Approach for securely deploying network devices

• US 7,748,035 B2
• Filed: 04/22/2005
• Issued: 06/29/2010
• Est. Priority Date: 04/22/2005
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Pritikin, Max, Leonardo, Pedro J., Nedeltchev, Plamen, Iacobacci, David, Aggarwal, Gautam
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Powers; William S
• Application Number:
  US11/112,948
• Publication Number:
  US 20060242695A1
• Time in Patent Office: 1,894 Days
• Field of Search: 718/104, 709/220, 709/230, 726/15, 726/27, 370/389, 713/2
• US Class Current: 726/15
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

According to an approach for securely deploying and configuring network devices, a secure introduction connection is established between a network device being deployed and a registrar. The secure introduction connection may conform to a secure communications protocol, such as HTTPS. The registrar provides bootstrap configuration data to the network device over the secure introduction connection. The bootstrap configuration data is used to establish a secure management connection between the network device and a secure management gateway. The secure management connection may conform to a secure communications protocol, such as IPsec or HTTPS. The secure management gateway provides user-specific configuration data and security policy data to the network device over the secure management connection. The user-specific configuration data and policy data are used to establish a secure data connection, such as a Dynamic Multipoint Virtual Private Network (DMVPN) connection, between the network device and the secure data gateway.

Claims

1. A computer-implemented method for deploying a network device, the computer-implemented method comprising:

establishing a secure introduction network connection between the network device and a registrar;

the registrar providing bootstrap configuration data to the network device over the secure introduction network connection, wherein the bootstrap configuration data is used to establish a secure management network connection between the network device and a secure management gateway;

the secure management gateway providing user-specific configuration data and security policy data to the network device over the secure management network connection; and

establishing a secure data network connection between the network device and a secure data gateway using the user-specific configuration data and the security policy data.

2. The computer-implemented method as recited in claim 1, wherein the secure introduction network connection conforms to the HTTPS communications protocol.

3. The computer-implemented method as recited in claim 1, wherein the secure management network connection conforms to one of an IPsec communications protocol and the HTTPS communications protocol.

4. The computer-implemented method as recited in claim 1, wherein the secure data network connection is a dynamic multipoint VPN (DMVPN) connection.

5. The computer-implemented method as recited in claim 1, wherein the secure management network connection conforms to an IPsec communications protocol and the secure data network connection is a dynamic multipoint VPN (DMVPN) connection.

6. The computer-implemented method as recited in claim 1, further comprising the registrar receiving, from a Web browser executing on the network device, a simple certificate enrollment protocol (SCEP) request that conforms to the HTTPS communications protocol.

7. The computer-implemented method as recited in claim 1, further comprising:

causing a networking services agent to be instantiated on the network device;

the secure management gateway receiving, from the networking services agent instantiated on the network device, data that indicates that the secure management network connection has been established; and

the secure management gateway providing the data to a networking services engine for processing.

8. The computer-implemented method as recited in claim 1, further comprising the secure management gateway providing updated user-specific configuration data and security policy data to the network device over the secure management network connection, wherein the updated user-specific configuration data and security policy data enable the secure management network connection to be updated.

9. The computer-implemented method as recited in claim 1, wherein the network device is a router, the secure management gateway is a management router and the secure data gateway is a corporate router.

10. A computer-readable volatile or non-volatile storage medium for deploying a network device, the computer-readable volatile or non-volatile storage medium storing instructions which, when executed by one or more processors, cause:

establishing a secure introduction network connection between the network device and a registrar;

the registrar providing bootstrap configuration data to the network device over the secure introduction network connection, wherein the bootstrap configuration data is used to establish a secure management network connection between the network device and a secure management gateway;

the secure management gateway providing user-specific configuration data and security policy data to the network device over the secure management network connection; and

establishing a secure data network connection between the network device and a secure data gateway using the user-specific configuration data and the security policy data.

11. The computer-readable volatile or non-volatile storage medium as recited in claim 10, wherein the secure introduction network connection conforms to the HTTPS communications protocol.

12. The computer-readable volatile or non-volatile storage medium as recited in claim 10, wherein the secure management network connection conforms to one of an IPsec communications protocol and the HTTPS communications protocol.

13. The computer-readable volatile or non-volatile storage medium as recited in claim 10, wherein the secure data network connection is a dynamic multipoint VPN (DMVPN) connection.

14. The computer-readable volatile or non-volatile storage medium as recited in claim 10, wherein the secure management network connection conforms to an IPsec communications protocol and the secure data network connection is a dynamic multipoint VPN (DMVPN) connection.

15. The computer-readable volatile or non-volatile storage medium as recited in claim 10, further storing additional instructions which, when executed by the one or more processors, cause the registrar receiving, from a Web browser executing on the network device, a simple certificate enrollment protocol (SCEP) request that conforms to the HTTPS communications protocol.

16. The computer-readable volatile or non-volatile storage medium as recited in claim 10, further storing additional instructions which, when executed by the one or more processors, cause:

causing a networking services agent to be instantiated on the network device;

the secure management gateway receiving, from the networking services agent instantiated on the network device, data that indicates that the secure management network connection has been established; and

the secure management gateway providing the data to a networking services engine for processing.

17. The computer-readable volatile or non-volatile storage medium as recited in claim 10, further storing additional instructions which, when executed by the one or more processors, cause the secure management gateway providing updated user-specific configuration data and security policy data to the network device over the secure management network connection, wherein the updated user-specific configuration data and security policy data enable the secure management network connection to be updated.

18. The computer-readable volatile or non-volatile storage medium as recited in claim 10, wherein the network device is a router, the secure management gateway is a management router and the secure data gateway is a corporate router.

19. An apparatus for deploying a network device, the apparatus comprising a memory storing instructions which, when executed by one or more processors, cause:

establishing a secure introduction network connection between the network device and a registrar;

the registrar providing bootstrap configuration data to the network device over the secure introduction network connection, wherein the bootstrap configuration data is used to establish a secure management network connection between the network device and a secure management gateway;

the secure management gateway providing user-specific configuration data and security policy data to the network device over the secure management network connection; and

establishing a secure data network connection between the network device and a secure data gateway using the user-specific configuration data and the security policy data.

20. The apparatus as recited in claim 19, wherein the secure introduction network connection conforms to the HTTPS communications protocol.

21. The apparatus as recited in claim 19, wherein the secure management network connection conforms to one of an IPsec communications protocol and the HTTPS communications protocol.

22. The apparatus as recited in claim 19, wherein the secure data network connection is a dynamic multipoint VPN (DMVPN) connection.

23. The apparatus as recited in claim 19, wherein the secure management network connection conforms to an IPsec communications protocol and the secure data network connection is a dynamic multipoint VPN (DMVPN) connection.

24. The apparatus as recited in claim 19, wherein the memory further stores additional instructions which, when executed by the one or more processors, cause the registrar receiving, from a Web browser executing on the network device, a simple certificate enrollment protocol (SCEP) request that conforms to the HTTPS communications protocol.

25. The apparatus as recited in claim 19, wherein the memory further stores additional instructions which, when executed by the one or more processors, cause:

causing a networking services agent to be instantiated on the network device;

the secure management gateway receiving, from the networking services agent instantiated on the network device, data that indicates that the secure management network connection has been established; and

the secure management gateway providing the data to a networking services engine for processing.

26. The apparatus as recited in claim 19, wherein the memory further stores additional instructions which, when executed by the one or more processors, cause the secure management gateway providing updated user-specific configuration data and security policy data to the network device over the secure management network connection, wherein the updated user-specific configuration data and security policy data enable the secure management network connection to be updated.

27. The apparatus as recited in claim 19, wherein the network device is a router, the secure management gateway is a management router and the secure data gateway is a corporate router.

28. An apparatus for deploying a network device, the apparatus comprising:

means for establishing a secure introduction network connection between the network device and a registrar;

means for the registrar providing bootstrap configuration data to the network device over the secure introduction network connection, wherein the bootstrap configuration data is used to establish a secure management network connection between the network device and a secure management gateway;

means for the secure management gateway providing user-specific configuration data and security policy data to the network device over the secure management network connection; and

establishing a secure data network connection between the network device and a secure data gateway using the user-specific configuration data and the security policy data.

29. The apparatus as recited in claim 28, wherein the secure introduction network connection conforms to the HTTPS communications protocol.

30. The apparatus as recited in claim 28, wherein the secure management network connection conforms to one of an IPsec communications protocol and the HTTPS communications protocol.

31. The apparatus as recited in claim 28, wherein the secure data network connection is a dynamic multipoint VPN (DMVPN) connection.

32. The apparatus as recited in claim 28, wherein the secure management network connection conforms to an IPsec communications protocol and the secure data network connection is a dynamic multipoint VPN (DMVPN) connection.

33. The apparatus as recited in claim 28, further comprising means for causing the registrar receiving, from a Web browser executing on the network device, a simple certificate enrollment protocol (SCEP) request that conforms to the HTTPS communications protocol.

34. The apparatus as recited in claim 28, further comprising means for:

causing a networking services agent to be instantiated on the network device;

the secure management gateway receiving, from the networking services agent instantiated on the network device, data that indicates that the secure management network connection has been established; and

the secure management gateway providing the data to a networking services engine for processing.

35. The apparatus as recited in claim 28, further comprising means for causing the secure management gateway providing updated user-specific configuration data and security policy data to the network device over the secure management network connection, wherein the updated user-specific configuration data and security policy data enable the secure management network connection to be updated.

36. The apparatus as recited in claim 28, wherein the network device is a router, the secure management gateway is a management router and the secure data gateway is a corporate router.