Intelligent network interface, cloud security unit, method for receiving data, method for sending data and computer-readable storage medium

Abstract

The invention relates to an intelligent network interface (1), comprising: - a network unit (14), which is designed to receive data (19) from an external network (18) and / or send data (19) to the external network (18); - an information exchange unit (13), which is designed to filter and / or block the received data (19) and / or the data (19) to be sent; - a hardware security unit (15), which is designed to encrypt and / or sign the data (19) to be received or the data (19) to be sent. The network interface (1) is characterised in that the network unit (14), the information exchange unit (13) and the hardware security unit (15) are unalterably integrated into a hardware unit (10), for example a daughterboard.

Description

[0001] Intelligent network interface, cloud security unit, method for receiving data, method for sending data and computer-readable storage medium

[0002] Description

[0003] The invention relates to an intelligent network interface, a cloud security unit, a method for receiving data, a method for sending data and a computer-readable storage medium.

[0004] The secure transmission of data between networks has not yet been adequately addressed. Various methods are known for sending data between different networks, for example, over the internet. It should be noted that the internet is considered an insecure network because the transport routes are not under the sole control of the sending or receiving entity.

[0005] Various organizations have developed standards to ensure the highest possible level of data security during storage and transmission. The German Federal Office for Information Security (BSI), for example, issues guidelines that must be met before classified documents can be digitally stored and transmitted. Similar guidelines exist from military organizations, such as NATO. For classified documents to be digitally stored, certification by the relevant, often government, authorities is usually essential. A particular challenge arises when the data is to be transmitted over the public internet and access to this data must also be possible over the internet. Such systems are often referred to as cloud systems. There is no single cloud solution orNot only are different cloud solutions based on a single architecture, but various cloud solutions are based on a wide variety of technologies and architectures. It is therefore necessary to define standardized interfaces between different cloud systems that enable secure data exchange. The modular structure of cloud architectures makes it possible to exchange individual components within a cloud system for others.

[0006] It is known to encrypt the data being transmitted, for example, using virtual private networks. However, such encryption of the transmission is not sufficient to ensure secure storage and transmission of the data, as there are numerous other attack vectors.

[0007] A further challenge is that users of such systems want to use off-the-shelf software that has not undergone any security testing. Therefore, it is important to ensure that an external attack on such systems cannot be successfully carried out.

[0008] Security patterns have been developed to ensure the security and integrity of data in a cloud system. An architecture described by such a pattern includes a firewall that prevents unauthorized access to the network to be protected. An information exchange gateway (IEG) is also deployed to prevent the uncontrolled outflow of classified data. Additionally, a hardware security module (HSM) acts as a trust anchor and provides a PKI (Public Key Infrastructure) with a secure storage medium for public keys, i.e., certificates, and private keys for encrypting data. This allows outgoing communication to be encrypted and incoming communication to be decrypted.

[0009] Furthermore, a kernel is used, which forms the host operating system and provides the interface to all hardware components, e.g., via appropriate hardware drivers. The host operating system provides a virtualization environment for running various guest systems. In the guest system, communication should be additionally encrypted at the application level. However, by using the virtualization environment, it is fundamentally possible to run any type of software while strictly separating the guest systems.

[0010] Within a cloud system, secure communication is possible between individual, mutually authorized guest systems.

[0011] The architecture described above assumes that two communicating cloud systems are similarly structured, i.e., that appropriate encryption methods are implemented. If two different cloud systems are to communicate with each other, which is often necessary in the NATO context, a protocol and media translator (TAC controller) is additionally deployed, which translates outgoing and incoming data from a source protocol to a target protocol, e.g., to use different encryption technologies at the transmission level.

[0012] To ensure a high level of security, certain components must be protected, i.e., against tampering and modification. Typically, the components to be protected include the firewall, the IEG, the kernel, and the virtualization environment, including application-level encryption. Since the kernel, including the hardware drivers, must be protected, any changes to the hardware (and, consequently, the drivers) require regular recertification of the entire system by the relevant government agencies. This is very complex and expensive. It also leads to advantageous technical adjustments to the cloud system being postponed and implemented only late.

[0013] Against this background, the object of the invention is to improve security during data transmission over an unsecured network. Furthermore, the object of the invention is to improve the maintainability and interchangeability of cloud system components, independent of the protection of data during transmission over an unsecured network. Furthermore, the object of the invention is to prevent the need for re-certification of a cloud system when replacing individual components.

[0014] The above object is achieved by the subject matter of the independent claims. The object is achieved in particular by an intelligent network interface comprising the following:

[0015] - a network unit configured to receive data from and / or send data to an external network;

[0016] - an information exchange unit designed to filter and / or block the received data and / or the data to be sent;

[0017] - a hardware security unit configured to encrypt and / or sign the data to be received or the data to be sent; wherein the network unit, the information exchange unit, and the hardware security unit are permanently integrated on a hardware unit, e.g., a daughterboard.

[0018] The intelligent network interface forms an interface to a cloud system, i.e. a secure network, on the one hand, and to an insecure network on the other hand, e.g. the Internet. A core of the invention lies in the fact that the network, instead of the hardware, now forms the component to be protected. In other words, this means that the network itself is protected against intrusion. Other hardware components within the cloud system can be freely replaced. This is made possible because the various components of the intelligent network interface are integrated in a hardware unit. In one embodiment, the hardware unit can comprise one or more processors. In one embodiment, the one or more processors can be embodied as an FPGA.In the context of this application, "unchangeable" means that a change to the configuration of the cloud security unit by the cloud system itself is not possible or is only organizationally possible through authorized admin processes. Overall, the invention achieves significantly greater flexibility in setting up isolated guest systems in the cloud system.

[0019] In one embodiment, the hardware security unit may comprise at least one trust anchor unit and / or a cryptography unit, wherein the at least one trust anchor unit may be configured to provide at least one trusted public, private and / or symmetric key, and wherein the cryptography unit may be configured to encrypt and / or sign data, e.g., the data to be sent and / or the data to be received, using the at least one public, private and / or symmetric key.

[0020] The hardware security unit, also referred to as a "Hardware Secure Module" or HSM, can have two components. The trust anchor unit can be configured to provide a so-called "Public Key Infrastructure" (PKI). This is achieved by providing public and / or private or symmetric keys. The trust anchor unit, also referred to as a "trust anchor," acts as a trust authority in this context. In other words, this means that all other components in the cloud system have a trust relationship with the trust anchor unit, i.e., the trust anchor unit forms a "trust authority." The cryptography unit can be configured to encrypt and / or sign data to be sent using the key provided by the trust anchor unit, in particular using a private key.When data to be sent is encrypted, the public key can be used for encryption. A remote party, e.g. another intelligent network interface, can decrypt correspondingly encrypted data with an associated symmetric key, e.g. using a private key that is assigned to the public key with which the data was encrypted. In this scenario, the public key can be provided by another intelligent network interface and used to encrypt data. Additionally or alternatively, a public key can also be provided by other components of the cloud system, e.g. by participants in the internal network. It is also possible for all participants in the internal network to share a public key.In other words, a public key can be stored by the trust anchor unit for all participants in the internal network, whereby the participants in the internal network have knowledge of the corresponding private key in order to decrypt appropriately encrypted data. Encryption is preferably carried out at Layer 2 of the OSI layer model. The OSI layer model (Open Systems Interconnection) is a conceptual framework that defines how networks communicate with each other and send data from a sender to a receiver. It consists of seven layers: physical, security, switching, transport, session, presentation, and application. Each layer has its own level of abstraction and performs a specific function. If encryption is carried out at Layer 2, the data link layer, then all application data is encrypted, regardless of whether it is on the host system orfurther encryption is provided in the application.

[0021] In one embodiment, the intelligent network interface may comprise a storage unit which may be configured to store one or more trustworthy public, private and / or symmetric keys, wherein in particular the trust anchor unit may be communicatively connected to the storage unit, preferably for reading one or more of the public and / or symmetric keys.

[0022] It is thus further possible in one embodiment for the keys to be securely stored in a storage unit. In one embodiment, it is conceivable that the storage unit is arranged at least on the same circuit board as the trust anchor unit. It is further provided in one embodiment that the storage unit is protected against changes. In one embodiment, it is provided that the trust anchor unit and / or the information exchange unit is (exclusively) communicatively connected to the storage unit, so that only the trust anchor unit and / or the information exchange unit has access to the storage unit and can read and store keys. These embodiments enable quick access to the keys and protection against unauthorized access.

[0023] In one embodiment, the hardware security unit can be configured to transmit the at least one public key to at least one virtualization unit for data encryption. In other words, the hardware security unit can provide a key service in a network, e.g., providing applications with public keys for encrypting and decrypting data. For example, a hypervisor could run an operating system in which an application is executed. The hardware security unit can then provide a public key for this application to encrypt data and decrypt received data.

[0024] In one embodiment, the information exchange unit can be designed to filter the data to be sent and / or received using at least one filter criterion, wherein the at least one filter criterion can in particular indicate a security classification of the data to be sent and / or the data to be received.

[0025] The information exchange unit can thus be configured to implement a comparison step in which a filter criterion is checked against a property of the data to be sent and / or the data to be received. In particular, for data to be sent, it can be checked whether this data has a security classification, e.g., whether it is classified as SECRET or TOP SECRET. For this purpose, the data can include a data field in which the classification is stored. Overall, the information exchange unit can prevent the leakage of data to be protected from the internal network into the insecure external network.

[0026] In one embodiment, the information exchange unit may be communicatively connected to the hardware security unit and configured to receive public keys for decrypting received data.

[0027] The information exchange unit can thus also gain access to the keys stored in the hardware security unit in order to efficiently decrypt data or to authenticate itself as a counterpart in another network segment.

[0028] In one embodiment, the data to be sent can be encrypted at an application layer. In addition to encryption of the data link layer or the network layer, encryption can also be performed at the application layer. For example, the HTTPS protocol is typically used to transmit Internet pages. HTTPS (Hypertext Transfer Protocol Secure) is a communications protocol on the World Wide Web, i.e., the Internet, with which data can be transmitted in a secure manner. It represents transport encryption, i.e., encryption of the application layer, and was developed to ensure the confidentiality and integrity of communication between web servers and web browsers (clients) on the World Wide Web. This is achieved, among other things, through encryption and authentication.

[0029] Application-layer encryption is particularly advantageous when combined with a protocol conversion unit. When translating from a source protocol to a target protocol, the data must first be decrypted before it can be encrypted again for the target protocol. This provides attackers with a point of attack to intercept confidential data. Additional application-layer encryption prevents confidential data from being exposed unencrypted, thus increasing the overall security of the transmission.

[0030] In one embodiment, a public key stored by the hardware security unit may be used to authenticate another intelligent network interface associated with the public key.

[0031] In other words, a public key can be used to authenticate a network component. This creates a trust relationship between the intelligent network interface and the other network component, i.e., the other intelligent network interface. This has the advantage that communication is only conducted with authenticated components.

[0032] In one embodiment, the hardware security unit can be configured to receive random numbers from an entropy unit, particularly one configured as part of the intelligent network interface or configured separately therefrom, and to use the random numbers indirectly in the encryption, decryption, and / or signing of the data to be sent. Additionally or alternatively, the random numbers can be used to generate key pairs for information exchange.

[0033] An entropy unit can generate random numbers. Generating random numbers is a difficult task in information technology. For example, the entropy unit can comprise at least one quantum random number generator. Such a quantum random number generator can, for example, exploit the randomness of the shot noise of a light source captured by a CMOS image sensor to generate (truly) random numbers. This is highly advantageous for generating keys for encryption using asymmetric cryptography methods. For example, session keys can be derived from a previously shared secret key. Each session key is then assigned a predetermined validity, e.g., a time value. Data encrypted with a corresponding session key is only accepted if the session key is still valid.

[0034] The previously shared private key can be used to generate a public key pair, which can be exchanged using the Diffie-Hellman exchange method. Once the corresponding keys have been exchanged, the data can be encrypted using common cryptography methods. The initially loaded private key can remain on the storage device.

[0035] In one embodiment, the entropy unit may provide a software as a service application and be communicatively coupled to the hardware security unit.

[0036] A particularly advantageous embodiment results when the entropy unit is not integrated into the same hardware unit, but provides a service via the secure internal network. However, it is also possible for the entropy unit to be located in the insecure external network, since a random number is not information that needs to be protected. In one embodiment, the entropy unit can be configured as part of the intelligent network interface and communicatively connected to the hardware security unit.

[0037] For a particularly efficient implementation, the entropy unit can be implemented as part of the intelligent network interface. This prevents lengthy queries over a network and allows the random numbers to be provided very quickly.

[0038] In one embodiment, the intelligent network interface may comprise at least one virtualization unit which may be configured to connect at least one operating system and / or at least one host application to the external network, wherein the at least one virtualization unit may further be configured to execute a virtualized representation of a network card for each operating system or each host application, wherein in particular each virtualized representation of the network card has a different PCI bus address.

[0039] It is particularly advantageous if the intelligent network interface provides virtual representations of network cards, preferably with different PCI bus addresses, so that connected applications and / or operating systems can communicate transparently with other network participants. The complexity of the intelligent network interface, i.e., data encryption and authentication to other network participants, is thus transparent to the connected applications and / or operating systems. The different PCI bus addresses enable secure separation of the data to be sent and / or received.

[0040] The problem is further solved in particular by a cloud security unit, comprising:

[0041] - an intelligent network interface, in particular as described above;

[0042] - at least one virtualization unit configured to communicate with an external network by means of the intelligent network interface, at least one operating system and / or at least one host application.

[0043] In one embodiment, each operating system and / or host application may be configured to use a different virtualized representation of the network card to communicate with the external network.

[0044] For the host application or operating system to access the functions of the intelligent network interface, a separate virtualized representation of the intelligent network interface can be used. These virtualized representations can be differentiated by different PCI bus addresses. Furthermore, it is conceivable that the keys used and provided for the respective host application or operating system are stored in separate memory areas by the hardware security unit of the intelligent network interface.

[0045] In one embodiment, the at least one virtualization unit and / or the operating system and / or the host application can be configured to encrypt or decrypt incoming data and / or data to be sent, in particular at the network layer and / or the application layer.

[0046] In one embodiment, the at least one virtualization unit can be communicatively connected to the intelligent network interface via an internal network connection. This means that the intelligent network interface separates a secure internal network from an external insecure network and enables the transmission of data to be protected via the insecure network to a second authenticated cloud security unit.

[0047] In one embodiment, the at least one virtualization unit and / or the operating system and / or the host application can be configured to receive public keys for signing or decrypting incoming data and / or data to be sent from the hardware security unit, and in particular, can be configured to encrypt or sign the data with the received keys. In other words, the intelligent network interface can provide a key service for the virtualization unit.

[0048] In one embodiment, the cloud security unit may comprise a protocol conversion unit configured to transform the data to be sent and / or received from a source protocol to a target protocol, particularly at a protocol layer below the application layer. The protocol conversion unit may be communicatively connected to the intelligent network unit.

[0049] If the intelligent network unit is communicatively connected to the protocol conversion unit, then communication with networks that use different protocols is possible. In other words, a protocol conversion unit enables secure communication with external networks that are classified as secure. This allows, for example, data to be exchanged between NATO partners who each use different protocols. If no protocol conversion unit is provided, then it is necessary for the intelligent network units communicating with each other to have the appropriate keys in order to decrypt data to the other intelligent network unit or to encrypt data for it. Conversion to other protocols is then not necessary. In both cases, however, a relationship of trust exists between the network units used.

[0050] Similar or identical advantages arise as described with regard to the intelligent network interface.

[0051] The object is further achieved in particular by a method for sending data, in particular by means of an intelligent network interface as described above, comprising the following steps:

[0052] - filtering the data to be sent using a filter criterion, in particular by means of an information exchange unit;

[0053] - Encrypting the filtered data, in particular by means of a hardware security unit; - Sending the encrypted data over a network to a target device.

[0054] The object is further achieved in particular by a method for receiving data, in particular by means of an intelligent network interface as described above, comprising the following steps:

[0055] - receiving data, in particular by means of a network unit;

[0056] - Decrypting the received data, in particular by means of a hardware security unit;

[0057] - filtering the decrypted data using a filter criterion, in particular by means of an information exchange unit.

[0058] The object is further achieved in particular by a computer-readable storage medium which contains instructions which cause at least one processor to implement a method as described above when the instructions are executed by the at least one processor.

[0059] Finally, the object is further achieved in particular by a cloud system which has at least two cloud security units as described above, which are communicatively connected to one another via an insecure network, e.g. the Internet.

[0060] Similar or identical advantages arise as those described in connection with the corresponding procedures.

[0061] The invention is explained in more detail below using exemplary embodiments. In the following, the following are shown:

[0062] Figure 1: a schematic representation of an intelligent network interface 1;

[0063] Figure 2: a schematic representation of a cloud security unit 40;

[0064] Figure 3: a schematic representation of a virtualization unit

[0065] 30; Figure 4: a flowchart 60 illustrating a method for filtering data;

[0066] Figure 5: a diagram illustrating a protocol translation;

[0067] Figure 6: a schematic diagram showing the use of a

[0068] Entropy unit 80 illustrated;

[0069] Figure 7: a flowchart illustrating a method 90 for sending data; and

[0070] Figure 8: a flowchart illustrating a method 100 for receiving data.

[0071] In the following, identical or equivalent parts are designated by the same reference numbers.

[0072] Figure 1 shows a schematic representation of an intelligent network interface 1. In the illustrated embodiment, the intelligent network interface 1 is embodied as a PCI Express card and can thus be used in a standard 19-inch housing with a motherboard. Such cards are now available as so-called Smart Network Interface Controllers (SmartNIC). A processor 10 is arranged on the card. In the illustrated embodiment, this processor is embodied as a so-called "field-programmable gate array" 10. In further examples, more than one processor 10 is used.

[0073] An FPGA (FPGA 10) is an integrated circuit that allows for flexible configuration and customization of digital circuits. Unlike conventional integrated circuits, which are fixed for a specific function, an FPGA can be programmed by the user to implement various logical functions and connections.

[0074] The operation of an FPGA is based on a matrix of programmable logic blocks and configurable connections. A typical FPGA consists of a large number of such blocks arranged in rows and columns. Each logic block consists of combinational logic and a flip-flop for storing data. An FPGA is configured by loading a special file called Hardware Description Language (HDL). HDLs such as VHDL (Very High Speed ​​Integrated Circuit Hardware Description Language) or Verilog are used to describe the desired functionality of the circuit.

[0075] Once the configuration file is loaded, the FPGA is internally rewired to provide the appropriate logical functions and connections. Programmable interconnects allow the logic blocks to be connected in various ways to create complex circuits.

[0076] The intelligent network interface 1 is communicatively connected to two networks. An external network communication connection 18 connects the intelligent network interface 1 to an external network. The external network can be the Internet, for example. However, it is fundamentally a network whose components are not under the control of the entity using the intelligent network interface 1 and therefore no trust relationship exists and it must be assumed that third parties will attempt to intercept and / or modify data 19 sent via the external network communication connection 18. An internal network connection 19 connects various components of the internal network. A trust relationship exists between these components, e.g. because they are components of a single company.In particular, it is assumed that the participants of the internal network adhere to uniform security standards.

[0077] To enable secure communication between participants of the internal network and participants of the external network, the intelligent network interface 1 comprises a hardware security unit 15, an information exchange unit 13, and a network unit 14. All of these components are integrated into a single hardware unit. In one embodiment, these components are provided on a daughterboard. This can then be connected to other components in a server rack or a PC via a PCI or PCI Express slot, e.g., a hypervisor running virtualized applications and / or operating systems. To ensure a high level of security, it is important that the hardware unit cannot be configured by the cloud system itself, or that this is only organizationally possible through authorized administrative processes.In an FPGA, the configuration can be protected from unwanted changes in various ways. For example, bitstream encryption can be used. The configuration file (bitstream) can be encrypted before being loaded onto the FPGA. The FPGA itself then has a built-in decryption mechanism that only accepts the bitstream if it is decrypted with the appropriate key. This prevents unauthorized persons from analyzing or modifying the bitstream. JTAG deactivation is also possible. JTAG (Joint Test Action Group) is a standardized interface used for programming and debugging FPGAs. By disabling the JTAG port, access to the FPGA for external programming or debugging purposes can be prevented. This provides an additional layer of security against unwanted configuration changes.Active monitoring can also be used. An FPGA can monitor itself for unauthorized changes to its configuration. For this purpose, special security mechanisms can be implemented that continuously check the integrity of the configuration. If an unauthorized change is detected, the FPGA can automatically enter a secure state or issue a warning. Finally, further physical security measures can be provided. To prevent physical tampering, an FPGA can be placed in a secure housing or on a special board. This measure makes access to the FPGA more difficult and reduces the risk of unauthorized configuration changes. For the purposes of this application, "unchangeable" in this context specifically means that at least one measure is taken to protect the configuration of the FPGA or hardware unit.

[0078] To enable encryption of the network traffic, i.e., the data 19 to be sent, the hardware security unit 15 is provided. The hardware security unit 15 is a so-called Hardware Secure Module (HSM). Typically, an HSM is a special physical device or security module used to generate, store, and manage cryptographic keys and securely perform cryptographic operations. In the illustrated embodiment, the hardware security unit 15 is also integrated into the hardware unit.

[0079] The hardware security unit 15 provides a secure environment and protection mechanisms to protect critical cryptographic operations from unauthorized access, theft, or tampering.

[0080] In the embodiment shown in Figure 1, the hardware security unit 15 has a trust anchor unit 11 and a cryptography unit 12.

[0081] The trust anchor unit 11 is configured to provide key management. The hardware security unit 15 securely generates, imports, exports, and stores cryptographic keys 2. These keys enable the secure management of key material, including the generation of key pairs, the storage of keys 2 in a protected memory 16, and the monitoring of key access. The trust anchor unit 11 represents the root of a trust hierarchy of a public key infrastructure.

[0082] A storage device 16 is provided for storing the keys 2.

[0083] The cryptography unit 12 provides hardware-accelerated cryptographic functions to perform security-critical operations such as encryption, decryption, digital signature creation and verification, and hash calculations. In particular, the cryptography unit 12 is configured to encrypt data 19 to be transmitted.

[0084] Finally, the hardware security unit 15 provides the definition of security policies and access rules for key access and the use of cryptographic operations. This includes authentication, authorization, and auditing of users and applications to ensure that only authorized entities can access the cryptographic functions of the hardware security unit 15.

[0085] In the illustrated embodiment, the information exchange unit 13 is designed as an "Information Exchange Gateway" (IEG). It enables the secure exchange of information between different networks. The IEG acts as a switching center or "gateway" that filters, monitors, transforms, and controls data traffic between the networks.

[0086] The information exchange unit 13 provides various functions to facilitate information exchange. An important task is to filter data traffic to block unwanted or harmful data. This can include, for example, protection against malware, spam, or unauthorized content.

[0087] In the embodiment of Figure 1, the data 19 to be transmitted includes data classified as confidential. The data 19 thus has corresponding properties that identify the data 19 as confidential. For example, each piece of data can be assigned a property that indicates the type of classification. In Germany, the following classifications are common: "VS-NUR FÜR DEN OFFIENSGEBEUCH," "VS-VERTRAULICH," "GEHEIM," and "STRENG GEHEIM." Depending on the classification, the data 19 will be passed through or not.

[0088] Security also plays a crucial role in the information exchange unit 13. In the illustrated embodiment, the information exchange unit 13 is configured to implement authentication and access control to protect data traffic. This ensures that only authorized users can access the information, depending on the classification of the data 19, and protects against unauthorized access or data leaks. The information exchange unit 13 monitors data traffic, logs events, and detects security incidents. This allows activities to be tracked, potential security risks to be identified, and violations of security policies to be detected.

[0089] The network unit 14 is designed to carry out the actual transmission of the data 19 to an external network, ie to transmit the data to an external network according to a transmission standard, e.g. by means of Ethernet.

[0090] Figure 2 shows a schematic representation of a cloud security unit 40.

[0091] The cloud security unit 40 includes the intelligent network unit or FPGA 10, as already described with reference to Figure 1. Furthermore, a virtualization unit 30 is schematically shown, which is communicatively connected to the FPGA 10. The virtualization unit 40 is designed to connect at least one guest system to the network. For example, the virtualization unit 30 can connect an operating system in which a variety of common office applications are executed.

[0092] The guest systems are executed by a hypervisor 41, which is communicatively connected to the intelligent network interface 10. It is also conceivable and frequently the case that the virtualization unit 30 executes more than one guest system. For example, a Linux-based environment could be executed and an environment based on the Microsoft Windows operating system. The virtualization unit 30 virtualizes a network card for each guest system executed by the hypervisor 41, each of which has a different PCI bus address. The guest systems can thus access external networks transparently and securely via the intelligent network interface 10 via the hypervisor.

[0093] Furthermore, the cloud security unit 40 comprises a protocol conversion unit 20. The protocol conversion unit 20 is particularly designed to enable a secure connection of the cloud security unit 40 to other cloud systems, i.e., third-party systems 50 that operate according to different security standards. In the illustrated embodiment, the protocol conversion unit 20 is designed as a so-called Tac controller. The function of the protocol conversion unit 20 is explained in more detail with reference to Figure 5.

[0094] Figure 3 schematically illustrates the structure of the virtualization unit 30 of Figure 2. The virtualization unit 30 has an encryption level 32 and a virtualization level 31. A virtualized representation of the intelligent network unit 1 is provided on the virtualization level 31. This virtualized representation serves as an interface between the virtualized guest system of the hypervisor 41 and the intelligent network interface 10. At the encryption level 32, encryption can be supported by the guest system or by an application executed in the guest system. In this way, the data to be transmitted can also be encrypted at the application level, ensuring increased data security. The guest system orThe executed application can access the functions of the intelligent network interface 10 via the virtualized representation of the intelligent network interface. In particular, keys for encryption, decryption, and authentication can be provided by the intelligent network interface 10. This is particularly important in conjunction with the protocol conversion unit 20, since data to be sent must be decrypted when translating between different transmission protocols. Additional encryption at the application level prevents the application data from being unencrypted, thus effectively preventing attacks on this data.

[0095] Figure 4 shows a flowchart illustrating a method 60 for filtering data. The method can be implemented, for example, by the information exchange unit 13 of Figure 1. In the method 60, data 19 that is subject to a security classification and therefore may not be transmitted via the external network (see Figure 1) is to be filtered. For this purpose, a check step 61 first checks whether data 19 is available for transmission. If this is the case, a filter check step 63 checks whether a filter criterion 62 is met. In the exemplary embodiment shown, the data 19 to be transmitted have a property that indicates whether or what type of security classification the data 19 to be transmitted is subject to. Thus, in the filter check step 63, a check is carried out to determine whether the data 19 to be transmitted is subject to a security classification, e.g., SECRET.Only if it is determined in the filter test step 63 that the data 19 does not satisfy the filter criterion 62, the filtered data 65 are sent (not shown).

[0096] If the filter check step 63 determines that the data 19 meets the filter criterion 62, the data 19 is filtered accordingly, meaning that only a subset of the data 19 can be filtered out, and the filtered data 65 is sent. The filtering of the data could, for example, be additionally documented to document the attempt to send protected data.

[0097] Figure 5 shows a diagram illustrating a protocol translation as it can be implemented, for example, using the protocol conversion unit 20. Figure 5 shows data 19 to be sent, which is transformed into translated data 19' by means of a protocol translator 75. In the example shown in Figure 5, three protocol layers are shown for illustration purposes. The numbers shown to the left of the figure refer to the numbering of the layers in the well-known OSI layer model. Figure 5 therefore shows protocols on layers 2, 4 and 6 of the OSI layer model. Layer 6 includes an application protocol, e.g. http. Layer 4 includes a transport protocol, e.g. IP. Layer 2 describes the data link layer on which Ethernet, for example, operates. Layers 2 and 6 are not changed in the protocol translation shown. Only layer 4 is adapted.For example, a third-party system may require the use of the UDP protocol instead of the TCP protocol. The protocol conversion unit 20 is therefore configured to translate from a source protocol 72, e.g., TCP, to a target protocol 74 without changing the payload data.

[0098] Overall, the illustrated protocol translation enables the connection of third-party systems, as is regularly required in the NATO context, for example.

[0099] Figure 6 shows a schematic diagram illustrating the use of an entropy unit 80. Figure 6 shows the hardware security unit 15 with the trust anchor unit 11 and the cryptography unit 12, which is communicatively connected to the entropy unit 80. The communicative network connection 82 can refer to either an internal (secure) network or an external (insecure) network. In the illustrated embodiment, the entropy unit 80 is designed as a quantum random number generator, which is designed to generate random numbers 81 and make them available to the hardware security unit 15 via the network connection 82. The random numbers 81 can then be used by the hardware security unit 15 to generate cryptographic keys.

[0100] In one embodiment, it is also possible for the entropy unit 80 and the intelligent network interface 1 to be arranged on a mainboard of a server or PC, wherein the bus systems of the mainboard are used as a network connection 82.

[0101] Figures 7 and 8 illustrate methods for sending and receiving data, respectively. Figure 7 illustrates a method 90 for sending data 19. The method 90 can be implemented, for example, by the intelligent network interface 1 of Figure 1. The method 90 begins with a filtering step 91, which can be implemented, for example, by the method illustrated by Figure 4. Data 19 to be sent are filtered according to a filter criterion 62 in the filtering step 91, and the resulting filtered data 65 are encrypted for transmission in the next encryption step 92. The encryption step 92 can be implemented, for example, by the hardware security unit 15 and in particular by the cryptography unit 12.

[0102] The encrypted data 94 are transferred to an external system in the subsequent sending step 93.

[0103] Figure 8 illustrates a method 100 for receiving data 19. In a first receiving step 101, the data 19 is received, e.g., from the intelligent network interface 1 and in particular the network unit 14. In the subsequent decryption step 102, the received data 19 is decrypted, e.g., by the hardware security unit 15 and in particular by the cryptography unit 12. The decrypted data 104 is then filtered in a filtering step 103 using a filter criterion 62. Received data can also be filtered before being forwarded to the target system. In this way, it can be checked whether the target system, e.g., a logged-in user in a guest system running by the virtualization unit 30, is authorized to receive the data 104. Only if this is the case is the data 104 forwarded to the virtualization unit 30.

[0104] At this point it should be noted that all of the parts described above are to be regarded individually - even without additional features described in the respective context, even if these have not been explicitly identified as optional features in the respective context, e.g. by using: in particular, preferably, for example, e.g., if necessary, round brackets, etc. - and in combination or any sub-combination as independent embodiments or further developments of the invention, as defined in particular in the introduction to the description and the claims. Deviations from this are possible. Specifically, it should be noted that the word in particular or round brackets do not identify any features that are mandatory in the respective context.

[0105] List of reference symbols:

[0106] 1 Intelligent network interface

[0107] 2 keys

[0108] 10 FPGA

[0109] 11 Trust anchor unit

[0110] 12 Cryptographic Unit

[0111] 13 Information Exchange Unit

[0112] 14 Network unit

[0113] 15 Hardware security unit

[0114] 16 storage units

[0115] 17 internal network communication connection

[0116] 18 external network communication connection

[0117] 19, 19' data

[0118] 20 Protocol Implementation Unit

[0119] 30 virtualization units

[0120] 31 Virtualization layer

[0121] 32 encryption levels

[0122] 40 Cloud Security Unit

[0123] 41 Hypervisor

[0124] 50 foreign systems

[0125] 60 methods for filtering data

[0126] 61 Test step

[0127] 62 filter criteria

[0128] 63 Filter test step

[0129] 64 Save step

[0130] 65 filtered data

[0131] 71 Application protocol

[0132] 72 Transport protocol

[0133] 73 Protocol of origin

[0134] 74 Target protocol

[0135] 75 Protocol Translation

[0136] 80 Entropy Unit Random Numbers

[0137] Network connection

[0138] Method for sending data, 103 filter step

[0139] Encryption step

[0140] Sending step encrypted data 0 Procedure for receiving data1 Receiving step 2 Decryption step 4 decrypted data

Claims

AMENDED CLAIMS received by the International Bureau on November 11, 2024 (11.11.2024) (New) claims 1. Intelligent network interface (1), comprising: a network unit (14) designed to receive data (19) from an external network (18) and / or to send it to the external network (18); an information exchange unit (13) designed to filter and / or block the received data (19) and / or the data to be sent (19); a hardware security unit (15) designed to encrypt and / or sign the data to be received (19) or the data to be sent (19); wherein the network unit (14), the information exchange unit (13), and the hardware security unit (15) are implemented on a hardware unit (10), e.g.a daughterboard, are unchangeably integrated, characterized in that the information exchange unit (13) is designed to filter the data (19) to be sent and / or received using at least one filter criterion (62), wherein the at least one filter criterion (62) in particular indicates a security classification of the data to be sent and / or the data to be received (19).

2. Intelligent network interface (1) according to claim 1, characterized in that the hardware security unit (15) has at least one trust anchor unit (11) and / or a cryptography unit (12), AMENDED SHEET (ARTICLE 19) wherein the at least one trust anchor unit (11) is designed to provide at least one trustworthy public, one private and / or symmetric key (2), and wherein the cryptography unit (12) is designed to decrypt and / or sign data, e.g. the data to be sent and / or the data to be received (19), using the at least one public, private (2) and / or symmetric key (2).

3. Intelligent network interface (1) according to one of the preceding claims, in particular according to claim 2, characterized by a storage unit (16) which is designed to store one or the at least one trustworthy public, private and / or symmetric key (2), wherein in particular the trust anchor unit (11) is communicatively connected to the storage unit (16), preferably for reading out one or the public and / or symmetric key (2).

4. Intelligent network interface (1) according to one of the preceding claims, in particular according to claim 2, characterized in that the hardware security unit (15) is designed to transmit the at least one public key (2) to at least one virtualization unit (30) for encrypting data.

5. Intelligent network interface (1) according to one of the preceding claims, characterized in that the data to be sent (19) are encrypted at a network layer.

6. Intelligent network interface (1) according to one of the preceding claims, characterized in that the hardware security unit (15) is designed to generate random numbers (81) from a, in particular as part of the intelligent network interface (1) or separately AMENDED SHEET (ARTICLE 19) trained, entropy unit (80) and to indirectly use the random numbers (81) in the encryption, decryption and / or signing of the data (19) to be sent.

7. Intelligent network interface (1) according to one of the preceding claims, in particular according to claim 6, characterized in that an / the entropy unit (80) provides a software as a service application and is communicatively connected to the hardware security unit (15).

8. Intelligent network interface (1) according to one of the preceding claims, in particular according to claim 7, characterized in that an entropy unit (80) is formed as part of the intelligent network interface (1) and is communicatively connected to the hardware security unit (15).

9. Intelligent network interface (1) according to one of the preceding claims, characterized by at least one virtualization unit (30) which is designed to connect at least one operating system and / or at least one host application to the external network (18), wherein the at least one virtualization unit (30) is further designed to execute a virtualized representation of a network card for each operating system or each host application, wherein in particular each virtualized representation of the network card has a different PCI bus address.

10. Cloud security unit (40), comprising: an intelligent network interface (1) according to one of the preceding claims; at least one hypervisor (41) which is designed to execute at least one operating system and / or at least one host application, wherein the at least one operating system AMENDED SHEET (ARTICLE 19) and / or the at least one host application is designed to communicate with an external network (18) by means of the intelligent network interface (1).

11. Cloud security unit (40) according to claim 10, characterized in that each operating system and / or each host application is designed to use a different virtualized representation of the network card for communication with the external network.

12. Cloud security unit (40) according to one of claims 10 to 11, in particular according to claim 10, characterized in that the at least one virtualization unit (30) and / or the operating system and / or the host application is designed to encrypt or decrypt incoming data and / or data to be sent (19), in particular on the network layer and / or the application layer.

13. Cloud security unit (40) according to one of claims 10 to 12, in particular according to claim 12, characterized in that the at least one virtualization unit (30) and / or the operating system and / or the host application is designed to receive public keys for signing or decrypting incoming data and / or data to be sent (19) from the hardware security unit (15) and in particular is designed to encrypt or sign the data (19) with the received keys.

14. A method (90) for sending data (19) by means of an intelligent network interface (1) according to one of claims 1 to 9, comprising the following steps: Filtering (91) the data (19) to be sent using a filter criterion (62), in particular by means of an information exchange unit (13); AMENDED SHEET (ARTICLE 19) Encrypting (92) the filtered data (64), in particular by means of a hardware security unit (15); Sending (93) the encrypted data (94) via a network (17, 18) to a target device.

15. A method (100) for receiving data (19) by means of an intelligent network interface (1) according to one of claims 1 to 9, comprising the following steps: Receiving (101) data (19), in particular by means of a network unit (14); Decrypting (102) the received data (19), in particular by means of a hardware security unit (15); Filtering (103) the decrypted data (104) using a filter criterion (62), in particular by means of an information exchange unit (13).

16. A computer-readable storage medium (10) containing instructions that cause at least one processor to implement a method according to one of claims 14 or 15 when the instructions are executed by the at least one processor (10). AMENDED SHEET (ARTICLE 19)

Images