Secure distributed time service in the fabric environment
AssigneeBrocade Communications Systems, Inc.
InventorsVidya Renganarayanan, Richard L. Hammons, James Kleinsteiber
Life of this patent
Estimating the term…
Abstract
A secure and distributed time service is discussed for use in a network. In particular, the invention relates to Fibre Channel networks and the secure distribution of time service using a push model. In order to distribute time on a push model, one entity assumes responsibility for time in the network. Other entities in the network receive periodic time updates and check the validity of their own time by gauging the elapsed time since the previous time update. The time service is secured using by applying a unique combination of encryption techniques.
Claims41
A method of maintaining distributed time in a network having a plurality of timekeeping devices including a primary timekeeping entity, each said timekeeping device comprising a network node, the method comprising the steps of:
- entering the time using an input mechanism on a first timekeeping device;
- sending the time from said first timekeeping device to said primary timekeeping entity;
- broadcasting a time update from said primary timekeeping entity to all other timekeeping entities, said broadcast repeating every T1 seconds and carrying an indication of the current time;
- receiving said time update at a second timekeeping entity and starting a counting device upon said receipt;
- checking the status of the counting device every T2 seconds and determining the elapsed time since said second timekeeping device received said time update comparing said elapsed time to a predetermined threshold value T3;
- and
- if said elapsed time is greater than T3, making an indication that said second timekeeping device's time is unreliable.
A network switch for maintaining distributed time in a network having a plurality of timekeeping devices, said network switch comprising:
- an I/O mechanism for receiving a time update from an operator;
- a first port for sending said time update across said network to a primary timekeeping entity;
- a second port for receiving a broadcast time update from said primary timekeeping entity every T1 seconds, said time update carrying an indication of the current time;
- a counter for timing the age of the most recently received time update, said counter restarting upon receipt of said time update;
- a microprocessor to (i) cause a status check upon said counter every T2 seconds, (ii) cause a determination of the elapsed time since said second timekeeping device received said time update, (iii) cause a comparison between said elapsed time and a predetermined threshold value T3;
- and (iv) cause an indication that said network switch is unsynchronized if said elapsed time is greater than T3.
A method of securely distributing time updates in a network having a primary timekeeping entity and one or more other time keeping devices, the method comprising the steps of:
- checking all timekeeping devices to determine if each is capable of participating in a secure time distribution system;
- at the primary timekeeping entity, ascertaining the time and constructing a time update item;
- creating a first-type derivative of said time update item;
- creating a time update message comprising said time update item and said first-type derivative of said time update item;
- sending the time update message to all timekeeping devices;
- at a first timekeeping device receiving said time update message, processing said time update message, wherein processing said time update message includes the sub-steps of, (i) noting a time of arrival and storing said time of arrival in a first memory;
- (ii) starting a counter to measure the age of the received time update at a time interval Tmeasure;
- (iii) storing in a second memory, the time from said time update message;
- (iv) creating a second-type derivative of said update item;
- and (v) comparing said created second-type derivative of said update item with the received first-type derivative of said update item.
A Fibre Channel network having securely distributing time updates, said network comprising:
- a primary timekeeping switch;
- one or more other time keeping switches;
- a first microprocessor at said primary timekeeping switch for (i) causing a check of all timekeeping devices to determine if each is capable of participating in a secure time distribution system, (ii) ascertaining the time and constructing a time update item;
- (iii) causing the creation of a first-type derivative of said time update item, (iv) causing the creation of a time update message comprising said time update item and said first-type derivative of said time update item;
- a first port for sending the time update message to all timekeeping devices;
- at a second timekeeping device,
- a second port for receiving said time update message,
- a first memory for storing said a time of arrival of said update message,
- a counter for measuring the age of the received time update at a time interval Tmeasure;
- a second memory for storing the time from said time update message;
- a second microprocessor for causing (1) the creation of a second-type derivative of said update item;
- and (2) the comparison of said created second-type derivative of said update item with the received first-type derivative of said update item.
The invention 31 wherein said first memory and said second memory are the same.
A Fibre Channel switch for securely maintaining distributed time in a network having a plurality of timekeeping devices and a primary timekeeping entity, said Fibre Channel switch comprising:
- a first port for receiving a time update message comprising (i) a time update item comprising the time, and (ii) a first-type derivative of said time update item;
- a first memory for storing said a time of arrival of said update message, a counter for measuring the age of the received time update at a time interval Tmeasure;
- a second memory for storing the time from said time update message;
- a microprocessor for causing (1) the creation of a second-type derivative of said update item;
- and (2) the comparison of said created second-type derivative of said update item with the received first-type derivative of said update item.
Dependencies are inferred from the claim text.