Network device host key verification by network controller using a cryptographic channel and a list of audit events

Abstract

Techniques and architecture are described that leverage a trusted cryptographic channel by a network controller to authenticate an unfamiliar host key found on a network device when the network controller is attempting to establish a secure connection over a secure channel. The network controller may authenticate an unfamiliar host key found on a network device by using the trusted cryptographic channel to retrieve the network device's host keys directly from the network device when the network controller encounters the unfamiliar host key. Additionally, the network controller may correlate all the audit events available to the network controller with the appearance of the unfamiliar host key and accepting the unfamiliar host key only if the unfamiliar host key is confirmed to be present on the network device and if the audit events indicate that the unfamiliar host key was recently properly installed or generated on the network device.