Configuration payload separation policies

1 . A non-transitory computer readable medium storing instructions, which when executed by a processor causes a network device to:

during a boot sequence of the network device, generate a first unique key for encrypting and decrypting data;

in response to the network device being successfully authenticated by validating a plurality of different types of components of the network device, identify a secure location in the network device for storing a second unique key, wherein the secure location is one of the plurality of different types of components of the network device;

encrypt at least a portion of data of the network device with the first unique key to yield an encrypted portion of data of the network device;

store the encrypted portion of data of the network device in an internal non-volatile memory of the network device;

and encrypting the first unique key with the second unique key to yield an encrypted first unique key;

storing the encrypted first unique key on an external non-volatile memory device;

in response to a request to access data within the at least the portion of data of the network device, decrypting the encrypted first unique key using the second unique key and decrypt the encrypted at least the portion of data of the network device using the first unique key.

2 . The non-transitory computer readable medium of claim 1 , wherein the secure location is determined to be a most secure location of the network device, and wherein the plurality of different types of components of the network device includes non-volatile memory.

3 . The non-transitory computer readable medium of claim 1 , wherein the at least the portion of data of the network device comprises one or more of configuration information, IP addresses, VLAN information, security certificates, encryption keys, unique user information, log information, trace information, runtime application data, the portion of a disk of the network device.

4 . The non-transitory computer readable medium of claim 1 , wherein the external non-volatile memory is physically detachable from the network device.

5 . The non-transitory computer readable medium of claim 1 , wherein the external non-volatile memory comprises a network storage device.

6 . The non-transitory computer readable medium of claim 1 , further comprising:

receiving a boot loader over a network to perform the boot sequence.

7 . The non-transitory computer readable medium of claim 1 , wherein sensitive information stored in the external non-volatile memory is inaccessible when detached from the network device.

8 . A method comprising:

during a boot sequence of a network device, generating a first unique key for encrypting and decrypting data;

encrypting the first unique key with a second unique key to yield an encrypted first unique key;

storing the encrypted first unique key on an external non-volatile memory device; encrypting at least a portion of data of the network device with the first unique key to yield an encrypted portion of data of the network device;

storing the encrypted portion of data of the network device in an internal non-volatile memory of the network device;

in response to a request to access data within the at least the portion of data of the network device, decrypting the encrypted first unique key using the second unique key and decrypting the encrypted at least the portion of data of the network device using the first unique key;

and authenticating the network device by validating a plurality of different types of components of the network device;

in response to the network device being successfully authenticated, determining a secure location for storing the second unique key in the network device, wherein the secure location is one of the plurality of different types of components of the network device.

9 . The method of claim 8 , wherein the second unique key is stored in a network location that is accessible to the network device after authentication of the network device.

10 . The method of claim 8 , wherein the secure location is determined to be a most secure location of the network device, and wherein the plurality of different types of components of the network device includes non-volatile memory.

11 . The method of claim 8 , wherein the at least the portion of data of the network device comprises one or more of configuration information, IP addresses, VLAN information, security certificates, encryption keys, unique user information, log information, trace information, runtime application data, the portion of a disk of the network device.

12 . The method of claim 8 , wherein the external non-volatile memory device is physically detachable from the network device.

13 . The method of claim 8 , further comprising:

receiving a boot loader over a network to perform the boot sequence.

14 . A network device comprising:

one or more memories having computer-readable instructions;

and one or more processors configured to execute the computer-readable instructions to:

during a boot sequence of the network device, generate a first unique key for encrypting and decrypting data;

in response to the network device being successfully authenticated by validating a plurality of different types of components of the network device, identify a secure location in the network device for storing a second unique key, wherein the secure location is one of the plurality of different types of components of the network device;

encrypt at least a portion of data of the network device with the first unique key to yield an encrypted portion of data of the network device;

store the encrypted portion of data of the network device in an internal non-volatile memory of the network device;

and encrypting the first unique key with the second unique key to yield an encrypted first unique key;

storing the encrypted first unique key on an external non-volatile memory device;

in response to a request to access data within the at least the portion of data of the network device, decrypting the encrypted first unique key using the second unique key and decrypt the encrypted at least the portion of data of the network device using the first unique key.

15 . The network device of claim 14 , the secure location is determined to be a most secure location of the network device, the plurality of different types of components of the network device includes non-volatile memory.

16 . The network device of claim 14 , the at least the portion of data of the network device comprises one or more of configuration information, IP addresses, VLAN information, security certificates, encryption keys, unique user information, log information, trace information, runtime application data, the portion of a disk of the network device.

17 . The network device of claim 14 , the external non-volatile memory is physically detachable from the network device.

18 . The network device of claim 14 , the external non-volatile memory comprises a network storage device.

19 . The network device of claim 14 , wherein the instructions further cause the processor to:

receive a boot loader over a network to perform the boot sequence.

20 . The network device of claim 14 , sensitive information stored in the network device is inaccessible when detached from the network device.