Technologies for accelerated hierarchical key caching in edge systems

Patent metadata

Field	Value
Publication number	US-12132825-B2
Application number	US-202117561558-A
Country	US
Kind code	B2
Filing date	Dec 23, 2021
Priority date	Mar 29, 2019
Publication date	Oct 29, 2024
Grant date	Oct 29, 2024

Abstract

Technologies for accelerated key caching in an edge hierarchy include multiple edge appliance devices organized in tiers. An edge appliance device receives a request for a key, such as a private key. The edge appliance device determines whether the key is included in a local key cache and, if not, requests the key from an edge appliance device included in an inner tier of the edge hierarchy. The edge appliance device may request the key from an edge appliance device included in a peer tier of the edge hierarchy. The edge appliance device may activate per-tenant accelerated logic to identify one or more keys in the key cache for eviction. The edge appliance device may activate per-tenant accelerated logic to identify one or more keys for pre-fetching. Those functions of the edge appliance device may be performed by an accelerator such as an FPGA. Other embodiments are described and claimed.

First claim

The invention claimed is:

1. A first edge appliance device comprising:
interface circuitry to receive a first request for a key, the first request from an edge device or a second edge appliance device;
instructions in the first edge appliance device; and
processor circuitry to be programmed by the instructions to:
determine the key is not in a key cache of the first edge appliance device;
cause transmission of a second request for the key to a third edge appliance device; and
add the key to the key cache.

2. The first edge appliance device of claim 1 , wherein the key is a first key, the processor circuitry to be programmed by the instructions to:
select at least one of a) a second key to prefetch from the third edge appliance device or b) cause the third edge appliance device to prefetch the key based on telemetry data.

3. The first edge appliance device of claim 2 , wherein key prefetch accelerated logic circuitry is to not read or modify the key.

4. The first edge appliance device of claim 1 , wherein the edge device is in a first tier of an edge hierarchy, the second edge appliance device is in a second tier of the edge hierarchy, and the third edge appliance device is in the second tier or a third tier of the edge hierarchy, the second tier to be at least one of physically further or logically further from the edge device than the first tier, the third tier to be at least one of physically further or logically further from the edge device than the second tier.

5. The first edge appliance device of claim 4 , wherein the first edge appliance device is in the second tier, is in the third tier, or is in a fourth tier, the fourth tier to be at least one of physically closer or logically closer to the edge device than the third tier.

6. The first edge appliance device of claim 5 , wherein the processor circuitry is to be programmed by the instructions to:
track usage of a FaaS instance; and
move the key to a fourth edge appliance device based on the tracked usage in advance of the key being requested, the fourth edge appliance device to be at least one of physically closer or logically closer than to the edge device the first edge appliance device.

7. The first edge appliance device of claim 1 , wherein the processor circuitry is to be programmed by the instructions to calculate a cache location for the key based on a latency associated with the edge device and one or more measured latencies between the edge device and one or more of the first edge appliance device, the second edge appliance device, the third edge appliance device, or a fourth edge appliance device.

8. The first edge appliance device of claim 1 , wherein the first request is from an FaaS instance in the edge device or the second edge appliance device.

9. The first edge appliance device of claim 8 , wherein the FaaS instance is to access encrypted data via the key.

10. The first edge appliance device of claim 1 , wherein the processor circuitry is to be programmed by the instructions to:
allocate a portion of the key cache for a tenant associated with an FaaS instance; and
search the portion in response to the key being requested.

11. The first edge appliance device of claim 1 , wherein the processor circuitry is to be programmed by the instructions to authenticate an extension associated with an initial request for the key.

12. The first edge appliance device of claim 1 , wherein the processor circuitry is to be programmed by the instructions to cause transmission of an encrypted form of the key to the edge device, the second edge appliance device, or an FaaS instance in response to the key being in the key cache.

13. The first edge appliance device of claim 1 , wherein the processor circuitry is to be programmed by the instructions to detect malicious attempts to access the key based on patterns of access attempts associated with the key.

14. The first edge appliance device of claim 1 , wherein the interface circuitry is to receive the first request from a Function-as-a-Service (FaaS) instance executing on the second edge appliance device or the edge device, the first request indicative of a key identifier corresponding to the key.

15. At least one non-transitory computer-readable medium comprising instructions to cause at least one processor circuit to at least:
determine a key is not in a key cache of an edge appliance device, the key requested from the edge appliance device by an edge device or by a first remote edge appliance device;
cause transmission of a request for the key to a second remote edge appliance device; and
cause addition of the key to the key cache.

16. The at least one non-transitory computer-readable medium of claim 15 , wherein the edge device is in a first tier of an edge hierarchy, the first remote edge appliance device is in a second tier of the edge hierarchy, and the second remote edge appliance device is in the second tier or a third tier of the edge hierarchy, the second tier to be at least one of physically further or logically further from the edge device than a distance between the first tier and the edge device, the third tier to be at least one of physically further or logically further from the edge device than a distance between the second tier and the edge device.

17. The at least one non-transitory computer-readable medium of claim 15 , wherein the key is a first key, wherein the instructions are to cause one or more of the at least one processor circuit to:
in advance of the first key being requested, determine at least one of (i) a second key to prefetch from a third remote edge appliance device or (ii) the third remote edge appliance device from which to prefetch the second key based on telemetry data;
request the second key from the third remote edge appliance device; and
cause addition of the second key to the key cache.

18. The at least one non-transitory computer-readable medium of claim 17 , wherein the telemetry data is indicative of at least one of user information, hardware information, performance utilization, network utilization, or resources associated with the edge device.

19. The at least one non-transitory computer-readable medium of claim 15 , wherein the key is requested by a Function-as-a-Service (FaaS) instance, the request including a key identifier corresponding to the key.

20. An apparatus to perform accelerated hierarchical key caching in edge systems comprising:
a key cache; and
processor circuitry including one or more of:
at least one of a central processor unit, a graphic processor unit or a digital signal processor, the at least one of the central processor unit, the graphic processor unit or the digital signal processor having control circuitry to control data movement within the processor circuitry, arithmetic and logic circuitry to perform one or more first operations corresponding to instructions, and one or more registers to store a result of the one or more first operations, the instructions in the apparatus;
a Field Programmable Gate Array (FPGA), the FPGA including first logic gate circuitry, a plurality of configurable interconnections, and storage circuitry, the first logic gate circuitry and interconnections to perform one or more second operations, the storage circuitry to store a result of the one or more second operations; or
Application Specific Integrated Circuitry (ASIC) including second logic gate circuitry to perform one or more third operations;
the processor circuitry to perform at least one of the first operations, the second operations o

Assignees

• Intel Corp

Inventors

• Verrall Timothy
• Willhalm Thomas
• Bernat Francesc Guim
• Kumar Karthik
• Smith Ned M
• Poornachandran Rajesh
• Sood Kapil
• Viswanathan Tarun
• Browne John J
• Kutch Patrick

Classifications

• H04L9/0897

  involving additional devices, e.g. trusted platform module [TPM], smartcard or USB · CPC title

• H04L9/0836 Primary

  using tree structure or hierarchical structure · CPC title

• H04L9/0894

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title

• H04L9/0891

  Revocation or update of secret information, e.g. encryption key update or rekeying · CPC title

• H04L9/083 Primary

  involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] · CPC title