WO2011046752A1

WO2011046752A1 - Systems and methods for license entitlement key distribution

Info

Publication number: WO2011046752A1
Application number: PCT/US2010/050966
Authority: WO
Inventors: Andrew Hilton
Original assignee: Schweitzer Engineering Laboratories Inc
Current assignee: Schweitzer Engineering Laboratories Inc
Priority date: 2009-10-14
Filing date: 2010-09-30
Publication date: 2011-04-21
Anticipated expiration: 2012-04-14
Also published as: US20110088096A1; US8261357B2

Abstract

The present disclosure relates to systems and methods for the distribution of license entitlement keys utilizing a small form-factor pluggable (SFP) transceiver. An SFP transceiver may be utilized in connection with a communication device that transmits data according to a variety of communication protocols. In various embodiments, the license entitlement keys may be generated using an SFP configuration value stored in machine-readable storage medium in the SFP transceiver. The SFP configuration value may be an input, together with other values associated with the SFP transceiver and a secret key in order to generate a license entitlement key. The secret key may be stored in the communication device, and may be stored in such a manner so to not be externally readable. In certain embodiments, configuration settings may be tied to the license entitlement key.

Description

SYSTEMS AND METHODS FOR

LICENSE ENTITLEMENT KEY DISTRIBUTION

Technical Field

[0001] The present disclosure relates to systems and methods for the distribution of license keys. More particularly, the present disclosure relates to the distribution of license keys in connection with a small form-factor pluggable transceiver.

Brief Description of the Drawings

[0002] FIG. 1 illustrates a flow chart of one embodiment of a method for license key distribution.

[0003] FIG. 2 illustrates a functional block diagram of a system for validating a license.

[0004] FIG. 3 illustrates a block diagram of one embodiment of a machine-readable storage medium, which may be comprised within an SFP transceiver.

Detailed Description of Preferred Embodiments

[0005] Disclosed herein are systems and methods for the distribution of license entitlement keys utilizing a small form-factor pluggable (SFP) transceiver. An SFP transceiver may be utilized in connection with a communication device that transmits data according to a variety of communication protocols. In various embodiments, the license entitlement keys may be generated using an SFP configuration value stored in a machine-readable storage medium in the SFP transceiver. The SFP configuration value may be an input, together with other values associated with the SFP transceiver and a secret key in order to generate a license entitlement key. The secret key may be stored in the communication device, and may be stored in such a manner so to not be externally readable. Certain embodiments may allow for the distribution of license entitlement keys in the field and without the use of a license server, Internet connection, dial-up connection and/or a USB dongle. Such embodiments may advantageously allow for devices to be upgraded and reconfigured in place and may thus reduce downtime and expense associated with the upgrade.

[0006] In certain embodiments, configuration settings may be tied to the generated license entitlement key. In one embodiment, based on a first value of the generated license entitlement key, a communication device may be configured to operate as an Ethernet switch, while based on a second value of the generated license entitlement key, the communication device may be configured to operate as a multiplexer in a synchronized optical network (SONET). Such embodiments may provide a convenient and transparent system for an end user to upgrade the communication device that combines the task of license management and device configuration. Further, such embodiments may facilitate the process of upgrading from one communication standard to another.

[0007] An SFP transceiver is a hot-pluggable transceiver, which may be used for both telecommunication and data communications applications. SFP transceivers may be configured to interface a communication device (e.g., a switch or a router) to a fiber optic or copper networking cable. SFP transceivers may be designed to support communications according to a variety of communication protocols and standards, including SONET, Ethernet, Fibre Channel, synchronous digital hierarchy (SDH), and the like. An SFP transceiver may also be configured to comply with various standards, including the SFP+ standard and the XFP standard. It will be understood that in any instance where an SFP transceiver is received herein, an SFP+ transceiver or an XFP transceiver may also be utilized.

[0008] An SFP transceiver may comply with a multi-source agreement (MSA), which ensures the interchangeability of SFP transceivers from different vendors. An SFP transceiver may comply with one or more MSAs, including SFP-8472 digital diagnostic monitor interface (DMI). This allows the SFP transceiver to monitor its various signal levels. It also provides information about the configuration of the SFP transceiver. The DMI interface provides access to two databases, namely an AO database and an A2 database, which can be read via an I2C interface. The AO database may contain vendor specific information, while the A2 database contains SFP transceiver

parameters and user configuration data.

[0009] SFP transceivers are available with a variety of different transmitter and receiver types, allowing users to select the appropriate transceiver for each link to provide the required optical reach over the available optical fiber type (e.g., multi-mode fiber or single-mode fiber). SFP transceivers are also available with a copper cable interface, allowing a communication device designed primarily for optical fiber communications to also communicate over an unshielded twisted pair networking cable.

[0010] Several aspects of the embodiments described below will be illustrated as software modules or components. As used herein, a software module or component may include any type of computer instruction or computer executable code located within a memory storage device. A software module or component may, for instance, comprise one or more physical or logical blocks of computer instructions, which may be organized as a routine, program, object, component, data structure, etc., that performs one or more tasks or implements particular abstract data types.

[0011] In certain embodiments, a particular software module or component may comprise disparate instructions stored in different locations of a memory storage device, which together implement the described functionality of the module. Indeed, a module or component may comprise a single instruction or many instructions, and may be distributed over several different code segments, among different programs, and across several memory storage devices. Some embodiments may be practiced in a distributed computing environment where tasks are performed by a remote processing device linked through a communications network. In a distributed computing

environment, software modules or components may be located in local and/or remote memory storage devices. In addition, data being tied or rendered together in a database record may be resident in the same memory storage device, or across several memory storage devices, and may be linked together in fields of a record in a database across a network.

[0012] Embodiments may be provided as a computer program product including a machine-readable storage medium having stored thereon instructions that may be used to program a computer (or other electronic device) to perform processes described herein. The machine-readable storage medium may include, but is not limited to, hard drives, floppy diskettes, optical disks, CD-ROMs, DVD-ROMs, ROMs, RAMs, EPROMs, EEPROMs, magnetic or optical cards, solid-state memory storage devices, or other types of media/machine-readable storage medium suitable for storing electronic instructions.

[0013] Reference in the specification to "one embodiment" or "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. The appearance of the phrase "in one embodiment" in various places in the specification are not necessarily all referring to the same embodiment.

[0014] FIG. 1 illustrates a flow chart of one embodiment of a method 100 for license key distribution. At step 1 10, an SFP transceiver is communicatively coupled with a communication device. The communication device may be of any type of device that is configured to receive an SFP transceiver. For example, the communication device may be configurable as either an Ethernet switch, or a SONET multiplexer. The

communication device may also communicate according to different communication protocols. Similarly, the SFP transceiver may be configured to communicate according to a variety of different communication protocols, line rates, link lengths, and

transmission media.

[0015] The SFP transceiver may be communicatively coupled to the communication device by way of a communication link. The communication link may comply with the SFP Transceiver Multi-Source Agreement (MSA). An SFP transceiver may also comply with other multi-source agreements, such as XFP, SFP+, and the like.

[0016] Once the SFP transceiver is in communication with the communication device, the communication device may determine whether the SFP transceiver has a stored license entitlement key (LEK) 120. If a stored LEK exists, method 100 may proceed to step 160. If a stored license entitlement key does not exist, method 100 proceeds to step 130.

[0017] Upon determining that an SFP transceiver does not include a stored LEK, an LEK may be generated. An SFP configuration value may be accessed 130. An SFP transceiver may include a machine-readable storage medium, which may contain the SFP configuration value. In certain embodiments, a unique SFP configuration value may be assigned to each SFP transceiver.

[0018] A secret key may be accessed 140 for use in generating the LEK. In certain embodiments, the secret key is included within a processor or a field-programmable gate array (FPGA) in the communication device. Certain processors or FPGAs may include internal values that are not readable external to the processor or FPGA. In certain embodiments, the secret key is stored such that it is not readable external to the processor or FPGA. In this way, the secrecy of the secret key may be enhanced. In other embodiments, the secret key may be stored in other locations and in a variety of forms of machine-readable media. In one embodiment, the secret key may be stored in an encrypted external flash memory, such as the Numonyx Krypto security

technologies available from Numonyx B.V., of Rolle, Switzerland.

[0019] Using the secret key and the SFP configuration value, an LEK may be generated and stored 150. In one embodiment, the generated LEK may be the output of a hash algorithm, which utilizes as inputs the SFP configuration value and the secret key. The hash algorithm may include secure hash algorithms (SHA), including SHA-0, SHA-1 , SHA-2. In alternative embodiments, other hash functions or data algorithms may be utilized. The output of the hash algorithm may be utilized as a license entitlement key. In various embodiments, further manipulation may be performed on the output of the hash algorithm in order to generate the license entitlement key. Once the license entitlement key has been generated, it may be stored. In certain

embodiments, the license entitlement key may be stored in a machine-readable storage medium within the SFP transceiver. In one embodiment, the secret key and the SFP configuration value are used as inputs to an SHA-1 algorithm. The output of the SHA-1 is a 20 byte long value, and constitutes the LEK. The LEK may then be stored into a machine-readable storage medium in the SFP transceiver.

[0020] After generating the LEK, method 100 then determines whether the

generated LEK is valid 160. A variety of techniques may be utilized to validate the LEK. In various embodiments, a database of valid license entitlement keys may be stored in a machine-readable storage medium in the SFP transceiver or stored in a machine- readable storage medium in the communication device. The generated LEK may be compared to the database of valid license entitlement keys. In still other embodiments, a license server, a USB authentication fob, a smart card, or other authentication technique may be employed. If the generated LEK is not found by one of the above- listed techniques, the LEK may be determined to be invalid. Upon determining that the LEK is not valid, method 100 may disable the communication device 180. In this manner, a measure of security may be introduced to ensure proper licensing.

[0021] If the generated LEK is validated, the communication device may be configured 170 based on a license associated with the generated LEK. For example, a configuration setting may be associated with a particular license, and based on the configuration setting, the communication device may be reconfigured. In one

embodiment, the configuration setting may comprise a setting of an FPGA. The configuration setting may cause the FPGA to select from a plurality of configuration files. For example, one configuration file may configure the FPGA to process Ethernet communications, while another configuration file may configure the FPGA to process communications according to a different protocol, such as SONET. A configuration file may be provided for each of the various communications protocols compatible with an SFP transceiver.

[0022] FIG. 2 illustrates one embodiment of a functional block diagram of a system 200 for validating a license. As illustrated in FIG. 2, a communication network 210 is in communication with an SFP transceiver 220 via a communication link 212. A

transceiver 222 may be configured to send and receive data via communication link 212 to communication network 210. Communication link 212 may include a variety of transmission media, including fiber optic or electrical cable. SFP transceiver 220 may be configured to communicate with communication network 210 in a variety of protocols and line speeds, including SONET (e.g., OC-1 , OC-3, OC-12, OC-24, OC-48, OC 192), SDH (e.g., STM-1 , STM-4, STM-16 and STM-64), and Ethernet (e.g., 100BASE-T, 100BASE-FX, 100BASE-SX, 100BASE-BX, 1000BASE-X, 1000BASE-T, and

1000BASE-CX).

[0023] SFP transceiver 220 includes a machine-readable storage medium 224. As illustrated in greater detail in FIG. 3 and discussed in greater detail below, machine- readable storage medium 224 may include a variety of types of information, including an SFP configuration value, and other types of information, such as a serial number, an identifier of a manufacturer, information regarding the type of the SFP transceiver, and the like. SFP transceiver 220 may be communicatively coupled via an SFP transceiver communication link 214 to a communication device 230. Link 214 may comprise an I2C interface. Each of communication device 230 and SFP transceiver 220 may comprise a port or an interface to create link 214.

[0024] SFP transceiver 220 is in communication with communication device 230 by way of an SFP communication link 214. Communication device 230 may include a processor 232. Processor 232 may operate using any number of processing rates, architectures, and may be embodied as a general purpose processor, an application specific processor, a field-programmable gate array, or other programmable device. Processor 232 may be configured to perform various algorithms and calculations described herein. In certain embodiments, including the illustrated embodiment of FIG. 2, a secret key 234 is stored within processor 232. In certain embodiments, secret key 234 may not be readable outside of processor 232, and accordingly, the secrecy of secret key 234 may be enhanced. Certain FPGA devices may allow for such secret values to be maintained within the FPGA. In other embodiments, secret key 234 may be stored in other locations.

[0025] A data bus 246 may provide a communication link between processor 232 and a machine-readable storage medium 236. Machine-readable storage medium 236 may be implemented using a variety of technologies, including hard drives, floppy diskettes, RAM, solid-state memory storage devices, and other storage media suitable for storing electronic instructions and other data. Certain embodiments may be provided as a computer program product including a machine-readable storage medium having stored instructions thereon that may be used to program a computer (or other electronic device) to perform processes described herein.

[0026] Machine-readable storage medium 236 may be the repository of software modules or other machine-readable instructions that are executable by processor 232. In particular, machine-readable storage medium 236 may store a license entitlement key generation module 238, a license validation module 240, a configuration module 242, configuration settings module 244, and a database of license entitlement keys 250.

[0027] License entitlement key generation module 238 may perform a method for generating a license entitlement key. In one embodiment, license entitlement key generation module 238 comprises a secure hash algorithm, which may utilize values stored in machine-readable storage medium 224 and secret key 234 to generate an output digest.

[0028] License validation module 240 may be operable to validate the license entitlement key generated by license entitlement key generation module 238. In one embodiment, a valid license entitlement key (not shown) is maintained in machine- readable storage medium 224. In certain embodiments, machine-readable storage medium 224 comprises only a single valid license entitlement key, which is specific to SFP transceiver 220. The license entitlement key generated by license entitlement key generation module 238 may be compared to the valid license entitlement key stored in machine-readable medium 224 in order to assess the validity of the generated license entitlement key.

[0029] In other embodiments, license validation module 240 may be configured to operate in conjunction with a database of license entitlement keys 250 stored on machine-readable storage medium 236. In some embodiments, database of license entitlement keys 250 may be encrypted so as to protect against unauthorized access to the database of license entitlement keys 250. In alternative embodiments, database of license entitlement keys 250 may be remote to communication device 230, and various techniques may be utilized to validate a license entitlement key (e.g., a license server, a USB authentication fob, a smart card, and the like).

[0030] Configuration module 242 may configure communication device 230 based upon the license corresponding to a valid license entitlement key. Various configuration settings may be stored in configuration settings module 244. In one embodiment, the configuration setting may comprise one or more settings of an FPGA, in embodiments where processor 232 comprises an FPGA. For example, the configuration setting may cause the FPGA to select from a plurality of configuration files, which may be stored in configuration settings module 244. One configuration file may configure the FPGA in a mode to process Ethernet communications, while another configuration file may configure the FPGA in another mode to process communications according to a different protocol, such as SONET.

[0031] FIG. 3 illustrates one embodiment of machine-readable storage medium 224, which may be comprised within an SFP transceiver. Machine-readable storage medium 224 comprises two databases, an AO database 310, and an A2 database 330. Various data may be stored in AO database 310, including a vendor name 312, a serial number 314, a transceiver wavelength 316, a manufacturer identification 318, and a line rate 320. In certain embodiments, AO database 310 may comprise read-only memory. A2 database 330 may comprise both read and write accessible memory and read-only memory. In a memory location for calibration data 332, various data may be recorded relating to the calibration of the SFP transceiver.

[0032] An SFP configuration value 336, a generated license entitlement key value 338, and a valid license entitlement key value 340 may be stored in a memory location for user configuration information 334. In certain embodiments, the SFP configuration value 336 and/or the valid license entitlement key value 340 may be stored in read-only memory.

[0033] As discussed in connection with FIGS. 1 and 2, above, SFP configuration value 336 may be a value that is utilized as an input to an algorithm for generating a license entitlement key. Similarly, various values from AO database 310 may also be used as inputs to the algorithm for generating a license entitlement key. The generated license entitlement key value may be compared to the valid license entitlement key value 340 in order to validate the generated license entitlement key. Once generated, a license entitlement key may be stored in the memory location for a generated license entitlement key value 338. By storing a generated license entitlement key, a system can validate the license entitlement key when the system is activated without requiring that the license entitlement key be generated again.

[0034] It will be obvious to those having skill in the art that many changes may be made to the details of the above-described embodiments without departing from the underlying principles of the present disclosure. The scope of the present invention should, therefore, be determined only by the following claims.

Claims

1 . A license entitlement key distribution comprising:

a communication device comprising,

a processor,

a small form-factor pluggable (SFP) transceiver communication interface,

a secret key,

a first machine-readable storage medium comprising,

a license entitlement key generation module executable by the processor; and

an SFP transceiver comprising,

a second machine-readable storage medium configured to store an SFP configuration value, and

a device communication port configured to communicatively couple the SFP transceiver with the SFP transceiver communication interface; and

wherein upon communicatively coupling the SFP transceiver to the

communication device, the license entitlement key generation module generates a generated license entitlement key based on the SFP configuration value and the secret key.

2. The system of claim 1 , wherein the second machine-readable storage medium further comprises a valid license entitlement key value; and

wherein the first machine-readable storage medium comprises a license validation module configured to validate a license by comparing the generated license entitlement key to the valid license entitlement key value.

3. The system of claim 2, wherein the license validation module is further configured to disable the communication device when the generated license entitlement key is unequal to the valid license entitlement key value.

4. The system of claim 1 , wherein the license entitlement key generation module comprises a hash algorithm and the secret key and the SFP configuration value are inputs to the hash algorithm; and wherein the output of the hash algorithm comprises the generated license entitlement key.

5. The system of claim 4, wherein the hash algorithm comprises SHA-1 .

6. The system of claim 1 , wherein the first machine-readable storage medium further comprises a configuration module executable by the processor, the configuration module configured to select a configuration setting based on the generated license entitlement key and to configure the communication device based on the configuration setting.

7. The system of claim 6, wherein the processor comprises a field- programmable gate array (FPGA), and wherein the configuration setting comprises a setting of the FPGA.

8. The system of claim 7, wherein the configuration setting in a first mode configures the FPGA to process Ethernet communications, and the configuration setting in a second mode configures the FPGA to process synchronized optical network communications.

9. The system of claim 1 , wherein the license entitlement key generation module is further configured to store the generated license entitlement key in the second machine-readable storage medium.

10. The system of claim 1 , wherein the second machine-readable storage medium is further configured to store at least one of an identifier of a manufacturer of the SFP transceiver and a serial number of the SFP transceiver; and wherein the license entitlement key generation module is further configured to generate the license entitlement key based on at least one of an identifier of a manufacturer of the SFP transceiver and a serial number of the SFP transceiver.

1 1 . The system of claim 1 , wherein the communication device is configurable based on the license entitlement key to operate as a synchronized optical network multiplexer in a first mode and to operate as an Ethernet switch in a second mode.

12. The system of claim 1 , wherein the SFP transceiver communication interface comprises an I2C interface.

13. A method for generating a license entitlement key, the method

comprising:

communicatively coupling a small form-factor pluggable (SFP) transceiver with a communication device;

accessing a secret key stored within the communication device;

accessing an SFP configuration value stored on an SFP machine-readable storage medium in the SFP transceiver; and

generating a generated license entitlement key based on the SFP configuration value and the secret key.

14. The method of claim 13, further comprising validating a license by comparing the license entitlement key to a valid license entitlement key value.

15. The method of claim 13, further comprising determining that a license is invalid by determining that the generated license entitlement key is unequal to a valid license entitlement key value; and

disabling the communication device.

16. The method of claim 13, wherein generating a generated license entitlement key further comprises inputting the secret key and the SFP configuration value into a hash algorithm; and wherein the generated license entitlement key comprises the output of the hash algorithm.

17. The method of claim 16, wherein the hash algorithm comprises SHA-1

18. The method of claim 13, further comprising:

selecting a configuration setting based on the generated license entitlement key; and

configuring the communication device based on the configuration setting.

19. The method of claim 18, wherein the configuration setting comprises a setting of a field-programmable gate array (FPGA).

20. The method of claim 19, wherein the configuration setting in a first mode configures the FPGA to process Ethernet communications, and the configuration setting in a second mode configures the FPGA to process synchronized optical network communications.

21 . The method of claim 13, further comprising storing the license entitlement key in the SFP machine-readable storage medium.

22. The method of claim 13, wherein generating the generated license entitlement key is further based on a second value stored in the SFP machine-readable storage medium, and wherein the second value represents at least one of an identifier of a manufacturer of the SFP transceiver and a serial number of the SFP transceiver.

23. The method of claim 13, wherein the communication device is

configurable based on the generated license entitlement key to operate as a

synchronized optical network multiplexer in a first mode and an Ethernet switch in a second mode.

24. A communication device configured to receive a small form-factor pluggable (SFP) transceiver, the SFP transceiver comprising an SFP configuration value, the communication device comprising:

a processor;

an SFP transceiver communication interface configured to communicatively couple the SFP transceiver to the communication device;

a secret key; and

a first machine-readable storage medium, the first machine- readable storage medium comprising,

a license entitlement key generation module executable by the processor and configured to generate a license entitlement key,

wherein upon communicatively coupling the SFP transceiver to the

communication device, the license entitlement key generation module generates a license entitlement key based on the SFP configuration value and the secret key.