Security profile selection and configuration of network devices via ownership voucher extension
Techniques and architecture are described for providing a configurable security posture for a network device using an extended ownership artifact, e.g., an ownership voucher, an ownership certificate, etc., and a security profile mechanism that scales to user needs and desires for security profiles on network devices, i.e., easily and securely customizable on thousands of nodes of a network. The configurable security posture may be achieved using the manufacturer authorized signing authority (MASA) to issue an ownership voucher with a security bit extension to support security profile additions. Using the MASA service, a user may explicitly decide on various security postures of a given network device and may apply that profile across the fixed or modular chassis of a network of network devices.
1. A method comprising:
providing, to a user, a first ownership artifact for a network device, wherein the first ownership artifact includes a first security profile selection bit string extension, and wherein the first security profile selection bit string extension is configured to configure the network device according to a first security profile;
receiving, from the user, a request for a second ownership artifact, wherein the request includes a request for a second security profile selection bit string extension within the second ownership artifact; and
at least in response to the request, providing the second ownership artifact to the user, wherein the second ownership artifact comprises the second security profile selection bit string extension, and wherein the second security profile selection bit string extension is configured to configure the network device according to a second security profile,
wherein the request lists only values of bits of the second security profile selection bit string extension that need to be changed to configure the network device according to the second security profile.
2. The method of claim 1 , wherein the request includes the first ownership artifact.
3. The method of claim 2 , further comprising:
based at least in part on the first ownership artifact, verifying, via a manufacturer authorized signing authority (MASA) mechanism, ownership by the user of the network device.
4. The method of claim 1 , wherein the request includes a request for a non-security profile selection bit string extension within the second ownership artifact.
5. The method of claim 1 , wherein the request for the second ownership artifact is signed by the user using the first ownership artifact.
6. The method of claim 5 , wherein a manufacturer authorized signing authority (MASA) mechanism is part of an original equipment manufacturer (OEM) that manufactured the network device.
7. The method of claim 1 , wherein the request for the second ownership artifact is based at least in part on one or more of (i) a change of ownership of the network device, (ii) different security requirements for different operational teams or business units within the user, (iii) different security requirements for different geographical regions, or (iv) new security requirements for the user.
8. A system comprising:
one or more processors; and
one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform actions comprising:
providing, to a user, a first ownership artifact for a network device, wherein the first ownership artifact includes first security profile selection bit string extension, and wherein the first security profile selection bit string extension is configured to configure the network device according to a first security profile;
receiving, from the user, a request for a second ownership artifact, wherein the request includes a request for a second security profile selection bit string extension within the second ownership artifact; and
at least in response to the request, providing the second ownership artifact to the user, wherein the second ownership artifact comprises the second security profile selection bit string extension, and wherein the second security profile selection bit string extension is configured to configure the network device according to a second security profile,
wherein the request lists only values of bits of the second security profile selection bit string extension that need to be changed to configure the network device according to the second security profile.
9. The system of claim 8 , wherein the request includes the first ownership artifact.
10. The system of claim 9 , wherein the actions further comprise:
based at least in part on the first ownership artifact, verifying, via a manufacturer authorized signing authority (MASA) mechanism, ownership by the user of the network device.
11. The system of claim 8 , wherein the request includes a request for a non-security profile selection bit string extension within the second ownership artifact.
12. The system of claim 8 , wherein the request for the second ownership artifact is signed by the user using the first ownership artifact.
13. The system of claim 12 , wherein a manufacturer authorized signing authority (MASA) mechanism the MASA mechanism is part of an original equipment manufacturer (OEM) that manufactured the network device.
14. The system of claim 8 , wherein the request for the second ownership artifact is based at least in part on one or more of (i) a change of ownership of the network device, (ii) different security requirements for different operational teams or business units within the user, (iii) different security requirements for different geographical regions, or (iv) new security requirements for the user.
15. One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors, cause the one or more processors to perform actions comprising:
providing, to a user, a first ownership artifact for a network device, wherein the first ownership artifact includes first security profile selection bit string extension, and wherein the first security profile selection bit string extension is configured to configure the network device according to a first security profile;
receiving, from the user, a request for a second ownership artifact, wherein the request includes a request for a second security profile selection bit string extension within the second ownership artifact; and
at least in response to the request, providing the second ownership artifact to the user, wherein the second ownership artifact comprises the second security profile selection bit string extension, and wherein the second security profile selection bit string extension is configured to configure the network device according to a second security profile,
wherein the request lists only values of bits of the second security profile selection bit string extension that need to be changed to configure the network device according to the second security profile.
16. The one or more non-transitory computer-readable media storing computer-executable instructions of claim 15 , wherein:
the request includes the first ownership artifact; and
the actions further comprise:
based at least in part on the first ownership artifact, verifying, via a manufacturer authorized signing authority (MASA) mechanism, ownership by the user of the network device.
17. The one or more non-transitory computer-readable media storing computer-executable instructions of claim 15 , wherein:
the request for the second ownership artifact is signed by the user using the first ownership artifact; and
a manufacturer authorized signing authority (MASA) mechanism is part of an original equipment manufacturer (OEM) that manufactured the network device.
18. The one or more non-transitory computer-readable media storing computer-executable instructions of claim 15 , wherein the request for the second ownership artifact is based at least in part on one or more of (i) a change of ownership of the network device, (ii) different security requirements for different operational teams or business units within the user, (iii) different security requirements for different geographical regions, or (iv) new security requirements for the user.
19. A method comprising:
providing, to a user, a first ownership artifact for a network device, wherein the first ownership artifact includes a first security profile selection bit string extension, and wherein the first security profile selection bit string extension is configured to configure the network device according to a first security profile;
receiving, from the user, a request for a second ownership artifact, wherein the request includes a request for a second security profile selection bit string extension within the second ownership artifact; and
at least in response to the request, providing the second ownership artifact to the user, wherein the second ownership artifact comprises the second security profile selection bit string extension, and wherein the second security profile selection bit string extension is configured to configure the network device according to a second security profile,
wherein the request lists (i) values of bits of the second security profile selection bit string extension that need to be changed to configure the network device according to the second security profile and (ii) current values of bits of the first security profile selection bit string extension that are to remain unchanged to configure the network device according to the second security profile.
20. A system comprising:
one or more processors; and
one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform actions comprising:
providing, to a user, a first ownership artifact for a network device, wherein the first ownership artifact includes first security profile selection bit string extension, and wherein the first security profile selection bit string extension is configured to configure the network device according to a first security profile;
receiving, from the user, a request for a second ownership artifact, wherein the request includes a request for a second security profile selection bit string extension within the second ownership artifact; and
at least in response to the request, providing the second ownership artifact to the user, wherein the second ownership artifact comprises the second security profile selection bit string extension, and wherein the second security profile selection bit string extension is configured to configure the network device according to a second security profile, and
wherein the request lists (i) values of bits of the second security profile selection bit string extension that need to be changed to configure the network device according to the second security profile and (ii) current values of bits of the first security profile selection bit string extension that are to remain unchanged to configure the network device according to the second security profile.