NETWORK DEVICE PROVISIONING

• US 20100306352A1
• Filed: 05/30/2009
• Published: 12/02/2010
• Est. Priority Date: 05/30/2009
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: VILHUBER, Jan, PRITIKIN, Max, McGREW, David A., WEIS, Brian E.
• Granted Patent: US 8,341,250 B2
• Time in Patent Office: Days
• US Class Current: 709/221
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263

Abstract

Systems, methods and other embodiments associated with network device provisioning are described. One example method includes storing a set of device specific identification data in a network device. The example method may also include storing an association between the network device and a set of device specific provisioning data. The example method may also include providing the set of device specific provisioning data to the network device. The set of device specific provisioning data may be provided in response to receiving a provisioning data request from the network device.

Claims

1. A logic encoded in one or more tangible media for execution and when executed operable to perform a method, the method comprising:

storing, in a network device, a set of device specific identification data;

storing an association between the network device and a set of device specific provisioning data; and

configuring a provisioning server to provide the set of device specific provisioning data to the network device in response to receiving a provisioning data request from the network device, where the provisioning data request facilitates authenticating the network device with a portion of the set of device specific identification data.

2. The logic of claim 1, where the set of device specific identification data comprises a digital certificate.

3. The logic of claim 1, where the set of device specific identification data comprises one or more of, a unique device identifier (UDI), and a public key certificate.

4. The logic of claim 1, where the set of device specific identification data comprises an identification number.

5. The logic of claim 4, where the identification number is one of, a media access control (MAC) address, and a behavior configuration number.

6. The logic of claim 1, where the set of device specific provisioning data comprises a set of instructions that, when executed, cause the network device to perform a behavior.

7. The logic of claim 1, where the set of device specific provisioning data comprises a set of trusted public information, where trusted public information facilitates establishing a secure connection between the network device and a device associated with the trusted public information.

8. The logic of claim 7 where a device associated with the trusted public information is one or more of, a certificate enrollment protocol registration authority, a certificate authority certificate enrollment protocol registration authority or certificate authority, a virtual private network (VPN) hub, a VPN peer, a group domain of interpretation (GDOI) server, and a customer network management station.

9. The logic of claim 1, the method comprising receiving a set of purchase data, where the purchase data is associated with the set of device specific provisioning data.

10. The logic of claim 1, where the set of device specific identification data is stored in the network device during the manufacture of the network device.

11. The logic of claim 9, comprising providing a portion of the set of device specific identification data to a purchaser associated with the set of purchase data.

12. An apparatus, comprising:

an identification data store to store a set of device identification data;

a behavior data store to store behavior data comprising a set of default behavior data;

a request logic to provide a behavior data request to a provisioning server, where the behavior data request comprises the set of device identification data and where the provisioning server is configured to authenticate the apparatus based, at least in part, on the set of device identification data;

a receipt logic to receive a behavior signal from the provisioning server, where the behavior signal identifies one of, the set of default behavior data and a set of updated behavior data, and to store the set of updated behavior data in the behavior data store upon determining that the behavior signal identifies the set of updated behavior data; and

a control logic to initiate a behavior based, at least in part, on one or more of, a set of behavior data in the behavior data store, and the behavior signal.

13. The apparatus of claim 12, where the set of device identification data comprises one or more of, a digital certificate, a unique device identifier, and an identification number.

14. The apparatus of claim 12, where a set of behavior data comprises one or more of, a set of instructions, and a set of trusted public information, where a member of the trusted public information facilitates establishing a secure connection with a device associated with the trusted public information.

15. The apparatus of claim 12, where the set of updated behavior data is contained in the behavior signal when the behavior signal identifies the set of updated behavior data.

16. A logic encoded in one or more tangible media for execution and when executed operable to perform a method, the method comprising:

storing a unique device identifier in a router;

storing a set of default behavior data in the router; and

storing an activation logic in the router, where the activation logic is configured to;

provide a behavior data request to a provisioning server upon detecting an initial activation of the router in a network, where the behavior data request comprises the unique device identifier and where the provisioning server is configured to authenticate the router based, at least in part, on the unique device identifier;

receive a behavior signal from the provisioning server, where the behavior signal identifies one of the set of default behavior data and a set of updated behavior data;

control the router to initiate a default behavior when the behavior signal identifies the set of default behavior data, the default behavior being based, at least in part, on the set of default behavior data; and

control the router to store the set of updated behavior data in the router, and to initiate an updated behavior upon determining that the behavior signal identifies the set of updated behavior data, the updated behavior being based, at least in part, on the set of updated behavior data.

17. The logic of claim 16, where the unique device identifier comprises one or more of, a digital certificate, a secure unique device identifier, and an identification number.

18. The logic of claim 16, where a set of behavior data comprises one or more of, a set of instructions, and a set of trusted addresses, where a trusted address facilitates establishing a secure connection with a device located at the trusted address.

19. The logic of claim 16, the method comprising:

receiving a set of purchase data, where the set of purchase data controls whether the behavior signal identifies the set of default behavior data or the set of updated behavior data;

receiving a behavior data request from the router; and

providing a behavior signal to the router.

20. The logic of claim 19, the method comprising:

generating the set of updated behavior data based, at least in part, on the set of purchase data upon determining that the set of purchase data is configured to control the behavior signal to identify the set of updated behavior data.

21. The logic of claim 19, the method comprising:

causing the router to be shipped to a location identified by the set of purchase data.

22. The logic of claim 16, where the activation logic is a zero-touch logic.

23. The logic of claim 19, the method comprising:

providing the unique device identifier to a purchaser identified by the set of purchase data.

24. A system, comprising:

means for storing a set of device specific identification data in a network device;

means for storing a set of default behavior data in the network device; and

means for selectively providing the network device a set of updated behavior data upon authenticating the network device based, at least in part, on a behavior data request received from the network device, the behavior data request comprising the set of device specific identification data.

25. A logic encoded in one or more tangible media for execution and when executed operable to perform a method, the method comprising:

controlling a network device to locate a first provisioning server; and

controlling the network device to authenticate the provisioning server.

26. The logic of claim 25, the method comprising:

receiving information concerning a current provisioning server from the first provisioning server;

controlling the network device to locate the current provisioning server; and

controlling the network device to authenticate the current provisioning server.

27. The logic of claim 25, where controlling the network device to locate the first provisioning server comprises providing the network device with one of, a DNS name of the first provisioning server, and IP address of the first provisioning server.

28. The logic of claim 26, where controlling the network device to locate the current provisioning server comprises providing the network device with one of, a DNS name of the current provisioning server, and an IP address of the current provisioning server.

29. The logic of claim 25, where controlling the network device to authenticate the provisioning server comprises controlling the network device to process a trusted public credential of the first provisioning server.

30. The logic of claim 26, where controlling the network device to authenticate the current server comprises controlling the network device to process a trusted public credential of the current provisioning server.