Hewlett Packard Enterprise Development LP

Zhijun Ren

Chunfeng Wang

Mohd Shahnawaz Siraj

Gaurav Patwardhan

Jianpo Han

Hao Lu

Manoj Thawani

Daniel N Harkins

Rajesh Kumar Ganapathy Achari

Amogh Guruprasad Deshmukh

Huimeng Huang

Shruthi Koundinya

Qiwei Chang

Xiaoding Shang

Guangning Qin

Jishi Wang

Liya Yi

A first switch port receives a first control packet, a header having a source media access control (MAC) address of a first MAC of a first interface of a sending device and a payload containing a second MAC of a second interface of the same sending device. The first and second interfaces form a bonded interface for failover purposes on the sending device. A second switch port receives a second control packet, a header having the second MAC as its source MAC and a payload containing the first MAC. The switch associates the first and second MAC addresses as related MAC addresses associated with the bonded interface. The switch facilitates failover between the secure interfaces via multiple uplinks while maintaining the port security on the switch by allowing transmission of data from either the first or second MAC address, associated as related MAC addresses, without triggering a port security violation.

Method to support multiple uplinks failover between switch interfaces with port security

Embodiments of the present disclosure relate to transmission of network access information for wireless devices. A method comprises transmitting an authorization request for the wireless device to a server upon receiving a presence announcement message from a wireless device. The method further comprises receiving an authorization response from the server including network access information and bootstrapping information of the wireless device. The method further comprise performing authentication with the wireless device based on the bootstrapping information. The method also comprises transmitting the network access information to the wireless device. The network access information includes a service set identifier (SSID) for a wireless local area network (WLAN) and credential information for the mobile device to access the WLAN. By automatically distributing network access information to the wireless device without requiring any user input, the efficiency of device provisioning and the security of WLAN can be improved.

Transmission of network access information for wireless device

Systems and methods are provided for mitigating denial-of-service attacks that can disrupt onboarding internet-of-things (IoT) devices onto a network and ensuring legitimate IoT devices are onboarded. Example implementations include receiving, at an access point (AP) from a device, a chirp signal comprising a hash of data including a first public key of an IoT device. Upon verification of the first public key, the AP generates a context based on a first public key received from the authenticator. The context comprises information for onboarding the IoT device without subsequent communications between the AP, configurator and the authenticator. The AP can use the context to create and transmit authentication authorization requests responsive to chirp signals. In some examples, a chirp table can be created by a configurator for tracking severing APs. The chirp table can be utilized in provisioning APs for future chirp signals as needed.

Mitigation of a denial of service attack in a device provisioning protocol (DPP) network

An AP sets up a data tunnel to a remote network and monitors a remote DHCP session between a client device and a remote DHCP server in the remote network. The remote DHCP server assigns a remote IP address to the client device, and communication between the client device and the remote network is based on the remote IP address. In response to determining completion of the remote DHCP session, the AP initializes a local DHCP session with a local DHCP server in a local network to obtain a local IP address for the client device. Communication between the client device and the local network is based on the local IP address. In response to detecting the client device roaming from the AP to a target AP, the AP forwards the remote and local IP addresses and session data of active sessions on the client device to the target AP.

Wi-Fi roaming support for cloud integrated remote WLAN deployment

Systems are methods are provided for implementing load balancing of IPsec security associations (SAs) SAs between different heterogeneous cores, for example in a multiple controller systems. The balancing of IPsec SAs are performed using software implementations of IPsec offloading and/or hardware implementations of IPsec offloading. By balancing the processing functions related to orchestration of IPsec SAs between hardware (e.g., IPsec hardware accelerator) and software (e.g., IPsec software accelerator), the methods realize increased optimization, improved user experience, and enhanced product performance in networks using IPsec. For example, an IPsec session is initiated, and it is determined whether a resource limitation for a hardware-based IPsec accelerator has been reached. If the limitation for the hardware-based IPsec accelerator has been reached, processing for the IPsec SA for the initiated IPsec session is offloaded to a software-based IPsec accelerator.

Internet protocol security (IPsec) security associations (SA) balance between heterogeneous cores in multiple controller system

Examples described herein provide wake-up of a network device. Examples include receiving, by a network interface of a first network device having a first Media Access Control (MAC) address, a request to wake-up a second network device having a second MAC address that is assigned to a same subnet as the first MAC address, and in response to the request, generating, by the first network device, a first wake-up frame having a destination address of the second MAC address and configured to cause the second network device to transition from operating in the first power mode to operating in the second power mode. Examples include transmitting, by the network interface of the first network device, the first wake-up frame to the second MAC address of the second network device.

Wake-up by a network device

Examples described herein relate to a selection of a network device in a network installation for a forwarder operation. Selection may include computing a performance score based on a set of performance parameters. Broadcasting the computed performance score to other network devices. Receiving performance scores from the other network devices. Comparing the received performance scores with the computed performance score. Continuing in the forwarder mode based on a determination that the received performance scores are less than its computed performance score. Receiving multicast Domain Name Service (mDNS) packets from one or more client devices. Sending the received mDNS packets to a central service.

Growing community of inventors

Beijing, China

Zhijun Ren