Communication device, method, and program

Abstract

A communication device 1 includes a communication path construction unit 11 that constructs a secure communication path between an instance S, which is a virtual subject constructed within the communication device 1, and a network interface N, which is mounted on the communication device 1 and is capable of executing a predetermined program. The instance S and the network interface N transmit and receive data, which is transmitted to and received from an external device 2, to and from each other by using the secure communication path.

Description

Communication device, method and program

[0001] The disclosed technology relates to encryption technology.

[0002] A technology has been proposed to protect communications by implementing encryption functions using Transport Layer Security (TLS) and other protocols from applications on containers (Pods).

[0003] In addition, SmartNICs (see, for example, Non-Patent Documents 1 and 2) have become available on the market, and a method is being considered in which MACsec processing is offloaded from the host computer or an internal container (Pod) to the SmartNIC, thereby encrypting and protecting communications from the SmartNIC to the outside.

[0004] Intel (registered trademark), "A SmartNIC for Accelerating Communications and Networking Workloads," [online], [searched July 17, 2024], Internet <URL: https: / / cdrdv2.intel.com / v1 / dl / getContent / 779620> NVIDIA (registered trademark), "ConnectX-6: The Highest Performance and Flexible Solution," [online], [searched July 17, 2024], Internet <URL: https: / / www.nvidia.com / ja-jp / networking / ethernet / connectx-6 / >

[0005] However, no encryption technology has been proposed for communications between a container (Pod) built inside a host computer and a SmartNIC in a virtual network inside the host computer.

[0006] The disclosed technology aims to provide a communication device, method, and program that can encrypt communication between an instance, which is a virtual entity constructed within a communication device, and a network interface that can execute a specified program.

[0007] One aspect of the disclosed technology includes a communication path construction unit that constructs a secure communication path between an instance, which is a virtual entity constructed within a communication device, and a network interface that is attached to the communication device and can execute a specified program, and the instance and the network interface use the secure communication path to send and receive data to and from an external device.

[0008] According to the disclosed technology, it is possible to encrypt communication between an instance, which is a virtual entity constructed within a communication device, and a network interface capable of executing a predetermined program.

[0009] FIG. 1 is a diagram showing an example of the functional configuration of a communication device. FIG. 2 is a diagram showing an example of a processing procedure of a communication method. FIG. 3 is a diagram showing an example of the functional configuration of an association unit 12. FIG. 4 is a diagram showing an example of the functional configuration of an association unit 12. FIG. 5 is a diagram showing an example of the functional configuration of a computer. FIG. 6 is a diagram showing an example of the processing procedure of Example 1. FIG. 7 is a diagram showing an example of the processing procedure of Example 2.

[0010] Hereinafter, embodiments of the disclosed technology will be described with reference to the drawings. Note that components having the same functions in the drawings are given the same reference numerals, and redundant description will be omitted.

[0011] 1, the communication device 1 includes, for example, a communication path construction unit 11, an association unit 12, and a secret information verification unit 13. The communication system includes, for example, the communication device 1 and an external device 2 of the communication device 1.

[0012] The communication method is realized, for example, by the communication path establishment unit 11 performing the process of step S11 shown in FIG.

[0013] A network interface N capable of executing a predetermined program is attached to the communication device 1. An example of the network interface N is a SmartNIC.

[0014] An instance S, which is a virtual entity, is constructed within the communication device 1. Examples of the instance S include a container, a pod, a virtual machine (VM) instance, and a virtual NIC associated with the VM.

[0015] Each component of the communication device 1 will be described below.

[0016] The communication path construction unit 11 constructs a secure communication path between the instance S and the network interface N (step S11).

[0017] The communication path construction unit 11 constructs a secure communication path, for example, by encrypting communication between the instance S and the network interface N using a predetermined encryption method.

[0018] An example of a specified encryption method is IPsec (Internet Protocol security) using an IP address assigned to instance S and an IP address assigned to network interface N in a virtual network constructed between instance S and network interface N.

[0019] Another example of the predetermined encryption method is an encryption method that uses a key exchanged during ID-based authentication key exchange.

[0020] Of course, the predetermined encryption method may be an encryption method other than the encryption methods exemplified above, such as an encryption method using a security protocol established by the Distributed Management Task Force (DMTF).

[0021] Thereafter, the instance S and the network interface N use the secure communication path established by the communication path establishment unit 11 to transmit and receive data to and from the external device 2 (step S2).

[0022] The network interface N may transmit and receive data to and from the external device 2 using a secure communication path different from the secure communication path established by the communication path establishment unit 11. If the secure path between the instance S and the network interface N is a first secure path and the secure path between the network interface N and the external device 2 is a second secure path, the network interface N decrypts data encrypted for communication via the first secure path and encrypts the decrypted data for communication via the second secure path. Alternatively, the network interface N decrypts data encrypted for communication via the second secure path and encrypts the decrypted data for communication via the first secure path. In this way, the network interface N may perform so-called encryption re-imaging processing.

[0023] An example of the second secure path is a secure communication path established by MACsec (Media Access Control security). That is, the network interface N may transmit and receive frames encrypted at the data link layer with the external device 2. In this case, the instance S and the network interface N transmit and receive frames at the data link layer that are transmitted and received over the second secure path over the first secure path.

[0024] In this way, the communication path construction unit 11 constructs a secure communication path between the instance S and the network interface N, thereby making it possible to encrypt communication between the instance S and the network interface N. This makes it possible to protect communication between the instance and the network interface without relying on the implementation of an application that uses TLS or the like.

[0025] [Modifications] The specific configurations of the embodiments of the disclosed technology are not limited to the configurations described above. The specific configurations of the embodiments of the disclosed technology can be appropriately modified in design, etc., within the scope of the spirit of the embodiments of the disclosed technology.

[0026] The various processes described in the embodiments of the disclosed technology may not only be performed chronologically in the order described, but may also be performed in parallel or individually depending on the processing capacity of the device performing the processes or as needed.

[0027] For example, data may be exchanged directly between the components of the communication device, or may be exchanged via a storage unit (not shown).

[0028] The communication device 1 may further include an association unit 12 that associates an instance with a network interface. In this case, after the association unit 12 completes the process of step S12, the communication path establishment unit 11 performs the process of step S11.

[0029] An example of the association is authentication of a network interface. That is, the association unit 12 may authenticate the network interface, and after the authentication of the network interface, the processing of the communication path construction unit 11 may be performed. As a result, a secure communication path is constructed between the instance and the network interface that has been successfully authenticated. The authentication of the network interface may be authentication using a public key infrastructure (PKI) or identity-based authentication key exchange (IBAKE).

[0030] An example of the association unit 12 will be described below. The processing of the association unit 12 described below is realized by an application installed in the communication device 1. This application may be executed by an instance, which is a virtual entity constructed in the communication device 1. Examples of instances are a container, a pod, a virtual machine (VM) instance, a virtual NIC associated with a VM, etc.

[0031] Example 1 The association unit 12 in Example 1 performs authentication using PKI (Public Key Infrastructure).

[0032] 3, the association unit 12 of Example 1 includes a storage unit 120, a public key certificate generation unit 121, a transmission unit 122, a reception unit 123, a restoration unit 124, and a confirmation unit 125. An example of the processing procedure of Example 1 is shown in FIG.

[0033] Examples of the processing performed by the association unit 12 in Example 1 are the <preparation processing> and <authentication processing> shown below.

[0034] <<Preparation Processing>> The network interface N generates a public key PKs and a private key SKs of the network interface N. The public key PKs and the private key SKs are stored in the storage unit N0 of the network interface N.

[0035] The network interface N transmits the public key PKs and the identification information of the network interface N to the association unit 12 .

[0036] The identification information of the network interface N is information unique to the network interface N, such as the MAC address of the network interface N, an IMEI (International Mobile Equipment Identity), or a serial number.

[0037] The public key certificate generation unit 121 generates a public key certificate for the network interface N using the public key PKs and identification information of the network interface N (step S121). The public key certificate generation unit 121 transmits the generated public key certificate to the network interface N. For example, the public key PKs and the identification information of the network interface N are included in the public key certificate.

[0038] The network interface N stores the received public key certificate in the storage unit N0.

[0039] The preparation process described above (processing including step S121) is performed before the authentication process (processing including steps S122 to S125) described later.

[0040] <<Authentication Process>> The transmission unit 122 transmits secret information to the network interface N (step S122). The secret information is information known only to the entity performing the authentication. The secret information is, for example, a random number Rn.

[0041] The network interface N uses its own private key SKs read from the storage unit N0 to process the private information received from the association unit 12, thereby generating processed private information Sgn. An example of the processed private information Sgn is a signature for the private information using the private key SKs.

[0042] The receiving unit 123 receives, from the network interface N, the processed secret information that the network interface N has generated by processing the secret information using its own secret key SKs (step S123).

[0043] The restoration unit 124 restores the processed secret information to the original secret information using the processed secret information and the public key PKs corresponding to the secret key SKs (step S124).

[0044] The confirmation unit 125 confirms whether the secret information transmitted by the transmission unit 122 matches the secret information generated by the restoration unit 124 (step S125). If it is confirmed that they match, it can be determined that the authentication of the network interface N has been successful.

[0045] The network interface N may transmit the public key PKs and public key certificate read from the storage unit N0 together with the processed secret information. In this case, the confirmation unit 125 confirms that the secret information matches and also confirms from the public key certificate that the received public key PKs is correct. In this case, the confirmation unit 125 may determine that the authentication of the network interface N has been successful if both confirmations are successful.

[0046] The network interface N may also transmit the identification information of the network interface N together with the processed secret information. In this case, the confirmation unit 125 confirms whether the secret information matches and also confirms from the public key certificate that the received identification information of the network interface N is correct. In this case, the confirmation unit 125 may determine that the authentication of the network interface N has been successful if both confirmations are successful.

[0047] Furthermore, the network interface N may transmit the public key PKs and public key certificate read from the storage unit N0, along with the processed secret information, and the identification information of the network interface N. In this case, the confirmation unit 125 confirms that the secret information matches, confirms from the public key certificate that the received public key PKs is correct, and confirms from the public key certificate that the received identification information of the network interface N is correct. In this case, the confirmation unit 125 may determine that the authentication of the network interface N has been successful if all confirmations have been made.

[0048] Example 2 The association unit 12 in Example 2 performs ID-based authentication key exchange (IBAKE).

[0049] The following description will focus on the differences from Example 1. Duplicate descriptions of the same parts as Example 1 will be omitted.

[0050] As shown in Fig. 4, the association unit 12 of Example 2 includes a storage unit 120, a master private key generation unit 126, a long-term private key generation unit 127, a short-term key generation unit 128, a transmission unit 129, a reception unit 1210, and a key generation unit 1211. An example of the processing procedure of Example 2 is shown in Fig. 7.

[0051] <<Preparation Process>> The master private key generation unit 126 generates a master private key MSK (step S126). The generated master private key MSK is stored in the storage unit 120.

[0052] The long-term private key generation unit 127 first receives the identification information of the network interface N from the network interface N. Then, the long-term private key generation unit 127 generates a private key SKa of the application using the master private key MSK read from the storage unit 120 and the identification information of the application (step S127). The private key SKa is the long-term private key of the application. The identification information of the network interface N and the generated private key SKa are stored in the storage unit 120.

[0053] The application identification information is information unique to the application, such as the application's MAC address, IMEI (International Mobile Equipment Identity), serial number, etc. This application performs authentication.

[0054] Then, the long-term private key generation unit 127 generates a private key SKs for the network interface N from the master private key MSK and the identification information of the network interface N read from the storage unit 120 (step S127). The private key SKs is a long-term private key for the network interface N. The private key SKs and the identification information of the application are sent to the network interface N.

[0055] The network interface N stores the received secret key SKs and application identification information in the storage unit N0 of the network interface N.

[0056] The preparation process described above (processing including steps S126 and S127) is performed before the authentication process (processing including steps S128 to S1211) described later.

[0057] <<Authentication Process>> The short-term key generation unit 128 generates a short-term private key eSKa and a short-term public key ePKa of the application from the identification information of the application, the identification information of the network interface N, and the private key SKa of the application (step S128). To do this, the short-term key generation unit 128 reads the identification information of the network interface N and the private key SKa of the application from the storage unit 120.

[0058] The transmission unit 129 transmits the generated short-term public key ePKa to the network interface N (step S129).

[0059] The network interface N generates a short-term private key eSKs and a short-term public key ePKs of the network interface N from the identification information of the application, the identification information of the network interface N, and the private key SKs of the network interface. To this end, the network interface N reads the identification information of the application and the private key SKs of the network interface from the storage unit N0 of the network interface N.

[0060] The network interface N transmits the generated short-term public key ePKs to the association unit 12 .

[0061] The receiving unit 1210 receives from the network interface N the short-term private key eSKs and the short-term public key ePKs among the short-term public keys ePKs generated by the network interface N from the application identification information, the network interface N identification information, and the network interface N's private key SKs (step S1210).

[0062] The key generation unit 1211 generates a key SK from the application identification information, the network interface N identification information, the application's private key SKa, short-term private key eSKa, and short-term public key ePKs (step S1211).

[0063] The network interface N generates a key SK from the identification information of the application, the identification information of the network interface N, the private key SKs of the network interface N, the short-term private key eSKa, and the short-term public key ePKs.

[0064] If the network interface N is authentic, the key SK generated by the key generation unit 1211 matches the key SK generated by the network interface N. In this case, data encrypted with the key SK generated by the key generation unit 1211 can only be decrypted by the network interface N. Conversely, data encrypted with the key SK generated by the network interface N can only be decrypted by the communication device 1. For this reason, it can be considered that the above process described in Example 2 effectively performs authentication.

[0065] The association unit 12 may perform only the authentication process. In this case, the preparation process is performed before the authentication process. In this case, the association unit 12 of Example 1 may include at least a transmission unit 122, a reception unit 123, a restoration unit 124, and a confirmation unit 125. Similarly, the association unit 12 of Example 2 may include at least a short-term key generation unit 128, a transmission unit 129, a reception unit 1210, and a key generation unit 1211.

[0066] The association unit 12 may further include a detection unit 1212 that detects whether a new network interface capable of executing a predetermined program has been attached to the communication device 1. In this case, if the detection unit 1212 detects a new network interface, the above-described processing is performed on the detected new network interface. This makes it possible to authenticate the network interface attached to the communication device 1.

[0067] In Example 1, the aforementioned processing refers to at least the processing of the transmitting unit 122, the receiving unit 123, the restoring unit 124, and the verifying unit 125. In Example 2, the aforementioned processing refers to at least the processing of the short-term key generating unit 128, the transmitting unit 129, the receiving unit 1210, and the key generating unit 1211.

[0068] The association unit 12 may associate an instance with a network interface by creating a list that associates a MAC address assigned to the instance with a MAC address assigned to the network interface in a virtual network constructed between the instance and the network interface.

[0069] The communication device 1 may further include a secret information verification unit 13. The secret information verification unit 13 checks whether secret information for establishing a secure communication path exists, and if it is not confirmed that secret information exists, sets the secret information (step S13). The secret information is, for example, a key used in a predetermined encryption method that the communication path establishment unit 11 uses to establish a secure communication path. Specifically, if the predetermined encryption method is IPsec, the secret information is a common key used in IPsec.

[0070] The process of step S13 by the secret information verification unit 13 is performed before the process of step S11 by the communication path establishment unit 11. If the communication device 1 includes the association unit 12, the process of step S13 by the secret information verification unit 13 is performed after the process of step S12 by the association unit 12 has ended and before the process of step S11 by the communication path establishment unit 11.

[0071] If the communication device 1 includes the secret information verification unit 13 , the communication path establishment unit 11 establishes a secure communication path using the secret information set by the secret information verification unit 13 .

[0072] The present invention may also include a device (terminal) for using the device, system, or method of the present invention via a network (telecommunications line). The "device (terminal) for use" may be provided with functions (e.g., control function, decoding function, restoration function, input / output function, etc.) necessary to obtain the effects of implementing the device, system, or method of the present invention.

[0073] It goes without saying that other modifications are possible without departing from the spirit of the present invention.

[0074] All publications, patent applications, and technical standards mentioned in this specification are herein incorporated by reference to the same extent as if each individual publication, patent application, or technical standard was specifically and individually indicated to be incorporated by reference.

[0075] [Program, Recording Medium] The functions realized by the components described in this specification may be implemented in circuitry or processing circuitry, including general-purpose processors, application-specific processors, integrated circuits, ASICs (Application Specific Integrated Circuits), CPUs (Central Processing Units), conventional circuits, and / or combinations thereof, programmed to realize the described functions. A processor includes transistors and other circuits and is considered to be circuitry or processing circuitry. A processor may also be a programmed processor that executes a program stored in a memory.

[0076] In this specification, a circuitry, unit, or means is hardware that is programmed to realize or performs the described functions, which may be any hardware disclosed herein or any hardware known to be programmed to realize or perform the described functions.

[0077] If the hardware is a processor considered to be a type of circuitry, the circuitry, means, or unit is a combination of the hardware and software used to configure the hardware and / or processor.

[0078] The various processes described above can be implemented by loading a program that executes each step of the above method into the recording unit 2020 of the computer 2000 shown in Figure 5, and operating the control unit 2010, input unit 2030, output unit 2040, display unit 2050, etc.

[0079] The program describing the processing contents can be recorded on a computer-readable recording medium, which may be, for example, a magnetic recording device, an optical disk, a magneto-optical recording medium, a semiconductor memory, or any other suitable recording medium.

[0080] The program may be distributed by, for example, selling, transferring, lending, etc. portable recording media such as DVDs and CD-ROMs on which the program is recorded. Furthermore, the program may be stored in a storage device of a server computer, and then transferred from the server computer to other computers via a network, thereby distributing the program.

[0081] A computer that executes such a program may first temporarily store the program recorded on a portable recording medium or transferred from a server computer in its own storage device. Then, when executing a process, the computer reads the program stored on its own recording medium and executes the process in accordance with the read program. Alternatively, the computer may read the program directly from a portable recording medium and execute the process in accordance with the program. Furthermore, the computer may execute the process in accordance with the program each time a program is transferred from a server computer to the computer. Alternatively, the server computer may not transfer the program to the computer, but may instead execute the process through a so-called ASP (Application Service Provider) service, which realizes the processing function by issuing an execution instruction and obtaining the results. Furthermore, the server computer may execute the process at the terminal using a so-called SaaS (Software as a Service) service, which allows users to use part of a server computer along with the program. In this embodiment, the program includes information used for processing by an electronic computer that is equivalent to a program (such as data that is not a direct instruction to a computer but has properties that dictate computer processing).

[0082] Furthermore, in this embodiment, the device is configured by executing a predetermined program on a computer, but at least a part of the processing contents may be realized by hardware.

Claims

1. A communication device including a communication path construction unit that constructs a secure communication path between an instance, which is a virtual entity constructed within the communication device, and a network interface that is attached to the communication device and can execute a specified program, and the instance and the network interface use the secure communication path to send and receive data to and from an external device.

2. A communication device according to claim 1, wherein said network interface transmits and receives said data to and from said external device using a secure communication path different from said secure communication path.

3. The communication device according to claim 1, further comprising an association unit that associates the instance with the network interface.

4. A communication device according to claim 3, wherein the association unit authenticates the network interface, and after the network interface is authenticated, the communication path establishment unit performs processing.

5. A communications device according to claim 1, further comprising a secret information confirmation unit that confirms whether secret information for constructing the secure communications path exists, and if it is not confirmed that the secret information exists, sets the secret information, and the communications path construction unit constructs the secure communications path using the set secret information.

6. A communication method including a communication path construction step in which a communication path construction unit constructs a secure communication path between an instance, which is a virtual entity constructed within a communication device, and a network interface that is attached to the communication device and is capable of executing a specified program, and the instance and the network interface use the secure communication path to mutually send and receive data to and from an external device.

7. A program for causing a computer to execute each step of the communication method of claim 6.

Images