Automated network discovery, secure network communications, and automated network configuration

A method for layer 2 (L2) network security, comprising:

• transmitting, to a new node, based on the new node being added to an L2 network managed by a central control node, a certificate chain of the central control node, one or more supported encryption algorithms, ephemeral shared key generation parameters, an ephemeral shared key generation public key of the central control node, and a signature comprising a signed payload hash digest;
• receiving, from the new node, a communication including a corresponding certificate chain of the new node, a selected encryption algorithm from the one or more supported encryption algorithms, a corresponding ephemeral shared key generation public key of the new node, and a corresponding signature comprising a corresponding signed payload hash digest;
• verifying an authenticity of the communication based on the corresponding certificate chain of the new node and the corresponding signature;
• generating an ephemeral shared key based on the ephemeral shared key generation parameters, the ephemeral shared key generation public key of the central control node, and the corresponding ephemeral shared key generation public key of the new node;
• and
• establishing, based on the verifying of the authenticity of the communication, a secure communication session over the L2 network with the new node based on the selected encryption algorithm and the ephemeral shared key.

A non-transitory computer-readable medium storing instructions that, when executed by one or more processors of a computing system, cause the computing system to:

• transmit, to a new node, based on the new node being added to a layer 2 (L2) network managed by the central control node, a certificate chain of the central control node, one or more supported encryption algorithms, ephemeral shared key generation parameters, an ephemeral shared key generation public key of the central control node, and a signature comprising a signed payload hash digest;
• receive, from the new node, a communication including a corresponding certificate chain of the new node, a selected encryption algorithm from the one or more supported encryption algorithms, a corresponding ephemeral shared key generation public key of the new node, and a corresponding signature comprising a corresponding signed payload hash digest;
• verify an authenticity of the communication based on the corresponding certificate chain of the new node and the corresponding signature;
• generate an ephemeral shared key based on the ephemeral shared key generation parameters, the ephemeral shared key generation public key of the central control node, and the corresponding ephemeral shared key generation public key of the new node;
• and
• establish, based on the verifying of the authenticity of the communication, a secure communication session over the L2 network with the new node based on the selected encryption algorithm and the ephemeral shared key.