COUNTERFEIT PREVENTION STRATEGY FOR PLUGGABLE MODULES

• US 20100325432A1
• Filed: 06/23/2009
• Published: 12/23/2010
• Est. Priority Date: 06/23/2009
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Lai, David C., Peng, Liang Ping, Carter, Adam Jonathan, Ding, Guoying, Tang, Norman
• Granted Patent: US 8,769,654 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices

Abstract

A method is provided, including (a) upon a standard small form-factor pluggable (SFP) module being inserted into an SFP jack on a network host device, determining if the SFP module is a legacy device or a smart device, (b) upon determining that the SFP module is a legacy device, receiving a magic code from the SFP module and determining if the magic code is a valid magic code, and (c) upon determining that the SFP module is a smart device, performing a smart authentication process with the SFP module. Associated apparatuses and additional methods are also provided.

Claims

1. An apparatus comprising:

a first communications interface configured to communicatively couple to a network plug of a network cable;

a second communications interface configured to communicatively couple to a network host device, the second communications interface being constructed and arranged to mount into an opening of the network host device, the network host device being constructed and arranged to receive and mount a standard small form-factor pluggable module in the opening;

a microcontroller, the microcontroller being configured to perform transceiver functions between the first communications interface and the second communications interface; and

authentication circuitry, the authentication circuitry being communicatively coupled with the microcontroller and the second communications interface, wherein;

the authentication circuitry is configured to provide a legacy-style authentication when the second communications interface is communicatively coupled to a legacy network host device; and

the authentication circuitry is configured to provide a smart authentication when the second communications interface is communicatively coupled to a smart network host device, the smart authentication being less susceptible to counterfeiting than the legacy-style authentication.

2. An apparatus as in claim 1 wherein the authentication circuitry is located on an authentication chip and the authentication chip includes:

logic circuitry;

firmware, the firmware storing;

a magic code cookie;

a unique signature;

code, which when executed by the logic circuitry, causes the logic circuitry to;

determine if the network host device is a legacy network host device or a smart network host device;

provide the contents of the magic code cookie to the network host device, if and only if the second interface is communicatively coupled to a legacy network host device; and

perform a smart authentication procedure with the network host device, if and only if the second interface is communicatively coupled to a smart network host device, the smart authentication procedure utilizing the unique signature according to a specified algorithm; and

hardening features, the hardening features protecting the contents of the firmware from being read from the authentication chip by an unauthorized external entity.

3. An apparatus as in claim 2 wherein the smart authentication procedure is a real-time algorithm.

4. An apparatus as in claim 3 wherein the real-time algorithm is a challenge-response algorithm wherein:

the network host device sends a first message to the logic circuitry of the apparatus; and

the logic circuitry cryptographically combines the first message with the unique signature according to the specified algorithm and sends the result to the network host device for verification.

5. An apparatus as in claim 3 wherein the real-time algorithm is a time-based algorithm wherein:

the logic circuitry cryptographically combines the current time with the unique signature according to the specified algorithm and sends the result to the network host device for verification.

6. A method comprising:

producing a plurality of apparatuses as in claim 3;

offering for sale the plurality of apparatuses to a plurality of customers, each customer currently having and operating at least one legacy network host device which is configured to receive standard small form-factor pluggable (SFP) modules;

offering for sale to the plurality of customers, a smart network host device which is not compatible with legacy SFP modules; and

after allowing a period of time to lapse after a customer of the plurality of customers has purchased a number of the apparatuses of claim 3, encouraging such customer to retire its legacy network devices in favor of smart network host devices.

7. An apparatus as in claim 2 wherein the authentication circuitry is located on an authentication chip, the authentication chip residing in a separate integrated circuit package as the microcontroller.

8. An apparatus comprising:

an enclosure, the enclosure having a plurality of openings therein, each opening being constructed and arranged to receive a standard small form-factor pluggable (SFP) module; and

a logic board mounted within the enclosure, the logic board including a controller and a plurality of signal connectors, each of the plurality of signal connectors aligning with a different opening of the plurality of openings such that an SFP module, when inserted into the opening, interfaces with the signal connector;

wherein the controller is configured to;

upon an SFP module being inserted into an opening and interfacing with a signal connector, determine if the SFP module is a legacy device or a smart device;

upon determining that the SFP module is a legacy device, receive a magic code from the SFP module and determine if the magic code is a valid magic code; and

upon determining that the SFP module is a smart device, perform a smart authentication process with the SFP module.

9. An apparatus as in claim 8 wherein the controller, when determining if the SFP module is a legacy device or a smart device, is configured to:

receive contents of a vendor name field stored on the SFP module from the SFP module;

if the received contents store a first value, then determine that the SFP module is a smart module;

if the received contents store any other value, then determine that the SFP module is a legacy module.

10. An apparatus as in claim 8 wherein the controller, when determining if the magic code is a valid magic code, is configured to:

receive identifying information from the SFP module;

cryptographically combine the received identifying information with a magic key stored in memory on the logic board to produce a computed magic code;

compare the received magic code with the computed magic code;

if the received magic code and the computed magic code are the same, then authenticate the SFP;

if the received magic code and the computed magic code are not the same, then identify the SFP as counterfeit.

11. An apparatus as in claim 8 wherein the smart authentication procedure is a real-time algorithm.

12. An apparatus as in claim 11 wherein:

the real-time algorithm is a challenge-response algorithm; and

the controller, when performing the smart authentication process with the SFP module, is configured to;

send a first message to the SFP module;

receive a second message from the SFP module in response to the first message; and

verify that the second message was correctly encrypted in accordance with a specified algorithm.

13. An apparatus as in claim 11 wherein:

the real-time algorithm is a time-based algorithm; and

the controller, when performing the smart authentication process with the SFP module, is configured to;

receive a message from the SFP module; and

verify that the message was correctly encrypted in accordance with a specified algorithm using a current time as an encryption parameter.

14. A method comprising:

producing a plurality of smart SFP modules, each smart SFP module including an authentication chip capable of;

performing a smart authentication with an apparatus as in claim 11;

or

communicating a magic code to a legacy network host device;

offering for sale the plurality of smart SFP modules to a plurality of customers, each customer currently having and operating;

at least one legacy network host device which is configured to receive SFP modules; and

at least one legacy SFP module;

producing a plurality of apparatuses as in claim 11;

configuring each of the plurality of apparatuses as in claim 11 to be capable of receiving a signal indicating that the apparatus should no longer communicate with legacy SFP modules, such that if the apparatus receives such a signal, that apparatus will no longer communicate with legacy SFP modules;

offering for sale to the plurality of customers, the plurality of configured apparatuses;

after allowing a period of time to lapse after a customer of the plurality of customers has purchased a number of smart SFP modules, encouraging such customer to retire each of its legacy network host devices in favor of a configured apparatus; and

after allowing a period of time to lapse after that customer has retired all of its legacy network host devices in favor of configured apparatuses, encouraging that customer to;

retire all of its legacy SFP modules in favor of smart SFP modules; and

send, to each of its configured apparatuses, the signal indicating that that apparatus should no longer communicate with legacy SFP modules.

18. A method as in claim 14 wherein the smart authentication procedure is a real-time algorithm.

19. A method as in claim 18 wherein:

the real-time algorithm is a challenge-response algorithm; and

performing the smart authentication process with the SFP module includes;

sending a first message to the logic circuitry of the SFP module; and

receiving a second message from the SFP module in response to the first message; and

verifying that the second message was correctly encrypted in accordance with a specified algorithm.

20. A method as in claim 18 wherein:

the real-time algorithm is a time-based algorithm; and

performing the smart authentication process with the SFP module includes;

receiving a message from the SFP module; and

verifying that the message was correctly encrypted in accordance with a specified algorithm using a current time as an encryption parameter.

15. A method comprising:

upon a standard small form-factor pluggable (SFP) module being inserted into an SFP jack on a network host device, determining if the SFP module is a legacy device or a smart device;

upon determining that the SFP module is a legacy device, receiving a magic code from the SFP module and determining if the magic code is a valid magic code; and

upon determining that the SFP module is a smart device, performing a smart authentication process with the SFP module.

16. A method as in claim 15 wherein determining if the SFP module is a legacy device or a smart device includes:

receiving contents of a vendor name field stored on the SFP module from the SFP module;

if the received contents store a first value, then determining that the SFP module is a smart module;

if the received contents store any other value, then determining that the SFP module is a legacy module.

17. A method as in claim 15 wherein determining if the magic code is a valid magic code includes:

receiving identifying information from the SFP module;

cryptographically combining the received identifying information with a magic key stored in memory of the network host device to produce a computed magic code;

comparing the received magic code with the computed magic code;

if the received magic code and the computed magic code are the same, then authenticating the SFP;

if the received magic code and the computed magic code are not the same, then identifying the SFP as counterfeit.