (e.g., network20) and the provisioning process is performed without intervention of the tenant network. For example, the network device and a ZTP server, provisioning helper, and/or DHCP/DNS servers used to provision the device may do so without requiring that elements of the tenant network instigate or control the provisioning process.

The processes ofFIGS. 4, 5, and 6described above are intended to be illustrative and not limiting. More generally, the above disclosure is meant to be illustrative and not limiting. Only the claims that follow are meant to set bounds as to what the claimed embodiments include. Furthermore, it should be noted that the features and limitations described in any one embodiment may be applied to any other embodiment herein, and flowcharts or examples relating to one embodiment may be combined with any other embodiment in a suitable manner, done in different orders, or done in parallel. In addition, the systems and methods described herein may be performed in real time. It should also be noted, the systems and/or methods described above may be applied to, or used in accordance with, other systems and/or methods.

It will be apparent to those of ordinary skill in the art that methods involved in the present disclosure may be embodied in a computer program product that includes a non-transitory computer-usable and/or -readable medium. For example, such a non-transitory computer-usable medium may consist of a read-only memory device, such as a CD-ROM disk or conventional ROM device, or a random-access memory, such as a hard drive device or a computer diskette, having a computer-readable program code stored thereon. It should also be understood that methods, techniques, and processes involved in the present disclosure may be executed using processing circuitry such as the processing circuitry ofFIG. 3described above.