Granted Patent B1

US 12,744,676 · App. 18/622,331 · Granted Sep 22, 2026

Inventors: Vivek Krishnan Devarajan (Seattle, WA); Luis Fernando Gonzalez Fernandez (Seattle, WA); Tuhin Gupta (Seattle, WA); William Bennett (Omaha, NE); Lee Douglas Goodrich (Seattle, WA); Joseph Papa (Seattle, WA)

Assignee: AMAZON TECHNOLOGIES, INC.

H04L9/3247H04L9/0877H04L63/0876H04L9/0866

Abstract

Claims (90)

1 . A system associated with a data center network, the system comprising:

a server;

a network interface card (NIC) connected to the server that performs first operations to cryptographically verify itself to a Dynamic Host Configuration Protocol (DHCP) server, the first operations comprising:

generating a private key using one-time programmable (OTP) seed parameters stored in a secure hardware component of a System-on-a-Chip (SoC) of the NIC;

populating a first DHCP Packet with authentication data comprising a hardware identifier (ID) associated with the SoC, and a public key ID (PuK ID) that indicates a public key corresponding to the private key;

signing the first DHCP packet with the private key to result in a first signed DHCP packet;

sending the first signed DHCP packet to the DHCP server; and

receiving a second DHCP packet from the DHCP server, the second DHCP packet proposing an Internet Protocol (IP) address for the NIC; and

the DHCP server configured to perform second operations comprising:

storing a list of hardware IDs that correspond to SoCs of NICs that are permitted to be connected to the data center network;

identifying the public key using the PuK ID from the first signed DHCP Packet;

verifying the first signed DHCP packet using the public key;

authenticating the SoC of the NIC by determining that the hardware ID is included in the list of hardware IDs; and

sending the second DHCP packet to the NIC.

2 . The system of claim 1 , the operations further comprising:

during a boot process of the SoC, measuring firmware code of the SoC to generate firmware measurement data;

populating the first DHCP packet with the firmware measurement data;

comparing, by the DHCP server, the firmware measurement data with expected firmware measurement data for the SoC; and

authenticating, by the DHCP server, the firmware code of the SoC based at least in part on the comparing.

3 . The system of claim 1 , wherein generating the private key comprises:

by a bootloader and during a boot process of the SoC, deriving the private key using at least the OTP seed parameters of the SoC.

4 . The system of claim 1 , further comprising:

identifying, by the NIC, a service IP address from the second DHCP packet, the service IP address being associated with a Domain Name Service (DNS) server; and

sending, from the NIC, a DNS request to the DNS server using the service IP address.

5 . A computer-implemented method comprising:

generating, at a network device, a private key using one-time programmable (OTP) seed parameters stored locally on the network device;

populating one or more first Dynamic Host Configuration Protocol (DHCP) packets with authentication data including (i) a unique hardware identifier (ID) associated with a hardware chip in the network device and (ii) a public key ID that indicates a public key corresponding to the private key;

signing the one or more first DHCP packets with a signature using the private key to result in one or more first signed DHCP packets;

sending the one or more first signed DHCP packets to a DHCP server; and

receiving, from the DHCP server, a second DHCP packet that indicates an Internet Protocol (IP) address assigned to the network device, wherein receipt of the second DHCP packet indicates that the DHCP server authenticated the network device by using the public key to verify that the signature was generated using the private key.

6 . The computer-implemented method of claim 5 , further comprising:

measuring firmware code of the network device to generate firmware measurement data;

populating a third DHCP packet with the firmware measurement data;

signing the third DHCP packet with the private key to result in a signed DHCP Request packet; and

sending the third DHCP packet to the DHCP server,

wherein receipt of the second DHCP packet indicates that the DHCP server authenticated the firmware code of the network device.

7 . The computer-implemented method of claim 5 , wherein generating the private key comprises:

by a bootloader and during a boot process of the hardware chip, deriving the private key using at least the OTP seed parameters.

8 . The computer-implemented method of claim 5 , further comprising:

computing a hash of at least a portion of the one or more first DHCP packets to result in a message digest;

populating the one or more first DHCP packets with the message digest; and

signing the message digest with the private key.

9 . The computer-implemented method of claim 5 , wherein:

the OTP seed parameters are programmed into fuses of the network device by burning the fuses, and

the unique hardware ID is burned into the fuses,

further comprising extracting the OTP seed parameters and the hardware ID from the fuses.

10 . The computer-implemented method of claim 9 , wherein the second DHCP packet is a DHCP Offer packet signed with a signature generated using a second private key associated with the DHCP server, further comprising:

using a second public key corresponding to the second private key, verifying that the signature on the DHCP Offer packet was generated using the second private key associated with the DHCP server.

11 . The computer-implemented method of claim 5 , wherein:

the one or more first DHCP packets comprise a DHCP Discover packet that is populated with the authentication data;

receiving the second DHCP packet includes receiving a DHCP Offer packet and receipt of the DHCP Offer packet indicates that the DHCP server authenticated hardware of the network device; and

the one or more first DHCP packets further comprise a DHCP Request packet that is populated with the authentication data and with firmware measurement data indicating a measurement of firmware code of the network device;

further comprising:

receiving a DHCP Acknowledgement packet that indicates the IP address is assigned to the network device, the receipt of the DHCP Offer packet indicating that the DHCP server authenticated the firmware code of the network device.

12 . The computer-implemented method of claim 5 , wherein the network device and the DHCP server are connected to a data center network, further comprising:

identifying, at the network device, a service IP address from the second DHCP packet, the service IP addresses including a service IP address associated with a Domain Name Service (DNS) server; and

sending a DNS request to the DNS server based at least in part on the second DHCP packet including the service IP addresses.

13 . A Dynamic Host Configuration Protocol (DHCP) server configured to cryptographically verify network devices that request Internet Protocol (IP) addresses, the DHCP server comprising:

one or more processors; and

one or more computer-readable media storing computer-executable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

receiving a list of unique hardware identifiers (IDs) associated with a hardware chips in the network devices that are permitted to be connected to a network associated with the DHCP server;

receiving, from a network device, one or more first signed DHCP packets with authentication data including (i) a unique hardware identifier (ID) associated with a hardware chip in the network device and (ii) a public key ID that indicates a public key corresponding to a private key used to sign the one or more first signed DHCP packets;

using the public key ID, retrieving the public key that corresponds to a private key that was used to sign the one or more first signed DHCP packets;

using the public key, verifying that a signature on the one or more first signed DHCP packets was generated using the private key;

authenticating the hardware chip by determining that the unique hardware ID is included in the list of unique hardware IDs; and

sending, to the network device, a second DHCP packet indicating an IP address.

14 . The DHCP server of claim 13 , the operations further comprising:

receiving, in the one or more first DHCP packets, firmware measurement data indicating measurements of firmware code of the hardware chip, the firmware measurement data being signed using the private key;

comparing the firmware measurement data with expected firmware measurement data for the hardware chip; and

authenticating the firmware code of the hardware based at least in part on the comparing and on the firmware measurement data being signed using the private key.

15 . The DHCP server of claim 13 , the operations further comprising:

based at least in part on authenticating the hardware chip, determining to provide the network device with service IP addresses for services associated with the network; and

populating the second DHCP packet with a service IP address being associated with a Domain Name Service (DNS) server.

16 . The DHCP server of claim 13 , the operations further comprising:

signing the second DHCP packet with a second signature using a second private key that is associated with the DHCP server, wherein the network device accesses a second public key that corresponds to the second private key and is usable to verify the second signature.

17 . The DHCP server of claim 13 , wherein:

the one or more first DHCP packets comprise a DHCP Discover packet that is populated with the authentication data;

sending the second DHCP packet includes sending a DHCP Offer packet indicating that the DHCP server authenticated hardware of the network device;

the one or more first DHCP packets further comprise a DHCP Request packet that is populated with firmware measurement data indicating a measurement of firmware code of the network device, the firmware measurement data being signed using the private key;

further comprising:

using the public key, verifying the firmware measurement data was signed using the private key;

authenticating the firmware code based at least in part on the firmware measurement data being signed using the private key; and

sending a DHCP Acknowledgement packet that indicates the IP address is assigned to the network device.

18 . The DHCP server of claim 13 , wherein:

the unique hardware ID is burned into fuses of the network device; and

the list of unique hardware identifiers (IDs) is a list of hardware IDs for the hardware chips in the network devices that are permitted to be connected to a network associated with the DHCP server.

19 . The DHCP server of claim 13 , the operations further comprising:

determining that a media access control (MAC) address associated with the network device was signed with the signature in the one or more first signed DHCP packets such that the MAC address was not spoofed by an intermediate device; and

creating a static binding between the MAC address and the IP address.

20 . The DHCP server of claim 13 , wherein the private key is generated by a bootloader of the network device, during a boot process of the hardware chip, and using at least one-time programmable (OTP) seed parameters stored at the network device.

References Cited (10)