/Patent Tracker
AmazonGranted patentNetworks & wirelessInterest 3/10

Amazon patents switch method to verify network cards without central servers

This patent describes a way for network switches in data centers to verify the identity of connected server components. Instead of relying on a central authorization server, the switch uses digital certificates to check if a network card is trusted. Once verified, the switch allows the card to access more resources by updating its security rules.

Why it mattersThis improves the security and speed of data center connections by allowing local switches to handle identity verification directly.

In the filing’s own words

Techniques for switches to establish trust with connected network interface cards (NICs) without the need of authorization servers. When an unauthorized NIC of a server is connected to a port of a switch, the switch provides port security such that hosts running on the server are unable to gain unauthorized access to resources. The switch may apply a default ACL to unauthorized NICs that allows limited communications, such as only communications to foundation services. The switch may establish trust with NICs using Public Key Infrastructure (PKI) vended identities. The unauthorized NIC may perform an attestation handshake with a PKI service to receive an identity certificate. A root certificate of a PKI service is stored on the switch which is used by the switch to verify the identity certificate of the NIC. Once authorized, the switch may construct ACLs that permit the NIC to communicate with other resources.

What exactly they claim (claim 1)

1. A system for authenticating a network interface card (NIC) of a server in a data center fabric, the system comprising: a Public Key Infrastructure (PKI) service of a network, the PKI service configured to perform first operations comprising: performing an attestation handshake with the NIC of the server to verify that the NIC is trustworthy; and providing the NIC with a digital certificate based at least in part on the NIC being verified as trustworthy; and a Top-of-Rack (ToR) switch configured to perform second operations comprising: storing a root certificate of the PKI service on the ToR switch, such that the ToR switch is a trust anchor for the PKI service; detecting a link up event indicating that the NIC has connected to a port of the ToR switch; applying a first access control list (ACL) to the port, wherein the first ACL defines a first set of permissions that allow the NIC to send traffic to foundation services associated with the data center fabric; allowing, based at least in part on the first ACL, the NIC to perform the attestation handshake with the PKI service; receiving the digital certificate from the NIC; verifying, using the root certificate, a certificate chain of the digital certificate; and in response to verifying the certificate chain of the digital certificate, applying a second ACL policy to the port, wherein the second ACL defines a second set of permissions that are more permissive than the first set of permissions.

Facts

Company
Amazon (Amazon Technologies, Inc.)
Official title
Establishment of trust between connected network devices
Patent number
US12750218B1
Application number
18622189
Filed
Mar 29, 2024
Granted
Sep 29, 2026
Inventors
9
Claims
20

Classified under

H04L 9/30 Electricity & electronicsH04L 9/3263 Electricity & electronics
Read the full filing (official PDF) ↗ Open in the Patent Tracker

More from Amazon in Networks & wireless

Summaries are simplified from the filing’s own abstract and first claim. A patent filing is not a product announcement.
Patent data and drawings: U.S. Patent and Trademark Office (USPTO). Nebula is not affiliated with or endorsed by the USPTO.