Fabric-based virtual air gap provisioning, system and methods
A device configured to or programmed to instantiate an isolated sub-fabric is presented. A network configuration device uses a virtual air gap policy to instantiate a sub-fabric from a fabric of networking nodes. The sub-fabric is configured with an internal routing policy that respects the nature of the defined isolation. Further, the fabric is provisioned with a virtual air gap that ensures the external networking nodes respect the isolation of the sub fabric.
1. A network configuration device for configuring a fabric of interconnected networking nodes, the network configuration device comprising:
at least one computer readable non-transitory memory configured to store at least an air gap policy comprising fabric isolation criteria defined with respect to a multi-dimensional fabric configuration space; and
at least one processor coupled with the at least one computer readable non-transitory memory, wherein the at least one processor is configured to execute instructions stored in the at least one computer readable non-transitory memory to:
identify, based on the fabric isolation criteria of the air gap policy, a subset of the interconnected networking nodes for constructing a sub-fabric within the fabric;
cause a transmission of at least one configuration instruction to at least one of the interconnected networking nodes in the subset of interconnected networking nodes, the at least one configuration instruction indicating an internal routing policy for the sub-fabric;
provision, at least in part based on the air gap policy, the fabric with an air gap to isolate the subset of the interconnected networking nodes of the sub-fabric from external nodes of the fabric;
cause a state change of interconnects between the interconnected networking nodes, when the fabric is provisioned with the air gap;
monitor for transmission of a heart-beat protocol packet between the interconnected networking nodes of the sub-fabric and the external nodes of the fabric;
prohibit the interconnected networking nodes of the sub-fabric from rejoining the external nodes of the fabric for a specified time period after provisioning the fabric with the air gap; and
allow the interconnected networking nodes of the sub-fabric to rejoin the external nodes of the fabric subsequent to the specified time period.
2. The network configuration device of claim 1 , wherein monitoring for transmission of the heart-beat protocol packet includes transmitting the heart-beat protocol packet from the interconnected networking nodes of the sub-fabric to the external nodes of the fabric.
3. The network configuration device of claim 2 , wherein transmitting the heart-beat protocol packet includes transmitting the heart-beat protocol packet on a regular periodic basis.
4. The network configuration device of claim 3 , wherein the regular periodic basis includes at least one of a once per second frequency, a once per minute frequency, a daily frequency, or a monthly frequency.
5. The network configuration device of claim 2 , wherein transmitting the heart-beat protocol packet includes transmitting the heart-beat protocol packet on an irregular, non-periodic basis.
6. The network configuration device of claim 5 , wherein the irregular, non-periodic basis is established based on at least one of a key, a secret token, or a pseudo-random number generator, used to synchronize transmission and reception of the heart-beat protocol packet from the interconnected networking nodes of the sub-fabric to the external nodes of the fabric.
7. The network configuration device of claim 1 , wherein monitoring for transmission of the heart-beat protocol packet includes transmitting the heart-beat protocol packet from the external nodes of the fabric to the interconnected networking nodes of the sub-fabric.
8. The network configuration device of claim 7 , wherein transmitting the heart-beat protocol packet includes transmitting the heart-beat protocol packet on a regular periodic basis.
9. The network configuration device of claim 8 , wherein the regular periodic basis includes at least one of a once per second frequency, a once per minute frequency, a daily frequency, or a monthly frequency.
10. The network configuration device of claim 7 , wherein transmitting the heart-beat protocol packet includes transmitting the heart-beat protocol packet on an irregular, non-periodic basis.
11. The network configuration device of claim 10 , wherein the irregular, non-periodic basis is established based on at least one of a key, a secret token, or a pseudo-random number generator, used to synchronize transmission and reception of the heart-beat protocol packet from external nodes of the fabric to the interconnected networking nodes of the sub-fabric.
12. The network configuration device of claim 1 , wherein the at least one processor is configured to execute a wipe clean policy to delete at least a portion of data stored in the interconnected networking nodes of the sub-fabric, prior to the interconnected networking nodes of the sub-fabric rejoining the external nodes of the fabric.
13. The network configuration device of claim 12 , wherein the wipe clean policy includes at least one of:
overwriting existing configuration files in memories of the interconnected networking nodes of the sub-fabric with NULL files; or
wiping each of the interconnected networking nodes clean of all configuration information including firmware files.
14. The network configuration device of claim 13 , wherein each of the interconnected networking nodes of the sub-fabric are configured with a count-down timer to simultaneously conduct a wipe clean operation.
15. The network configuration device of claim 1 , wherein the interconnected networking nodes of the sub-fabric are distributed across a geographically significant distance.
16. The network configuration device of claim 15 , wherein the geographically significant distance includes nodes interconnected networking nodes of the sub-fabric distributed across at least one of a city, a continent or the world.
17. A method of configuring a fabric of interconnected networking nodes, the method comprising:
identifying, based on fabric isolation criteria of an air gap policy, a subset of the interconnected networking nodes for constructing a sub-fabric within the fabric, wherein the fabric isolation criteria are defined with respect to a multi-dimensional fabric configuration space;
causing a transmission of at least one configuration instruction to at least one of the interconnected networking nodes in the subset of interconnected networking nodes, the at least one configuration instruction indicating an internal routing policy for the sub-fabric;
provisioning, at least in part based on the air gap policy, the fabric with an air gap to isolate the subset of the interconnected networking nodes of the sub-fabric from external nodes of the fabric;
causing a state change of interconnects between the interconnected networking nodes, when the fabric is provisioned with the air gap; and
monitoring for transmission of a heart-beat protocol packet between the interconnected networking nodes of the sub-fabric and the external nodes of the fabric, including transmitting the heart-beat protocol packet from the interconnected networking nodes of the sub-fabric to the external nodes of the fabric on an irregular, non-periodic basis,
wherein the irregular, non-periodic basis is established based on at least one of a key, a secret token, or a pseudo-random number generator, used to synchronize transmission and reception of the heart-beat protocol packet from the interconnected networking nodes of the sub-fabric to the external nodes of the fabric.
18. The method of claim 17 , wherein:
the sub-fabric is a top secret sub-fabric; and
the method includes prohibiting the interconnected networking nodes of the sub-fabric from rejoining the external nodes of the fabric.
19. A non-transitory computer-readable storage medium including program code which, when executed by at least one processor, causes operations comprising:
identifying, within a fabric of interconnected networking nodes, a subset of interconnected networking nodes for constructing a sub-fabric within the fabric, wherein identifying the subset is based on fabric isolation criteria of an air gap policy, and the fabric isolation criteria are defined with respect to a multi-dimensional fabric configuration space;
causing a transmission of at least one configuration instruction to at least one of the interconnected networking nodes in the subset of interconnected networking nodes, the at least one configuration instruction indicating an internal routing policy for the sub-fabric;
provisioning, at least in part based on the air gap policy, the fabric with an air gap to isolate the subset of the interconnected networking nodes of the sub-fabric from external nodes of the fabric;
causing a state change of interconnects between the interconnected networking nodes, when the fabric is provisioned with the air gap; and
monitoring for transmission of a heart-beat protocol packet between the interconnected networking nodes of the sub-fabric and the external nodes of the fabric, including transmitting the heart-beat protocol packet from the external nodes of the fabric to the interconnected networking nodes of the sub-fabric on an irregular, non-periodic basis,
wherein the irregular, non-periodic basis is established based on at least one of a key, a secret token, or a pseudo-random number generator, used to synchronize transmission and reception of the heart-beat protocol packet from external nodes of the fabric to the interconnected networking nodes of the sub-fabric.