Method for authenticating a networked endpoint using a physical (power) challenge

• US 10,235,516 B2
• Filed: 05/10/2016
• Issued: 03/19/2019
• Est. Priority Date: 05/10/2016
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Parello, John, Ramanujam, Padmanabhan, Pollakattu, Sarat
• Primary Examiner(s): Giddins, Nelson
• Application Number:
  US15/150,851
• Publication Number:
  US 20170331803A1
• Time in Patent Office: 1,043 Days
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: H04L 25/02 Details ; arrangements for supplying electrical power along data transmission lines systems for transmitting signals via power distribution lines H04B3/54
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 9/3221 interactive zero-knowledge proofs

Abstract

Various systems and methods for using power challenges to authenticate network devices are disclosed herein. For example, one method involves initiating a power challenge to authenticate an endpoint device, which involves, at least in part, requesting the endpoint device to perform a specific power signature; receiving data indicating whether the endpoint device performed the requested power signature within a given time interval, wherein the data can be received from, e.g., a power interface or other device capable of observing the endpoint device; processing the received data to determine if the endpoint device correctly performed the requested power signature; and if the endpoint correctly performed the power signature, authenticating the endpoint.

Claims

1. A method comprising

determining whether to initiate a power challenge for an endpoint device;

in response to a determination to initiate a power challenge, determining whether the endpoint device is connected to a trusted power interface;

in response to a determination that the endpoint device is connected to the trusted power interface,

sending a power challenge to the endpoint device via a power interface, wherein

the endpoint device is connected to the power interface, and

the power challenge requires the endpoint device to modulate power used by endpoint device in a specified pattern, and

sending an observation request to one or more of a plurality of sensor devices;

receiving first proof of work information from the power interface, wherein

the power interface determines the first proof of work information by observing a pattern of power that passes through the power interface during a period in which the endpoint device is performing the power challenge;

receiving second proof of work information from one or more of the plurality of sensor devices, wherein

the one or more of the plurality of the sensor devices determines the second proof of work information by observing a pattern emitted by the endpoint device during the period in which the endpoint device is performing the power challenge; and

determining whether the endpoint device adequately performed the power challenge by processing the first proof of work information and the second proof of work information.

2. The method of claim 1, wherein the processing further comprises

determining whether a trusted sensor device adequately observed a power signature associated with the power challenge.

3. The method of claim 2, wherein the processing further comprises

authenticating the endpoint device in response to a determination that a trusted sensor device adequately observed the power signature.

4. The method of claim 1, wherein the processing further comprises

determining whether a quorum of the plurality of sensor devices observed a power signature associated with the power challenge.

5. The method of claim 1, wherein the processing further comprises

generating a weighted average, wherein

the weighted averaged is based on the second proof of work information received from the one or more of the plurality of sensor devices.

6. The method of claim 1, further comprising

authenticating the endpoint device in response to a determination that the endpoint device adequately performed the power challenge.

7. The method of claim 1, further comprising

initiating an error protocol in response to a determination that the endpoint device did not adequately perform the power challenge.

8. The method of claim 1, further comprising

determining whether to initiate a power challenge for an endpoint device;

and

the determining whether the endpoint device is connected to the trusted power interface is performed in response to a determination to initiate the power challenge.

9. A system comprising:

a challenge initiating module, wherein the challenge initiating module is configured to

determine whether to initiate a power challenge for an endpoint device,

in response to a determination to initiate a power challenge, determine whether the endpoint device is connected to a trusted power interface, and

in response to a determination that the endpoint device is connected to the trusted power interface,

send a power challenge to the endpoint device via a power interface, wherein

the endpoint device is connected to the power interface, and

the power challenge requires the endpoint device to modulate power used by endpoint device in a specified pattern;

a server interface module, wherein the server interface module is configured to

send an observation request to one or more of a plurality of sensor devices, wherein

the observation request is sent in response to the determination that the endpoint device is not connected to the trusted power interface, and

the server interface module is further configured to

receive first proof of work information from the power interface, wherein

 

the power interface determines the first proof of work information by observing a pattern of power that passes through the power interface during a period in which the endpoint device is performing the power challenge, and

receive second proof of work information from one or more of the plurality of sensor devices, wherein

 

the one or more of the plurality of the sensor devices determines the second proof of work information by observing a pattern emitted by the endpoint device during the period in which the endpoint device is performing the power challenge; and

a challenge processing module, wherein the challenge processing module is configured to

determine whether the endpoint device adequately performed the power challenge by processing the first proof of work information and the second proof of work information.

10. The system of claim 9, wherein the challenge processing module is further configured to

determine whether a trusted sensor device adequately observed a power signature associated with the power challenge.

11. The system of claim 10, wherein the challenge processing module is further configured to

authenticate the endpoint device in response to a determination that a trusted sensor device adequately observed the power signature.

12. The system of claim 9, wherein the challenge processing module is further configured to

determine whether a quorum of the plurality of sensor devices observed a power signature associated with the power challenge.

13. The system of claim 9, wherein the challenge processing module is further configured to

generate a weighted average, wherein

the weighted averaged is based on the second proof of work information received from the one or more of the plurality of sensor devices.

14. The system of claim 9, wherein the challenge processing module is further configured to

authenticate the endpoint device in response to a determination that the endpoint device adequately performed the power challenge.

15. The system of claim 9, wherein the challenge processing module is further configured to

initiate an error protocol in response to a determination that the endpoint device did not adequately perform the power challenge.

16. An apparatus comprising:

a challenge initiating module, wherein the challenge initiating module is configured to

determine whether to initiate a power challenge for an endpoint device,

in response to a determination to initiate a power challenge, determine whether the endpoint device is connected to a trusted power interface, and

in response to a determination that the endpoint device is connected to the trusted power interface,

send a power challenge to the endpoint device via a power interface, wherein

the endpoint device is connected to the power interface, and

the power challenges requires the endpoint device to modulate power used by endpoint device in a specified pattern;

a server interface module, wherein the server interface module is configured to

send an observation request to one or more of a plurality of sensor devices, wherein

the observation request is sent in response to the determination that the endpoint device is not connected to the trusted power interface, and

the server interface module is further configured to

receive first proof of work information from the power interface, wherein

 

the power interface determines the first proof of work information by observing a pattern of power that passes through the power interface during a period in which the endpoint device is performing the power challenge, and

receive second proof of work information from one or more of the plurality of sensor devices, wherein

 

the one or more of the plurality of the sensor devices determines the second proof of work information by observing a pattern emitted by the endpoint device during the period in which the endpoint device is performing the power challenge; and

a challenge processing module, wherein the challenge processing module is configured to

determine whether the endpoint device adequately performed the power challenge by processing the first proof of work information and the second proof of work information.

17. The apparatus of claim 16, wherein the challenge processing module is further configured to

determine whether a trusted sensor device adequately observed a power signature associated with the power challenge.

18. The apparatus of claim 17, wherein the challenge processing module is further configured to

authenticate the endpoint device in response to a determination that a trusted sensor device adequately observed the power signature.

19. The apparatus of claim 16, wherein the challenge processing module is further configured to

determine whether a quorum of the plurality of sensor devices observed a power signature associated with the power challenge.

20. The apparatus of claim 16, wherein the challenge processing module is further configured to

generate a weighted average, wherein

the weighted averaged is based on the second proof of work information received from the one or more of the plurality of sensor devices.

21. The apparatus of claim 16, wherein the challenge processing module is further configured to

authenticate the endpoint device in response to a determination that the endpoint device adequately performed the power challenge.