Trusted network protocol proxy via intelligent network interface controller

Abstract

An information processing system may include a processor and a network interface. The network interface may be configured to perform protocol conversion during communication between the information processing system and a destination system by: receiving data from the processor according to a first protocol; converting the data to a second protocol; and transmitting the converted data to the destination system.

Description

Technical Field

[0001] The present disclosure generally relates to information processing systems, and more particularly, to methods and systems for enabling a trusted network protocol proxy via an intelligent network interface controller. Background Art

[0002] As the value and use of information continue to increase, individuals and enterprises seek additional ways to process and store information. One option available to users is an information processing system. An information processing system typically processes, compiles, stores, and / or communicates information or data for commercial, personal, or other purposes, thereby allowing users to leverage the value of this information. Since the technologies and information processing needs and requirements vary among different users or applications, information processing systems may also vary in terms of what information is processed, how the information is processed, how much information is processed, stored, or communicated, and how quickly and efficiently the information can be processed, stored, or communicated. The variations in information processing systems allow the information processing systems to be general-purpose or configured for a particular user or particular use (such as financial transaction processing, flight reservation, enterprise data storage, or global communication). Additionally, an information processing system may include various hardware and software components that can be configured to process, store, and communicate information, and may include one or more computer systems, data storage systems, and networking systems.

[0003] In some computing applications, an information processing system may include a hypervisor for hosting one or more virtual resources such as virtual machines (VMs). A hypervisor may include software and / or firmware that is generally operable to allow multiple virtual machines and / or operating systems to run simultaneously on a single information processing system. This operability is typically achieved via virtualization, which is a technique for hiding the physical characteristics of computing system resources (e.g., the physical hardware of a computing system) from other systems, applications, or end users so that these resources can be interacted with. Thus, a virtual machine may include any program or collection of programs of executable instructions that are configured to execute a guest operating system on the hypervisor or host operating system so as to manage and / or control the allocation and use of hardware resources such as memory, central processing unit time, disk space, and input and output devices by or in conjunction with the hypervisor / host operating system, and to provide an interface between such hardware resources and the applications hosted by the guest operating system.

[0004] In other applications, an information processing system may be used in a "bare metal" configuration, where only one operating system is installed and no hypervisor and virtual resources are required.

[0005] In either case, the network interface of the information handling system may include an intelligent network interface card or "SmartNIC" and / or a data processing unit (DPU), which may provide capabilities not found in a traditional NIC. For purposes of this disclosure, the terms "SmartNIC" and "DPU" may be used interchangeably.

[0006] In some data center production environments, certain network protocols may be intentionally disabled for security reasons. For example, Dynamic Host Configuration Protocol (DHCP) and Trivial File Transfer Protocol (TFTP) are protocols that are often prohibited in such situations. For example, such protocols may be blocked by switches, routers, firewalls, etc. within the environment. However, various useful capabilities may rely on such prohibited protocols. For example, without such protocols, network boot (e.g., booting using the Preboot Execution Environment (PXE)) may not be available. In addition, various HCI specific tasks such as node imaging, downloading payloads, etc. may also rely on prohibited protocols.

[0007] However, in such environments, HTTP and HTTPS are usually available for use. Therefore, embodiments of the present disclosure can enable prohibited network protocols to be used by converting their communications to allowed protocols (e.g., by encapsulating the communications in HTTP or HTTPS packets).

[0008] It should be noted that the discussion of technology in the background section of the present disclosure does not constitute an admission of the prior art. Such an admission is not made herein unless clearly and unambiguously indicated as such. Summary of the invention

[0009] According to the teachings of the present disclosure, disadvantages and problems associated with existing network protocol technologies within information handling systems may be reduced or eliminated.

[0010] According to an embodiment of the present disclosure, an information processing system may include a processor and a network interface. The network interface may be configured to perform protocol conversion during communication between the information processing system and a destination system by: receiving data from the processor according to a first protocol; converting the data to a second protocol; and transmitting the converted data to the destination system.

[0011] According to these and other embodiments of the present disclosure, a method may include performing the following operations in an information processing system including a processor and a network interface: performing protocol conversion at the network interface during communication between the information processing system and a destination system by: receiving data from the processor according to a first protocol; converting the data to a second protocol; and transmitting the converted data to the destination system.

[0012] According to these and other embodiments of the present disclosure, an article of manufacture may include a non-transitory computer-readable medium having instructions thereon that are executable by a processor of a network interface of an information handling system to perform the following operations: performing protocol conversion during communications between the information handling system and a destination system by: receiving data from the processor according to a first protocol; converting the data to a second protocol; and transmitting the converted data to the destination system.

[0013] From the drawings, descriptions and claims included herein, the technical advantages of the present disclosure may be easily apparent to those skilled in the art. The objects and advantages of the embodiments will be achieved and realized at least by the elements, features and combinations particularly pointed out in the claims.

[0014] It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are not restrictive of the claims set forth in the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] A more complete understanding of embodiments of the present invention and advantages thereof may be obtained by referring to the following description taken in conjunction with the accompanying drawings, in which like reference numerals indicate like features, and in which:

[0016] Figure 1 A block diagram illustrating selected components of an example information processing system according to an embodiment of the present disclosure; and

[0017] Figure 2 A block diagram illustrating an example architecture according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0018] refer to Figure 1 and Figure 2 The preferred embodiments and their advantages are best understood wherein like numerals are used to designate like and corresponding parts.

[0019] For purposes of this disclosure, the term "information handling system" may include any tool or collection of tools that can be operated to calculate, classify, process, transmit, receive, retrieve, generate, switch, store, display, visualize, detect, record, reproduce, dispose of, or utilize any form of information, intelligence, or data for commercial, scientific, control, entertainment, or other purposes. For example, an information handling system may be a personal computer, a personal digital assistant (PDA), a consumer electronic device, a network storage device, or any other suitable device, and may vary in size, shape, performance, functionality, and price. An information handling system may include a memory, one or more processing resources (such as a central processing unit ("CPU") or hardware or software control logic). Additional components of an information handling system may include one or more storage devices, one or more communication ports for communicating with external devices, and various input / output ("I / O") devices (such as a keyboard, a mouse, and a video display). An information handling system may also include one or more buses that can be operated to transmit communications between various hardware components.

[0020] For purposes of this disclosure, when two or more elements are referred to as being “coupled” to each other, the term indicates that the two or more elements are in electronic or mechanical communication, where applicable, whether directly or indirectly, with or without intervening elements.

[0021] When two or more elements are referred to as being "coupleable" to each other, the term indicates that they are capable of being coupled together.

[0022] For purposes of this disclosure, the term "computer-readable medium" (e.g., transient or non-transitory computer-readable medium) may include any tool or collection of tools that can retain data and / or instructions for a period of time. Computer-readable media may include, but are not limited to: storage media such as direct access storage devices (e.g., hard drives or floppy disks), sequential access storage devices (e.g., tape disk drives), optical disks, CD-ROMs, DVDs, random access memories (RAM), read-only memories (ROMs), electrically erasable programmable read-only memories (EEPROMs), and / or flash memories; communication media such as wires, optical fibers, microwaves, radio waves, and other electromagnetic and / or optical carrier waves; and / or any combination of the foregoing. Physical computer-readable media such as disk drives, solid-state drives, non-volatile memories, etc. may also be referred to herein as "physical storage resources."

[0023] For the purposes of this disclosure, the term "information processing resource" may broadly refer to any component system, device or equipment of an information processing system, including but not limited to: a processor, a service processor, a basic input / output system, a bus, a memory, an I / O device and / or an interface, a storage resource, a network interface, a motherboard and / or any other component and / or element of an information processing system.

[0024] For purposes of this disclosure, the term "management controller" may broadly refer to an information handling system that provides management functionality (typically out-of-band management functionality) to one or more other information handling systems. In some embodiments, the management controller may be (or may be an integral part of) a service processor, a baseboard management controller (BMC), a chassis management controller (CMC), or a remote access controller (e.g., Dell Remote Access Controller (DRAC) or Integrated Dell Remote Access Controller (iDRAC)).

[0025] Figure 1 1 is a block diagram showing selected components of an example information processing system 100 having multiple host systems 102 according to an embodiment of the present disclosure. Figure 1 As shown, information handling system 100 may include multiple host systems 102 coupled to each other via an internal network 110 .

[0026] In some embodiments, information handling system 100 may include a single chassis housing multiple host systems 102. In other embodiments, information handling system 100 may include a cluster of multiple chassis, each chassis having one or more host systems 102. In still other embodiments, host systems 102 may be completely separate information handling systems, and they may be coupled together via an internal network or an external network such as the Internet.

[0027] In some embodiments, host system 102 may include a server (e.g., embodied in a "sled" form factor). In these and other embodiments, host system 102 may include a personal computer. In other embodiments, host system 102 may be a portable computing device (e.g., a laptop, notebook, tablet, handheld device, smartphone, personal digital assistant, etc.). Figure 1 As shown, the information processing system 100 may include a processor 103, a memory 104 communicatively coupled to the processor 103, and a network interface 106 communicatively coupled to the processor 103. For the purpose of clear explanation, Figure 1 In FIG. 1 , each host system 102 is shown as including only a single processor 103 , a single memory 104 , and a single network interface 106 . However, host systems 102 may include any suitable number of processors 103 , memories 104 , and network interfaces 106 .

[0028] The processor 103 may include any system, device or apparatus configured to interpret and / or execute program instructions and / or process data, and may include, but is not limited to, a microprocessor, a microcontroller, a digital signal processor (DSP), an application specific integrated circuit (ASIC), or any other digital or analog circuit configured to interpret and / or execute program instructions and / or process data. In some embodiments, the processor 103 may interpret and / or execute program instructions and / or process data stored in the memory 104 and / or other computer-readable media accessible to the processor 103.

[0029] Memory 104 may be communicatively coupled to processor 103 and may include any system, device, or apparatus (e.g., a computer-readable medium) configured to retain program instructions and / or data for a period of time. Memory 104 may include RAM, EEPROM, PCMCIA card, flash memory, magnetic storage device, optical-magnetic storage device, or any suitable group and / or set of volatile memory or non-volatile memory that retains data after power to information handling system 100 is disconnected.

[0030] like Figure 1 As shown, a hypervisor 116 and one or more guest operating systems (OS) 118 may be stored on the memory 104. In some embodiments, the hypervisor 116 and one or more guest OS 118 may be stored in a computer-readable medium (e.g., a local or remote hard drive) accessible to the processor 103 other than the memory 104. Each guest OS 118 may also be referred to as a "virtual machine."

[0031] Hypervisor 116 may include software and / or firmware that is generally operable to allow multiple virtual machines and / or operating systems to run simultaneously on a single computing system (e.g., information handling system 100). This operability is generally achieved via virtualization, which is a technique for hiding the physical characteristics of computing system resources (e.g., the computing system's physical hardware) from other systems, applications, or end users from interacting with those resources. The hypervisor 116 may be one of a variety of dedicated and / or commercially available virtualization platforms, including but not limited to: VIRTUALLOGIX VLX for embedded systems, IBM's Z / VM, XEN, ORACLE VM, VMWARE's ESX SERVER, L4 MICROKERNEL, TANGO, MICROSOFT's HYPER-V, SUN's LOGICAL DOMAINS, HITACHI's VIRTAGE, KVM, VMWARE SERVER, VMWARE WORKSTATION, VMWARE FUSION, QEMU, MICROSOFT's VIRTUAL PC and VIRTUAL SERVER, INNOTEK's VIRTUALBOX, and SWSOFT's PARALLELS WORKSTATION and PARALLELS DESKTOP.

[0032] In one embodiment, the hypervisor 116 may include a specially designed OS with native virtualization capabilities. In another embodiment, the hypervisor 116 may include a standard OS with a merged virtualization component for performing virtualization.

[0033] In another embodiment, the hypervisor 116 may include a standard OS running concurrently with a separate virtualized application. In this embodiment, the virtualized application of the hypervisor 116 may be an application that runs on top of the OS and interacts with computing system resources only through the OS. Optionally, at some levels, the virtualized application of the hypervisor 116 may interact indirectly with computing system resources via the OS, and at other levels, directly interact with computing system resources (e.g., similar to the way the OS interacts directly with computing system resources, or as firmware running on computing system resources). As yet another alternative, at all levels, the virtualized application of the hypervisor 116 may interact directly with computing system resources (e.g., similar to the way the OS interacts directly with computing system resources, or as firmware running on computing system resources) without utilizing the OS, but still interacting with the OS to coordinate the use of computing system resources.

[0034] As described above, the hypervisor 116 may instantiate one or more virtual machines. A virtual machine may include any program of executable instructions or a collection of programs of executable instructions that is configured to execute a client OS 118 so as to manage and / or control the allocation and use of hardware resources such as memory, CPU time, disk space, and input and output devices through or in conjunction with the hypervisor 116, and to provide an interface between such hardware resources and applications hosted by the client OS 118. In some embodiments, the client OS 118 may be a general-purpose OS, such as WINDOWS or LINUX, for example. In other embodiments, the client OS 118 may include a dedicated and / or limited-purpose OS configured to perform application-specific functionality (e.g., persistent storage).

[0035] At least one host system 102 in the information handling system 100 may have a virtual machine manager 120 stored in its memory 104. The virtual machine manager 120 may include software and / or firmware that is generally operable to manage the various hypervisors 116 and the guest OS 118 instantiated on each hypervisor 116, including controlling the migration of the guest OS 118 between the hypervisors 116. Figure 1 The virtual machine manager 120 is shown as being instantiated on a host system 102 on which the hypervisor 116 is also instantiated, but in some embodiments, the virtual machine manager 120 may be instantiated on a dedicated host system 102 within the information handling system 100 or on a host system 102 of another information handling system 100.

[0036] The network interface 106 may include any suitable system, device, or apparatus operable to act as an interface between the associated information handling system 100 and the internal network 110. The network interface 106 may enable its associated information handling system 100 to communicate with the internal network 110 using any suitable transmission protocol (e.g., TCP / IP) and / or standard (e.g., IEEE 802.11, Wi-Fi). In certain embodiments, the network interface 106 may include a physical network interface card (NIC). In the same or alternative embodiments, the network interface 106 may be configured to communicate via wireless transmission. In the same or alternative embodiments, the network interface 106 may provide physical access to the networking medium and / or provide a low-level addressing system (e.g., by using a media access control address). In some embodiments, the network interface 106 may be implemented as a local area network ("LAN") on the motherboard ("LOM") interface. The network interface 106 may include one or more suitable NICs, including but not limited to: a mezzanine card, a network daughter card, etc.

[0037] In some embodiments, the network interface 106 may include a SmartNIC and / or a DPU. In addition to the statefulness and custom offloads that a SmartNIC or DPU may provide, the network interface may also have an independent management domain with a separate operating system, independent certificates, and independent remote access. Thus, the network interface 106 may include its own dedicated processor and memory.

[0038] In addition to processor 103 , memory 104 , and network interface 106 , host system 102 may also include one or more other information processing resources.

[0039] The internal network 110 may be a network and / or structure configured to communicatively couple information processing systems to each other. In certain embodiments, the internal network 110 may include a communication infrastructure that provides physical connections and a management layer that organizes the physical connections of the host system 102 and other devices coupled to the internal network 110. The internal network 110 may be implemented as a storage area network (SAN), a personal area network (PAN), a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), a wireless local area network (WLAN), a virtual private network (VPN), an intranet, the Internet, or any other suitable architecture or system that facilitates the transmission of signals, data, and / or messages (commonly referred to as data), or may be a part of them. The internal network 110 may use any storage and / or communication protocol to transmit data, including but not limited to: Fiber Channel, Fiber Channel over Ethernet (FCoE), Small Computer System Interface (SCSI), Internet SCSI (iSCSI), Frame Relay, Ethernet Asynchronous Transfer Mode (ATM), Internet Protocol (IP), or other packet-based protocols, and / or any combination thereof. The network 110 and its various components may be implemented using hardware, software, or any combination thereof.

[0040] Now go to Figure 2 , a block diagram of selected components of another embodiment is shown. Host 202 includes or is communicatively coupled to management controller 126 (eg, BMC). Host 202 also includes SmartNIC 206 as a network interface.

[0041] SmartNIC 206 may execute a software agent (referred to herein as a trusted network protocol agent) in operation that exposes an emulated NIC (e.g., a standard NIC) to host 202. The software agent may also expose a bridge NIC to the SmartNIC OS for external communication with other information processing systems such as destination 250.

[0042] SmartNIC 206 can be configured to communicate with the network in accordance with a first network protocol (e.g., Figure 2The SmartNIC 206 may communicate with the host 202 via the emulated NIC using a protocol that is prohibited in an environment such as DHCP or TFTP. The SmartNIC 206 or an agent executing thereon may convert such communications to a different second network protocol that is not prohibited (e.g., HTTP or HTTPS). For example, data received from the host 202 may be encapsulated in packets according to the second protocol before being transmitted to the destination 250. In some embodiments, the destination 250 and the SmartNIC 206 may communicate via a representational state transfer (REST) ​​application programming interface (API).

[0043] Conversely, communications received from destination 250 at SmartNIC 206 may be converted (e.g., decapsulated) according to the second protocol before being passed to host 202. In this way, bidirectional communications may be achieved, such that host 202 communicates internally via a prohibited protocol, but external communications occur via an allowed protocol.

[0044] In some embodiments, the destination 250 may also include a SmartNIC configured to perform the same type of protocol conversion. For example, the host 202 may initiate a TFTP request, and its SmartNIC may communicate the request via HTTPS. The SmartNIC at the destination 250 may receive the HTTPS version of the TFTP request, convert the version back to normal TFTP, and pass the normal TFTP to the host system at the destination 250.

[0045] In this embodiment, the software agent may run entirely on the SmartNIC 206 without requiring any processing resources of the host 202. In addition, the management controller 126 may provide credentials to the destination 250 (e.g., verification of a username and password or other suitable authentication mechanism according to a REST API).

[0046] In some embodiments, SmartNIC 206 may also execute a DHCP server service internally, and the software agent may communicate with the service via the bridge NIC. The DHCP server on the SmartNIC may also use a REST API, and DHCP configuration information may be passed as a parameter via the REST API. The host 202 may receive a DHCP response via the simulated NIC of SmartNIC 206.

[0047] In some embodiments, SmartNIC 206 may also include a cache that can be used for certain types of communications. When host 202 requests a network file via, for example, TFTP, the agent may first scan the cache to try to find the file mentioned by the TFTP request. If the file is found, the agent may immediately return the file to host 202 via the TFTP protocol without requiring any external communication. If the file is not found, the agent may convert the request to communicate externally with destination 250 via a REST API as discussed above.

[0048] Destination 250 may pass the requested files in packets via the REST API to SmartNIC 206. The agent may save each packet in a cache folder and begin the process of responding to TFTP requests initiated by host 202. The software agent executing on SmartNIC 206 may communicate with the cache via a bridge NIC or via any other suitable mechanism.

[0049] The protocol conversion may be accomplished in any suitable manner. For example, Listing 1 below is one embodiment of a TFTP request that may be communicated via HTTP, HTTPS, a REST API, or any other suitable mechanism.

[0050] Post:

[0051] Open: TFTP

[0052] Source: / TFTP / Payload

[0053] Target: 192.168.0.1

[0054] Get:

[0055] Name: TFTP

[0056] Source: 192.168.0.1

[0057] original:

[0058] Id: 8527

[0059] submit:

[0060] Id: 8527

[0061] original:

[0062] submit:

[0063] Cache: TFTP

[0064] start:

[0065] length:

[0066] flow:

[0067] List 1.

[0068] Although various possible advantages have been described with respect to the embodiments of the present disclosure, those of ordinary skill in the art who have benefited from the present disclosure will appreciate that not all of these advantages may apply in any particular embodiment. In any particular embodiment, some, all, or even none of the advantages listed may apply.

[0069] The present disclosure covers all changes, substitutions, variations, alterations and modifications to the exemplary embodiments herein that would be conceived by a person of ordinary skill in the art. Similarly, the appended claims cover all changes, substitutions, variations, alterations and modifications to the exemplary embodiments herein that would be conceived by a person of ordinary skill in the art, where appropriate. In addition, references in the appended claims to a device or system or a component of a device or system that is adapted to, arranged to, capable of, configured to, enabled to, operable to, or operated to perform a specific function cover the device, system or component, whether or not the device, system, component or the specific function is activated, turned on or unlocked, as long as the device, system or component is adapted to, arranged to, capable of, configured to, enabled to, operable to, or operated to perform the specific function.

[0070] Unless otherwise specifically noted, the articles shown in the drawings are not necessarily drawn to scale. However, in some embodiments, the articles shown in the drawings may be drawn to scale.

[0071] All examples and conditional language described herein are intended for teaching purposes to help readers understand the inventions and concepts contributed by the inventors to advance the present technology, and are interpreted as not being limited to such specifically described examples and conditions. Although embodiments of the present invention have been described in detail, it should be understood that various changes, substitutions and modifications may be made to the present disclosure without departing from the spirit and scope of the present disclosure.

Claims

1. An information processing system, the information processing system include: processor; as well as Network interface; The network interface is configured to perform protocol conversion during communication between the information processing system and the destination system by: receiving data from the processor according to the disabled first protocol; converting the data to a second protocol that is not prohibited; and The converted data is transmitted to the destination system.

2. The information processing system of claim 1, wherein the first protocol comprises a protocol selected from the group consisting of Dynamic Host Configuration Protocol (DHCP) and Trivial File Transfer Protocol (TFTP).

3. The information processing system of claim 1, wherein the second protocol comprises a Representational State Transfer (REST) ​​application programming interface (API). 4 . The information handling system of claim 1 , wherein the network interface controller is configured to expose a simulated network interface controller to the processor. 5 . The information processing system of claim 1 , wherein the network interface controller is configured to expose a bridge-type network interface controller to the destination system.

6. The information processing system according to claim 1, wherein the information processing system is further configured to: receiving additional data from the destination system according to the second protocol; converting the additional data to the first protocol; and The converted additional data is transmitted to the processor.

7. A method, the method comprising performing the following operations in an information processing system including a processor and a network interface: Performing protocol conversion at the network interface during communication between the information processing system and the destination system by: receiving data from the processor according to the disabled first protocol; converting the data to a second protocol that is not prohibited; and The converted data is transmitted to the destination system.

8. The method of claim 7, wherein the first protocol comprises a protocol selected from the group consisting of Dynamic Host Configuration Protocol (DHCP) and Trivial File Transfer Protocol (TFTP).

9. The method of claim 7, wherein the second protocol comprises a Representational State Transfer (REST) ​​application programming interface (API).

10. The method of claim 7, wherein the network interface controller is configured to expose a simulated network interface controller to the processor.

11. The method of claim 7, wherein the network interface controller is configured to expose a bridge-type network interface controller to the destination system.

12. The method of claim 7, further comprising: include: receiving additional data from the destination system according to the second protocol; converting the additional data to the first protocol; as well as The converted additional data is transmitted to the processor.

13. An article of manufacture comprising a non-transitory computer readable medium having instructions thereon, the instructions being executable by a processor of a network interface of an information processing system to: Protocol conversion is performed during communication between the information processing system and the destination system by: receiving data from the processor according to the disabled first protocol; converting the data to a second protocol that is not prohibited; and The converted data is transmitted to the destination system.

14. The article of manufacture of claim 13, wherein the first protocol comprises a protocol selected from the group consisting of Dynamic Host Configuration Protocol (DHCP) and Trivial File Transfer Protocol (TFTP).

15. The article of manufacture of claim 13, wherein the second protocol comprises a Representational State Transfer (REST) ​​application programming interface (API).

16. The article of manufacture of claim 13, wherein the network interface controller is configured to expose a simulated network interface controller to the processor.

17. The article of manufacture of claim 13, wherein the network interface controller is configured to expose a bridge-type network interface controller to the destination system.

18. The article of manufacture of claim 13, wherein the instructions are further executable to: receiving additional data from the destination system according to the second protocol; converting the additional data to the first protocol; and The converted additional data is transmitted to the processor.

Images