Hewlett Packard Enterprise Development LP

Aruba Networks, Inc.

Daniel N Harkins

Sachin Ganu

Mohd Shahnawaz Siraj

Gopalakrishna Raman

Amogh Guruprasad Deshmukh

Eldad Perahia

Gaurav Patwardhan

Nitin A Changlani

Abhiruchi Dakshinkar

Chunfeng Wang

Rajesh Kumar Ganapathy Achari

Vigneshwara Upadhyaya

Yafeng Jiang

Zhijun Ren

Gopakumar Nambisan

Carlos Gomez Gallego

Guangning Qin

Systems and methods are provided for encryption enhancement for a multi-link operation. Various subsets of addresses (or all addresses) associated with the frame are set to a determined known value, allowing encryption of the mac protocol data unit (MPDU) at a controller without knowledge of which particular link the frames will be sent. The multi-link devices (MLDs) used in the above communication may conduct communications in compliance with the IEEE 802.11be standard.

Encryption enhancement for multi-link operation in 802.11

Systems and methods are provided for mitigating denial-of-service attacks that can disrupt onboarding internet-of-things (IoT) devices onto a network and ensuring legitimate IoT devices are onboarded. Example implementations include receiving, at an access point (AP) from a device, a chirp signal comprising a hash of data including a first public key of an IoT device. Upon verification of the first public key, the AP generates a context based on a first public key received from the authenticator. The context comprises information for onboarding the IoT device without subsequent communications between the AP, configurator and the authenticator. The AP can use the context to create and transmit authentication authorization requests responsive to chirp signals. In some examples, a chirp table can be created by a configurator for tracking severing APs. The chirp table can be utilized in provisioning APs for future chirp signals as needed.

Mitigation of a denial of service attack in a device provisioning protocol (DPP) network

Example implementations relate to connecting an IoT device to a wireless network using Device Provisioning Protocol (DPP). An authentication server receives a DPP network access authorization request including a connector identifier from an Access Point (AP) in communication with the IoT device. The connector identifier is a hash of the public network access key of the IoT device. If the connector identifier is valid, the authentication server determines a configurable policy from a set of configurable policies that is applicable to the IoT device. The authentication server transmits network permissions defined in the configurable policy to the AP. The IoT device is connected to the wireless network by the AP based on the network permissions.

Connecting internet of thing (IoT) devices to a wireless network

The secure configuration of a headless networking device is described. A label associated with the headless networking device is scanned and a public key is determined. scanning a label associated with a networking device. A configuration process is initiated for the networking device using the public key associated with the networking device that was determined based on the scanned label.

Secure configuration of a headless networking device

Systems and methods are provided for cloud controlled secure Bluetooth pairing for network device management. A method for a mobile device includes sending a Bluetooth pairing request to a network device that cannot connect to a network, wherein the network device responds to the Bluetooth pairing request by sending a challenge token; responsive to receiving the challenge token from the network device, sending the challenge token to a server, wherein the server responds to the challenge token by sending a response token, wherein the response token comprises a secure Bluetooth pairing key; and responsive to receiving the response token from the server, establishing a secure Bluetooth connection with the network device, comprising pairing with the network device using the secure pairing key.

Cloud controlled secure Bluetooth pairing for network device management

Described herein are systems, devices, techniques and products for managing the dynamic assignment of media access control (MAC) addresses to wireless network devices, such as by identifying a dynamically assigned MAC address before, after, or during a wireless association process and communicating the dynamically assigned MAC address to a wireless network device. Also disclosed are systems, devices, techniques and products for preventing a denial of service attack on a wireless access point's association table, such as by requiring devices that associate with a wireless access point to respond to a query from the wireless access point shortly after association.

Infrastructure coordinated media access control address assignment

Wireless association table denial of service prevention

Before establishing a connection between a first and a second devices, the first device determines whether a third device is a trusted or untrusted device. If it is a trusted device, the first device receives from the third device a public key and information indicating the public key of the second device; and, uses the public key by combining its own private key and the public key of the second device to generate a shared secret, and using the shared secret to communicate to the second device. Otherwise, the first device refrains from communications with the third device. Also, the second device combines its private key with the public key of the first device received from the trusted third device to generate the same shared secret, and uses the shared secret to provision the first device to access a secured wireless network provided by the second device.

Growing community of inventors

La Selva Beach, CA, United States of America

Daniel N Harkins