Certificate-based connections reflecting a network architecture
A computer network device that implements a data plane is described. During operation, the computer network device may receive, associated with a second computer network device, a request to establish a connection, where the request includes an instance of a first type of certificate associated with a first certificate authority for a first layer in a hierarchy in the network, and/or an instance of a second type of certificate associated with a second certificate authority for a second layer in the hierarchy, where the first layer is lower in the hierarchy than the second layer. Then, the computer network device may selectively establish a connection in the network with the second computer network device based at least in part on the instance of the first type of certificate and/or the instance of the second type of certificate.
1. A computer network device, comprising:
an interface circuit configured to communicate with a second computer network device in a network;
a processor coupled to the interface circuit; and
memory, coupled to the processor, storing program instructions, wherein, when executed by the processor, the program instructions cause the computer network device to perform operations comprising:
receiving, associated with the second computer network device, a request to establish a connection, wherein the request comprises an instance of a first type of certificate associated with a first certificate authority for a first layer in a hierarchy in the network, an instance of a second type of certificate associated with a second certificate authority for a second layer in the hierarchy, or both, wherein the first layer is lower in the hierarchy than the second layer, wherein the first layer is associated with a tenant and the second layer is associated with a managed service provider (MSP) of the network, and wherein the tenant is a customer of the MSP;
selectively establishing a connection in the network with the second computer network device based at least in part on the instance of the first type of certificate, the instance of the second type of certificate, or both; and
based at least in part on the instance of the first type of certificate, the instance of the second type of certificate, or both, excluding the connection with the second computer network device when the second computer network device is associated with a different tenant of the MSP, a different MSP or both.
2. The computer network device of claim 1 , wherein the computer network device is configured to implement a data plane.
3. The computer network device of claim 1 , wherein the second computer network device comprises: an access point, or implements a data plane.
4. The computer network device of claim 1 , wherein, when the second computer network device is in the first layer, the second computer network device comprises an access point.
5. The computer network device of claim 1 , wherein, when the second computer network device is in the second layer, the second computer network device implements a data plane.
6. The computer network device of claim 1 , wherein the second computer network device is associated with a different manufacturer or provider than a manufacturer or a provider of the computer network device.
7. The computer network device of claim 1 , wherein the instance of the first type of certificate is associated with a first computer system and the instance of the second type of certificate is associated with a second computer system; and
wherein the second computer system is different from the first computer system.
8. The computer network device of claim 7 , wherein the first computer system, the second computer system or both comprise a controller of the computer network device and the second computer network device.
9. The computer network device of claim 1 , wherein the instance of the first type of certificate is signed by the first certificate authority, and the instance of the second type of certificate is signed by the second certificate authority.
10. A non-transitory computer-readable storage medium for use in conjunction with a computer network device, the computer-readable storage medium storing program instructions that, when executed by the computer network device, cause the computer network device to perform operations comprising:
receiving, associated with a second computer network device, a request to establish a connection, wherein the request comprises an instance of a first type of certificate associated with a first certificate authority for a first layer in a hierarchy in a network, an instance of a second type of certificate associated with a second certificate authority for a second layer in the hierarchy, or both, wherein the first layer is lower in the hierarchy than the second layer, wherein the first layer is associated with a tenant and the second layer is associated with a managed service provider (MSP) of the network, and wherein the tenant is a customer of the MSP;
selectively establishing a connection in the network with the second computer network device based at least in part the instance of the first type of certificate, the instance of the second type of certificate, or both; and
based at least in part on the instance of the first type of certificate, the instance of the second type of certificate, or both, excluding the connection with the second computer network device when the second computer network device is associated with a different tenant of the MSP, a different MSP or both.
11. The non-transitory computer-readable storage medium of claim 10 , wherein the computer network device implements a data plane.
12. The non-transitory computer-readable storage medium of claim 10 , wherein the instance of the first type of certificate is associated with a first computer system and the instance of the second type of certificate is associated with a second computer system; and
wherein the second computer system is different from the first computer system.
13. The non-transitory computer-readable storage medium of claim 10 , wherein, when the second computer network device is in the first layer, the second computer network device comprises an access point.
14. A method for selectively establishing a connection in a network, comprising:
by a computer network device:
receiving, associated with a second computer network device, a request to establish a connection, wherein the request comprises an instance of a first type of certificate associated with a first certificate authority for a first layer in a hierarchy in the network, an instance of a second type of certificate associated with a second certificate authority for a second layer in the hierarchy, or both, wherein the first layer is lower in the hierarchy than the second layer, wherein the first layer is associated with a tenant and the second layer is associated with a managed service provider (MSP) of the network, and wherein the tenant is a customer of the MSP;
selectively establishing the connection in the network with the second computer network device based at least in part the instance of the first type of certificate, the instance of the second type of certificate, or both; and
based at least in part on the instance of the first type of certificate, the instance of the second type of certificate, or both, excluding the connection with the second computer network device when the second computer network device is associated with a different tenant of the MSP, a different MSP or both.
15. The method of claim 14 , wherein the computer network device implements a data plane.
16. The method of claim 14 , wherein the instance of the first type of certificate is associated with a first computer system and the instance of the second type of certificate is associated with a second computer system; and
wherein the second computer system is different from the first computer system.
17. The method of claim 14 , wherein, when the second computer network device is in the first layer, the second computer network device comprises an access point.
18. The method of claim 14 , wherein the instance of the first type of certificate is signed by the first certificate authority, and the instance of the second type of certificate is signed by the second certificate authority.
19. The method of claim 14 , wherein the second computer network device is associated with a different manufacturer or provider than a manufacturer or a provider of the computer network device.
20. The method of claim 14 , wherein the instance of the first type of certificate is associated with a first computer system and the instance of the second type of certificate is associated with a second computer system; and
wherein the second computer system is different from the first computer system.