Provisioning remote access points

• US 9,509,746 B2
• Filed: 11/19/2013
• Issued: 11/29/2016
• Est. Priority Date: 06/03/2009
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Aruba Networks Incorporated (Hewlett-Packard Enterprise Company)
• Inventors: Mehta, Manish, Kshirsagar, Shekhar, PalChaudhuri, Santashil
• Primary Examiner(s): NGUYEN, THU HA T
• Application Number:
  US14/084,325
• Publication Number:
  US 20140082060A1
• Time in Patent Office: 1,106 Days
• Field of Search: 709/203, 709/220, 709/238, 709/201, 709/202, 709/204
• US Class Current: 1/1
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04W 24/02 Arrangements for optimising operational condition
• CPC Class Codes: H04W 84/042 Public Land Mobile systems, e.g. cellular systems
• CPC Class Codes: H04W 84/045 using private Base Stations, e.g. femto Base Stations, home Node B
• CPC Class Codes: H04W 88/085 Access point devices with remote components

Abstract

Provisioning remote access points for use in a telecommunication network. A remote access point contains identity information established during manufacturing; this identity information may be in the nature of a digital certificate. The identity information is stored in the remote access point, and may be stored in a Trusted Platform Module if present. When the remote access node is powered up in unprovisioned state, outside the manufacturing environment, it attempts to establish an internet connection via a first wired interface, and queries a user for information representing the TCP/IP address of its controller via a second wired interface. Once an internet connection is present, and a TCP/IP address has been provided, the remote access point attempts to connect to the controller at that address. Once a connection is established, controller and access point exchange and verify each other'"'"'s identities.

Claims

1. A computer implemented method, comprising:

establishing, at a network device, a wired network connection;

generating a query requesting controller information, wherein generating includes receiving a request for a web page and transmitting a query web page that is different from the requested web page, and wherein the query web page requests the controller information;

receiving input corresponding to a determination of the controller information;

transmitting a controller connection request using the controller information, wherein the controller connection request is transmitted using the wired network connection, wherein the controller connection request includes an identifier of the network device, wherein receiving the controller connection request at a network controller causes the network controller to query a whitelist for the identifier of the network device, and wherein the identifier of the network device is stored as a digital certificate;

receiving a response to the controller connection request;

establishing a controller connection using the response;

receiving configuration information over the controller connection; and

installing the configuration information.

2. The method of claim 1, wherein a key for the digital certificate is stored in a Trusted Platform Module (TPM) of the network device.

3. The method of claim 1, wherein establishing the controller connection includes establishing a secure tunnel between the network device and a network controller, and wherein receiving the configuration information includes receiving the configuration information over the secure tunnel.

4. The method of claim 1, further comprising:

receiving a query for installed software version information;

transmitting the installed software version information;

receiving updated software; and

installing the updated software.

5. The method of claim 1, wherein the network device is a wireless access point compliant with an IEEE 802.11 standard.

6. A system comprising:

one or more processors; and

a non-transitory computer readable storage medium communicatively coupled to the one or more processors, wherein the non-transitory computer readable storage medium includes instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including;

establishing a wired network connection;

generating a query requesting controller information, wherein generating includes receiving a request for a web page and transmitting a query web page that is different from the requested web page, and wherein the query web page requests the controller information;

receiving input corresponding to a determination of the controller information;

transmitting a controller connection request using the controller information, wherein the controller connection request is transmitted using the wired network connection, wherein the controller connection request includes an identifier of the system, wherein receiving the controller connection request at a network controller causes the network controller to query a whitelist for the identifier of the system, and wherein the identifier of the system is stored as a digital certificate;

receiving a response to the controller connection request;

establishing a controller connection using the response;

receiving configuration information over the controller connection; and

installing the configuration information.

7. The system of claim 6, further comprising:

a Trusted Platform Module (TPM) communicatively coupled to the one or more processors, wherein a key for the digital certificate is stored in the TPM.

8. The system of claim 6, wherein establishing the controller connection includes establishing a secure tunnel between the system and a network controller, and wherein receiving the configuration information includes receiving the configuration information over the secure tunnel.

9. The system of claim 6, wherein the operations further include:

receiving a query for installed software version information;

transmitting the installed software version information;

receiving updated software; and

installing the updated software.

10. The system of claim 6, wherein the system is a wireless access point compliant with an IEEE 802.11 standard.

11. A non-transitory computer readable medium comprising instructions that, when executed by one or more processors, cause the one or more processors to perform operations including:

establishing, at a network device, a wired network connection;

generating a query requesting controller information, wherein generating includes receiving a request for a web page and transmitting a query web page that is different from the requested web page, and wherein the query web page requests the controller information;

receiving input corresponding to a determination of the controller information;

transmitting a controller connection request using the controller information, wherein the controller connection request is transmitted using the wired network connection, wherein the controller connection request includes an identifier of the network device, wherein receiving the controller connection request at a network controller causes the network controller to query a whitelist for the identifier of the network device, and wherein the identifier of the network device is stored as a digital certificate;

receiving a response to the controller connection request;

establishing a controller connection using the response;

receiving configuration information over the controller connection; and

installing the configuration information.

12. The non-transitory computer readable medium of claim 11, wherein a key for the digital certificate is stored in a Trusted Platform Module (TPM) of the network device.

13. The non-transitory computer readable medium of claim 11, wherein establishing the controller connection includes establishing a secure tunnel between the network device and a network controller, and wherein receiving the configuration information includes receiving the configuration information over the secure tunnel.

14. The non-transitory computer readable medium of claim 11, further comprising instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:

receiving a query for installed software version information;

transmitting the installed software version information;

receiving updated software; and

installing the updated software.

15. The non-transitory computer readable medium of claim 11, wherein the network device is a wireless access point compliant with an IEEE 802.11 standard.