Arista Networks, Inc.

Ethan Barnett Rahn

Andre Pech

Baptiste Elie Franck Covolato

Douglas Alan Gourlay

Julien André Alexis Gomes

Baptiste Covolato

Roy Wen

Julien Gomes

Aaron Delaney

Roy Magruder

Kenneth James Duda

Dipankar Bhatt Acharya

Hua Zhong

Eudean Michael Sun

Robert Eugene Gilligan

Gil Adrian Torres

Fred Hsu

Ritesh Kumar Sinha

Steven Cohen

Andrey Elenskiy

Steve Magers

Ian O'brien

James Samuel Brinkley

Rajat Bajaj

Michelle Binlu Wang

Pranav Choudhary

For dynamic installation of extensible network operating system (ENOS) extensions, a network device downloads a full software image (SWI) having a signature and a directory containing software packages from an install source. During downloading, the network device modifies the full SWI on the fly, including reading and removing the software packages (SWIX files) from the directory, as each one is read, determining whether to keep it, for each 'keep' SWIX file, extracting an ENOS extension and a corresponding signature, and storing them on a nonvolatile memory, resulting in a modified SWI with a signature but without the SWIX files. After download is complete, the signed ENOS extensions stored on the nonvolatile memory are verified to determine valid ENOS extensions for inclusion in an overlay filesystem which becomes a root filesystem for the network device. The signed modified SWI is also verified before booting the network device into the modified SWI.

Signed SWI containing signed extensions for dynamic installation

A centralized manager in a network deployment is configured to perform periodic automated rotation of secrets used in the network and customer devices in the deployment. The centralized manager is further configured with intelligence to automatically install the rotated secrets onto the deployed devices. The centralized controller can provide high frequency rotations to improve network security.

High frequency rotation of cryptographic data

Embodiments of the present disclosure include techniques for securing the flow of configuration commands issued to network devices. When an authorized command source, such as an authorized user or program, issues a command, security data for the command is generated and associated with the command. The command and security data may flow across multiple software applications to the network device. The network device receiving the command may use the security data to verify that the command source is an authorized source and to validate that the command was unaltered.

Cryptographically signed network configurations

A method for authenticating an origin of a network device. The method includes reading one or more encrypted parameters from a memory of the network device, decoding the one or more encrypted parameters, and determining whether one or more of the decoded parameters match parameters obtained from a trusted platform module (TPM) installed in the network device and/or a read only memory (ROM) of the network device. In response to a mismatch between the decoded parameters and the parameters obtained from the TPM or the ROM, at least one of suspending operation of the device or transmitting a report of an authentication failure across a network on which the device is operating.

Network device authentication

Cryptographically identifying a device to a service includes: providing the cloud service with a cryptographically signed token, the token being embedded in the device when the device was manufactured, the token including first information and second information. The cloud service verifies the token using a public key associated with the second information and determines a user using the first information. The device receives, from the cloud service, provisioning information customized for the user and including a client certificate for communicating with the cloud service.

Cryptographically identifying a device

Verifying a hardware license and controlling hardware features includes receiving a first part of a license payload and a license signature covering the license payload from a CPU, the license signature being generated using a private encryption key; receiving a second part of the license payload from a memory, the CPU being unable to modify the second part of the license payload; generating a hash using the first part and the second part of the license payload; and verifying the license signature using the hash and a public encryption key associated with the private encryption key. When the verifying is successful, communicating with circuitry to enable functionality of the circuitry specified in the license payload.

Hardware license verification

A method for distributing network services for a network device through a multi-tenant network service. An identification parameter is associated with the device and is stored in a database by an orders management system after the device is ordered. The method includes establishing a network connection between a network device and a multi-tenant network service and, in response to establishing the network connection, obtaining device-associated identification parameter from the network device. The identification parameter is used to query the database for at least one record associated with the network device identifying a tenant of the multi-tenant network service in which the tenant corresponds to the device. The service maps the network device to the identified tenant of the multi-tenant network service and distributes network services based upon the mapping of the network device to the identified tenant.

Device provisioning in a multi-tenant service

Network devices are securely provisioned through authenticated ZTP servers. In some approaches, a storage device local to the network device includes information for connecting with and authenticating a local or remote ZTP server. This information may include a root of trust to use when connecting with a designated ZTP server. The ZTP server may be identified using either a dynamic host configuration protocol (DHCP) server or a network address specified in the local memory storage. In an approach, the local memory storage is a removable USB flash memory device inserted into the network device when the device is booted up. In another approach, the ZTP authentication information is stored within memory integrated within the network device. Once a ZTP server is connected to the network device, a secure connection may be established such as a secure transport layer session (TLS) utilizing the root of trust.

Systems and methods for provisioning network devices

In general, embodiments relate to methods and systems for signing a software image (SWI), distributing the signed SWI to one or more network devices, and verifying, on a per-network device basis, the signed SWI.

Method and system for software image verification using a Null File

Growing community of inventors

Thousand Oaks, CA, United States of America

Ethan Barnett Rahn