[go: up one dir, main page]

US20100313262A1 - Provisioning remote access points - Google Patents

Provisioning remote access points Download PDF

Info

Publication number
US20100313262A1
US20100313262A1 US12/477,774 US47777409A US2010313262A1 US 20100313262 A1 US20100313262 A1 US 20100313262A1 US 47777409 A US47777409 A US 47777409A US 2010313262 A1 US2010313262 A1 US 2010313262A1
Authority
US
United States
Prior art keywords
remote access
access point
controller
address
wired interface
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Abandoned
Application number
US12/477,774
Inventor
Manish Mehta
Shekhar Kshirsagar
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Hewlett Packard Enterprise Development LP
Original Assignee
Aruba Networks Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Aruba Networks Inc filed Critical Aruba Networks Inc
Priority to US12/477,774 priority Critical patent/US20100313262A1/en
Publication of US20100313262A1 publication Critical patent/US20100313262A1/en
Assigned to ARUBA NETWORKS, INC. reassignment ARUBA NETWORKS, INC. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: KSHIRSAGAR, SHEKHAR, MEHTA, MANISH
Priority to US14/084,325 priority patent/US9509746B2/en
Priority to US15/359,266 priority patent/US10491583B2/en
Assigned to HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP reassignment HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: ARUBA NETWORKS, INC.
Abandoned legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/95—Retrieval from the web
    • G06F16/951—Indexing; Web crawling techniques
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/60—Software deployment
    • G06F8/61—Installation
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/60—Software deployment
    • G06F8/65—Updates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/45—Network directories; Name-to-address mapping
    • H04L61/4505—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols
    • H04L61/4511—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols using domain name system [DNS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5007—Internet protocol [IP] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W24/00—Supervisory, monitoring or testing arrangements
    • H04W24/02—Arrangements for optimising operational condition
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/04—Large scale networks; Deep hierarchical networks
    • H04W84/042—Public Land Mobile systems, e.g. cellular systems
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/04—Large scale networks; Deep hierarchical networks
    • H04W84/042—Public Land Mobile systems, e.g. cellular systems
    • H04W84/045—Public Land Mobile systems, e.g. cellular systems using private Base Stations, e.g. femto Base Stations, home Node B
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/08—Access point devices
    • H04W88/085—Access point devices with remote components

Definitions

  • the present invention relates to telecommunication networks, and in particular, to the problem of setting up (provisioning) remote access points for use in telecommunication networks.
  • Remote networking allows the extension of a networking environment, such as a corporate networking environment, to remote locations.
  • a remote access point at a remote location establishes a connection with its home (corporate) controller over the switched internet. In most cases this connection is an encrypted tunnel.
  • the remote access point connected to the home controller, extends the services available in the corporate environment through wireless and/or wired connections with the remote access point. This allows corporate users full access to systems and services in remote locations, such as remote offices or homes. It also allows corporate information technology groups to provide such access in a controlled and secure manner.
  • remote access points An issue with remote access points, and in particular to deploying remote access points to a large number of users and/or locations is the time and labor required.
  • Each remote access point must be properly set up, or provisioned. Typically this requires an information technology specialist in the organization to take a remote access point out of its packaging, install required configuration information such as the IP address of the corporate controller the remote access point is to contact, device credentials, and any updates necessary. Then the remote access point is repackaged and sent to the particular user or location for installation and use. Of course the remote access point must be tracked through all these steps.
  • FIG. 1 shows a network
  • FIG. 2 shows device provisioning
  • Embodiments of the invention relate to methods of provisioning remote access points.
  • An access point has identification information stored in it as part of the manufacturing process.
  • This identification information may include digital certificates which are cryptographically signed, and keys corresponding to these certificates may be stored in a Trusted Platform Module (TPM) if available in the remote access point.
  • TPM Trusted Platform Module
  • the identification information contains information about the particular remote access point, and may include information such as Media Access Control (MAC) addresses for wired and/or wireless ports.
  • MAC Media Access Control
  • the remote access point also contains a program to be run at power up if the access point is in an unprovisioned state.
  • an unprovisioned remote access point When an unprovisioned remote access point is powered up by a user it establishes an internet connection using a first wired port. On a second wired port, the remote access point requests user input relating to the TCP/IP address or fully qualified domain name of the controller which is to support the remote access point. The remote access point uses this user input to establish a connection to the controller via the internet connection using the first wired port.
  • This connection between the remote access point and the controller may be via a tunnel, which may be encrypted or secured.
  • the controller may have a list of remote access points it is to support, and accept connections from and send configuration information to only those remote access points. Once connected, the remote access point and the controller exchange identification information to verify identities. Once verified, the controller sends configuration data and any updates to the remote access point. The remote access point installs this configuration information to provision the remote access point, and places it into operation. This may require rebooting the remote access point.
  • FIG. 1 shows a network.
  • Router 100 connects 180 to a switched network 200 such as the Internet.
  • interface 300 also connects 320 to network 200 providing connectivity 350 .
  • Interface 300 may be a device known to the art such as a DSL or Cable modem, or a wireless interface such as a 3G, WiMAX, WiFi, or other radio connection.
  • Interface 300 provides services such as Internet access via wired connection 350 , which may be in the form of an IEEE802.3 Ethernet interface, or another wired interface such as USB or IEEE1394 Firewire.
  • Remote access point 400 connects 350 to the Internet via first wired interface 430 .
  • Controller 100 is a purpose-built digital device having a CPU 110 , memory hierarchy 120 , and a plurality of network interfaces 130 .
  • CPU 110 may be a MIPS-class processor from companies such as Raza Microelectronics or Cavium Networks, although CPUs from companies such as Intel, AMD, IBM, Freescale, or the like may also be used.
  • Memory hierarchy 120 includes read-only memory for device startup and initialization, high-speed read-write memory such as DRAM for containing programs and data during operation, and bulk memory such as hard disk or compact flash for permanent file storage of programs and data.
  • Network interfaces 130 are typically IEEE 802.3 Ethernet interfaces to copper, although high-speed optical fiber interfaces may also be used.
  • Controller 100 typically operates under the control of purpose-built embedded software, typically running under a Linux operating system, or an operating system for embedded devices such as VXWorks. Controller 100 may have dedicated hardware for encryption, and/or for routing packets between network interfaces 130 . Controller 100 may also be equipped with Trusted Platform Module (TPM) 160 , an industry-standard device for providing secure storage.
  • TPM Trusted Platform Module
  • Remote access point 400 is also a purpose-built digital device having a CPU 410 , memory hierarchy 420 , a first wired interface 430 , an optional wireless interface 440 , second wired interface 450 which may represent a plurality of additional wired interfaces, and may contain TPM 460 for secure storage.
  • the CPU commonly used for such access nodes is a MIPS-class CPU such as one from Raza Microelectronics or Cavium Networks, although processors from other vendors such as Intel, AMD, Freescale, and IBM may be used.
  • Memory hierarchy 420 comprises read-only storage such as ROM or EEPROM for device startup and initialization, fast read-write storage such as DRAM for holding operating programs and data, and permanent bulk file storage such as compact flash memory.
  • Remote access point 400 typically operates under control of purpose-built programs running on an embedded operating system such as Linux or VXWorks.
  • Optional wireless interface 340 is typically an interface operating to the family of IEEE 802.11 standards including but not limited to 802.11a, b, g, and/or n.
  • First wired interface 430 may be an IEEE803.2 Ethernet interface, or other wired interface such as USB or IEEE1394 Firewire.
  • second wired interface 450 may be one or more IEEE802.3 Ethernet interfaces, USB interfaces, IEEE1493 Firewire interfaces, or a combination.
  • a small remote access point 400 may have an IEEE803.2 Ethernet wired interface for first wired interface 430 , an IEEE802.11a/b/g/n wireless interface 440 , and an additional IEEE802.3 Ethernet port and a USB port as second wired interface 450 .
  • a larger remote access point 400 may have multiple second Ethernet ports.
  • identification information is generated and stored in remote access point 400 .
  • This information may be stored in memory hierarchy 420 , as an example in EEPROM or flash storage, and/or in TPM 460 if a TPM is present.
  • This identification information contains device unique information, which may be for example a serial number, or the MAC address of the first wired interface 430 .
  • this information is stored as a digital certificate containing a Distinguished Name which contains the MAC address of the first wired interface 430 of the device. If remote access point 400 contains a TPM 460 , the key for this certificate is stored in the TPM, otherwise the key for the certificate is stored in EEPROM or Flash memory.
  • Remote access point 400 also contains an initialization program stored in memory hierarchy 420 which is to be run whenever the remote access point 400 is powered up in unprovisioned state.
  • the user of remote access point 400 prepares it for setup by establishing a wired connection 350 between internet interface 300 and first wired interface 430 .
  • a second wired connection 480 is established between second wired interface 450 and a personal computer 500 .
  • the initialization program executes as shown in FIG. 2 . It first attempts to establish an Internet connection via first wired interface 430 .
  • the exact process required for establishing this connection depends on the nature of the interface, but is understood in the art.
  • IP Internet Protocol
  • the DHCP protocol described in RFC 2131 for IPv4 networks and RFC 3315 for IPv6 networks is used by the device to obtain the information necessary to establish an Internet connection.
  • the user is queried via second wired interface 450 and connection 480 to computer 500 for information on controller 100 which is to support remote access point 400 .
  • remote access point 400 starts up a simple web server attached to second wired interface 450 .
  • This simple web server running on remote access point 400 provides a page in response to any URI requested from computer 500 , requesting information on the controller which is to support remote access point 400 .
  • the information requested may be as simple as the TCP/IP address of controller 100 , for example, an address such as 192.168.249.240 may be provided by the user.
  • the user may provide a fully qualified domain name (FQDN), such as setup.yoyodyne.com, which will be looked up by the initialization program and translated to a TCP/IP address.
  • FQDN fully qualified domain name
  • the user may be provided with a key code which is resolved to the TCP/IP address of the controller, such as XP3Y-4GG7-3DEK-6RTM which is resolved by the web server software running on remote access point 400 to the TCP/IP address needed.
  • a simple serial protocol and interface may be used on second wired interface 450 , such as an RS-232 serial interface, or RS-232 over USB, and a simple query and response scheme prompting the user for input and accepting that input, once again, the TCP/IP address of controller 100 , a FQDN, or a key code which is resolved to the TCP/IP address of the controller.
  • remote access point 400 attempts to contact controller 100 at the specified TCP/IP address using wired interface 430 .
  • Controller 100 may accept requests from all remote access points contacting it at this address, or controller 100 may contain a whitelist stored in memory hierarchy 120 of those individual remote access points which are to be accepted. This whitelist may also reside outside of the controller 100 with the controller 100 being able to access the information at any time. This whitelist for example could be based on the unique MAC address of first wired interface 430 present in each remote access point 400 . If the MAC address, which is present in the device credentials such as digital certificate, is on the whitelist, the connection is accepted, otherwise the connection is rejected.
  • controller 100 accepts the connection from remote access point 400 , controller 100 and remote access point 400 exchange and verify identity information. In one embodiment of the invention, this involves verifying certificates and certificate chain kept by each party.
  • controller 100 sends configuration information to remote access point 400 .
  • a secure tunnel such as an IPsec tunnel is established between controller 100 and remote access point 400 , and configuration information is downloaded through this tunnel.
  • IPsec protocols are known to the art and are defined for example in RFC 4301, and RFC 4309.
  • the configuration information provided by controller 100 is installed in remote access point 400 .
  • a check for updates to the software present in remote access point 400 may be made with controller 100 , and any additional or updated software downloaded and installed in remote access point 400 .
  • This may be performed, for example, by a system where controller 100 queries remote access point 400 for information on versions of installed software, compares those versions to current versions maintained on the controller, and sends updates as needed.
  • initialization is complete, and operation of the remote access point in its provisioned state many now begin. This may be accomplished by the initialization program starting the remote access point software, or by the initialization software restarting remote access point 400 .

Landscapes

  • Engineering & Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Databases & Information Systems (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • Data Mining & Analysis (AREA)
  • Power Engineering (AREA)
  • Small-Scale Networks (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

Provisioning remote access points for use in a telecommunication network. A remote access point contains identity information established during manufacturing; this identity information may be in the nature of a digital certificate. The identity information is stored in the remote access point, and may be stored in a Trusted Platform Module if present. When the remote access node is powered up in unprovisioned state, outside the manufacturing environment, it attempts to establish an internet connection via a first wired interface, and queries a user for information representing the TCP/IP address of its controller via a second wired interface. Once an internet connection is present, and a TCP/IP address has been provided, the remote access point attempts to connect to the controller at that address. The controller may filter connection requests through a whitelist of approved remote access points. Once a connection is established, controller and access point exchange and verify each other's identities. This may be done through the exchange and verification of digital certificates. Provisioning information is downloaded from controller to remote access point and installed. This may be done via a tunnel such as an encrypted tunnel. Software updates may be applied. The provisioned remote access point is placed in operation.

Description

    BACKGROUND OF THE INVENTION
  • The present invention relates to telecommunication networks, and in particular, to the problem of setting up (provisioning) remote access points for use in telecommunication networks.
  • Remote networking allows the extension of a networking environment, such as a corporate networking environment, to remote locations. In operation, a remote access point at a remote location establishes a connection with its home (corporate) controller over the switched internet. In most cases this connection is an encrypted tunnel. The remote access point, connected to the home controller, extends the services available in the corporate environment through wireless and/or wired connections with the remote access point. This allows corporate users full access to systems and services in remote locations, such as remote offices or homes. It also allows corporate information technology groups to provide such access in a controlled and secure manner.
  • An issue with remote access points, and in particular to deploying remote access points to a large number of users and/or locations is the time and labor required. Each remote access point must be properly set up, or provisioned. Typically this requires an information technology specialist in the organization to take a remote access point out of its packaging, install required configuration information such as the IP address of the corporate controller the remote access point is to contact, device credentials, and any updates necessary. Then the remote access point is repackaged and sent to the particular user or location for installation and use. Of course the remote access point must be tracked through all these steps.
  • While such provisioning may be acceptable for a small number of units, such a process does not scale, becoming burdensome when more than a few units are involved.
  • What is needed is a better way to provision remote access points.
    • BRIEF DESCRIPTION OF THE DRAWINGS
  • The invention may be best understood by referring to the following description and accompanying drawings that are used to illustrate embodiments of the invention in which:
  • FIG. 1 shows a network, and
  • FIG. 2 shows device provisioning.
    •  DETAILED DESCRIPTION
  • Embodiments of the invention relate to methods of provisioning remote access points.
  • An access point has identification information stored in it as part of the manufacturing process. This identification information may include digital certificates which are cryptographically signed, and keys corresponding to these certificates may be stored in a Trusted Platform Module (TPM) if available in the remote access point. The identification information contains information about the particular remote access point, and may include information such as Media Access Control (MAC) addresses for wired and/or wireless ports. The remote access point also contains a program to be run at power up if the access point is in an unprovisioned state.
  • When an unprovisioned remote access point is powered up by a user it establishes an internet connection using a first wired port. On a second wired port, the remote access point requests user input relating to the TCP/IP address or fully qualified domain name of the controller which is to support the remote access point. The remote access point uses this user input to establish a connection to the controller via the internet connection using the first wired port. This connection between the remote access point and the controller may be via a tunnel, which may be encrypted or secured. Optionally, the controller may have a list of remote access points it is to support, and accept connections from and send configuration information to only those remote access points. Once connected, the remote access point and the controller exchange identification information to verify identities. Once verified, the controller sends configuration data and any updates to the remote access point. The remote access point installs this configuration information to provision the remote access point, and places it into operation. This may require rebooting the remote access point.
  • FIG. 1 shows a network. Router 100 connects 180 to a switched network 200 such as the Internet. At a remote location, interface 300 also connects 320 to network 200 providing connectivity 350. Interface 300 may be a device known to the art such as a DSL or Cable modem, or a wireless interface such as a 3G, WiMAX, WiFi, or other radio connection. Interface 300 provides services such as Internet access via wired connection 350, which may be in the form of an IEEE802.3 Ethernet interface, or another wired interface such as USB or IEEE1394 Firewire. Remote access point 400 connects 350 to the Internet via first wired interface 430.
  • Controller 100 is a purpose-built digital device having a CPU 110, memory hierarchy 120, and a plurality of network interfaces 130. CPU 110 may be a MIPS-class processor from companies such as Raza Microelectronics or Cavium Networks, although CPUs from companies such as Intel, AMD, IBM, Freescale, or the like may also be used. Memory hierarchy 120 includes read-only memory for device startup and initialization, high-speed read-write memory such as DRAM for containing programs and data during operation, and bulk memory such as hard disk or compact flash for permanent file storage of programs and data. Network interfaces 130 are typically IEEE 802.3 Ethernet interfaces to copper, although high-speed optical fiber interfaces may also be used. Controller 100 typically operates under the control of purpose-built embedded software, typically running under a Linux operating system, or an operating system for embedded devices such as VXWorks. Controller 100 may have dedicated hardware for encryption, and/or for routing packets between network interfaces 130. Controller 100 may also be equipped with Trusted Platform Module (TPM) 160, an industry-standard device for providing secure storage.
  • Remote access point 400 is also a purpose-built digital device having a CPU 410, memory hierarchy 420, a first wired interface 430, an optional wireless interface 440, second wired interface 450 which may represent a plurality of additional wired interfaces, and may contain TPM 460 for secure storage. As with controller 100, the CPU commonly used for such access nodes is a MIPS-class CPU such as one from Raza Microelectronics or Cavium Networks, although processors from other vendors such as Intel, AMD, Freescale, and IBM may be used. Memory hierarchy 420 comprises read-only storage such as ROM or EEPROM for device startup and initialization, fast read-write storage such as DRAM for holding operating programs and data, and permanent bulk file storage such as compact flash memory. Remote access point 400 typically operates under control of purpose-built programs running on an embedded operating system such as Linux or VXWorks. Optional wireless interface 340 is typically an interface operating to the family of IEEE 802.11 standards including but not limited to 802.11a, b, g, and/or n. First wired interface 430 may be an IEEE803.2 Ethernet interface, or other wired interface such as USB or IEEE1394 Firewire. Similarly, second wired interface 450 may be one or more IEEE802.3 Ethernet interfaces, USB interfaces, IEEE1493 Firewire interfaces, or a combination. As an example, a small remote access point 400 may have an IEEE803.2 Ethernet wired interface for first wired interface 430, an IEEE802.11a/b/g/n wireless interface 440, and an additional IEEE802.3 Ethernet port and a USB port as second wired interface 450. A larger remote access point 400 may have multiple second Ethernet ports.
  • According to an aspect of the invention, during manufacturing, identification information is generated and stored in remote access point 400. This information may be stored in memory hierarchy 420, as an example in EEPROM or flash storage, and/or in TPM 460 if a TPM is present. This identification information contains device unique information, which may be for example a serial number, or the MAC address of the first wired interface 430.
  • In one embodiment of the invention, this information is stored as a digital certificate containing a Distinguished Name which contains the MAC address of the first wired interface 430 of the device. If remote access point 400 contains a TPM 460, the key for this certificate is stored in the TPM, otherwise the key for the certificate is stored in EEPROM or Flash memory.
  • Remote access point 400 also contains an initialization program stored in memory hierarchy 420 which is to be run whenever the remote access point 400 is powered up in unprovisioned state.
  • According to the invention, the user of remote access point 400 prepares it for setup by establishing a wired connection 350 between internet interface 300 and first wired interface 430. A second wired connection 480 is established between second wired interface 450 and a personal computer 500.
  • When remote access point 400 is powered up in an unprovisioned state, the initialization program executes as shown in FIG. 2. It first attempts to establish an Internet connection via first wired interface 430. The exact process required for establishing this connection depends on the nature of the interface, but is understood in the art. As an example, for Internet Protocol (IP) interfaces, the DHCP protocol described in RFC 2131 for IPv4 networks and RFC 3315 for IPv6 networks is used by the device to obtain the information necessary to establish an Internet connection.
  • The user is queried via second wired interface 450 and connection 480 to computer 500 for information on controller 100 which is to support remote access point 400.
  • In one embodiment of the invention, remote access point 400 starts up a simple web server attached to second wired interface 450. This allows the user to use any web browser on computer 500, such as Mozilla Firefox, Apple's Safari, Google's Chrome, or even Internet Explorer, to provide the needed information. This simple web server running on remote access point 400 provides a page in response to any URI requested from computer 500, requesting information on the controller which is to support remote access point 400. In one example, the information requested may be as simple as the TCP/IP address of controller 100, for example, an address such as 192.168.249.240 may be provided by the user. Rather than providing a TCP/IP address, the user may provide a fully qualified domain name (FQDN), such as setup.yoyodyne.com, which will be looked up by the initialization program and translated to a TCP/IP address. In another example, the user may be provided with a key code which is resolved to the TCP/IP address of the controller, such as XP3Y-4GG7-3DEK-6RTM which is resolved by the web server software running on remote access point 400 to the TCP/IP address needed.
  • In another embodiment of the invention, a simple serial protocol and interface may be used on second wired interface 450, such as an RS-232 serial interface, or RS-232 over USB, and a simple query and response scheme prompting the user for input and accepting that input, once again, the TCP/IP address of controller 100, a FQDN, or a key code which is resolved to the TCP/IP address of the controller.
  • Once the TCP/IP address of controller 100 has been provided, and the Internet connection established, remote access point 400 attempts to contact controller 100 at the specified TCP/IP address using wired interface 430.
  • Assume controller 100 is accessible via the Internet at the specified TCP/IP address. Controller 100 may accept requests from all remote access points contacting it at this address, or controller 100 may contain a whitelist stored in memory hierarchy 120 of those individual remote access points which are to be accepted. This whitelist may also reside outside of the controller 100 with the controller 100 being able to access the information at any time. This whitelist for example could be based on the unique MAC address of first wired interface 430 present in each remote access point 400. If the MAC address, which is present in the device credentials such as digital certificate, is on the whitelist, the connection is accepted, otherwise the connection is rejected.
  • If controller 100 accepts the connection from remote access point 400, controller 100 and remote access point 400 exchange and verify identity information. In one embodiment of the invention, this involves verifying certificates and certificate chain kept by each party.
  • Once identities have been verified, controller 100 sends configuration information to remote access point 400. In one embodiment of the invention, once the identities of controller 100 and remote access point 400 have been verified, a secure tunnel such as an IPsec tunnel is established between controller 100 and remote access point 400, and configuration information is downloaded through this tunnel. IPsec protocols are known to the art and are defined for example in RFC 4301, and RFC 4309.
  • The configuration information provided by controller 100 is installed in remote access point 400.
  • Optionally, a check for updates to the software present in remote access point 400 may be made with controller 100, and any additional or updated software downloaded and installed in remote access point 400. This may be performed, for example, by a system where controller 100 queries remote access point 400 for information on versions of installed software, compares those versions to current versions maintained on the controller, and sends updates as needed.
  • With the configuration information now present, initialization is complete, and operation of the remote access point in its provisioned state many now begin. This may be accomplished by the initialization program starting the remote access point software, or by the initialization software restarting remote access point 400.
  • While the invention has been described in terms of various embodiments, the invention should not be limited to only those embodiments described, but can be practiced with modification and alteration within the spirit and scope of the appended claims. The description is this to be regarded as illustrative rather than limiting.

Claims (11)

1. A method of provisioning a remote access point having identity information stored in the remote access point memory, a first wired interface for connecting to the internet, and a second wired interface for connecting to a user computer, the method comprising:
establishing an internet connection on the first wired interface,
accepting user input through the second wired interface, the user input representing a TCP/IP address,
attempting to connect to a controller at the TCP/IP address via the internet connection on the first wired interface,
exchanging and verifying identity information with the controller,
downloading and installing configuration information from the controller, and
placing the remote access node in operation.
2. The method of claim 1 where the identity information contains the MAC address of at least the first wired interface.
3. The method of claim 1 where the identity information is a digital certificate.
4. The method of claim 1 where the controller maintains a whitelist of remote access points which are allowed to connect, and refusing connections from remote access points not on the whitelist.
5. The method of claim 1 where the step of downloading and installing configuration information includes downloading and installing any software updates for the remote access point.
6. The method of claim 1 where the step of downloading and installing configuration information is performed using a tunnel.
7. The method of claim 6 where the tunnel is encrypted.
8. The method of claim 6 where the tunnel is an IPsec tunnel.
9. The method of claim 1 where the user input representing a TCI/IP address is a TCP/IP address.
10. The method of claim 1 where the user input representing a TCI/IP address is a Fully Qualified Domain Name (FQDN),
11. The method of claim 1 where the user input representing a TCI/IP address is a code representing a TCP/IP address.
US12/477,774 2009-06-03 2009-06-03 Provisioning remote access points Abandoned US20100313262A1 (en)

Priority Applications (3)

Application Number Priority Date Filing Date Title
US12/477,774 US20100313262A1 (en) 2009-06-03 2009-06-03 Provisioning remote access points
US14/084,325 US9509746B2 (en) 2009-06-03 2013-11-19 Provisioning remote access points
US15/359,266 US10491583B2 (en) 2009-06-03 2016-11-22 Provisioning remote access points

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
US12/477,774 US20100313262A1 (en) 2009-06-03 2009-06-03 Provisioning remote access points

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US14/084,325 Continuation US9509746B2 (en) 2009-06-03 2013-11-19 Provisioning remote access points

Publications (1)

Publication Number Publication Date
US20100313262A1 true US20100313262A1 (en) 2010-12-09

Family

ID=43301725

Family Applications (3)

Application Number Title Priority Date Filing Date
US12/477,774 Abandoned US20100313262A1 (en) 2009-06-03 2009-06-03 Provisioning remote access points
US14/084,325 Active US9509746B2 (en) 2009-06-03 2013-11-19 Provisioning remote access points
US15/359,266 Active 2029-10-19 US10491583B2 (en) 2009-06-03 2016-11-22 Provisioning remote access points

Family Applications After (2)

Application Number Title Priority Date Filing Date
US14/084,325 Active US9509746B2 (en) 2009-06-03 2013-11-19 Provisioning remote access points
US15/359,266 Active 2029-10-19 US10491583B2 (en) 2009-06-03 2016-11-22 Provisioning remote access points

Country Status (1)

Country Link
US (3) US20100313262A1 (en)

Cited By (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2012023050A2 (en) 2010-08-20 2012-02-23 Overtis Group Limited Secure cloud computing system and method
US20120257603A1 (en) * 2011-04-06 2012-10-11 Mathieu Mercier Network Access Point Management
US20130103836A1 (en) * 2011-10-21 2013-04-25 Joseph Garcia Baniqued Centralized Configuration with Dynamic Distributed Address Management
US8665744B2 (en) 2012-05-18 2014-03-04 Gainspan Corporation Convenient provisioning of embedded devices with WiFi capability
US20140215207A1 (en) * 2013-01-31 2014-07-31 Hewlett-Packard Development Company, L.P. Provisioning and managing certificates for accessing secure services in network
US20150124966A1 (en) * 2012-04-13 2015-05-07 Anyfi Networks Ab End-to-end security in an ieee 802.11 communication system
EP2709392A4 (en) * 2011-06-17 2015-08-05 Zte Corp Processing method and system for initiating radio remote unit
US20150223081A1 (en) * 2012-08-09 2015-08-06 Lg Electronics Inc. Method for receiving downlink signal by station in wireless communication system
US20170238236A1 (en) * 2016-02-17 2017-08-17 Zitovault, Inc. Mac address-bound wlan password
EP3214891A4 (en) * 2014-10-27 2018-05-30 ZTE Corporation Switching-on method, base station, base station controller, switching-on system and storage medium
US20180249346A1 (en) * 2017-02-27 2018-08-30 Mavenir Networks, Inc. System and method for network stranded remote radio installation
CN109547311A (en) * 2018-11-16 2019-03-29 中国航空工业集团公司洛阳电光设备研究所 A kind of transmission method of avionics system environment 1394B bus communication frame structure
US10389581B2 (en) * 2014-09-30 2019-08-20 Arris Enterprises Llc Access-point controller discovery via an intermediary
US10420155B2 (en) * 2016-03-18 2019-09-17 Plume Design, Inc. Distributed Wi-Fi setup systems and methods
US10470102B2 (en) * 2016-02-17 2019-11-05 Zitovault, Inc. MAC address-bound WLAN password
US20210092136A1 (en) * 2019-09-24 2021-03-25 Pc Matic Inc Protecting Against Remote Desktop Protocol Intrusions
US11272361B2 (en) 2015-03-30 2022-03-08 Arris Enterprises Llc Zero-touch onboarding in a network

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9300766B2 (en) 2012-07-31 2016-03-29 At&T Intellectual Property I, L.P. Method and apparatus for initiating and maintaining sessions between endpoints
WO2018172818A1 (en) * 2017-03-23 2018-09-27 Pismo Labs Technology Ltd. Method and system for restricting transmission of data traffic for devices with networking capabilities
CN111091204B (en) * 2019-12-14 2023-07-18 树行科技(上海)有限公司 Intelligent monitoring method and device for maintenance behaviors and computer readable storage medium

Citations (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030043178A1 (en) * 2001-09-06 2003-03-06 International Business Machines Corporation Initiation of interactive support from a computer desktop
US20030046410A1 (en) * 2001-09-06 2003-03-06 International Business Machines Corporation Method and apparatus for providing entitlement information for interactive support
US20030043180A1 (en) * 2001-09-06 2003-03-06 International Business Machines Corporation Method and apparatus for providing user support through an intelligent help agent
US20030237016A1 (en) * 2000-03-03 2003-12-25 Johnson Scott C. System and apparatus for accelerating content delivery throughout networks
US20050086295A1 (en) * 2000-10-06 2005-04-21 Andrew Cunningham Asynchronous hypertext messaging system and method
US20060185001A1 (en) * 2005-02-17 2006-08-17 Stieglitz Jeremy E Methods and apparatus to configure a network device via an authentication protocol
US20080098472A1 (en) * 2004-07-28 2008-04-24 Nobuyuki Enomoto Connection Method, Communication System, Device, and Program
US20090094351A1 (en) * 2007-10-08 2009-04-09 Qualcomm Incorporated Access terminal configuration and access control
US7890612B2 (en) * 2006-05-08 2011-02-15 Electro Guard Corp. Method and apparatus for regulating data flow between a communications device and a network
US20110258454A1 (en) * 2010-04-15 2011-10-20 General Instrument Corporation Cross-domain identity management for a whitelist-based online secure device provisioning framework
US20120023569A1 (en) * 2000-03-01 2012-01-26 Steven Spicer Secure network resource access system
US20120036234A1 (en) * 2004-04-15 2012-02-09 Staats Robert T Systems and methods for managing a network

Family Cites Families (32)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6185619B1 (en) * 1996-12-09 2001-02-06 Genuity Inc. Method and apparatus for balancing the process load on network servers according to network and serve based policies
US6029196A (en) * 1997-06-18 2000-02-22 Netscape Communications Corporation Automatic client configuration system
US7181766B2 (en) * 2000-04-12 2007-02-20 Corente, Inc. Methods and system for providing network services using at least one processor interfacing a base network
US7840645B1 (en) * 2001-10-22 2010-11-23 Cisco Technology, Inc. Methods and apparatus for providing content over a computer network
US8817757B2 (en) * 2001-12-12 2014-08-26 At&T Intellectual Property Ii, L.P. Zero-configuration secure mobility networking technique with web-based authentication interface for large WLAN networks
US7805161B1 (en) * 2002-06-03 2010-09-28 Sprint Spectrum L.P. Virtual visitor location register for a wireless local area network
US7152100B2 (en) * 2002-07-09 2006-12-19 Adtran, Inc. System and method for provisioning network access devices
US7249177B1 (en) * 2002-11-27 2007-07-24 Sprint Communications Company L.P. Biometric authentication of a client network connection
US7448080B2 (en) * 2003-06-30 2008-11-04 Nokia, Inc. Method for implementing secure corporate communication
US8767931B2 (en) * 2003-07-14 2014-07-01 Orative Corporation Provisioning in communications systems
US7430181B1 (en) * 2003-11-26 2008-09-30 Cisco Technology, Inc. Method and apparatus for automatically configuring devices on a wireless network
DE102004027160B4 (en) * 2004-06-03 2006-06-14 Siemens Ag Method for configuring a router and computer program product and system for carrying out the method
EP1615381A1 (en) * 2004-07-07 2006-01-11 Thomson Multimedia Broadband Belgium Device and process for wireless local area network association
US7292592B2 (en) * 2004-10-08 2007-11-06 Telefonaktiebolaget Lm Ericsson (Publ) Home network-assisted selection of intermediary network for a roaming mobile terminal
US7263076B1 (en) * 2004-10-09 2007-08-28 Radiuz Networks Llc System and method for managing a wireless network community
US7499998B2 (en) * 2004-12-01 2009-03-03 Cisco Technology, Inc. Arrangement in a server for providing dynamic domain name system services for each received request
US7542572B2 (en) * 2004-12-01 2009-06-02 Cisco Technology, Inc. Method for securely and automatically configuring access points
US7339915B2 (en) * 2005-10-11 2008-03-04 Cisco Technology, Inc. Virtual LAN override in a multiple BSSID mode of operation
US8281387B2 (en) * 2006-06-30 2012-10-02 Intel Corporation Method and apparatus for supporting a virtual private network architecture on a partitioned platform
GB0623101D0 (en) * 2006-11-20 2006-12-27 British Telecomm Secure network architecture
US8532026B2 (en) * 2007-06-21 2013-09-10 Ubeeairwalk, Inc. System, method, and computer-readable medium for multi-stage transmit protection in a femtocell system
US7877369B2 (en) * 2007-11-02 2011-01-25 Paglo Labs, Inc. Hosted searching of private local area network information
US20090164644A1 (en) * 2007-12-19 2009-06-25 Ulf Soderberg Wireless security configuration system and method
US9112879B2 (en) * 2009-05-12 2015-08-18 Hewlett-Packard Development Company, L.P. Location determined network access
US8429404B2 (en) * 2009-09-30 2013-04-23 Intel Corporation Method and system for secure communications on a managed network
US8555054B2 (en) * 2009-10-12 2013-10-08 Palo Alto Research Center Incorporated Apparatus and methods for protecting network resources
US9176829B2 (en) * 2011-07-01 2015-11-03 Microsoft Technology Licensing, Llc Managing recovery virtual machines in clustered environment
US9571482B2 (en) * 2011-07-21 2017-02-14 Intel Corporation Secure on-line sign-up and provisioning for Wi-Fi hotspots using a device management protocol
US9197498B2 (en) * 2012-08-31 2015-11-24 Cisco Technology, Inc. Method for automatically applying access control policies based on device types of networked computing devices
US9219719B1 (en) * 2012-09-21 2015-12-22 Google Inc. Automatic dynamic vetting of browser extensions and web applications
US9628346B2 (en) * 2012-12-13 2017-04-18 Level 3 Communications, Llc Devices and methods supporting content delivery with reducer services
US9692748B2 (en) * 2014-09-24 2017-06-27 Oracle International Corporation Unified provisioning of applications on devices in an enterprise system

Patent Citations (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120023569A1 (en) * 2000-03-01 2012-01-26 Steven Spicer Secure network resource access system
US20030237016A1 (en) * 2000-03-03 2003-12-25 Johnson Scott C. System and apparatus for accelerating content delivery throughout networks
US20090327116A1 (en) * 2000-10-06 2009-12-31 Avt Technologies Ltd. Asynchronous Hypertext Messaging
US20050086295A1 (en) * 2000-10-06 2005-04-21 Andrew Cunningham Asynchronous hypertext messaging system and method
US20030046410A1 (en) * 2001-09-06 2003-03-06 International Business Machines Corporation Method and apparatus for providing entitlement information for interactive support
US20030043180A1 (en) * 2001-09-06 2003-03-06 International Business Machines Corporation Method and apparatus for providing user support through an intelligent help agent
US20030043178A1 (en) * 2001-09-06 2003-03-06 International Business Machines Corporation Initiation of interactive support from a computer desktop
US20120036234A1 (en) * 2004-04-15 2012-02-09 Staats Robert T Systems and methods for managing a network
US20080098472A1 (en) * 2004-07-28 2008-04-24 Nobuyuki Enomoto Connection Method, Communication System, Device, and Program
US20060185001A1 (en) * 2005-02-17 2006-08-17 Stieglitz Jeremy E Methods and apparatus to configure a network device via an authentication protocol
US7890612B2 (en) * 2006-05-08 2011-02-15 Electro Guard Corp. Method and apparatus for regulating data flow between a communications device and a network
US20090094351A1 (en) * 2007-10-08 2009-04-09 Qualcomm Incorporated Access terminal configuration and access control
US20110258454A1 (en) * 2010-04-15 2011-10-20 General Instrument Corporation Cross-domain identity management for a whitelist-based online secure device provisioning framework

Cited By (26)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2012023050A2 (en) 2010-08-20 2012-02-23 Overtis Group Limited Secure cloud computing system and method
US20120257603A1 (en) * 2011-04-06 2012-10-11 Mathieu Mercier Network Access Point Management
US9161239B2 (en) * 2011-04-06 2015-10-13 Hewlett-Packard Development Company, L.P. Network access point management
EP2709392A4 (en) * 2011-06-17 2015-08-05 Zte Corp Processing method and system for initiating radio remote unit
US20130103836A1 (en) * 2011-10-21 2013-04-25 Joseph Garcia Baniqued Centralized Configuration with Dynamic Distributed Address Management
US9787632B2 (en) * 2011-10-21 2017-10-10 Aruba Networks, Inc. Centralized configuration with dynamic distributed address management
US20150237002A1 (en) * 2011-10-21 2015-08-20 Aruba Networks, Inc. Centralized Configuration with Dynamic Distributed Address Management
US9137198B2 (en) * 2011-10-21 2015-09-15 Hewlett-Packard Development Company, L.P. Centralized configuration with dynamic distributed address management
US20150124966A1 (en) * 2012-04-13 2015-05-07 Anyfi Networks Ab End-to-end security in an ieee 802.11 communication system
US8665744B2 (en) 2012-05-18 2014-03-04 Gainspan Corporation Convenient provisioning of embedded devices with WiFi capability
US20150223081A1 (en) * 2012-08-09 2015-08-06 Lg Electronics Inc. Method for receiving downlink signal by station in wireless communication system
US9319902B2 (en) * 2012-08-09 2016-04-19 Lg Electronics Inc. Method for receiving downlink signal by station in wireless communication system
US9325697B2 (en) * 2013-01-31 2016-04-26 Hewlett Packard Enterprise Development Lp Provisioning and managing certificates for accessing secure services in network
US20140215207A1 (en) * 2013-01-31 2014-07-31 Hewlett-Packard Development Company, L.P. Provisioning and managing certificates for accessing secure services in network
CN111542049A (en) * 2014-09-30 2020-08-14 鲁库斯无线公司 Discovery of Cloud-Based Access Point Controllers
US10389581B2 (en) * 2014-09-30 2019-08-20 Arris Enterprises Llc Access-point controller discovery via an intermediary
EP3214891A4 (en) * 2014-10-27 2018-05-30 ZTE Corporation Switching-on method, base station, base station controller, switching-on system and storage medium
US10405361B2 (en) * 2014-10-27 2019-09-03 Zte Corporation Switching-on method, base station, base station controller, switching-on system and storage medium
US11272361B2 (en) 2015-03-30 2022-03-08 Arris Enterprises Llc Zero-touch onboarding in a network
US20170238236A1 (en) * 2016-02-17 2017-08-17 Zitovault, Inc. Mac address-bound wlan password
US10470102B2 (en) * 2016-02-17 2019-11-05 Zitovault, Inc. MAC address-bound WLAN password
US10420155B2 (en) * 2016-03-18 2019-09-17 Plume Design, Inc. Distributed Wi-Fi setup systems and methods
US20180249346A1 (en) * 2017-02-27 2018-08-30 Mavenir Networks, Inc. System and method for network stranded remote radio installation
US10743190B2 (en) * 2017-02-27 2020-08-11 Mavenir Networks, Inc. System and method for network stranded remote radio installation
CN109547311A (en) * 2018-11-16 2019-03-29 中国航空工业集团公司洛阳电光设备研究所 A kind of transmission method of avionics system environment 1394B bus communication frame structure
US20210092136A1 (en) * 2019-09-24 2021-03-25 Pc Matic Inc Protecting Against Remote Desktop Protocol Intrusions

Also Published As

Publication number Publication date
US20140082060A1 (en) 2014-03-20
US20170078277A1 (en) 2017-03-16
US9509746B2 (en) 2016-11-29
US10491583B2 (en) 2019-11-26

Similar Documents

Publication Publication Date Title
US10491583B2 (en) Provisioning remote access points
JP4896956B2 (en) Active management technology (AMT) provisioning in computer systems
EP2156610B1 (en) Managing network components using usb keys
US8370905B2 (en) Domain access system
CN102859935B (en) Virtual machine remote is utilized to safeguard the system and method for the multiple clients in electric network
US11470075B2 (en) Systems and methods for provisioning network devices
US10805381B2 (en) Web storage based IoT device protect mechanism
US20110252237A1 (en) Authorizing Remote Access Points
US20100275251A1 (en) Transferring credential information
CN109495431B (en) Access control method, device and system, and switch
US10700874B2 (en) Machine to machine virtual private network
US11218463B2 (en) Trust establishment to deploy servers in data centers
CN105791235A (en) A method and device for downloading configuration information
CN103944716A (en) User authentication method and device
CN114499870A (en) Updating public key certificates in network devices using blockchain networks
EP3580885B1 (en) Private key updating
US8972532B2 (en) Providing hardware configuration management for heterogeneous computers
RU2387089C2 (en) Method of allocating resources with limited access
US20250193071A1 (en) Enabling configuring an endpoint device
US12363130B2 (en) Methods and devices for securing a multiple-access peripheral network
CN114268444A (en) Access method, server and storage medium for broadband access server
Hicks Azure MFA Integration
WO2023169688A1 (en) Enabling configuring an endpoint device
CN116594641A (en) Operating system installation method and device, electronic equipment and storage medium
HK1169529A (en) Managing network components using usb keys

Legal Events

Date Code Title Description
AS Assignment

Owner name: ARUBA NETWORKS, INC., CALIFORNIA

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:MEHTA, MANISH;KSHIRSAGAR, SHEKHAR;REEL/FRAME:027972/0738

Effective date: 20090602

STCB Information on status: application discontinuation

Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION

AS Assignment

Owner name: HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP, TEXAS

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:ARUBA NETWORKS, INC.;REEL/FRAME:045921/0055

Effective date: 20171115