# US 2021/0243034 A1 · Authentication without pre-known credentials > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0243034 A1 - Document ID: US20210243034A1 - Status: Published application - Kind: A1 - Application number: 16/782,835 - Filed: 2020-02-05 - Published: 2021-08-05 - Earliest claimed: 2020-02-05 - Assignees: NXP B.V. - Applicants: NXP B.V. - Inventors: Thierry G. C. Walrant - Web page: https://patentgrep.com/patent/US20210243034A1 ## CPC - H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC} - H04L 9/085: {Secret sharing or secret splitting, e.g. threshold schemes} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 41/082: the condition being updates or upgrades of network functionality - H04L 49/351: for local area network [LAN], e.g. Ethernet switches - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A communication system is disclosed. The communication system includes a network device including a plurality of communication ports and a plurality of communication nodes coupled with the network device through the plurality of communication ports. The communication system further includes a controller that is configured to generate a security key and to send a new configuration along with a message authentication code to the network device, wherein the controller is further configured to break the security key into parts and send the parts of the security key to at least some of the plurality of communication nodes such that each of the at least some of the plurality of communication node receiving one part of the parts of the security key. The network device is configured to retrieve the parts of the secret key from the at least some of the plurality of communication nodes, to assemble the secret key from the retrieved parts of the secret key and using the assembled secret key to authenticate the new configuration. ## Claims ### Claim 1 A communication system, comprising: a network device including a plurality of communication ports; a plurality of communication nodes coupled with the network device through the plurality of communication ports; and a controller, wherein the controller is configured to generate a security key and to send a new configuration along with a message authentication code to the network device, wherein the controller further configured to break the security key into parts and send the parts of the security key to the at least some of the plurality of communication nodes such that each of the at least some of the plurality of communication node receiving one part of the parts of the security key; and wherein the network device is configured to retrieve the parts of the secret key from the at least some of the plurality of communication nodes, to assemble the secret key from the retrieved parts of the secret key and using the assembled secret key to authenticate the new configuration. ### Claim 2 (depends on 1) The communication system of claim 1, wherein the controller configured to generate the message authentication code using a data in the new configuration and the security key. ### Claim 3 (depends on 1) The communication system of claim 1, wherein the network device includes a network fabrics, wherein the network fabrics is configured to assemble the secret key from the retrieved parts and to generate a new message authentication code using a data in the new configuration and the assembled security key. ### Claim 4 (depends on 1) The communication system of claim 1, wherein the controller is further configured to send a version number of the new configuration to the at least some of the plurality of the communication nodes and to the network device. ### Claim 5 (depends on 4) The communication system of claim 4, wherein the controller is further configured to send a previous version number of a previously deployed configuration to the at least some of the plurality of the communication nodes and to the network device. ### Claim 6 (depends on 3) The communication system of claim 3, wherein the network fabrics is configured to authenticate the new configuration by comparing the message authentication code with the new message authentication code. ### Claim 7 (depends on 6) The communication system of claim 6, wherein the switch fabrics is configured to discard the new configuration if the comparing fails. ### Claim 8 A method for authenticating a new configuration of a network device, the method comprising: receiving the new configuration, a message authentication code that is generated using a data in the new configuration and a security key, wherein parts of the security key are stored in a plurality of communication nodes coupled with the network device; retrieving parts of the secret key from the plurality communication nodes; assembling the parts of the secret key; and generating a new message authentication code using the assembled secret key and comparing the message authentication code with the new message authentication code and upon a successful comparison, deploying the new configuration in the network device. ### Claim 9 (depends on 8) The method of claim 8, wherein the network device includes a switch fabrics, wherein the switch fabrics is configured to assemble the secret key from the retrieved parts and to generate the new message authentication code using the data in the new configuration and the assembled security key. ### Claim 10 (depends on 8) The method of claim 8, wherein the receiving further includes receiving a version number of the new configuration. ### Claim 11 (depends on 10) The method of claim 10, wherein the receiving further includes receiving a previous version number of a previously deployed configuration. ### Claim 12 (depends on 9) The communication system of claim 9, wherein the switch fabrics is configured to discard the new configuration if the comparing fails. ### Claim 13 A network device, comprising: a switch fabrics configured to receive a new configuration and a message authentication code for the network device from a controller, wherein the message authentication code is generated using contents of the new configuration and a security key; a memory for at least temporarily storing the new configuration; a plurality of communication ports coupled with the switch fabrics, wherein the communication ports are configured to be coupled with a plurality of communication nodes; and wherein the switch fabrics is configured to retrieve parts of the security key from the plurality of communication ports and to reassemble the parts into an assembled security key, wherein the switch fabrics is configured to derive a new message authentication code using the assembled security key and the contents of the new configuration, wherein the switch fabrics is further configured to compare the new message authentication code with the message authentication code and deploy the new configuration upon a successful comparison. ### Claim 14 (depends on 13) The network device of claim 13, wherein the switch fabrics is further configured to receive a version number of the new configuration. ### Claim 15 (depends on 14) The network device of claim 14, wherein the switch fabrics is configured to receive a previous version number of a previously deployed configuration. ### Claim 16 (depends on 13) The network device of claim 13, wherein the switch fabrics is further configured to discard the new configuration if the comparison fails.