Extending packet processing to trusted programmable and fixed-function accelerators

Patent metadata

Field	Value
Publication number	US-10642972-B2
Application number	US-201615298419-A
Country	US
Kind code	B2
Filing date	Oct 20, 2016
Priority date	Oct 20, 2016
Publication date	May 5, 2020
Grant date	May 5, 2020

Abstract

Methods and apparatus for extending packet processing to trusted programmable and fixed-function accelerators. Secure enclaves are created in system memory of a compute platform, wherein software code external from a secure enclave cannot access code or data within a secure enclave, and software code in a secure enclave can access code and data both within the secure enclave and external to the secure enclave. Software code for implementing packet processing operations is installed in the secure enclaves. The compute platform further includes one or more hardware-based accelerators that are used by the software to offload packet processing operations. The accelerators are configured to read packet data from input queues, process the data, and output processed data to output queues, wherein the input and output queues are located in encrypted portions of memory that may be in a secure enclave or external to the secure enclaves. Tokens are used by accelerators to validate access to memory in secure enclaves, and used by both accelerators and secure enclaves to access encrypted memory external to secure enclaves.

First claim

What is claimed is:

1. A method comprising:
creating at least one secure enclave in system memory of a compute platform including a processor, a network interface, and at least one hardware-based accelerator including a first accelerator, the compute platform configured to support a virtualized execution environment including a plurality of virtual machines (VMs) or containers, each secure enclave occupying a respective protected portion of the system memory, wherein software code external from a secure enclave cannot access code or data within a secure enclave, and software code in a secure enclave can access code and data both within the secure enclave and external to the secure enclave;
installing software code for implementing software-based packet processing operations in the at least one secure enclave;
performing packet processing for a plurality of packet flows corresponding to packets received at the network interface, wherein the packet processing for at least a portion of the plurality of packet flows includes a service chain comprising software-based packet processing performed via execution of software code in a secure enclave and at least one service performed by the first accelerator.

2. The method of claim 1 , wherein packet processing for at least one packet flow includes accessing, via at least one of software running in a secure enclave or an accelerator, at least one of an input queue and an output queue located in a portion of encrypted memory external to the secure enclave.

3. The method of claim 2 , further comprising:
employing a secure token to generate encrypted data prior to writing data to the portion of encrypted memory external to the secure enclave;
writing the encrypted data, via a memory controller, to an input queue or output queue in the portion of encrypted memory external to the secure enclave;
reading, via the memory controller in response to a memory read request issued by a requester, encrypted data from an input queue or output queue in the portion of encrypted memory external to the secure enclave, the encrypted data being returned to the requester; and
employing the secure token to decrypt the encrypted data returned by the memory controller.

4. The method of claim 3 , wherein the compute platform includes a trusted component and a memory controller coupled to the system memory, further comprising:
generating, via the trusted component, the secure token; and
provisioning the secure token to each of software running in the secure enclave, and the first accelerator.

5. The method of claim 1 , wherein packet processing for at least one packet flow includes accessing memory within a secure enclave via a memory access request issued by the one or more accelerators.

6. The method of claim 5 , further comprising employing a secure token with each memory access request issued by the one or more accelerators to access memory within the secure enclave.

7. The method of claim 6 , wherein the compute platform includes a trusted component and a memory controller coupled to the system memory, further comprising:
issuing, via the trusted component to each of the accelerator and the memory controller, a secure token to be included in each memory access request to memory within the secure enclave.

8. The method of claim 7 , wherein the compute platform includes a plurality of accelerators, further comprising:
for each combination of a secure enclave and an accelerator used in a service chain,
provisioning a secure token to be included in each memory access request from the accelerator to the secure enclave.

9. The method of claim 1 , wherein a service chain includes:
a first set of one or more services performed via execution of software in the secure enclave; and
a second set of one or more services performed by the first accelerator.

10. The method of claim 9 , wherein at least a portion of the first set of one or more services and the second set of one or more services is performed in parallel.

11. The method of claim 1 , wherein the first accelerator includes a plurality of registers, further comprising:
programming a first register with a first memory location of an input queue in which input data to be processed by the first accelerator is to be stored; and
programming a second register with a second memory location of an output queue in which output data produced by the first accelerator via processing the input data is to be stored.

12. The method of claim 11 , further comprising:
enqueuing in the input queue, via software executing in a secure enclave, packet data to be processed by the first accelerator;
reading, via the accelerator, the packet data;
processing the packet data via the first accelerator, to produce processed packet data; and
writing the processed packet data to the output queue.

Assignees

• Sood Kapil
• Chakrabarti Somnath
• Shen Wei
• Rozas Carlos V
• Vij Mona
• Scarlata Vincent R
• Intel Corp

Inventors

• Sood Kapil
• Chakrabarti Somnath
• Shen Wei
• Rozas Carlos V
• Vij Mona
• Scarlata Vincent R

Classifications

• G06F2212/152

  Virtualized environment, e.g. logically partitioned system · CPC title

• G06F12/1408

  by using cryptography (for digital transmission H04L9/00) · CPC title

• G06F21/44

  Program or device authentication · CPC title

• G06F2212/402

  Encrypted data · CPC title

• G06F2212/1052

  Security improvement · CPC title