# US 2019/0173680 A1 · Admissions control of a device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0173680 A1 - Document ID: US20190173680A1 - Status: Published application - Kind: A1 - Application number: 16/253,853 - Filed: 2019-01-22 - Published: 2019-06-06 - Earliest claimed: 2017-01-03 - Assignees: Hewlett Packard Enterprise Development LP - Applicants: Hewlett Packard Enterprise Development LP - Inventors: Nigel Edwards; Michael R. Krause - Web page: https://patentgrep.com/patent/US20190173680A1 ## CPC - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself} - H04L 9/14: using a plurality of keys or algorithms - H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy - H04L 9/3271: {using challenge-response} - H04L 45/72: {Routing based on the source address} - H04L 63/0281: {Proxies} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - H04L 2209/56: Financial cryptography, e.g. electronic payment or e-cash - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A control device performs an admissions control process with a first device to determine whether the first device is authorized to communicate over the communication fabric that supports memory semantic operations. ## Claims ### Claim 1 A method comprising: detecting, by a control device, a first device that is newly connected to or newly activated in a communication fabric that supports memory semantic operations between the first device and a second device; performing, by the control device, an admissions control process with the first device to determine whether the first device is authorized to communicate over the communication fabric; and instructing a switch to route packets of the newly connected or newly activated first device just to the control device until the admission control process succeeds. ### Claim 2 (depends on 1) The method of claim 1, further comprising: in response to the admissions control process succeeding, enabling, by the control device, communication by the first device over the communication fabric. ### Claim 3 (canceled) ### Claim 4 (canceled) ### Claim 5 (depends on 1) The method of claim 1, further comprising: in response to the admissions control process succeeding, sending, by the control device, a transaction integrity key to the first device, the transaction integrity key to be used in providing security for transactions of the first device and to restrict the first device to a predefined set of transaction types. ### Claim 6 (depends on 1) The method of claim 1, wherein performing the admissions control process uses a security element to verify the first device. ### Claim 7 (canceled) ### Claim 8 (depends on 1) The method of claim 1, further comprising: determining, by the control device, whether the first device supports a security header in transactions over the communication fabric; and in response to determining that the first device does not support the security header, configuring, by the control device, a gateway to act as a proxy for the first device, the proxy to insert the security header for a transaction of the first device. ### Claim 9 (depends on 8) The method of claim 8, wherein configuring the gateway further comprises configuring the gateway that performs at least one selected from among: inserting or modifying an access key in a packet on behalf of the first device to access a resource over the communication fabric, changing a component identifier in the packet for communication involving the first device, and restricting transaction types that are allowed for the first device. ### Claim 10 A control device comprising: at least one processor to: determine whether a first device supports a security feature; in response to determining that the first device supports the security feature, perform admissions control to determine whether the first device is authorized to communicate over a communication fabric that supports memory semantic operations; detect the first device that is newly connected to or newly activated in the communication fabric; and instruct a switch to route packets of the newly connected or newly activated first device just to the control device until the admission control process succeeds. ### Claim 11 (depends on 10) The control device of claim 10, wherein the at least one processor is to: send a key to the first device to implement the security feature; and in response to determining that the first device does not support the security feature, configure a gateway to act as a proxy for the first device to implement the security feature, wherein the key is for generating a security value to include in a transaction packet sent by the first device over the communication fabric. ### Claim 12 (depends on 10) The control device of claim 10, wherein the at least one processor is to: send a key to the first device to implement the security feature; and in response to determining that the first device does not support the security feature, configure a gateway to act as a proxy for the first device to implement the security feature, wherein the admissions control comprises performing a challenge-response process or retrieving a certificate from the first device. ### Claim 13 (depends on 10) The control device of claim 10, wherein the at least one processor is to: send a key to the first device to implement the security feature; and in response to determining that the first device does not support the security feature, configure a gateway to act as a proxy for the first device to implement the security feature, wherein the at least one processor is to further, in response to determining that the first device supports the security feature, configure the switch to enable routing of packets between the first device and other devices connected to the communication fabric. ### Claim 14 (depends on 10) The control device of claim 10, wherein the at least one processor is to: send a key to the first device to implement the security feature; and in response to determining that the first device does not support the security feature, configure a gateway to act as a proxy for the first device to implement the security feature, wherein the configuring of the gateway further comprises configuring the gateway that performs at least one selected from among: inserting or modifying an access key in a packet on behalf of the first device to access a resource over the communication fabric, changing a component identifier in the packet for communication involving the first device, and restrict transaction types that are allowed for the first device. ### Claim 15 An article comprising at least one non-transitory machine-readable storage medium storing instructions that upon execution cause a processor of a control device to: detect a first device in a communication fabric that supports memory semantic operations, wherein the first device is one component of a larger group of components forming a larger device, the first device being selected from a group of components consisting of: an individual memory device, an individual graphics controller; an individual accelerator; an individual I/O component an individual ingress interface; an individual egress interface; an individual digital signal processor; and an individual switch; and perform an admissions control process with the first device to determine whether the first device is authorized to communicate over the communication fabric. ### Claim 16 (depends on 15) The article of claim 15, wherein the instructions, upon execution, are to direct the processor of the control device to: determine whether the first device is newly connected to or newly activated in the communication fabric; instruct a switch to route packets of the newly connected or newly activated first device just to the control device until the admission control process succeeds. ### Claim 17 (depends on 16) The article of claim 16, wherein the instructions, upon execution, are to direct the processor of the control device to direct the switch to drop packets sent from the first device and not addressed to the control device. ### Claim 18 (depends on 15) The article of claim 15, wherein the admissions control process comprises retrieving a certificate from an address within an address space at the first device. ### Claim 19 (depends on 15) The article of claim 15, wherein the instructions, upon execution, are to direct the processor of the control device to provide the first device with a transaction integrity key that restricts the first device to a predefined set of transaction types. ### Claim 20 (depends on 15) The article of claim 15, the instructions, upon execution, are to direct a processor of the control device to provide the first device with a transaction integrity key that limits access by the first device to predefined address spaces. ### Claim 21 (depends on 1) The method of claim 1, further comprising, at the switch, dropping packets sent from the first device and not addressed to the control device. ### Claim 22 (depends on 10) The control device of claim 10, wherein the at least one processor is to direct a switch to drop packets sent from the first device and not addressed to the control device. ### Claim 23 (depends on 10) The control device of claim 10, wherein the admissions control process comprises retrieving a certificate from an address within an address space at the first device.