Feature Enablement or Disablement Based on Discovery Message

• US 20150207793A1
• Filed: 07/31/2012
• Published: 07/23/2015
• Est. Priority Date: 07/31/2012
• Status: Abandoned Application

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Inventors: Mohamed, Parvez Syed, Wakumoto, Shaun
• Application Number:
  US14/417,066
• Publication Number:
  US 20150207793A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: Y02D 30/00 Reducing energy consumption in communication networks

Abstract

Example embodiments disclosed herein relate to a discovery message, the discovery message including information related to an attribute of a port of a network device sending the discovery message. A determination is made whether to enable/disable a feature at a port of the network device based on the information related to the attribute of a port of the network device and a port of a neighbor network device.

Claims

1. A non-transitory computer-readable storage medium, storing a set of instructions, executable by a processor, to perform a method to:

generate, at a network device, a discovery message, the discovery message including information related to a security attribute of a port of the network device;

transmit the generated message to a neighbor network device;

receive a response to the discovery message, the response to the discovery message including information related to the security attribute of a port of the neighbor network device; and

determine whether to enable/disable a security feature at the port of the network device based on the information related to the security attribute of the port of the neighbor network device.

2. The non-transitory computer-readable storage medium of claim 1, the method further to:

enable a security feature at the port of the network device when it is determined that the port of the network device and the port of the neighbor network device are both capable of enabling the security feature.

3. The non-transitory computer readable storage medium of claim 2, the method further to:

transmit a communication to the neighbor network device securely based on the enabled security feature.

4. The non-transitory computer readable storage medium of claim 1, wherein the information related to the security attribute includes whether the port of the network device is capable of enabling the security feature related to the security attribute and whether the security feature is enabled.

5. The non-transitory computer-readable storage medium of claim 1, wherein the security feature is one of MAC security standard (MACsec) and 802.1x port-based encryption.

6. The non-transitory computer-readable storage medium of claim 1, wherein the discovery message is generated in accordance with one of link layer discovery protocol and a physical layer device (PHY) communication exchange.

7. A network device, comprising:

a discovery module to

generate discovery messages, the discovery messages to include information related to an attribute of a port of the network device;

parse received discovery messages for information related to the attribute of a port of a neighbor network device; and

determine whether to enable/disable a feature at the port of the network device based on the information related to the attribute of the port of the neighbor network device;

a feature module to enable/disable a feature at a port of the network device based on a determination of the discovery module to enable the feature; and

a processor to implement the discovery module.

8. The network device of claim 7, further comprising:

a pass through module to pass information through the port of the network device without modification of a frame, based on Ethertype, when a pass through feature is enabled.

9. The network device of claim 8, the discovery module further to:

receive and parse discovery messages for information related to the attribute of a port of another neighbor network device;

determine whether to enable/disable the pass through feature at the port of the network device based on the information related to the attribute of the port of the neighbor network device and the attribute of the port of the another neighbor network device, wherein the attribute relates to a security feature.

10. The network device of claim 7, wherein the feature is MAC security standard (MACsec).

12. The network device of claim 7, wherein the discovery message is generated in accordance with one of link layer discovery protocol and a physical layer device (PHY) communication exchange.

11. The network device of daim 7, wherein the feature is 802.1X port-based encryption.

13. A computer-readable storage medium, storing a set of instructions, executable by a processor, to perform a method to:

receive, at a port of a network device, a discovery message from a port of a first neighbor network device, the discovery message including information related to a security attribute of the port of the first neighbor network device;

determine, based on the received information related to the security attribute, whether the port of the first neighbor network device is capable of enabling a security feature;

determine whether a port of a second neighbor network device is capable of enabling the security feature; and

enabling a pass through feature at the port of the network device to enable secure communication between the port of the first neighbor device and the port of the second neighbor device based on a determination that the port of the first neighbor network device and the port of the second neighbor network device are capable of enabling a security feature.

14. The computer-readable storage medium of claim 13, wherein to determine whether the port of the second neighbor network device is capable of enabling the security feature includes:

transmit to the second neighbor network device a discovery message;

receive a discovery message from the second neighbor network device including information related to the security attribute of the port of the second neighbor network device.

15. The computer readable storage medium of claim 13, wherein the pass through feature permits secure communication using 802.1X between the port of the first neighbor network device and the port of the second neighbor network device.

16. The computer readable storage medium of claim 13, wherein the pass through feature permits secure communication using MAC security standard between the port of the first neighbor network device and the port of the second neighbor network device.