NETWORKING AS A SERVICE

• US 20120331524A1
• Filed: 09/04/2012
• Published: 12/27/2012
• Est. Priority Date: 01/17/2008
• Status: Active Grant

• Current Assignee: Extreme Networks, Inc.
• Original Assignee: Aerohive Networks Incorporated (Extreme Networks, Inc.)
• Inventors: Palmer, Matthew Alan, Mayhew, Steven Couch, MOWER, Carl Steven
• Granted Patent: US 8,763,084 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 67/025 for remote control or remote monitoring of applications
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network

Abstract

Networking as a Service (NaaS) delivers network services using remote appliances controlled by a hosted, multi-tenant management system. The system may include a heartbeating process for communication between a web-based server and appliances, in which the appliances periodically contact the management system on the server. The heartbeating process allows the appliances to maintain a completely up-to-date configuration. Furthermore, heartbeating allows for comprehensive monitoring of appliances and for software distribution. The system may also include means for authenticating appliances, without the need for pre-installed PSKs or certificates.

Claims

1. A method comprising:

discovering local devices, network services, and an uplink carrier associated with a network;

configuring the network using a business wizard and a library of network configurations;

forming and maintaining the network as a secure network;

monitoring networking devices of the network using a hearbeat process;

auto-upgrading software implemented in the network.

2. The method of claim 1, further comprising ensuring the networking devices are running one and only one version of networking software.

3. The method of claim 1, further comprising maintaining one version of software on a hub.

4. The method of claim 1, further comprising enabling modification of network as a service solutions at multiple system levels.

5. The method of claim 1, further comprising delivering network management applications as a multi-tenant hosted software as a service.

6. The method of claim 1, further comprising developing, designing, and delivering network management software applications from a multi-tenant software as a service model using Web services that are distributed across the Internet.

7. The method of claim 1, further comprising providing network management functions via one or more Web pages through which users can configure and monitor the networking devices.

8. The method of claim 7, further comprising providing re-configuration of the networking devices through a separate Web-based service.

9. The method of claim 7, further comprising providing performance statistics through a separate Web-based service.

10. The method of claim 7, further comprising serving Web pages from a Web user interface server in a stateless fashion to a user associated with management of the network.

11. The method of claim 1, further comprising:

receiving at a heartbeat server periodically from a first networking device of the networking devices a packet including all logs since a last, acknowledged, heartbeat communication;

responding with one packet containing a user ID of a latest configuration file that the first networking device should be running, and a build number of a software image that the first networking device should be running, wherein the response packet from the heartbeat server is implicitly an acknowledgement that the logs have been accepted so the networking device knows to purge applicable values from memory;

wherein when the first networking device is not running the latest configuration or the software image, the first networking device fetches the latest configuration file or the software image via a secure transport method;

12. The method of claim 1, further comprising:

registering by a first networking device of the networking devices that the first networking device is running stale code;

fetching by the first networking device a newer image, wherein a delay in fetching the newer image is added between each block fetched so as to not saturate the limited WAN link;

burning the newer image into a memory partition on the networking device for active software, wherein the memory partition does not hold a currently running stale image;

rebooting the networking device into the memory partition;

wherein if the newer image does not successfully receive a heartbeat reply in an amount of time after reboot, the networking device reverts to the stale image.

13. The method of claim 1, further comprising:

receiving an instruction to publish a modified configuration through a web page interface;

generating at a Web user interface server new configuration files for one or more of the networking devices;

copying the new configuration files to each of the servers where the new configuration files are stored in a short term monitoring database of a heartbeat server;

updating by the Web user interface server the short term monitoring database with a user ID associated with the new configuration files for each of the one or more of the networking devices;

wherein on a next heartbeat, the one or more of the networking devices receives the user ID for an applicable one of the new configuration files and, recognizing they have a stale configuration, will fetch the new configuration file via a secure transport method.

14. The method of claim 13, further comprising distilling and pushing data to a long-term database from the short-term database.

15. The method of claim 1, further comprising authenticating a networking device of the networking devices to a Web service, wherein the networking device does not have a PSK.

16. The method of claim 15, further comprising locking down the networking device with access to only DNS and the Web service.

17. The method of claim 15, further comprising:

receiving a Web request from a user associated with the Web service and the networking device;

fielding the Web request at a captive portal, wherein the captive portal sends a splash screen HTML response that has a redirect to an HTTPS link to a Web service login server associated with the Web service with information in a redirect URL of the captive portal about the networking device, wherein the information includes a MAC address of the networking device;

receiving a request at the Web service login server;

generating a short-lived number used once (NONCE) and storing the short-lived NONCE in association with the MAC address at the Web service login server;

sending from the login Web server a login form, wherein the end user is prompted to enter a device password into the form;

validating the password at the login Web server, wherein the login Web server responds to a correct password with a confirmation page, placing a stub in the confirmation page with the redirect URL and the short-lived NONCE;

receiving an HTTP POST of the generated NONCE at the captive portal;

handshaking between a heartbeat daemon and a heartbeat server over HTTPS;

receiving the NONCE at the heartbeat server in a next scheduled heartbeat cycle, before the NONCE expires, wherein the heartbeat server looks up the MAC address to validate the NONCE and, if valid, sends an MD5 hash of the password or an equivalent cryptographic hash function;

wherein the heartbeat daemon uses the MD5 hash as an authentication token for subsequent heartbeats.

18. A system comprising:

a means for discovering local devices, network services, and an uplink carrier associated with a network;

a means for configuring the network using a business wizard and a library of network configurations;

a means for forming and maintaining the network as a secure network;

a means for monitoring networking devices of the network using a hearbeat process;

a means for auto-upgrading software implemented in the network.

19. The system of claim 18, further comprising a means for delivering network management applications as a multi-tenant hosted software as a service.

20. The system of claim 18, further comprising a means for authenticating a networking device of the networking devices to a Web service, wherein the networking device does not have a PSK.