Node and port authentication in a fibre channel network

A method of mutually authenticating a first port on a first switch with a second port on a second switch, said first port coupled to said second port by a communication medium that is exclusive to said first port and said second port, the method comprising the steps of:

• sending a first fact from said first port to said second port;
• at said second switch, creating a second-type derivative of said first fact,
• sending said second-type derivative of said first fact from said second port to said first port;
• at said first switch, storing said second-type derivative of said first fact in a first memory;
• sending a second fact from said second port to said first port;
• at said first switch, creating a first-type derivative of said second fact;
• sending said first-type derivative of said second fact from said first port to said second port;
• at said second switch, storing said first-type derivative of said second fact in a second memory;
• sending defined information concerning said first switch from said first port to said second port;
• sending a third-type derivative of said defined information concerning said first switch from said first port to said second port;
• at said second switch, comparing said defined information concerning said first switch with said third-type derivative of said defined information concerning said first switch;
• at said second switch, comparing said first type derivative of said second fact with said second fact;
• sending defined information concerning said second switch from said second port to said first port;
• sending a third-type derivative of said defined information concerning said second switch from said second port to said first port;
• at said first switch, comparing said defined information concerning said second switch with said third-type derivative of said defined information concerning said second switch;
• and
• at said first switch, comparing said second type derivative of said first fact with said first fact.

A method of mutually authenticating a first port on a first switch with a second port on a second switch, the method comprising the steps of:

• sending from said first port to said second port, an authentication request command having a payload of a first fact;
• sending from said second port to said first port, a request acknowledge command having a payload of a second fact, a second-type derivative of said first fact, defined information concerning said second switch, and a third-type derivative of defined information concerning said second switch;
• and
• sending from said first port to said second port, a confirm authentication command having a payload of a first-type derivative of said second fact, defined information concerning said first switch, and a third-type derivative of defined information concerning said first switch.

A method of mutually authenticating a first port on a first switch with a second port on a second switch, the method comprising the steps of:

• sending from said first port to said second port, an authentication request command having a payload of a first fact, defined information concerning said first switch, and a third-type derivative of defined information concerning said first switch,
• sending from said second port to said first port, a request acknowledge command having a payload of a second fact, a second-type derivative of said first fact, defined information concerning said second switch, and a third-type derivative of defined information concerning said second switch;
• and
• sending from said first port to said second port, a confirm authentication command having a payload of a first-type derivative of said second fact.

A method of mutually authenticating a first port on a first switch with a second port on a second switch, the method comprising the steps of:

• receiving on said second port any recognized communication and interpreting said recognized communication as having a recognized purpose and an additional purpose, said additional purpose being a request for authentication command;
• at said second switch, creating a second-type derivative of said recognized communication and storing said second-type derivative and said recognized communication in a memory;
• sending from said second port to said first port an acknowledge request command having a payload of a second fact, said second type derivative of said recognized communication;
• defined information concerning said second switch, and a third-type derivative of defined information concerning said second switch;
• and
• sending from said first port to said second port, a first-type derivative of said second fact, defined information concerning said first switch, and a third-type derivative of defined information concerning said first switch.

A method of authenticating a first port on a first switch with a second port on a second switch, the method comprising the steps of:

• at said first switch generating a random or pseudo-random first fact;
• at said first switch, storing said first fact in a first memory;
• sending from said first port to said second port, an authentication request command;
• sending from said first port to said second port, said first fact;
• at said second switch, storing said first fact in a second memory;
• at said second switch, generating a random or pseudo-random second fact;
• sending from said second port to said first port, a request acknowledge command;
• sending from said second port to said first port, said second fact, said second switch's PKI certificate, and a signed-first fact comprising a version of said first fact that has been signed using a PKI public key uniquely associated with said second switch;
• at said first switch, attempting to verify said second switches PKI certificate using a public key of a certificate authority that is common to both said first switch and said second switch;
• at said first switch, attempting to verify said second switches signature using said PKI public key uniquely associated with said second switch;
• sending from said first port to said second port, a confirm command;
• sending from said first port to said second port, said first switch's PKI certificate, and a signed second fact comprising a version of said second fact that has been signed using a PKI public key uniquely associated with said first switch;
• at said second switch, attempting to verify said first switches PKI certificate using said public key of a certificate authority that is common to both said first switch and said second switch;
• and
• at said second switch, attempting to verify said first switches signature using said PKI public key uniquely associated with said second switch.