Methods and systems for using smart network interface cards to secure data transmission between an initiator host running an object and a target host equipped with a disaggregated hardware device that satisfies hardware specifications of the object
This disclosure is directed to methods and systems that establish a secure data channel between a host and a disaggregated hardware device (“DHD”) of a data center. The system comprises an initiator host that runs objects, such as virtual machines and containers. The host includes an initiator smart network interface card (“SNIC”). The initiator SNIC includes a virtual device, a trust platform module (“TPM”) and a security engine. The system also comprises a target host equipped with a DHD and a target SNIC. The target SNIC includes a TPM and a security engine. The TPM and the security engine of the initiator SNIC and the TPM and the security engine of the target SNIC establish a secure data channel between an object running on the host and the DHD.
1 . A method for establishing a secure data channel between an initiator host and a disaggregated hardware device (“DHD”) of a target host in a data center, the method comprising:
creating an initiator device key pair at an initiator smart network interface card (“SNIC”) of the initiator host, the initiator device key pair having an initiator private device key and an initiator public device key;
reserving a DHD at the target host in response to a target SNIC of the target host receiving a hardware allocation request and the initiator public device key from the initiator SNIC;
creating a target device key pair at the target SNIC of the target host, the target device key pair having a target private device key and a target public device key; and
sending a notification of a successful reservation of the DHD and the target public device key to the initiator SNIC from the target SNIC,
wherein reserving the DHD at the target host comprises:
constructing the hardware allocation request in response to the initiator SNIC receiving a hardware specification for running an object on the initiator host;
sending the hardware allocation request and the initiator public device key from the initiator SNIC to a disaggregated hardware manager of the data center;
searching a trusted computing resource pool of the data center for an available DHD that matches the hardware specification in the hardware allocation request; and
applying a certificate to the initiator public device key when an available DHD that matches the hardware specification in the hardware allocation request is identified in the trusted computing resource pool.
2 . The method of claim 1 wherein creating the initiator device key pair at the initiator SNIC comprises generating a management key pair using a trusted platform module (“TPM”) of the initiator SNIC in response to the TPM receiving instructions from a disaggregated hardware daemon running on the initiator SNIC.
3 . The method of claim 1 further comprising the initiator SNIC and the target SNIC establishing a symmetric key pair for sending data to the DHD of the target host.
4 . A system for securing data transmission between a host and a disaggregated hardware device (“DHD”) of a data center, the system comprising:
an initiator host that provides an execution environment for running an object;
an initiator smart network interface card (“SNIC”) interconnected with a bus of the initiator host, the initiator SNIC having a trusted platform module (“TPM”), a virtual device corresponding to a hardware allocation of the DHD that satisfies hardware specifications of the object and presented to the initiator host as a local hardware device that satisfies the hardware specifications of the object, and a security engine;
a target host equipped with the DHD; and
a target SNIC interconnected with a bus of the target host, the target SNIC having a TPM and a security engine, the TPM and the security engine of the initiator SNIC and the TPM and the security engine of the target SNIC establishing a secure data channel between the object and the DHD to enable the object to access the DHD over the secure data channel through the virtual device.
5 . The system of claim 4 wherein the TPM of the initiator SNIC comprises a key derivation function that creates an initiator device key pair having an initiator private device key and an initiator public device key.
6 . The system of claim 4 wherein the TPM of the target SNIC comprises a key derivation function that creates a target device key pair having a target private device key and a target public device key.
7 . The system of claim 4 wherein the security engine of the initiator SNIC encrypts data for sending to the DHD using an initiator private device key created by the TPM of the initiator SNIC and decrypts results generated by the DHD using a target public device key created by the TPM of the target SNIC.
8 . The system of claim 4 wherein the security engine of the target SNIC encrypts results generated by the DHD using a target private device key created by the TPM of the target SNIC and decrypts data sent to the DHD from the initiator SNIC using an initiator public device key created by the TPM of the initiator SNIC.
9 . The system of claim 4 further comprising a disaggregated hardware manager that searches a trusted computing resource pool of the data center to identify the DHD of the target host.
10 . The system of claim 4 wherein the target host comprises a shared hardware manager that tracks which DHDs of the target host are available.
11 . A method for establishing a secure data channel between an initiator host and a disaggregated hardware device (“DHD”) of a target host in a data center, the method comprising:
creating an initiator device key pair at an initiator smart network interface card (“SNIC”) of the initiator host, the initiator device key pair having an initiator private device key and an initiator public device key;
reserving a DHD at the target host in response to a target SNIC of the target host receiving a hardware allocation request and the initiator public device key from the initiator SNIC;
creating a target device key pair at the target SNIC of the target host, the target device key pair having a target private device key and a target public device key; and
sending a notification of a successful reservation of the DHD and the target public device key to the initiator SNIC from the target SNIC,
wherein reserving the DHD at the target host comprises:
sending the hardware allocation request and a certificate verifying the trustworthiness of the initiator public device key to the target SNIC;
reserving the DHD of the target host, the DHD matching the hardware specification in the hardware allocation request;
generating the target device key pair using a target TPM of the target SNIC in response to the target TPM receiving instructions from the target SNIC; and
sending the notification of the successful reservation of the DHD and the target public device key from the target SNIC to the initiator SNIC.
12 . The method of claim 11 wherein creating the initiator device key pair at the initiator SNIC comprises generating a management key pair using a trusted platform module (“TPM”) of the initiator SNIC in response to the TPM receiving instructions from a disaggregated hardware daemon running on the initiator SNIC.
13 . The method of claim 11 further comprising the initiator SNIC and the target SNIC establishing a symmetric key pair for sending data to the DHD of the target host.