Zero touch provisioning

Patent metadata

Field	Value
Publication number	US-11070658-B2
Application number	US-201615138664-A
Country	US
Kind code	B2
Filing date	Apr 26, 2016
Priority date	Oct 31, 2012
Publication date	Jul 20, 2021
Grant date	Jul 20, 2021

Abstract

According to one embodiment, a method comprises automatically uploading device information from a first network device in a first operating state to a second network device in response to an event, such as an initial power up. The second network device is part of the cloud, and thus, providing cloud-based services. Subsequent to the uploading of the device information, the first network device receives information controlling the operation of the first network device based on the device information.

First claim

The invention claimed is:

1. A method comprising:
in response to a first event, automatically uploading device information from a first network device to a second network device providing a cloud-based service;
receiving, by the first network device and from the second network device, provisioning information for controlling an operation of the first network device responsive to uploading the device information;
provisioning the first network device based on the provisioning information;
establishing communication with a configuration device;
receiving configuration information for the first network device from the configuration device based on a validation check performed by the configuration device on the first network device using validation information provided by the second network device; and
upon validation via a trusted platform module deployed within the first network device, configuring the first network device based on the received configuration information.

2. The method of claim 1 , wherein the provisioning information comprises at least two of (1) a Media Access Control (MAC) address for the first network device, (2) a serial number for the first network device, and (3) storage location information, the method further comprising:
using the provisioning information to obtain configuration information for the first network device.

3. The method of claim 1 , wherein the received configuration information comprises at least one of: a security policy, a wireless service set identifier (SSD), a routing policy, shared secret information, wireless transmission power information, or wireless channels.

4. The method of claim 1 , further comprising:
pushing the information for controlling operation of the first network device onto a third network device that is associated with a same subnetwork as the first network device.

5. The method of claim 1 , wherein the first event includes performing an initial power up placing the first network device in a first operating state and connecting to a network associated with the second network device.

6. The method of claim 1 , wherein the configuration information is obtained by the first network device (i) using at least a portion of the provisioning information received from the second network device to establish communications with a third network device, (ii) providing information identifying the first network device, and (iii) receiving the configuration information based on the information identifying the first network device.

7. The method of claim 1 , further comprising:
uploading the device information and receiving the information controlling the operation of the first network device using digital certificates.

8. The method of claim 1 , wherein the validation comprises performing validation using a challenge and response protocol soliciting a signed certificate from the trusted platform module.

9. A first network device comprising a processor resource, and configured to:
in response to a first event, automatically upload device information to a second network device that provides a cloud-based service;
receive from the second network device, provisioning information for controlling an operation of the first network device responsive to uploading the device information;
provision the first network device based on the provisioning information;
establish communication with a configuration device to obtain configuration information for the first network device;
receive the configuration information for the first network device from the configuration device based on a validation check performed by the configuration device on the first network device using validation information provided by the second network device; and
upon validation via a trusted platform module deployed within the first network device, configure the first network device based on the received configuration.

10. The first network device of claim 9 , wherein the provisioning information comprises at least two of (1) a Media Access Control (MAC) address for the first network device, (2) a serial number for the first network device, and (3) storage location information,
wherein the first network device further to: use the provisioning information to obtain configuration for the first network device.

11. The first network device of claim 9 , wherein the received configuration information comprises at least one of: a security policy, a wireless service set identifier (SSD), a routing policy, shared secret information, wireless transmission power information, or wireless channels.

12. The first network device of claim 9 , the first network device further to:
push the information for controlling operation of the first network device onto a third network device that is associated with a same subnetwork as the first network device.

13. The first network device of claim 9 , wherein the validation is performed using a challenge and response protocol resulting in the first network device sending a signed certificate in response to a solicitation of the signed certificate from the trusted platform module.

14. A non-transitory storage medium including software that, when executed by one or more hardware processors implemented within a first network device, performs operations comprising:
in response to a first event, automatically uploading device information from the first network device to a second network device that provides a cloud-based service;
receiving, from the second network device, provisioning information for controlling the operation of the first network device responsive to uploading the device information;
provisioning the first network device based on the provisioning information;
establishing communication with a configuration device to obtain configuration information for the first network device;
receiving the configuration information for the first network device from the configuration device based on a validation check performed by the configuration device on the first network device using validation information provided by the second network device; and
upon validation via a trusted platform module deployed within the first network device, configuring the first network device based on the received configuration.

15. The non-transitory storage medium of claim 14 , further comprising instructions that, when executed, cause the processor to perform operations comprising using the provisioning information to obtain configuration for the first network device, wherein the provisioning information comprises at least two of (1) a Media Access Control (MAC) address for the first network device, (2) a serial number for the first network device, and (3) storage location information.

16. The non-transitory storage medium of claim 14 , wherein the received configuration information comprises at least one of: a security policy, a wireless service set identifier (SSD), a routing policy, shared secret information, wireless transmission power information, or wireless channels.

17. The non-transitory storage medium of claim 14 , wherein the software that, when executed by the one or more hardware processors implemented within the first network device, performs operations further comprising receiving a solicitation requesting a signed certificate from the trusted platform module, and responding with the signed certificate.

Assignees

• Aruba Networks Inc
• Hewlett Packard Entpr Dev Lp

Inventors

• Gray Gordon Paul
• Burke Anthony
• Munro David
• Liu Yan

Classifications

• H04M1/72412

  using two-way short-range wireless interfaces · CPC title

• H04M1/72409 Primary

  by interfacing with external accessories (hands-free H04M1/60) · CPC title

• H04L41/0806 Primary

  for initial configuration or provisioning, e.g. plug-and-play · CPC title

• H04L2101/681

  using addresses for wireless personal area networks or wireless sensor networks, e.g. Zigbee addresses · CPC title

• H04L2101/622

  Layer-2 addresses, e.g. medium access control [MAC] addresses · CPC title