Patent ID: 7350227

Claim:
A method for secure network device policy configuration, the method comprising the computer-implemented steps of: storing a mapping between a group identifier and a particular cryptographic key, wherein the group identifier identifies a group of three or more network devices; intercepting, at an intermediary network device, one or more data packets that (a) are addressed to a destination device other than the intermediary network device, (b) collectively contain a request, and (c) collectively contain the group identifier; selecting, from among one or more cryptographic keys that are stored at the intermediary network device, the particular cryptographic key that is mapped to the group identifier; sending, toward an upstream device that sent the one or more data packets toward the intermediary network device, a first message that contains a first challenge; receiving a second message that contains a first response; generating a verification value based on (a) the particular cryptographic key and (b) the first challenge; determining whether the first response matches the verification value; and in response to determining that the first response matches the verification value, performing particular steps comprising: selecting, from among one or more authorization sets, a particular authorization set that is mapped to the group identifier; determining whether the request is allowed by the particular authorization set; and in response to determining that the request is allowed by the particular authorization set, configuring, based on the request, a policy of the intermediary network device.