METHOD FOR AUTHENTICATING A NETWORKED ENDPOINT USING A PHYSICAL (POWER) CHALLENGE

• US 20170331803A1
• Filed: 05/10/2016
• Published: 11/16/2017
• Est. Priority Date: 05/10/2016
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Parello, John, Ramanujam, Padmanabhan, Pollakattu, Sarat
• Granted Patent: US 10,235,516 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: H04L 25/02 Details ; arrangements for supplying electrical power along data transmission lines systems for transmitting signals via power distribution lines H04B3/54
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 9/3221 interactive zero-knowledge proofs

Abstract

Various systems and methods for using power challenges to authenticate network devices are disclosed herein. For example, one method involves initiating a power challenge to authenticate an endpoint device, which involves, at least in part, requesting the endpoint device to perform a specific power signature; receiving data indicating whether the endpoint device performed the requested power signature within a given time interval, wherein the data can be received from, e.g., a power interface or other device capable of observing the endpoint device; processing the received data to determine if the endpoint device correctly performed the requested power signature; and if the endpoint correctly performed the power signature, authenticating the endpoint.

Claims

1. A method comprising

determining whether to initiate a power challenge for an endpoint device;

in response to a determination to initiate a power challenge, determining whether the endpoint device is connected to a known power interface;

in response to a determination that the endpoint device is not connected to a known power interface,

sending a power challenge to the endpoint device, and

sending an observation request to one or more of a plurality of sensor devices;

receiving proof of work information from one or more of the plurality of sensor devices, wherein

the proof of work information is associated with the power challenge; and

determining whether the endpoint device adequately performed the power challenge by processing the proof of work information.

2. The method of claim 1, wherein the processing further comprises

determining whether a trusted sensor device adequately observed a power signature associated with the power challenge.

3. The method of claim 2, wherein the processing further comprises

authenticating the endpoint device in response to a determination that a trusted sensor device adequately observed the power signature.

4. The method of claim 1, wherein the processing further comprises

determining whether a quorum of the plurality of sensor devices observed a power signature associated with the power challenge.

5. The method of claim 1, wherein the processing further comprises

generating a weighted average, wherein

the weighted averaged is based on the proof of work information received from the one or more of the plurality of sensor devices.

6. The method of claim 1, further comprising

authenticating the endpoint device in response to a determination that the endpoint device adequately performed the power challenge.

7. The method of claim 1, further comprising

initiating an error protocol in response to a determination that the endpoint device did not adequately perform the power challenge.

8. The method of claim 1, further comprising

determining whether to initiate a power challenge for an endpoint device;

and

the determining whether the endpoint device is connected to a known power interface is performed in response to a determination to initiate the power challenge.

9. A system comprising:

a challenge initiating module, wherein the challenge initiating module is configured to determine whether to initiate a power challenge for an endpoint device,

in response to a determination to initiate a power challenge, determine whether the endpoint device is connected to a known power interface, and

in response to a determination that the endpoint device is not connected to a known power interface,

send a power challenge to the endpoint device;

a server interface module, wherein the server interface module is configured to

send an observation request to one or more of a plurality of sensor devices, wherein

the observation request is sent in response to the determination that the endpoint device is not connected to a known power interface, and

receive proof of work information from one or more of the plurality of sensor devices, wherein

the proof of work information is associated with the power challenge; and

a challenge processing module, wherein the challenge processing module is configured to

determine whether the endpoint device adequately performed the power challenge by processing the proof of work information.

10. The system of claim 9, wherein the challenge processing module is further configured to

determine whether a trusted sensor device adequately observed a power signature associated with the power challenge.

11. The system of claim 10, wherein the challenge processing module is further configured to

authenticate the endpoint device in response to a determination that a trusted sensor device adequately observed the power signature.

12. The system of claim 9, wherein the challenge processing module is further configured to

determine whether a quorum of the plurality of sensor devices observed a power signature associated with the power challenge.

13. The system of claim 9, wherein the challenge processing module is further configured to

generate a weighted average, wherein

the weighted averaged is based on the proof of work information received from the one or more of the plurality of sensor devices.

14. The system of claim 9, wherein the challenge processing module is further configured to

authenticate the endpoint device in response to a determination that the endpoint device adequately performed the power challenge.

15. The system of claim 9, wherein the challenge processing module is further configured to

initiate an error protocol in response to a determination that the endpoint device did not adequately perform the power challenge.

16. An apparatus comprising:

a challenge initiating module, wherein the challenge initiating module is configured to determine whether to initiate a power challenge for an endpoint device,

in response to a determination to initiate a power challenge, determine whether the endpoint device is connected to a known power interface, and

in response to a determination that the endpoint device is not connected to a known power interface,

send a power challenge to the endpoint device;

a server interface module, wherein the server interface module is configured to

send an observation request to one or more of a plurality of sensor devices, wherein

the observation request is sent in response to the determination that the endpoint device is not connected to a known power interface, and

receive proof of work information from one or more of the plurality of sensor devices, wherein

the proof of work information is associated with the power challenge; and

a challenge processing module, wherein the challenge processing module is configured to

determine whether the endpoint device adequately performed the power challenge by processing the proof of work information.

17. The apparatus of claim 16, wherein the challenge processing module is further configured to

determine whether a trusted sensor device adequately observed a power signature associated with the power challenge.

18. The apparatus of claim 17, wherein the challenge processing module is further configured to

authenticate the endpoint device in response to a determination that a trusted sensor device adequately observed the power signature.

19. The apparatus of claim 16, wherein the challenge processing module is further configured to

determine whether a quorum of the plurality of sensor devices observed a power signature associated with the power challenge.

20. The apparatus of claim 16, wherein the challenge processing module is further configured to

generate a weighted average, wherein

the weighted averaged is based on the proof of work information received from the one or more of the plurality of sensor devices.

21. The apparatus of claim 16, wherein the challenge processing module is further configured to

authenticate the endpoint device in response to a determination that the endpoint device adequately performed the power challenge.