Systems and methods using a network interface controller (NIC) to broker a secure remote connection at the hardware layer
Systems and methods are provided that may be implemented to use compute capabilities of a network interface controller (NIC) to broker a secure connection across a network between a target information handling system (e.g., such as a server) and one or more other entities (e.g., such as other information handling systems implementing a cloud service or private network, and/or that are providing other remote service/s across the network). This secure connection may be brokered by the NIC at a hardware level in a manner that is separate from a host programmable integrated circuit of the same target information handling system, and in a way that is agnostic and independent of any host operating system or other logic that is executing on the host programmable integrated circuit of the target information handling system.
1. A system, comprising a first information handling system coupled to a second information handling system and a third information handling system, the first information handling system comprising:
a first programmable integrated circuit; and
a network interface controller (NIC) coupled to the first programmable integrated circuit and implementing a network interface, the NIC comprising a second programmable integrated circuit integrated within the NIC and programmed to:
broker an encrypted connection across a network between the second programmable integrated circuit of the NIC and the second information handling system,
execute a virtual private network (VPN) client to broker the encrypted connection by establishing a first VPN across the network for encrypted network communications between the second programmable integrated circuit of the NIC and a third programmable integrated circuit of the second information handling system,
decrypt first VPN data of encrypted network communications received across the first VPN from the third programmable integrated circuit of the second information handling system, and communicate the decrypted first VPN data to the first programmable integrated circuit, and
encrypt data received from the first programmable integrated circuit and retransmit the encrypted data as first VPN data across the first VPN across the network to the third programmable integrated circuit of the second information handling system;
where the third programmable integrated circuit of the second information handling system is programmed to:
establish a second and different VPN across the network between the third programmable integrated circuit of the second information handling system and a fourth programmable integrated circuit of a third information handling system for encrypted network communications of the second encrypted connection between the third programmable integrated circuit of the second information handling system and the fourth integrated circuit of the third information handling system,
receive and decrypt second VPN data received across the second VPN from the fourth programmable integrated circuit of the third information handling system, and encrypt and retransmit the decrypted second VPN data as the first VPN data to the second programmable integrated circuit of the NIC, and
receive and decrypt first VPN data received across the first VPN from the second programmable integrated circuit of the NIC, and encrypt and retransmit the decrypted first VPN data as the second VPN data to the fourth programmable integrated circuit of the third information handling system.
2. The system of claim 1 , where the second programmable integrated circuit of the NIC is programmed to broker the encrypted connection by tunneling out to the second information handling system across the network and without occurrence of tunneling into the first or second programmable integrated circuits of the information handling system from across the network.
3. The system of claim 1 , where the first programmable circuit is programmed to execute a host operating system (OS); and where the second programmable integrated circuit of the NIC is programmed to:
decrypt the first VPN data of encrypted network communications received across the first VPN from the third programmable integrated circuit of the second information handling system, and communicate the decrypted first VPN data to the OS executing on the first programmable integrated circuit; and
encrypt data received from the OS executing on the first programmable integrated circuit and retransmit the encrypted data as first VPN data across the network to the third programmable integrated circuit of the second information handling system.
4. The system of claim 1 , where the network comprises a public network, and where the NIC comprises a network interface coupled to the public network by local network hardware coupled between the first information handling system and the public network, the local network hardware comprising at least one of a router, switch, or firewall hardware.
5. The system of claim 1 , where the NIC comprises non-volatile memory (NVM) integrated within the NIC that is coupled to the second programmable integrated circuit of the NIC, the NVM storing cryptographic key/s; and where the second programmable integrated circuit of the NIC is programmed to:
broker the encrypted connection between the second programmable integrated circuit of the NIC and the second information handling system by retrieving and transmitting the cryptographic key/s across the network to the third programmable integrated circuit of the second information handing system as credentials for a VPN login to the second information handling system to establish the first VPN across the network for encrypted network communications between the second programmable integrated circuit of the NIC and the third programmable integrated circuit of the second information handling system;
decrypt the first VPN data of encrypted network communications received across the first VPN from the third programmable integrated circuit of the second information handling system, and communicate the decrypted first VPN data to the first programmable integrated circuit; and
encrypt data received from the first programmable integrated circuit and retransmit the encrypted data as first VPN data across the network to the third programmable integrated circuit of the second information handling system.
6. The system of claim 1 , where the second programmable integrated circuit of the NIC is programmed to automatically broker the encrypted connection across a network between the information handling system and the second information handling system at every power on event and/or at every booting of a host operating system (OS) executing on the first programmable integrated circuit of the information handling system.
7. An information handling system, comprising:
a first programmable integrated circuit; and
a network interface controller (NIC) coupled to the first programmable integrated circuit and implementing a network interface, the NIC comprising a second programmable integrated circuit integrated within the NIC and programmed to broker an encrypted connection across a network between the second programmable integrated circuit of the NIC and one or more external network entities separately from the first programmable integrated circuit;
where the second programmable integrated circuit of the NIC is further programmed to:
broker the encrypted connection by transmitting first cryptographic key/s across the network to a first one of the one or more external network entities as credentials to establish a first session of the first encrypted connection between the NIC and the first one of the one or more external network entities,
establish a second and different encrypted connection across the network between the NIC and a second different one of the one or more external network entities,
receive second cryptographic key/s from the second one of the one or more of external network entities across the second encrypted connection, the second cryptographic key/s being different from the first cryptographic key/s, and
transmit the second cryptographic key/s across the network to the first one of the one or more external network entities as credentials to establish a second and different session of the first encrypted connection between the NIC and the first one of the one or more external network entities.
8. An information handling system, comprising:
a first programmable integrated circuit; and
a network interface controller (NIC) coupled to the first programmable integrated circuit and implementing a network interface, the NIC comprising a second programmable integrated circuit integrated within the NIC and programmed to broker an encrypted connection across a network between the second programmable integrated circuit of the NIC and one or more external network entities separately from the first programmable integrated circuit;
where the information handling system is a bare metal server without any host OS installed on the information handling system and executing on the first programmable integrated circuit; and where the second programmable integrated circuit of the NIC is programmed to automatically broker the encrypted connection across a network between the information handling system and the one or more external network entities at a first power on event of the bare metal server with no host OS installed on the bare metal server.
9. A method, comprising:
operating a host programmable integrated circuit of a first information handling system coupled to a second programmable integrated circuit integrated within a network interface controller (NIC) of the first information handling system, the second programmable integrated circuit of the NIC being coupled in communication between the host programmable integrated circuit and a network;
operating the second programmable integrated circuit of the NIC to:
broker a first encrypted connection across the network between the second programmable integrated circuit of the NIC and a third programmable integrated circuit of a second information handling system in a manner that is separate from the host programmable integrated circuit of the first information handling system,
execute a virtual private network (VPN) client to broker the first encrypted connection by establishing a first VPN across the network for encrypted network communications of the first encrypted connection between the NIC and the third programmable integrated circuit of the second information handling system,
decrypt first VPN data of encrypted network communications received across the first VPN from the third programmable integrated circuit of the second information handling system, and communicate the decrypted first VPN data to the host programmable integrated circuit of the first information handling system, and
encrypt data received from the host programmable integrated circuit of the first information handling system and retransmit the encrypted data received from the host programmable integrated circuit of the first information handling system as first VPN data across the first VPN to the third programmable integrated circuit of the second information handling system; and
operating the third programmable integrated circuit of the second information handling system to:
establish a second and different VPN across the network between the third programmable integrated circuit of the second information handling system and a fourth programmable integrated circuit of a third information handling system for encrypted network communications of the second encrypted connection between the third programmable integrated circuit of the second information handling system and the fourth integrated circuit of the third information handling system,
receive and decrypt second VPN data received across the second VPN from the fourth programmable integrated circuit of the third information handling system, and encrypt and retransmit the decrypted second VPN data as the first VPN data to the second programmable integrated circuit of the NIC, and
receive and decrypt first VPN data received across the first VPN from the second programmable integrated circuit of the NIC, and encrypt and retransmit the decrypted first VPN data as the second VPN data to the fourth programmable integrated circuit of the third information handling system.
10. The method of claim 9 , further comprising operating the second programmable integrated circuit of the NIC to broker the first encrypted connection by tunneling out across the network to the third programmable integrated circuit of the second information handling system and without occurrence of tunneling into the first or second programmable integrated circuits of the first information handling system from across the network.
11. The method of claim 9 , further comprising:
executing a host operating system (OS) on the host programmable circuit of the first information handling system; and
operating the second programmable integrated circuit of the NIC to:
decrypt the first VPN data of the encrypted network communications received across the first VPN from the third programmable integrated circuit of the second information handling system,
communicate the decrypted first VPN data to the OS executing on the host programmable integrated circuit of the first information handling system; and
encrypt the data received from the OS executing on the host programmable integrated circuit and retransmitting the second encrypted data as first VPN data across the first VPN to the third programmable integrated circuit of the second information handling system.
12. The method of claim 9 , further comprising operating the third processing device of the second information handling system to bridge the first VPN and the second VPN to establish a data path from the host programmable integrated circuit of the first information handling system through the NIC to the fourth programmable integrated circuit of the third information handling system.
13. The method of claim 9 , where the network comprises a public network, and where the NIC comprises a network interface coupled to the public network by local network hardware coupled between the first information handling system and the public network, the local network hardware comprising at least one of a router, switch, or firewall hardware.
14. The method of claim 9 , further comprising operating the second programmable integrated circuit of the NIC to:
broker the first encrypted connection by transmitting cryptographic key/s across the network to the third programmable integrated circuit of the second information handling system for a VPN login to establish the first VPN across the network for encrypted network communications between the NIC and the third programmable integrated circuit of the second information handling system;
decrypt the first VPN data of encrypted network communications received across the first VPN from the third programmable integrated circuit of the second information handling system, and communicate the decrypted first VPN data to the host programmable integrated circuit; and
encrypt data received from the host programmable integrated circuit of the first information handling system and retransmit the encrypted data as first VPN data across the first VPN to the third programmable integrated circuit of the second information handling system.
15. The method of claim 9 , further comprising operating the second programmable integrated circuit of the NIC to automatically broker the first encrypted connection across the network between the second programmable integrated circuit of the NIC and the third programmable integrated circuit of the second information handling system at every power on event and/or at every booting of a host operating system (OS) executing on the host programmable integrated circuit of the first information handling system.
16. A method, comprising:
operating a host programmable integrated circuit of a first information handling coupled to a second programmable integrated circuit integrated within a network interface controller (NIC) of the first information handling system, the second programmable integrated circuit of the NIC being coupled in communication between the host programmable integrated circuit and a network; and
operating the second programmable integrated circuit of the NIC to broker a first encrypted connection across the network between the second programmable integrated circuit of the NIC and a third programmable integrated circuit of a second information handling system in a manner that is separate from the host programmable integrated circuit of the first information handling system; and
where the method further comprises operating the second programmable integrated circuit of the NIC to:
broker the first encrypted connection by transmitting first cryptographic key/s across the network to the third programmable integrated circuit of the second information handling system as credentials to establish a first session of the first encrypted connection between the NIC and the third programmable integrated circuit of the second information handling system,
establish a second and different encrypted connection across the network between the NIC and a fourth programmable integrated circuit of a third information handling system,
receive second cryptographic key/s from the fourth programmable integrated circuit of the third information handling system across the second encrypted connection, the second cryptographic key/s being different from the first cryptographic key/s; and
transmit the second cryptographic key/s across the network to the third programmable integrated circuit of the second information handling system as credentials to establish a second and different session of the first encrypted connection between the NIC and the to the third programmable integrated circuit of the second information handling system.
17. A method, comprising:
operating a host programmable integrated circuit of a first information handling system coupled to a second programmable integrated circuit integrated within a network interface controller (NIC) of the first information handling system, the second programmable integrated circuit of the NIC being coupled in communication between the host programmable integrated circuit and a network; and
operating the second programmable integrated circuit of the NIC to broker a first encrypted connection across the network between the second programmable integrated circuit of the NIC and a third programmable integrated circuit of a second information handling system in a manner that is separate from the host programmable integrated circuit of the first information handling system;
where the first information handling system is a bare metal server; and were the method further comprises operating the second programmable integrated circuit of the NIC to automatically broker the first encrypted connection across the network between the first information handling system and the third programmable integrated circuit of the second information handling system at a first power on event of the bare metal server with no host OS installed on the bare metal server.