Network element authentication in communication networks

A system for authenticating a device attached to a first network, comprising:

• a new switch on the first network configured to transmit via a direct connection an identifier that identifies the new switch;
• a mobile device configured to receive, via the direct connection, the identifier and transmits, via a second network, the identifier, wherein the second network is a public network, the direct connection being between the mobile device and the new switch;
• an authorization server configured to receive the identifier from the mobile device via the second, public network and includes:
• an inventory module configured to determine, based on the identifier, whether the new switch is authorized to route data on the first network, and
• a key module configured to transmit, when the authentication server determines that the new switch is authorized to route data on the first network, to the mobile device via the second, public network, a private key for a discovery packet on the first network, the discovery packet specifying how to route data on the first network,
• wherein the mobile device is configured to configure, via the direct connection, the new switch with the private key to enable the new switch to digitally sign the discovery packet, and
• wherein the new switch is configured to transmit the digitally signed discovery packet on the first network to another network element, the other network element authenticates the discovery packet using the digital signature, and, when the other network element authenticates the discovery packet, the other network element starts routing data to the new switch.

A non-transitory program storage device tangibly embodying a program of instructions executable by at least one machine to perform a method for authenticating a new switch on a first network, the method comprising:

• receiving, at a mobile device via a direct connection between the mobile device and the new switch, an identifier that identifies the new switch;
• transmitting, via a second network, the identifier to an authentication server that determines, based on the identifier, whether the new switch is authorized to route data on the first network, wherein the second network is a public network;
• when the authentication server determines that the new switch is authorized to route data on the first network, receiving, via the second, public network, a private key for a discovery packet on the first network, the discovery packet specifying how to route data on the first network;
• and
• configuring, via the direct connection, the new switch with the private key to enable the new switch to digitally sign the discovery packet, wherein the new switch transmits the digitally signed discovery packet on the first network to another network element, the other network element authenticates the discovery packet using the digital signature, and, when the other network element authenticates the discovery packet, the other network element starts routing data to the new switch.