SMART ZERO-TOUCH DEPLOYMENT (ZTP)

Abstract

A network device (120, 220, 302) comprising: a non-transitory storage medium (404, 606, 608, 610) storing instructions (406-416); and one or more processors (402, 604) configured to access the non-transitory storage medium and execute the instructions to: initiating attempts to connect to a cloud-based provisioning system (110, 210, 301); Locating a gateway (130, 230, 303) by broadcasting a discovery message from the network device, wherein the gateway is co-located with the network device, wherein a network connection exists between the gateway and the cloud-based provisioning system, and wherein the gateway, in response to the gateway establishing the network connection with the cloud-based provisioning system, downloads a network address of the gateway from the cloud-based provisioning system; based on the receipt of the gateway's network address in a response from the gateway to the discovery message broadcast by the network device: Determining, at the network device, to use the gateway’s network connection to the cloud-based provisioning system, and Failure to establish an independent network connection to the cloud-based delivery system by ceasing attempts to connect to the cloud-based delivery system; Sending a request for configuration information for the network device to the cloud-based provisioning system over the network connection between the gateway and the cloud-based provisioning system; and Receiving configuration information from the cloud-based provisioning system via the gateway.

Description

background

[0001] Various devices enable the forwarding of data packets in a computer network from one device to another, including routers, switches, access points, and gateways. A router is a network device that forwards data packets between different Internet Protocol (IP) networks at the network layer (Layer 3) of the Open Systems Interconnection (OSI) model. A switch is a network device that uses a Media Access Control (MAC) address to forward data at the data link layer (Layer 2) of the OSI model. An access point (AP) is a network device directly connected to a wired local area network (such as Ethernet) that provides wireless connections (such as using wireless LAN technology or Wi-Fi) to other devices that use that wired connection. A gateway is a network device that enables the flow of data from one discrete network to another.Gateways differ from routers or switches in that they communicate using more than one protocol to connect multiple networks and can operate at any of the seven layers of the OSI model.

[0002] A computer network can implement each of these devices through a provisioning process. For example, a network administrator can connect to each of these devices and provide provisioning and routing information so the devices can communicate with each other over the network. However, when the network becomes very large, manual provisioning becomes almost impossible. Better procedures are needed.

[0003] EP 3 419 222 B1 relates to the field of communication, in particular to an access method, a device and a system.

[0004] US 2012 / 0 219 007 A1 relates to a device for communication, an energy management system and a method for controlling the same.

[0005] US 2014 / 0 136 660 A1 relates to the extension of multicast / broadcast services to wide area networks.

[0006] The present invention is defined by independent claims 1, 9, and 17. Embodiments are subject to the respective dependent claims. Brief description of the drawings

[0007] The present disclosure will be described in detail in accordance with one or more different examples with reference to the following figures. The figures are for illustrative purposes only and show only typical examples. Fig. 1 shows an environment corresponding to some application examples. Fig. 2 shows another / alternative example system environment in accordance with some application examples. Fig. 3 shows a configuration process in accordance with some application examples. Fig. 4 is an example of a computer component that may be used to implement various features of the examples described in the present disclosure. Fig. 5 is an example of a computer component that may be used to implement various features of the examples described in the present disclosure. Fig. 6 shows a block diagram of an example computer system in which various of the examples described herein may be implemented.

[0008] The figures are not exhaustive and do not limit the present disclosure to the precise form disclosed. Detailed description

[0009] Some networks implement a network provisioning process. Network provisioning can allow authorized users, devices, and servers to access other devices on the network by downloading configurations and meeting connectivity and security requirements.

[0010] This provisioning process is generally performed separately by each device. For example, the routers, switches, and gateways (and any other devices co-located with these devices) can separately connect to a central provisioning system by establishing individual secure network connections (e.g., HTTPS (Secure Hypertext Transfer Protocol) web sockets) to the provisioning system. Once connected, the devices can download their configurations. To illustrate, downloading configurations can involve changing various parameters on the device (e.g., Internet Protocol (IP) address, Ethernet or Wi-Fi settings) or downloading and / or installing software (e.g., installation folders, device drivers, partitioning settings, setup tools, enterprise software, firmware, or applications).

[0011] Once the devices have downloaded the parameters from the central provisioning system, they can connect to a network (e.g., a secure corporate network, the internet, or a cloud network) through the gateway. For example, if the devices are access points that have downloaded the parameters from the central provisioning system, the access points can provide a Wi-Fi connection for other devices to connect to the network. Another example: If the devices are switches that have downloaded the parameters from the central provisioning system, the switches can provide a wired connection for other devices to connect to the network.

[0012] When the provisioning system is implemented in the cloud, multiple individual HTTPS connections are established to the cloud. For example, the network devices co-located with the gateway connect to a cloud-based provisioning system via separate network connections to download their configurations, many of which may be similar because they are co-located.

[0013] Examples of the disclosure enable network devices to connect to a cloud-based provisioning system (e.g., a central device that provides provisioning and routing information so that the devices can communicate with each other and access a public or private network) over a single secure connection (e.g., a web socket connection or a Secure Hypertext Transfer Protocol (HTTPS) web socket). The connection may be established between the provisioning system and a first gateway that serves as an access point to the Internet from a branch office. Other network devices may also connect to this first gateway, e.g., routers, switches, access points, second gateways, or any other network device.When each of the network devices is connected via a single web socket connection, the combined network paths can drastically reduce the number of connections received (e.g., established) by the cloud-based provisioning system.

[0014] The connection process may begin with a network device (e.g., a switch or AP) sending a discovery message to the first gateway. The first gateway may respond with its IP address. Upon receiving the first gateway's IP address, the network device refrains from attempting to establish its own connection to the cloud-based provisioning system and instead relies on the existing connection between the first gateway and the cloud. The network device may then request its configuration from the cloud-based provisioning system through the first gateway, more specifically, through the first gateway's existing secure connection to the cloud-based provisioning system. If, however, the first gateway is not discovered, the network device initiates its own individual connection to the cloud-based provisioning system.

[0015] Various technical problems are solved by this disclosure. In conventional systems, a network administrator can manually connect to each of these devices to deploy the configurations or software. When the network becomes very large, manual deployment becomes nearly impossible. These conventional systems can be enhanced to allow different network devices to communicate with each other, and the network devices to download their configurations (e.g., Internet Protocol (IP) address, Ethernet or Wi-Fi settings) or software (e.g., installation folders, device drivers, partitioning settings, setup tools, enterprise software, or applications) through a common deployment process.

[0016] Technical improvements are realized throughout the application. By leveraging the connection to the gateway, the improved communication process can reduce the number of electronic messages transmitted over the network to the cloud-based provisioning system. This can help limit electronic communications intended for provisioning the network devices using multiple communication paths and route communications over a single network path between a branch gateway and network devices, rather than multiple network paths between each of the network devices and the provisioning system. This can reduce overall network traffic on the communications network and allow for greater bandwidth utilization for other data packets.The improved communication process can also reduce the overall processing load in a cloud network, including the cloud-based delivery system, allowing the cloud network to provide faster response times for other processing tasks.

[0017] Fig. Figure 1 shows an environment corresponding to some example applications. This figure shows the provisioning system 110, a plurality of network devices 120 (illustrated as router 120A, switch 120B, and access point 120C), a gateway 130, and a network 140. Other network devices 120 or configurations may be implemented without departing from the scope of the disclosure.

[0018] Each of the devices in the network can establish a connection to the other devices after interacting with the provisioning system 110. The provisioning process can be initiated by establishing a secure connection with the provisioning system 110.

[0019] Provisioning system 110 may enable services for other devices on the network. For example, the provisioning system may initiate a configuration process and provide authentication credentials for network, routing, or Wi-Fi configuration. Once the credentials are installed, the configuration process may enable a plurality of network devices 120 to connect to the cloud or other devices over network 140. Provisioning system 110 may also provide troubleshooting or monitoring processes to resolve connectivity issues or other problems encountered by devices on network 140.

[0020] In some examples, the provisioning system 110 may provide an on-demand self-service that allows end users to acquire and remove cloud services (e.g., applications or any infrastructure that supports the applications or configuration parameters) without requiring the assistance of an administrative user.

[0021] A plurality of network devices 120 may include one or more electronic devices capable of connecting to one or more networks, but may require parameters to connect to the networks. A plurality of network devices 120 may include, for example, routers, switches, access points, and gateways that include one or more hardware processors and a machine-readable storage medium. APs may, for example, refer to a network device that enables a wireless-compatible device, such as a client device or station (STA), to connect to a wired network. Further details describing the components of a plurality of network devices 120 are provided in the Fig. contain.

[0022] Gateway 130 may be a specific type of network device 120 that provides a network connection to a network for other network devices. In some examples, gateway 130 may establish a network connection to one or more downstream gateways or other network devices 120.

[0023] In some examples, gateway 130 is a branch gateway or a gateway AP (GAP) (used interchangeably). The branch gateway can be a WAN-facing gateway in an SD-WAN or micro-branch deployment. In some micro-branch deployments, a dedicated gateway device such as gateway 130 is not required. Additional APs can be added "beneath" the branch gateway to extend radio coverage in a micro-branch deployment. In some examples, gateway 130 can refer to an AP or other network device that has Network Address Translation (NAT) routing and Dynamic Host Control Protocol (DHCP) server capabilities.

[0024] In some examples, the branch gateway "owns" the public IP address, provides gateway / gateway-like functionality (e.g., DHCP, NAT, or routing capabilities), and can also host a VPN (Virtual Private Network) client to enable secure connectivity to a remote data center (e.g., a main office) or other cloud services, depending on the needs of the micro branch. The configuration between the branch gateway of a micro branch deployment and any additional APs is typically different, as they serve different roles within a micro branch deployment.

[0025] In some examples, no dedicated gateway is required. Instead, a branch gateway (or other network device acting as a gateway) acts as the WAN-facing gateway in an SD-WAN or micro-branch deployment and can be connected via an Ethernet connection (Eth-0) through a WAN port of the branch gateway. A first AP can be operatively connected to the branch gateway, and a second AP can be operatively connected to the first AP (e.g., the first and second APs are daisy-chained to the branch gateway). These implementation details are for illustrative purposes only and are not intended to limit the disclosure.

[0026] Network 140 may include two or more communicatively coupled network devices connected via a wired or wireless connection. The devices may communicate via one or more layers of the OSI model and may consist of private or public networks interconnected by a wide range of electronic, wireless, and optical network technologies. Further details regarding network 140 are described in Fig. 6 shown.

[0027] During a provisioning process, each of the multiple network devices 120 may individually connect to the provisioning system 110 to download parameters. For example, multiple network devices 120 may each download parameters associated with the device (e.g., IP address, Ethernet or Wi-Fi settings), folder layout, or rules.

[0028] The folder layout enables grouping of network devices based on common deployment scenarios. Each folder can contain one or more rules. Each management platform or group policy can be associated with a single folder. In some examples, groups of folders can be created for different network device types or branch locations, and then subfolders with independent deployment rules can be stored under parent folders.

[0029] The rules may correspond to when and how the network devices should be provided with provisioning information. The rules may also specify the automatic assignment of network devices to folders and / or events that trigger alerts to the network devices 120.

[0030] An example provisioning rule may include an instruction for network device 120 to connect to provisioning server 110 with group information and a shared secret. Provisioning server 110 may use the group information to organize network device 120 into configuration and reporting groups. The shared secret may serve as a trust mechanism between the network device and provisioning server 110. In some examples, the group information may also identify gateway 130 as a connection point to network 140.

[0031] Once the parameters have been downloaded, the plurality of network devices 120 can install the parameters and execute the downloaded rules they individually received from the provisioning server 110. The plurality of network devices 120 can also connect to the network 140 via the gateway 130.

[0032] Fig. Figure 2 shows another / alternative example system environment consistent with some application examples. This figure shows the provisioning system 210, a plurality of network devices 220 (illustrated as router 220A, switch 220B, and access point 220C), a gateway 230, and a network 240. Other network devices 220 or configurations may be implemented without departing from the scope of the disclosure.

[0033] The provisioning system 210, the plurality of network devices 220, the gateway 230, and the network 240 may be similar devices to the provisioning system 110, the plurality of network devices 120 (illustrated as router 120A, switch 120B, and access point 120C), the gateway 130, and the network 140, as shown in Fig. 1, except that they are configured to use a deployment process as shown in Fig. 3 shown.

[0034] Fig. 3 shows the provisioning process according to some application examples. The provisioning system 301, the plurality of network devices 302, and the gateway 303 may be similar devices to the provisioning system 210, the plurality of network devices 220, and the gateway 230, as shown in Fig. 2, or the provisioning system 110, the plurality of network devices 120 and the gateway 130, as shown in Fig. 1 shown.

[0035] In block 305, the gateway 303 may establish a connection with the provisioning system 301. For example, the cable modem 303 may establish a custom secure network connection to the provisioning system 301. Once connected, the data interface 303 may download its configurations (e.g., an IP address, DNS settings, IP address mask, or other Ethernet or Wi-Fi settings) or software (e.g., software that can be executed locally on the data interface 303, including installation folders, device drivers, partitioning settings, setup tools, enterprise software, firmware, or applications).

[0036] In some examples, the secure network connection is a web socket connection. The web socket connection may conform to a communications protocol that establishes a persistent, bidirectional, full-duplex Transmission Control Protocol (TCP) connection from gateway 303 to provisioning system 301. The web socket connection may be initiated by sending a handshake request from an HTTP connection of gateway 303 to provisioning system 301. By acknowledging or accepting the handshake request, the HTTP connection may be upgraded to a web socket connection, an HTTPS connection, or another connection type that provides the required level of security.

[0037] At block 310, a first network device of a plurality of network devices 302 may send (e.g., broadcast) a discovery message to gateway 303 over a first network connection. First network device 302 may include any combination of the disclosed network devices, including, but not limited to, a router, switch, access point, or a second gateway (different from gateway 230).

[0038] In some examples, the first network device 302 may conform to the Dynamic Host Configuration Protocol (DHCP). DHCP may conform to a network management protocol used in IP networks to automatically assign IP addresses and other network configuration parameters to devices connected to the network using a client-server architecture. DHCP may eliminate the need to manually configure network devices individually (e.g., a network administrator logging into each network device to assign an IP address). DHCP may consist of two network components, including a centrally installed network DHCP server (e.g., provisioning system 301, gateway, router, or other suitable device) and one or more client instances of the protocol stack on each computer or device (e.g., first network device 302).When connecting to the network and periodically thereafter, network clients can request a set of parameters from the DHCP server using the DHCP protocol.

[0039] In some examples, the first network device 302 sends a discovery message to the network subnet using DHCP, using the destination address (limited broadcast) or the specific subnet broadcast address (directed broadcast). Gateway 303 may receive the broadcast from the first network device 302.

[0040] The broadcast may be transmitted to all network devices co-located with network device 302. Common devices as used herein refer to network devices located on the same physical or virtual network, which may be within the same physical location or a subnet.

[0041] The colocation of the network devices may be limited to a threshold distance between the network devices that can receive the broadcast signal (e.g., distance within a structure that does not block the signal, or a predetermined distance such as 100 feet). In some examples, each of the network devices of a single branch office may be associated with similar parameters (e.g., a single gateway 303 or access point, or a single location, branch, or office) to connect to a common network.

[0042] The discovery message may contain various information that allows the first network device 302 to identify itself to the gateway 303. This may include, for example, an identifier of the first network device 302. Gateway 303 may, for example, respond with its IP address. Upon receiving the IP address of the gateway 303, the first network device 302 refrains from attempting to establish its own connection to the provisioning system 301 and instead relies on the existing connection between the gateway 303 and the provisioning system 301. The first network device 302 may direct the outgoing provisioning request to the IP address of the gateway 303 rather than to the IP address of the provisioning system 301.

[0043] In some examples, the first network device 302 of the plurality of network devices 302 may not have an existing connection to cloud-based services, including the cloud-based provisioning system 301. Thus, the first network device may be a new device that was not previously connected to the network.

[0044] In block 320, the gateway 303 may respond to the discovery message from the first network device 302. The discovery message may include, for example, ICMP (Internet Control Message Protocol) messages or any other communication between two network devices to determine the presence and location of a gateway. The response may include various information that allows the gateway 303 to identify itself to the first network device 302. This may include, for example, an IP address of the gateway 303.

[0045] At block 330, the first network device 302 may associate with the gateway 303. The association process may identify a next device for the first network device 302 to send data packets on the network. For example, the first network device 302 may associate with the gateway 303 by adopting and updating configurations stored locally on the first network device 302 to identify the next device to send data packets. By associating with the gateway 303, the first network device 302 does not need to rebroadcast or discover devices (e.g., using the DHCP discovery process) each time it wants to send data on the network.

[0046] At block 340, the first network device 302 may refrain from establishing an independent connection to the provisioning system 301. In other words, the first network device first attempts to connect to cloud-based services, and if it determines that it can connect to the gateway 303, it may stop attempting to connect to the cloud-based services. In some examples, after receiving the IP address of the gateway 303, the first network device stops attempting to establish its own connection to the provisioning system 301 and instead relies on the existing connection between the gateway 303 and the provisioning system 301.

[0047] If the connection is interrupted, the devices can remain connected using the stored IP address and other configuration information. The devices can only be disconnected from each other when released under DHCP. For example, the first network device 302 can send a request to the provisioning system 301 or the gateway 303 to release the DHCP information and disable the IP address of the first network device 302. The first network device 302 can transmit the discovery message the next time it wants to connect to the network.

[0048] In block 350, the network device 302 may request configuration information from the gateway 303. As illustrated, in block 350A, the network device 302 may request configuration information from the gateway 303, and the gateway 303 may forward the request for configuration information to the provisioning system 301 in block 350B.

[0049] In some examples, network device 302 may request its configuration information from provisioning system 301 via gateway 303, or more specifically, via the existing secure connection between gateway 303 and provisioning system 301. On the other hand, if gateway 303 is not discovered by network device 302 within a certain period of time (e.g., one minute), network device 302 may initiate its own individual connection to provisioning system 301.

[0050] At block 360, the provisioning system 301 may return configuration information to the gateway 303. The configuration information may include, for example, network configurations or a link to software. The network device 302 may download the software via the link included in the configuration information.

[0051] At block 370, gateway 303 may process the configuration information. For example, if the configuration information is received in an encrypted format, gateway 303 may decrypt the packet information on behalf of network device 302. If the independent connection between network device 302, gateway 303, and provisioning system 301 is established, the data packets may be decrypted at gateway 303. If the independent connection between network device 302, gateway 303, and provisioning system 301 is not established (e.g., if network device 302 and provisioning system 301 communicate directly with each other to provide information), the data packets may be decrypted at network device 302.

[0052] In block 380, gateway 303 may send configuration information to network device 302. As illustrative examples, the configuration information may include network configurations or a link to software. Network device 302 may download the software from the link included in the configuration information.

[0053] For simplicity, the example described herein has been limited to a single network device among a plurality of network devices 302. The disclosure should not be limited to a single network device, and one of ordinary skill in the art will recognize that additional network devices may also establish this connection with gateway 303 through additional discovery message processes.

[0054] As an illustrative example, additional network devices from the plurality of network devices 302 may each send a discovery message to the gateway 303. For example, a second network device from a plurality of network devices 302 may send a second discovery message to the gateway 303. Gateway 303 may respond to the second discovery message from the second network device from the plurality of network devices 302, allowing the second network device to refrain from establishing an independent connection to the provisioning system 301. The second network device may request configuration information from the gateway 303, which it forwards to the provisioning system 301 using the same secure connection it used when connecting to the provisioning system 301 for the first network device from the plurality of network devices 302.Provisioning system 301 may return the configuration information to gateway 303 (e.g., over the same secure connection), gateway 303 may process the configuration information (e.g., decrypt packets containing the second configuration information), and forward the decrypted packets containing the second configuration information to the second network device. In some examples, the process of decrypting individual packets of information may be performed by a plurality of network devices 302 in parallel with the decryption of the packets containing the first configuration information.

[0055] In some examples, prior to block 305, the plurality of network devices 302 may select a particular network device from the plurality of network devices 302 to identify as a gateway 303. For example, multiple network devices 302 (e.g., gateways, switches, or APs) are communicating with each other and determine that they are co-located in the same branch office (e.g., within a threshold distance such that the devices can receive each other's network signal, communicatively coupled to a subset of access points, switches, or gateways). Once multiple network devices 302 detect that they are co-located, a unique identifier for the multiple network devices 302 may be generated to select a particular network device to act as a gateway 303 (e.g., or as a GAP).The gateway 303 alone can contact the cloud system via the unique identifier, and the device need not be limited to an actual gateway hardware device. This can help avoid multiple connections to the provisioning system 301 from multiple devices within the plurality of network devices 302, while also enabling a single point of communication with the provisioning system 301 for troubleshooting, troubleshooting, and the like. On the cloud side, a branch configuration is provided, allowing all network devices located together in the same branch or site to be configured (e.g., at the branch level).

[0056] It should be noted that the terms "optimize," "optimal," and the like, as used herein, may be used to make or achieve performance as effective or perfect as possible. However, as one skilled in the art reading this document will recognize, perfection cannot always be achieved. Accordingly, these terms may also mean making or achieving performance as good or effective as possible or practical under the circumstances, or making or achieving performance better than that achievable with other settings or parameters.

[0057] Fig. Figure 4 shows an example computer component that can be used to implement gateway zero-touch provisioning (ZTP) according to various examples. As shown in Fig. 4, the computing component 400 may be, for example, a server computer, a controller, or other similar computing component that can process data. In the example implementation of Fig. 4, the computing component 400 includes a hardware processor 402 and a machine-readable storage medium 404.

[0058] The hardware processor 402 may be one or more central processing units (CPUs), semiconductor-based microprocessors, and / or other hardware devices capable of retrieving and executing instructions stored in the machine-readable storage medium 404. The hardware processor 402 may retrieve, decode, and execute instructions, such as instructions 406-416, to control processes or operations for provisioning network devices. Alternatively, or in addition to retrieving and executing instructions, the hardware processor 402 may include one or more electronic circuits comprising electronic components for performing the functionality of one or more instructions, such as a field-programmable gate array (FPGA), an application-specific integrated circuit (ASIC), or other electronic circuitry.

[0059] A machine-readable storage medium, such as machine-readable storage medium 404, may be any electronic, magnetic, optical, or other physical storage device that contains or stores executable instructions. For example, machine-readable storage medium 404 may be random access memory (RAM), non-volatile RAM (NVRAM), electrically erasable programmable read-only memory (EEPROM), a storage device, an optical disk, or the like. In some examples, machine-readable storage medium 404 may be a non-transitory storage medium, where the term "non-transitory" does not include the transitory transmission signals. As described in detail below, machine-readable storage medium 404 may be encoded with executable instructions, such as instructions 406-416.

[0060] Hardware processor 402 may execute instruction 406 to locate a gateway. For example, network device 220 may send a discovery message to locate gateway 230 co-located with network device 220. A network connection may exist between gateway 230 and a cloud-based provisioning system, such as provisioning system 210.

[0061] In some examples, hardware processor 402 may execute instruction 408 to receive a response containing the gateway's identifier. For example, network device 220 may receive a response to the discovery message, where the response includes an identifier of gateway 230.

[0062] In some examples, hardware processor 402 may execute instruction 410 to establish a connection with the gateway. For example, network device 220 may establish a connection with gateway 230 using the gateway's identifier.

[0063] Hardware processor 402 may execute instruction 412 to refrain from establishing an independent network connection to a provisioning system. For example, network device 220 may determine that an independent network connection should not be established to the cloud-based provisioning system. The decision not to establish an independent network connection may be based on the existing network connection between the gateway and the cloud-based provisioning system.

[0064] Hardware processor 402 may execute instruction 414 to send a request for configuration information to the provisioning system via the gateway. For example, network device 220 may send a request for configuration information for the network device to the cloud-based provisioning system via the existing network connection between the gateway and the cloud-based provisioning system.

[0065] Hardware processor 402 may execute instruction 416 to receive the configuration information from the cloud-based provisioning system via the gateway. In some examples, network device 220 may receive packets containing the configuration information from provisioning system 210, which network device 220 may install locally to connect to network 240.

[0066] Fig. 5 shows an example computing component that can be used to implement gateway zero-touch provisioning (ZTP) in accordance with various examples. Computing component 500 is, for example, a server computer, a controller, or other similar computing component capable of processing data (see Fig. ). In the example implementation of Fig. 5, the computing component 500 includes a hardware processor 502 and a machine-readable storage medium 504.

[0067] The hardware processor 502 may be one or more central processing units (CPUs), semiconductor-based microprocessors, and / or other hardware devices capable of retrieving and executing instructions stored in the machine-readable storage medium 504. The hardware processor 502 may retrieve, decode, and execute instructions, such as instructions 506-516, to control processes or operations for provisioning network devices. Alternatively, or in addition to retrieving and executing instructions, the hardware processor 502 may include one or more electronic circuits comprising electronic components for performing the functionality of one or more instructions, such as a field-programmable gate array (FPGA), an application-specific integrated circuit (ASIC), or other electronic circuitry.

[0068] A machine-readable storage medium, such as machine-readable storage medium 504, may be any electronic, magnetic, optical, or other physical storage device that contains or stores executable instructions. For example, machine-readable storage medium 504 may be random access memory (RAM), non-volatile random access memory (NVRAM), electrically erasable programmable read-only memory (EEPROM), a storage device, an optical disk, or the like. In some examples, machine-readable storage medium 504 may be a non-transitory storage medium, where the term "non-transitory" does not include the transitory transmission signals. As described in detail below, machine-readable storage medium 504 may be encoded with executable instructions, such as instructions 506 through 516.

[0069] Hardware processor 502 may execute instruction 506 to receive a discovery message sent from a network device. For example, gateway 230 may receive a discovery message sent from a network device 220 located near gateway 230.

[0070] Hardware processor 502 may execute instruction 508 to send a response within the gateway's identifier. For example, gateway 230 may send a response to the discovery message to network device 220. The response may include an identifier of the gateway (e.g., the IP address of gateway 230). In some examples, connecting to network device 220 may eliminate the need for network device 220 to establish an independent network connection to a cloud-based provisioning system 210 through network device 220.

[0071] Hardware processor 502 may execute instruction 510 to receive a request for configuration information from the network device. For example, gateway 230 may receive a request for configuration information from a cloud-based provisioning system, such as provisioning system 210. The request may be forwarded to gateway 230 because the identifier of gateway 230 is included in the request.

[0072] Hardware processor 502 may execute instruction 512 to send the request for configuration information to a provisioning system. For example, gateway 230 may send the request to provisioning system 210 over an existing network connection between gateway 230 and provisioning system 210.

[0073] Hardware processor 502 may execute instruction 514 to receive the configuration information from the provisioning system. For example, gateway 230 may receive the configuration information from provisioning system 210.

[0074] Hardware processor 502 may execute instruction 516 to forward the configuration information to the network device. For example, gateway 230 may forward the configuration information to network device 220.

[0075] In some examples, the gateway 230 may decrypt packets containing the configuration information before forwarding the packets to the network device 220.

[0076] In some examples, gateway 230 may receive second configuration information for a second network device from provisioning system 210, where the second network device is network device 220B and the other network device is first network device 220A. Gateway 230 may decrypt packets containing the second configuration information for network device 220B in parallel with decrypting the packets containing the first configuration information for network device 220A. Once the packets are decrypted, gateway 230 may forward the decrypted packets containing the second configuration information to second network device 220B.

[0077] Fig. 6 shows a block diagram of an example computer system 600 in which various examples described herein may be implemented. The example computer system 600 may correspond to one or more of the devices described herein, including the provisioning system 110, a plurality of network devices 120, and the gateway 130, as shown in Fig. 1, the provisioning system 210, a plurality of network devices 220 and the gateway 230, as shown in Fig. 2, and the provisioning system 301, a plurality of network devices 302 and the gateway 303, as shown in Fig. 3. In some examples, computer system 600 may consist of a combination of these devices (e.g., network device 302 and gateway 303).

[0078] Computer system 600 includes a bus 602 or other communication mechanism for conveying information, and one or more hardware processors 604 connected to bus 602 to process information. For example, hardware processor(s) 604 may be one or more general-purpose microprocessors.

[0079] Computer system 600 also includes main memory 606, such as random access memory (RAM), a cache, and / or other dynamic storage devices, connected to bus 602 for storing information and instructions to be executed by processor 604. Main memory 606 may also be used to store temporary variables or other intermediate information during the execution of instructions to be executed by processor 604. Such instructions, stored in storage media accessible by processor 604, make computer system 600 a special-purpose machine adapted to perform the operations specified in the instructions.

[0080] Computer system 600 also includes a read-only memory (ROM) 608 or other static storage device connected to bus 602 for storing static information and instructions for processor 604. A storage device 610, such as a magnetic disk, an optical disk, or a USB flash drive, is provided and connected to bus 602 for storing information and instructions.

[0081] Computer system 600 may be connected to a display 612, such as a liquid crystal display (LCD) (or a touch screen), via bus 602 for displaying information to a computer user. An input device 614, including alphanumeric and other keys, is coupled to bus 602 for communicating information and command selections to processor 604. Another type of user input device is cursor control 616, such as a mouse, trackball, or cursor direction keys for communicating direction information and command selections to processor 604 and controlling cursor movement on display 612. In some examples, the same direction information and command selections as with cursor control may be implemented via receiving touches on a touchscreen without a cursor.

[0082] Computer system 600 may include a user interface module for implementing a graphical user interface, which may be stored on a mass storage device as executable software code executed by the computing device(s). This and other modules may include, for example, components such as software components, object-oriented software components, class components and task components, processes, functions, attributes, procedures, subroutines, segments of program code, drivers, firmware, microcode, circuits, data, databases, data structures, tables, arrays, and variables.

[0083] In general, the terms "component," "engine," "system," "database," "data store," and the like, as used herein, may refer to logic embodied in hardware or firmware, or to a collection of software instructions that may have entry and exit points and be written in a programming language such as Java, C, or C++. A software component may be compiled and linked into an executable program, installed in a dynamic link library, or written in an interpreted programming language such as BASIC, Perl, or Python. It is understood that software components may be callable by other components or by themselves, and / or may be called in response to detected events or interrupts. Software components configured to run on computing devices may be embodied on a computer-readable medium, such as a hard disk.a compact disc, digital video disc, flash drive, magnetic disk, or other tangible medium, or as a digital download (and may be originally stored in a compressed or installable format that requires installation, decompression, or decryption before execution). Such software code may be stored partially or entirely in a memory of the executing computing device so that it can be executed by the computing device. Software instructions may be embedded in firmware, such as an EPROM. In addition, the hardware components may consist of connected logic units such as gates and flip-flops and / or programmable units such as programmable gate arrays or processors.

[0084] Computer system 600 may implement the techniques described herein using custom hard-wired logic, one or more ASICs or FPGAs, firmware, and / or program logic that, in combination with the computer system, causes or programs computer system 600 to be a special-purpose machine. According to one example, the techniques described herein are performed by computer system 600 in response to processor(s) 604 executing one or more sequences of one or more instructions contained in main memory 606. Such instructions may be read into main memory 606 from another storage medium, such as storage device 610. Execution of the instruction sequences contained in main memory 606 causes processor(s) 604 to perform the process steps described herein.In alternative examples, hard-wired circuits may be used instead of or in combination with software instructions.

[0085] The term "non-transitory media" and similar terms as used herein refer to any media that stores data and / or instructions that cause a machine to operate in a particular manner. Such non-transitory media may include non-volatile media and / or volatile media. Examples of non-volatile media include optical or magnetic disks, such as storage device 610. Volatile media includes dynamic memory, such as main memory 606. Common forms of non-transitory media include, for example, floppy disks, flexible disks, hard disks, solid-state drives, magnetic tape or other magnetic data storage media, CD-ROMs, other optical data storage media, physical media with hole patterns, RAM, PROM and EPROM, FLASH EPROM, NVRAM, other memory chips or cartridges, and networked versions thereof.

[0086] Non-transitory media are distinct from transmission media but can be used in conjunction with them. Transmission media are involved in the transfer of information between non-transitory media. Examples of transmission media include coaxial cable, copper wire, and fiber optic cable, including the wires that make up bus 602. Transmission media can also take the form of sound or light waves, such as those generated in data communications via radio and infrared.

[0087] Computer system 600 also includes a communications interface 618 connected to bus 602. Communications interface 618 establishes a bidirectional data communications connection to one or more network connections connected to one or more local area networks. For example, communications interface 618 may be an Integrated Services Digital Network (ISDN) card, a cable modem, a satellite modem, or a modem for establishing a data communications connection to a corresponding type of telephone line. As another example, communications interface 618 may be a Local Area Network (LAN) card for establishing a data communications connection to a compatible LAN (or a WAN component for communicating with a WAN). Wireless connections may also be implemented.In each of these implementations, the communication interface 618 sends and receives electrical, electromagnetic, or optical signals that carry digital data streams representing various types of information.

[0088] A network connection typically enables data communication across one or more networks to other data devices. For example, a network connection may connect across a local area network to a host computer or to data devices of an Internet service provider (ISP). The ISP, in turn, provides data communication services across the worldwide packet data communications network, now commonly referred to as the "Internet." Both the local area network and the Internet use electrical, electromagnetic, or optical signals that carry digital data streams. The signals across the various networks and the signals on the network connection and across the communications interface 618 that carry the digital data to and from the computer system 600 are examples of transmission media.

[0089] Computer system 600 can send messages and receive data, including program code, over the network(s), the network connection, and the communications interface 618. In the Internet example, a server could transmit requested code for an application program over the Internet, the ISP, the local network, and the communications interface 618.

[0090] The received code may be executed by processor 604 as soon as it is received and / or stored in storage device 610 or other non-volatile memory for later execution.

[0091] Each of the processes, methods, and algorithms described in the preceding sections may be embodied in, and fully or partially automated by, code components executed by one or more computer systems or computer processors comprising computer hardware. The one or more computer systems or computer processors may also operate to support the performance of the corresponding operations in a cloud computing environment or as software as a service (SaaS). The processes and algorithms may be partially or fully implemented in application-specific circuitry. The various features and methods described above may be used independently or combined in various ways.Various combinations and subcombinations are intended to be within the scope of this disclosure, and certain method or process blocks may be omitted in some implementations. The methods and processes described herein are also not limited to any particular order, and the associated blocks or states may be executed in other suitable orders, in parallel, or otherwise. Blocks or states may be added to or removed from the disclosed examples. The execution of certain operations or processes may be distributed among computer systems or computer processors located not only in a single machine, but distributed across a number of machines.

[0092] A circuit may be implemented in any form of hardware, software, or a combination thereof. For example, one or more processors, controllers, ASICs, PLAs, PALs, CPLDs, FPGAs, logic components, software routines, or other mechanisms may be implemented to form a circuit. In implementation, the various circuits described herein may be implemented as discrete circuits, or the described functions and features may be distributed, in part or in whole, among one or more circuits. Even though various features or functional elements are individually described or claimed as separate circuits, those features and functions may be shared by one or more common circuits, and such description is not intended to assume or imply that separate circuits are required to implement those features or functions.If a circuit is implemented in whole or in part with software, that software may be implemented to operate with a computer or processing system capable of performing the functionality described with respect to it, such as computer system 600.

[0093] As used herein, the term "or" can be understood both inclusively and exclusively. Furthermore, descriptions of resources, operations, or structures in the singular should not be construed as excluding the plural. Conditional expressions such as "may," "could," "might," or "may" are generally intended to convey that certain examples include certain features, elements, and / or steps, while other examples do not, unless expressly stated otherwise or the relevant context requires otherwise.

[0094] Unless expressly stated otherwise, the terms and expressions used in this document, as well as their variations, are not to be interpreted as limiting but as open-ended. Adjectives such as "conventional," "traditional," "normal," "standard," "known," and terms of similar import are not to be construed as limiting the subject matter described to a particular period of time or to a subject matter available at a particular time, but should be understood to include conventional, traditional, normal, or standard technologies that may be available or known now or at any time in the future.The presence of broader words and phrases such as “one or more,” “at least,” “but not limited to,” or similar phrases in some cases should not be construed as meaning that the narrower case is intended or required in the absence of such broader phrases.

Claims

[1] A network device (120, 220, 302) comprising: a non-transitory storage medium (404, 606, 608, 610) storing instructions (406-416); and one or more processors (402, 604) configured to access the non-transitory storage medium and execute the instructions to: initiating attempts to connect to a cloud-based provisioning system (110, 210, 301); Locating a gateway (130, 230, 303) by broadcasting a discovery message from the network device, wherein the gateway is co-located with the network device, wherein a network connection exists between the gateway and the cloud-based provisioning system, and wherein the gateway, in response to the gateway establishing the network connection with the cloud-based provisioning system, downloads a network address of the gateway from the cloud-based provisioning system; based on the receipt of the gateway's network address in a response from the gateway to the discovery message broadcast by the network device: Determining, at the network device, to use the gateway’s network connection to the cloud-based provisioning system, and Failure to establish an independent network connection to the cloud-based delivery system by ceasing attempts to connect to the cloud-based delivery system; Sending a request for configuration information for the network device to the cloud-based provisioning system over the network connection between the gateway and the cloud-based provisioning system; and Receiving configuration information from the cloud-based provisioning system via the gateway. [2] The network device of claim 1, wherein the instructions are further executable on the one or more processors to: Associate the network device with the gateway using the gateway's network address. [3] The network device of claim 1, wherein the received configuration information is decrypted configuration information provided by the gateway based on the decryption, at the gateway, of encrypted configuration information received at the gateway from the cloud-based provisioning system. [4] The network device of claim 1, wherein the network connection between the gateway and the cloud-based provisioning system is a secure connection. [5] The network device of claim 1, wherein the network address of the gateway is an Internet Protocol (IP) address of the gateway, and wherein the instructions are executable on the one or more processors to determine to use the network connection of the gateway to the cloud-based provisioning system based on receiving the IP address of the gateway in the response to the broadcast discovery message. [6] The network device of claim 1, wherein the configuration information from the cloud-based provisioning system includes network configuration parameters. [7] The network device of claim 1, wherein the configuration information from the cloud-based provisioning system comprises a link to software, and wherein the instructions are further executable on the one or more processors to: Download the software to the network device using the link. [8] The network device of claim 1, wherein the instructions are executable on the one or more processors to send the request for configuration information to the network address of the gateway. [9] Procedure which includes: Downloading, by a gateway (130, 230, 303) comprising a hardware processor (502, 604), from a cloud-based delivery system (110, 210, 301), a network address of the gateway in response to the gateway establishing a network connection with the cloud-based delivery system; receiving a discovery message at the gateway broadcast by a network device (120, 220, 302) co-located with the gateway; Sending a response to the discovery message to the network device by the gateway, the response including the network address of the gateway, and the response causing the network device to determine, based on receiving the network address of the gateway in the response, to use the gateway's network connection to the cloud-based provisioning system and to discontinue a previously initiated attempt by the network device to establish a connection to the cloud-based provisioning system; Receiving, at the gateway and from the network device, a request for configuration information from the cloud-based provisioning system, the request being directed to the gateway based on the network address of the gateway; Sending, by the gateway, the request to the cloud-based provisioning system using the network connection between the gateway and the cloud-based provisioning system; Receiving the configuration information from the cloud-based provisioning system at the gateway; and Forwarding the configuration information to the network device through the gateway. [10] The method of claim 9, wherein the received configuration information is encrypted and the method further comprises: Decrypting the received configuration information at the gateway to generate decrypted configuration information, wherein forwarding the configuration information to the network device comprises forwarding the decrypted configuration information to the network device. [11] The method of claim 10, wherein the network device is a first network device and the received configuration information is first encrypted configuration information, the method further comprising: Receiving, at the gateway, from the cloud-based provisioning system, second encrypted configuration information for a second network device; Decrypting the second encrypted configuration information in parallel with decrypting the first encrypted configuration information, wherein decrypting the second encrypted configuration information generates second decrypted configuration information; and Forwarding the second decrypted configuration information from the gateway to the second network device. [12] The method of claim 9, wherein the network connection between the gateway and the cloud-based provisioning system is a secure connection. [13] The method of claim 9, wherein the network address of the gateway is an Internet Protocol (IP) address of the gateway. [14] The method of claim 9, wherein the configuration information from the cloud-based provisioning system includes network configuration parameters. [15] The method of claim 9, wherein the configuration information from the cloud-based provisioning system comprises a link to software, and wherein the method further comprises: Download the software through the network device using the link. [16] The method of claim 9, wherein the discovery message is broadcast to network devices located within a threshold distance together with the network device. [17] A system comprising: a gateway (130, 230, 303) for downloading a network address of the gateway from a cloud-based provisioning system (110, 210, 301) in response to the gateway establishing a network connection with the cloud-based provisioning system; and a network device (120, 220, 302) for: Initiating an attempt to connect to the cloud-based provisioning system; Locating the gateway by broadcasting a discovery message from the network device, wherein the gateway is co-located with the network device and the network connection exists between the gateway and the cloud-based provisioning system; based on the receipt of the gateway's network address in a response from the gateway to the discovery message broadcast by the network device: Determining, at the network device, to use the gateway’s network connection to the cloud-based provisioning system, and Failure to establish an independent network connection to the cloud-based delivery system by ceasing to attempt to connect to the cloud-based delivery system; Sending a request for configuration information for the network device to the cloud-based provisioning system over the network connection between the gateway and the cloud-based provisioning system; and Receiving configuration information from the cloud-based provisioning system via the gateway. [18] The system of claim 17, wherein the network device further serves to: Associate the network device with the gateway using the gateway's network address. [19] The system of claim 17, wherein the network device is to send the request for the configuration information to the network address of the gateway and not to a network address of the cloud-based provisioning system. [20] The system of claim 17, wherein the network address of the gateway is an Internet Protocol (IP) address of the gateway, and wherein the network device is to determine to use the network connection of the gateway to the cloud-based provisioning system based on receiving the IP address of the gateway in the response to the broadcast discovery message.

Images