Zoned mesh network isolation
Embodiments of the present disclosure include a processing device that determines that a first node device of a plurality of node devices in a network is non-compliant with a network policy, identifies a first subset of the plurality of node devices that are not associated with the first node device, and transmits a communication to the first subset of the plurality of node devices that instructs respective ones of the first subset of the plurality of node devices to perform an alteration of a state of a communication path of the first subset of the plurality of node devices to be incompatible with the first node device.
1 . A method comprising:
determining, by an administration device of a network, that a first node device of a plurality of node devices in the network is non-compliant with a network policy, the first node device being arranged in a zone of the network;
identifying, by a processor of the administration device, a first subset of the plurality of node devices that are outside the zone;
transmitting, from the administration device to the first subset of the plurality of node devices, an instruction to alter a state of a communication path of the first subset of the plurality of node devices to be incompatible with the first node device, wherein the instruction includes an updated seed that causes the first subset of the plurality of node devices to generate an updated cryptographic key.
2 . The method of claim 1 , wherein the instruction causes an alteration of a first cryptographic state of the first subset of the plurality of node devices to be incompatible with a second cryptographic state of the first node device.
3 . The method of claim 2 , wherein the updated cryptographic key causes the alteration of the first cryptographic state of the first subset of the plurality of node devices to be incompatible with the second cryptographic state of the first node device.
4 . The method of claim 1 , further comprising:
identifying, by the processor of the administration device, a second subset of the plurality of node devices that are arranged within the zone, wherein the instruction causes the communication path to be incompatible with the second subset of the plurality of node devices.
5 . The method of claim 4 , wherein identifying, by the processor of the administration device, the second subset of the plurality of node devices comprises identifying the second subset of the plurality of node devices based on at least one of a geographic proximity or a network proximity of the second subset of the plurality of node devices to the first node device.
6 . The method of claim 1 , wherein the instruction causes the first subset of the plurality of node devices to alter the state of the communication path without directly accessing the first node device.
7 . A system comprising:
a memory; and
a processor, operatively coupled to the memory, to:
determine that a first node device of a plurality of node devices in a network is non-compliant with a network policy, the first node device being arranged in a zone of the network;
identify a first subset of the plurality of node devices that are outside the zone; and
transmit, to the first subset of the plurality of node devices, an instruction to alter a state of a communication path of the first subset of the plurality of node devices to be incompatible with the first node device, wherein the instruction includes an updated seed that causes the first subset of the plurality of node devices to generate an updated cryptographic key.
8 . The system of claim 7 , wherein the instruction causes an alteration of a first cryptographic state of the first subset of the plurality of node devices to be incompatible with a second cryptographic state of the first node device.
9 . The system of claim 8 , wherein the updated cryptographic key causes the alteration of the first cryptographic state of the first subset of the plurality of node devices to be incompatible with the second cryptographic state of the first node device.
10 . The system of claim 7 , wherein the processor is further to:
identify a second subset of the plurality of node devices that are arranged within the zone, wherein the instruction causes the communication path to be incompatible with the second subset of the plurality of node devices.
11 . The system of claim 10 , wherein the processor is to identify the second subset of the plurality of node devices based on at least one of a geographic proximity or a network proximity of the second subset of the plurality of node devices to the first node device.
12 . The system of claim 7 , wherein the plurality of node devices form a mesh network.
13 . A non-transitory computer-readable storage medium including instructions that, when executed by a processor, cause the processor to:
determine that a first node device of a plurality of node devices in a network is non-compliant with a network policy, the first node device being arranged in a zone of the network;
identify, by the processor, a first subset of the plurality of node devices that are outside the zone; and
transmit, to the first subset of the plurality of node devices, a configuration to alter a state of a communication path of the first subset of the plurality of node devices to be incompatible with the first node device, wherein the configuration includes an updated seed that causes the first subset of the plurality of node devices to generate an updated cryptographic key.
14 . The non-transitory computer-readable storage medium of claim 13 , wherein the configuration causes an alteration of a first cryptographic state of the first subset of the plurality of node devices to be incompatible with a second cryptographic state of the first node device.
15 . The non-transitory computer-readable storage medium of claim 14 , wherein the updated cryptographic key causes the alteration of the first cryptographic state of the first subset of the plurality of node devices to be incompatible with the second cryptographic state of the first node device.
16 . The non-transitory computer-readable storage medium of claim 13 , wherein instructions cause the processor further to:
identify a second subset of the plurality of node devices that are arranged within the zone, wherein the configuration causes the communication path to be incompatible with the second subset of the plurality of node devices.
17 . The non-transitory computer-readable storage medium of claim 16 , wherein the instructions cause the processor to identify the second subset of the plurality of node devices based on at least one of a geographic proximity or a network proximity of the second subset of the plurality of node devices to the first node device.