Counterfeit prevention strategy for pluggable modules

• US 8,769,654 B2
• Filed: 06/23/2009
• Issued: 07/01/2014
• Est. Priority Date: 06/23/2009
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Tang, Norman, Carter, Adam Jonathan, Lai, David C., Peng, Liang Ping, Ding, Guoying
• Primary Examiner(s): Reza, Mohammad W
• Application Number:
  US12/489,608
• Publication Number:
  US 20100325432A1
• Time in Patent Office: 1,834 Days
• Field of Search: 726/3, 726/9, 726/18, 726/20, 713/153, 713/164, 713/165
• US Class Current: 726/9
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices

Abstract

A method is provided, including (a) upon a standard small form-factor pluggable (SFP) module being inserted into an SFP jack on a network host device, determining if the SFP module is a legacy device or a smart device, (b) upon determining that the SFP module is a legacy device, receiving a magic code from the SFP module and determining if the magic code is a valid magic code, and (c) upon determining that the SFP module is a smart device, performing a smart authentication process with the SFP module. Associated apparatuses and additional methods are also provided.

Claims

1. An apparatus comprising:

a first communications interface configured to communicatively couple to a network plug of a network cable;

a second communications interface configured to communicatively couple to a network host device, the second communications interface being constructed and arranged to mount into an opening of the network host device, the network host device being constructed and arranged to receive and mount a standard small form-factor pluggable module in the opening;

a microcontroller, the microcontroller being configured to perform transceiver functions between the first communications interface and the second communications interface; and

authentication circuitry, the authentication circuitry being communicatively coupled with the microcontroller and the second communications interface, wherein, the authentication circuitry is configured to;

determine whether the second communication interface is coupled to a legacy network host device or a smart network host device;

provide contents of a magic code cookie to the network host device when the second communications interface is communicatively coupled to a legacy network host device; and

perform a smart authentication procedure with the network host device when the second communications interface is communicatively coupled to a smart network host device, the smart authentication procedure utilizing a unique signature according to a time-based algorithm.

2. An apparatus as in claim 1 wherein the authentication circuitry is located on an authentication chip and the authentication chip includes:

logic circuitry;

firmware, the firmware storing;

the magic code cookie;

the unique signature;

and

hardening features, the hardening features protecting the contents of the firmware from being read from the authentication chip by an unauthorized external entity.

3. An apparatus as in claim 1 wherein the time-based algorithm

cryptographically combines the current time with the unique signature and sends the result to the network host device for verification.

4. An apparatus as in claim 1 wherein:

providing contents of the magic code cookie to the network host device verifies to the network host device that the apparatus was made by an approved manufacturer rather than by a non-approved manufacturer attempting to counterfeit; and

the smart authentication procedure verifies to the network host device that the apparatus was made by an approved manufacturer rather than by a non-approved manufacturer attempting to counterfeit, the verification provided by the smart authentication procedure serving as a stronger indicator that the apparatus is not counterfeit as compared to providing contents of the magic code cookie to the network host device.

5. An apparatus as in claim 1 wherein the microcontroller is configured to perform the transceiver functions in response to providing contents of the magic code cookie to the network host device and the smart authentication being performed successfully.

6. A method comprising:

producing a plurality of apparatuses as in claim 1;

offering for sale the plurality of apparatuses to a plurality of customers, each customer currently having and operating at least one legacy network host device which is configured to receive standard small form-factor pluggable (SFP) modules;

offering for sale to the plurality of customers, a smart network host device which is not compatible with legacy SFP modules; and

after allowing a period of time to lapse after a customer of the plurality of customers has purchased a number of the apparatuses of claim 1, encouraging such customer to retire its legacy network devices in favor of smart network host devices.

7. An apparatus as in claim 1 wherein the authentication circuitry is located on an authentication chip, the authentication chip residing in a separate integrated circuit package as the microcontroller.

8. An apparatus comprising:

an enclosure, the enclosure having a plurality of openings therein, each opening being constructed and arranged to receive a standard small form-factor pluggable (SFP) module; and

a logic board mounted within the enclosure, the logic board including a controller and a plurality of signal connectors, each of the plurality of signal connectors aligning with a different opening of the plurality of openings such that an SFP module, when inserted into the opening, interfaces with the signal connector;

wherein the controller is configured to;

upon an SFP module being inserted into an opening and interfacing with a signal connector, determine if the SFP module is a legacy device or a smart device;

upon determining that the SFP module is a legacy device, receive a magic code from the SFP module and determine if the magic code is a valid magic code; and

upon determining that the SFP module is a smart device, perform a smart authentication procedure with the SFP module, the smart authentication procedure utilizing a unique signature according to a time-based algorithm.

9. An apparatus as in claim 8 wherein the controller, when determining if the SFP module is a legacy device or a smart device, is configured to:

receive contents of a vendor name field stored on the SFP module from the SFP module;

if the received contents store a first-predefined value, then determine that the SFP module is a smart module;

if the received contents store any other value other than the predefined value, then determine that the SFP module is a legacy module.

10. An apparatus as in claim 8 wherein the controller, when determining if the magic code is a valid magic code, is configured to:

receive identifying information from the SFP module;

cryptographically combine the received identifying information with a magic key stored in memory on the logic board to produce a computed magic code;

compare the received magic code with the computed magic code;

if the received magic code and the computed magic code are the same, then authenticate the SFP;

if the received magic code and the computed magic code are not the same, then identify the SFP as counterfeit.

11. An apparatus as in claim 8 wherein:

the controller, when performing the smart authentication procedure with the SFP module, is configured to;

receive a message from the SFP module; and

verify that the message was correctly encrypted in accordance with the time based algorithm using a current time as an encryption parameter.

12. An apparatus as in claim 8 wherein:

the controller is further configured to reject the SFP module as a counterfeit when the SFP module has been determined to be a legacy device and the magic code has been determined not to be valid;

the controller is further configured to accept the SFP module when the SFP module has been determined to be a legacy device and the magic code has been determined to be valid; and

performing the smart authentication procedure with the SFP module includes;

rejecting the SFP module as a counterfeit when the smart authentication procedure indicates that the SFP module was made by a non-approved manufacturer attempting to counterfeit; and

otherwise, accepting the SFP module.

13. An apparatus as in claim 12 wherein:

the controller is configured to perform telecommunication functions with the SFP module in response to accepting the SFP module; and

the controller is configured to refrain from performing telecommunication functions with the SFP module in response to rejecting the SFP module.

14. A method comprising:

producing a plurality of smart SFP modules, each smart SFP module including an authentication chip capable of;

performing a smart authentication with an apparatus as in claim 8; and

communicating a magic code to a legacy network host device;

offering for sale the plurality of smart SFP modules to a plurality of customers, each customer currently having and operating;

at least one legacy network host device which is configured to receive SFP modules; and

at least one legacy SFP module;

producing a plurality of apparatuses as in claim 8;

configuring each of the plurality of apparatuses as in claim 8 to be capable of receiving a signal indicating that the apparatus should no longer communicate with legacy SFP modules, such that if the apparatus receives such a signal, that apparatus will no longer communicate with legacy SFP modules;

offering for sale to the plurality of customers, the plurality of configured apparatuses;

after allowing a period of time to lapse after a customer of the plurality of customers has purchased a number of smart SFP modules, encouraging such customer to retire each of its legacy network host devices in favor of a configured apparatus; and

after allowing a period of time to lapse after that customer has retired all of its legacy network host devices in favor of configured apparatuses, encouraging that customer to;

retire all of its legacy SFP modules in favor of smart SFP modules; and

send, to each of its configured apparatuses, the signal indicating that that apparatus should no longer communicate with legacy SFP modules.

15. A method comprising:

upon a standard small form-factor pluggable (SFP) module being inserted into an SFP jack on a network host device, determining if the SFP module is a legacy device or a smart device;

upon determining that the SFP module is a legacy device, receiving a magic code from the SFP module and determining if the magic code is a valid magic code; and

upon determining that the SFP module is a smart device, performing a smart authentication procedure with the SFP module, the smart authentication procedure utilizing a unique signature according to a time-based algorithm.

16. A method as in claim 15 wherein determining if the SFP module is a legacy device or a smart device includes:

receiving contents of a vendor name field stored on the SFP module from the SFP module;

if the received contents store a first value, then determining that the SFP module is a smart module;

if the received contents store any other value, then determining that the SFP module is a legacy module.

17. A method as in claim 15 wherein determining if the magic code is a valid magic code includes:

receiving identifying information from the SFP module;

cryptographically combining the received identifying information with a magic key stored in memory of the network host device to produce a computed magic code;

comparing the received magic code with the computed magic code;

if the received magic code and the computed magic code are the same, then authenticating the SFP;

if the received magic code and the computed magic code are not the same, then identifying the SFP as counterfeit.

18. A method as in claim 15 wherein:

performing the smart authentication procedure with the SFP module includes;

receiving a message from the SFP module; and

verifying that the message was correctly encrypted in accordance with the time-based algorithm using a current time as an encryption parameter.