Patent ID: 12192336

DETAILED DESCRIPTION OF THE INVENTION

In the following description, for the purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the present invention. It will be apparent, however, that the present invention may be practiced without these specific details. In other instances, well-known structures and devices are shown in block diagram form in order to avoid unnecessarily obscuring the present invention.

Embodiments are described herein according to the following outline:1.0 General Overview2.0. System Architecture3.0. Implementation Mechanism-Hardware Overview4.0. Extensions and Alternatives
1.0 General Overview

This overview presents a basic description of some aspects of a possible embodiment of the present invention. It should be noted that this overview is not an extensive or exhaustive summary of aspects of the possible embodiment. Moreover, it should be noted that this overview is not intended to be understood as identifying any particularly significant aspects or elements of the possible embodiment, nor as delineating any scope of the possible embodiment in particular, nor the invention in general. This overview merely presents some concepts that relate to the example possible embodiment in a condensed and simplified format and should be understood as merely a conceptual prelude to a more detailed description of example possible embodiments that follows below.

When digital currency/cryptocurrency mining systems, e.g., bitcoin mining systems are deployed in large industrial-scale mining facilities, technicians typically mount each system into their appropriate rack and connect the systems to the power. When the bitcoin mining systems are first booted up, the systems need to be configured. In the case where there are a large number of systems being brought online, the amount of work required to get each system up and running is onerous. Each system has traditionally been required to be configured manually in order for the system to start mining for the customer. Many bitcoin miner providers take advantage of the situation where, in a default configuration state, bitcoin mining systems are powered on in the customer's bitcoin mining facility by initializing the bitcoin mining systems to start mining immediately but for the bitcoin provider rather than the customer. By the time the customer's technicians have properly configured all of the systems, a large amount of time has passed where the bitcoin mining systems have not produced any results by sitting idle or, in some cases, the bitcoin mining systems have produced revenue for the bitcoin miner providers.

Zero Touch Provisioning (ZTP) has been used for networking devices and IoT devices. The method that is typically used in the networking industry is not secure because it is assumed that the device is correctly embedded with the appropriate link to the configuration server. The router, network device, etc., is configured at the factory with the link to the appropriate configuration server. Once the device boots up, it contacts the configuration server to download the latest firmware version. However, ZTP by itself is not secure for bitcoin mining systems which is one of the reasons why manual configuration is used.

Since bitcoin mining systems create currency, the possibility of a corrupt or hijacked mining system is the reason why manual configuration has been necessary. Embodiments discussed herein improve the performance and security of the mining systems by providing a secure configuration environment where the mining systems can be securely configured in a timely manner. Thus, downtime is substantially decreased and performance for the entire facility is substantially improved.

In an embodiment, a trusted platform module (TPM) chip is incorporated into each of the bitcoin mining systems in a mining facility. The TPM chip is a secure encryption chip that allows the mining system to uniquely identify itself to a central management server in two different ways that gives two levels of security, one for general messaging and one for sensitive messaging. The TPM chip works in conjunction with mining system software to facilitate secure configuration of the bitcoin mining system as well as secure registration and recovery operations.

2.0 System Architecture

Referring toFIG.1, in an embodiment, a plurality of bitcoin mining systems101a-101nreside in mining facility105. Each bitcoin mining system101a-101nprovides an API102a-102nwhere a user device103or cloud-based central management server104can communicate with and control the system over a network107. The API102a-102ncan be used by higher level fleet management or data center management software104across the network107(e.g., Internet, intranet, etc.) to optimize fleetwide operational metrics across a plurality of bitcoin mining systems101a-101nas well as quickly and automatically respond to fluctuating energy costs and curtailment events via dynamic configuration of the bitcoin mining systems101a-101n. The API102a-102ncan also provide a GUI based interface to the user device103, where the user can, for example, select which metric (e.g., throughput, efficiency, total power, etc.) to use and a slider to select the value of the metric.

In an embodiment, when multiple bitcoin mining systems101a-101nare first booted up in the mining facility105, each mining system101a-101nreaches out to the central management/configuration server104to obtain initial configuration information in order to configure the bitcoin mining system to operate as per customer specifications. In order to perform this securely, each bitcoin mining system101a-101nincorporates an on-board TPM chip that allows for secure communications between the bitcoin mining system101a-101nand the cloud-based central management/configuration server104.

Referring toFIG.2, a block diagram of communications between a mining system101aand manufacturing software205and a cloud-based central management/configuration server104is illustrated.

An embodiment automatically configures a mining system on first boot using user configurable settings stored in the cloud network107. One such configuration could be network settings, where a mining system can connect to a gateway, reach out to the cloud network107, and configure its customer-defined network settings using configuration data from, for example, a central management server104. Once on the secured network, the mining system can start to mine with the other cloud-set configurations e.g., pool, worker, energy consumption mode, etc.

In an embodiment, during the manufacturing process the TPM chip203is manufactured with a set of fixed seeds unique to the TPM chip203. The fixed seeds allow the TPM chip203to generate consistent RSA/ECC key pairs. When the mining system101ais first booted up during the manufacturing process, the TPM chip203generates a public key and miner software201reports it along with the serial number of the TPM chip201and the key pair209generated by miner software201to the manufacturing software205. Manufacturing software205stores the public key along with the mining system device serial number and software key pair in the manufacturing storage204.

Cloud-based central management server104gathers the public keys and device serial numbers210from the manufacturing software205across network107. Note that the public keys and serial numbers may additionally or alternatively be stored at a secure mining system manufacturer's site that is accessible to customer-owned central management servers. Cloud-based central management server104stores the public key and device serial numbers in storage206. In an embodiment, central management server104stores the public keys and device serial numbers in a lookup table or other data structure such that the public keys are associated with their corresponding serial numbers. Note that there may be more than one manufacturing software as well as more than one cloud-based central management server, e.g., each customer can implement a cloud-based central management server for their sites.

At initial on-site bootup of the mining system101a, the TPM chip203private key and public key can be generated at startup with a fixed template207. The fixed template ensures that the keys that are generated are always the same and unique for each TPM chip203, thereby foregoing the need to store them long term on local disk storage. The TPM public key is retrieved from a TPM driver in miner software201during boot up. Secure zero touch provisioning then takes place if configured to do so.

During normal operation, two pairs of keys are used to communicate (e.g., via JSON Web Tokens (JWTs), etc.) with the central management server104. A software generated (e.g., by miner software201) key pair for normal, general communications211between the mining system101aand the central management server104and a TPM key pair used for sensitive/security communications212such as device registration, ownership change etc. In general, using the TPM chip to encrypt messages is slower than using software keys to encrypt messages. The system improves the performance of the bitcoin mining systems as well as the cloud-based central management server by using the software keys whenever possible to make the communication paths more efficient and faster. Further, while typical systems manage their systems using a shared authorization certificate, an embodiment dramatically improves the security of the technology environment by storing unique authorization information for each device.

A message that is signed using the software key is used for general messaging to the cloud-based central management server104. In normal operations, the message succeeds in verification by the cloud-based central management server104. If a message fails verification, or a software key is missing from a recent factory reset, then software key pairs are purged from factory reset and the system reverts to using the TPM key as discussed below to onboard the device to the cloud-based central management server104.

A message signed by the TPM chip203using the TPM key208is used for registering the software key pair with the cloud-based central management server104and initiating the secure zero touch provisioning. Miner software201sends the registration message to the TPM chip203to sign the message using the TPM private key. TPM chip203transmits the signed message208to the miner software201. The registration message contains the mining system101aserial number and the software public key. The message is signed using the TPM public key. Miner software201sends the signed message212to the cloud-based central management server104. The cloud-based central management server104verifies the signature from the message using the TPM public key associated with the mining system101aserial number stored in storage206. In an embodiment, cloud-based central management server104uses the serial number to find the corresponding TPM public key in the data structure in storage206. Cloud-based central management server104then hashes the message using the TPM public key and decrypts the signature using the TPM public key. If the hash value matches the decrypted signature from the message, then the message is valid. Upon verification, the cloud-based central management server104stores the software public key in association with the mining system101aand sends configuration data to the mining system101a. The central management server104has the ability to select which configuration data is used for each particular mining system, allowing for different configurations for certain groups of mining systems, types of mining systems (e.g., different hardware setups, different hardware vendors, etc.), etc. Configuration data can include the initial settings that the miner uses to start operations, e.g., power usage settings, target hash rates, WiFi settings, pool setting, worker ID, fan activation, etc. For example, an administrator may want to disable fans in the mining system when it is in standby mode if the facility is not set up for hot/cold aisles. Mining system101areceives the configuration data and miner software201configures system parameters using the configuration data. Mining system101athen operates using the updated system parameters. The configuration data can be updated at any time to change the ZTP configuration as conditions change in the facility and/or new mining systems. The entire communication exchange between miner software201and cloud-based central management server104can be encrypted using Transport Layer Security (TLS).

In an embodiment, the mining system101acan retrieve a random server challenge (e.g., from/ping) to be included in the message (e.g., signed DATE, key in AWS KMS, etc.). The cloud-based central management server104verifies the message signature with the TPM public key (populated from the manufacturing process) that is associated with the mining system serial number in the storage206and records the new software public key in storage206to associate the software public key with the mining system101a. If an action such as ownership change of the mining system101ais required, the miner software201sends the ownership change message to the TPM chip203for the TPM chip203to sign the message using the TPM private key. Miner software201sends the signed message to the cloud-based central management server104as discussed above.

Referring toFIG.3, an example user interface screen300is shown that may be displayed by the central management server104to an administrator. The user interface screen300allows the administrator to configure the provisioning process. In an embodiment, the administrator can designate which configuration data to use for the entire facility (e.g., Default Group) or for individual pools301. The administrator can designate the configuration data to be used per pool. Each individual pool may be configured using a separate configuration data file302. Mining systems can be assigned to different groups and the administrator cn designate which groups are assigned to each pool303.

Note that although bitcoin is mentioned specifically in the above discussions and examples, any digital/crypto currency that requires mining systems can be improved using the material discussed herein.

In an embodiment, an apparatus comprises a processor and is configured to perform any of the foregoing methods.

In an embodiment, one or more non-transitory computer-readable storage media, storing software instructions, which when executed by one or more processors cause performance of any of the foregoing methods.

Although separate embodiments are discussed herein, any combination of embodiments and/or partial embodiments discussed herein may be combined to form further embodiments.

3.0. Implementation Mechanisms-Hardware Overview

According to one embodiment, the techniques described herein are implemented by one or more special-purpose computing devices. The special-purpose computing devices may be hard-wired to perform the techniques or may include digital electronic devices such as one or more application-specific integrated circuits (ASICs) or field programmable gate arrays (FPGAs) that are persistently programmed to perform the techniques or may include one or more general purpose hardware processors programmed to perform the techniques pursuant to program instructions in firmware, memory, other storage, or a combination. Such special-purpose computing devices may also combine custom hard-wired logic, ASICs, or FPGAs with custom programming to accomplish the techniques. The special-purpose computing devices may be desktop computer systems, portable computer systems, handheld devices, networking devices or any other device that incorporates hard-wired and/or program logic to implement the techniques. For example,FIG.4is a block diagram that illustrates a computer system400upon which an embodiment of the invention may be implemented. Computer system400includes a bus402or other communication mechanism for communicating information, and a hardware processor404coupled with bus402for processing information. Hardware processor404may be, for example, a general-purpose microprocessor.

Computer system400also includes a main memory406, such as a random access memory (RAM) or other dynamic storage device, coupled to bus402for storing information and instructions to be executed by processor404. Main memory406also may be used for storing temporary variables or other intermediate information during execution of instructions to be executed by processor404. Such instructions, when stored in non-transitory storage media accessible to processor404, render computer system400into a special-purpose machine that is device-specific to perform the operations specified in the instructions.

Computer system400further includes a read only memory (ROM)408or other static storage device coupled to bus402for storing static information and instructions for processor404. A storage device410, such as a magnetic disk or optical disk, is provided and coupled to bus402for storing information and instructions.

Computer system400may be coupled via bus402to a display412, such as a liquid crystal display (LCD), for displaying information to a computer user. An input device414, including alphanumeric and other keys, is coupled to bus402for communicating information and command selections to processor404. Another type of user input device is cursor control416, such as a mouse, a trackball, or cursor direction keys for communicating direction information and command selections to processor404and for controlling cursor movement on display412. This input device typically has two degrees of freedom in two axes, a first axis (e.g., x) and a second axis (e.g., y), that allows the device to specify positions in a plane.

Computer system400may implement the techniques described herein using device-specific hard-wired logic, one or more ASICs or FPGAs, firmware and/or program logic which in combination with the computer system causes or programs computer system400to be a special-purpose machine. According to one embodiment, the techniques herein are performed by computer system400in response to processor404executing one or more sequences of one or more instructions contained in main memory406. Such instructions may be read into main memory406from another storage medium, such as storage device410. Execution of the sequences of instructions contained in main memory406causes processor404to perform the process steps described herein. In alternative embodiments, hard-wired circuitry may be used in place of or in combination with software instructions.

The term “storage media” as used herein refers to any non-transitory media that store data and/or instructions that cause a machine to operation in a specific fashion. Such storage media may comprise non-volatile media and/or volatile media. Non-volatile media includes, for example, optical or magnetic disks, such as storage device410. Volatile media includes dynamic memory, such as main memory406. Common forms of storage media include, for example, a floppy disk, a flexible disk, hard disk, solid state drive, magnetic tape, or any other magnetic data storage medium, a CD-ROM, any other optical data storage medium, any physical medium with patterns of holes, a RAM, a PROM, and EPROM, a FLASH-EPROM, NVRAM, any other memory chip or cartridge.

Storage media is distinct from but may be used in conjunction with transmission media. Transmission media participates in transferring information between storage media. For example, transmission media includes coaxial cables, copper wire and fiber optics, including the wires that comprise bus402. Transmission media can also take the form of acoustic or light waves, such as those generated during radio-wave and infra-red data communications.

Various forms of media may be involved in carrying one or more sequences of one or more instructions to processor404for execution. For example, the instructions may initially be carried on a magnetic disk or solid state drive of a remote computer. The remote computer can load the instructions into its dynamic memory and send the instructions over a telephone line using a modem. A modem local to computer system400can receive the data on the telephone line and use an infra-red transmitter to convert the data to an infra-red signal. An infra-red detector can receive the data carried in the infra-red signal and appropriate circuitry can place the data on bus402. Bus402carries the data to main memory406, from which processor404retrieves and executes the instructions. The instructions received by main memory406may optionally be stored on storage device410either before or after execution by processor404.

Computer system400also includes a communication interface418coupled to bus402. Communication interface418provides a two-way data communication coupling to a network link420that is connected to a local network422. For example, communication interface418may be an integrated services digital network (ISDN) card, cable modem, satellite modem, or a modem to provide a data communication connection to a corresponding type of telephone line. As another example, communication interface418may be a local area network (LAN) card to provide a data communication connection to a compatible LAN. Wireless links may also be implemented. In any such implementation, communication interface418sends and receives electrical, electromagnetic or optical signals that carry digital data streams representing various types of information.

Network link420typically provides data communication through one or more networks to other data devices. For example, network link420may provide a connection through local network422to a host computer424or to data equipment operated by an Internet Service Provider (ISP)426. ISP426in turn provides data communication services through the world wide packet data communication network now commonly referred to as the “Internet”428. Local network422and Internet428both use electrical, electromagnetic or optical signals that carry digital data streams. The signals through the various networks and the signals on network link420and through communication interface418, which carry the digital data to and from computer system400, are example forms of transmission media.

Computer system400can send messages and receive data, including program code, through the network(s), network link420and communication interface418. In the Internet example, a server430might transmit a requested code for an application program through Internet428, ISP426, local network422and communication interface418.

The received code may be executed by processor404as it is received, and/or stored in storage device410, or other non-volatile storage for later execution.

4.0. Extensions and Alternatives

As used herein, the terms “first,” “second,” “certain,” and “particular” are used as naming conventions to distinguish queries, plans, representations, steps, objects, devices, or other items from each other, so that these items may be referenced after they have been introduced. Unless otherwise specified herein, the use of these terms does not imply an ordering, timing, or any other characteristic of the referenced items.

In the drawings, the various components are depicted as being communicatively coupled to various other components by arrows. These arrows illustrate only certain examples of information flows between the components. Neither the direction of the arrows nor the lack of arrow lines between certain components should be interpreted as indicating the existence or absence of communication between the certain components themselves. Indeed, each component may feature a suitable communication interface by which the component may become communicatively coupled to other components as needed to accomplish any of the functions described herein.

In the foregoing specification, embodiments of the inventive subject matter have been described with reference to numerous specific details that may vary from implementation to implementation. Thus, the sole and exclusive indicator of what is the inventive subject matter, and is intended to be the inventive subject matter, is the set of claims that issue from this application, in the specific form in which such claims issue, including any subsequent correction. In this regard, although specific claim dependencies are set out in the claims of this application, it is to be noted that the features of the dependent claims of this application may be combined as appropriate with the features of other dependent claims and with the features of the independent claims of this application, and not merely according to the specific dependencies recited in the set of claims. Moreover, although separate embodiments are discussed herein, any combination of embodiments and/or partial embodiments discussed herein may be combined to form further embodiments.

Any definitions expressly set forth herein for terms contained in such claims shall govern the meaning of such terms as used in the claims. Hence, no limitation, element, property, feature, advantage or attribute that is not expressly recited in a claim should limit the scope of such claim in any way. The specification and drawings are, accordingly, to be regarded in an illustrative rather than a restrictive sense.