Communication device, method, and program

Abstract

A communication device 1 includes: a management unit 11 that receives information relating to an instance, which is a virtual entity constructed in the communication device 1, and a network interface that is attached to the communication device 1 and can execute a predetermined program; an authentication unit 12 that authenticates the network interface; a secret information storage unit 13 that stores, after the authentication, information relating to whether secret information for constructing a secure communication path between the instance and the network interface exists; and a communication path construction unit 14 that, when it is found, by referring to the secret information storage unit 13 after the authentication, that the secret information exists, constructs the secure communication path between the instance and the network interface by using the secret information. The instance and the network interface mutually transmit and receive, by using the secure communication path, data transmitted to and received from an external device.

Description

Communication device, method, and program

[0001] The disclosed technology relates to cryptography technology.

[0002] As SmartNIC (see, for example, Non-Patent Documents 1 to 3) becomes available in the market, a method of protecting external communication from SmartNIC by encrypting it by offloading MACsec processing from a host computer or an internal container (e.g., Pod) to SmartNIC has been considered. However, conventionally, after offloading to SmartNIC, communication performed in a virtual NW inside the host that exists between a container (Pod) constructed inside the host and SmartNIC has not been a target of encryption and has not been protected.

[0003] Intel (registered trademark), "FPGA SmartNIC N6000-PL Platform", [online], [searched on February 6, 2025], Internet <URL: https: / / www.intel.co.jp / content / www / jp / ja / products / details / fpga / platforms / smartnic / n6000-pl-platform.html> Altera (registered trademark), "FPGA AI NIC & SmartNIC", [online], [searched on February 6, 2025], Internet <URL: https: / / www.intel.co.jp / content / www / jp / ja / products / details / fpga / platforms / smartnic.html> NVIDIA (registered trademark), "ConnectX-6 Solution Boasting the Highest Performance and Flexibility", [online], [searched on February 6, 2025], Internet <URL: https: / / www.nvidia.com / ja-jp / networking / ethernet / connectx-6 / >

[0004] However, a cryptography technology for communication performed in a virtual NW inside the host computer that exists between a container constructed inside the host computer and SmartNIC has not been proposed so far.

[0005] The disclosed technology aims to provide a communication device, method, and program capable of encrypting communication between an instance, which is a virtual entity constructed within a communication device, and a network interface capable of executing a predetermined program.

[0006] One aspect of the disclosed technology includes a management unit that receives information about an instance, which is a virtual entity constructed within a communication device, and a network interface installed in the communication device that can execute a predetermined program; an authentication unit that authenticates the network interface; a secret information storage unit that stores information about whether secret information exists for constructing a secure communication path between the instance and the network interface after authentication; and a communication path construction unit that, after authentication, if it is determined that secret information exists by referring to the secret information storage unit, uses the secret information to construct a secure communication path between the instance and the network interface. The instance and the network interface then use the secure communication path to send and receive data to and from external devices.

[0007] According to the disclosed technology, it is possible to encrypt communication between an instance, which is a virtual entity constructed within a communication device, and a network interface on which a predetermined program can be executed.

[0008] Figure 1 shows an example of the functional configuration of a communication device. Figure 2 shows an example of the processing procedure for a communication method. Figure 3 shows an example of the functional configuration of a computer.

[0009] Embodiments of the disclosed technology will be described below with reference to the drawings. Note that components having the same function are numbered identically in the drawings, and redundant explanations are omitted.

[0010] [Communication Device and Method] As shown in Figure 1, the communication device 1 includes, for example, a management unit 11, an authentication unit 12, a secret information storage unit 13, a communication path construction unit 14, and an offload unit 15. The communication system includes, for example, the communication device 1 and an external device 2 of the communication device 1. The communication method is realized, for example, by the communication device 1 performing the processing from step S11 to step S2 shown in Figure 2. The communication device 1 is equipped with a network interface N capable of executing a predetermined program. An example of the network interface N is a SmartNIC. Within the communication device 1, an instance S, which is a virtual entity, is constructed. An example of the instance S is a virtual NIC associated with a container, pod, VM (Virtual Machine) instance, VM, etc. The following describes each component of the communication device 1. The management unit 11 receives information about the instance S and the network interface N (step S1). This information is received, for example, by input by a user of the communication device 1. The information about the network interface N is output to the authentication unit 12.

[0011] An example of information about instance S is the MAC address of the Ethernet interface assigned to instance S. An example of information about SmartNIC is the MAC address owned by SmartNIC. Subsequently, the processing for communicating with external devices is offloaded from instance S to network interface N. An example of the processing for communicating with external devices is MACsec (Media Access Control security) processing. This offload is performed by the offload unit 15. The offload unit 15 may be implemented by an existing application. In this case, offloading is performed by making an offload request to this existing application. If there is no existing application, offloading may be performed manually. <Authentication unit 12> Information about network interface N received by the management unit 11 is input to the authentication unit 12. The authentication unit 12 performs authentication of network interface N (step S2). The authentication processing by the authentication unit 12 is performed, for example, after receiving an authentication processing execution request from the management unit 11.

[0012] The authentication unit 12 can identify the network interface N to be authenticated from the information about the network interface N received by the management unit 11. The user may be able to select the authentication method. Examples of authentication methods include authentication using ID-based authentication key exchange (IBAKE) and authentication using PKI (Public Key Infrastructure). An example of the process when authentication using ID-based authentication key exchange (IBAKE) is performed is described below. The authentication unit 12 generates a short-term private key eSKa and a short-term public key ePKa from the identification information of the authentication unit 12, the identification information of the network interface N, and the private key SKa of the authentication unit 12. The authentication unit 12 sends the short-term public key ePKa to the network interface N. The authentication unit 12 receives the short-term public key ePKs from the network interface N, which was generated by the network interface N from the identification information of the authentication unit 12, the identification information of the network interface N, and the private key SKs of the network interface N. The authentication unit 12 generates key SK from the authentication unit 12's identification information, the network interface N's identification information, the authentication unit 12's private key SKa, short-term private key eSKa, and short-term public key ePKs. The network interface N generates key SK from the authentication unit 12's identification information, the network interface N's identification information, the network interface N's private key SKs, short-term private key eSKa, and short-term public key ePKs. When these processes are completed, it is determined that authentication of the network interface N has been successful.

[0013] The following is an example of the process when authentication is performed using PKI (Public Key Infrastructure). The authentication unit 12 transmits secret authentication information to the network interface N. The secret authentication information is information known only to the entity performing the authentication, and is, for example, a random number. The authentication unit 12 receives processed secret authentication information from the network interface N, which is generated by the network interface N processing the secret authentication information using its own private key. The authentication unit 12 uses the processed secret authentication information and the public key corresponding to the private key to convert the processed secret authentication information back to the original secret authentication information. Then, the authentication unit 12 checks whether the secret authentication information received from the network interface N matches the converted secret authentication information. If a match is confirmed, the authentication of the network interface N is determined to be successful. If the network interface N is legitimate, the key SK generated by the authentication unit 12 and the key SK generated by the network interface N will match. In this case, data encrypted with the key SK generated by the authentication unit 12 can only be decrypted by the network interface N. Conversely, data encrypted with the key SK generated by the network interface N can only be decrypted by the communication device 1, which includes the authentication unit 12. Therefore, it can be considered that the above process effectively performs authentication.

[0014] Depending on the authentication method used, confidential information is generated during the authentication process to establish a secure communication path between instance S and network interface N. For example, if authentication is performed using ID-based authentication key exchange (IBAKE), confidential information is generated during the authentication process to establish a secure communication path between instance S and network interface N. Therefore, in this case, after authentication, confidential information exists to establish a secure communication path between instance S and network interface N. The confidential information generated by authentication is stored, for example, in network interface N. The authentication result and information on whether confidential information exists to establish a secure communication path between instance S and network interface N are output to the management unit 11. <Confidential Information Storage Unit 13> After authentication by the authentication unit 12, information on whether confidential information exists to establish a secure communication path between instance S and network interface N is stored in the confidential information storage unit 13 (step S13). The confidential information storage unit 13 may further store information about instance S and network interface N, and the authentication method used by the authentication unit 12.

[0015] For example, the management unit 11 stores information in the secret information storage unit 13 regarding whether secret information exists for constructing a secure communication path between instance S and network interface N. <Communication Path Construction Unit 14> After authentication by the authentication unit 12, the communication path construction unit 14, if it finds that secret information exists by referring to the secret information storage unit 13, uses the secret information to construct a secure communication path between instance S and network interface N (step S14). The processing by the communication path construction unit 14 is carried out, for example, according to instructions from the management unit 11. For example, the management unit 11 sends to the communication path construction unit 14 information about instance S and network interface N, which are the targets for constructing the communication path, and an authentication result indicating that authentication by the authentication unit 12 was OK. The communication path construction unit 14 associates instance S with network interface N. The communication path construction unit 14 requests the management unit 11 to confirm whether secret information exists for constructing a secure communication path between instance S and network interface N, and to distribute the secret information to instance S if secret information exists. Here, distributing confidential information to instance S means, for example, distributing confidential information to the Ethereum of instance S.

[0016] Upon receiving the above request, the management unit 11 refers to the secret information storage unit 13 based on the information about the network interface N. If the referencing results in finding that the authentication method is ID-based authentication key exchange (IBAKE) and that secret information for establishing a secure communication path between instance S and network interface N exists within network interface N, then, for example, the management unit 11 requests the authentication unit 12 to distribute the secret information to instance S and to return a completion notification to the management unit 11 once the distribution is complete. Once the management unit 11 receives the completion notification from the authentication unit 12, it notifies the communication path construction unit 14 that the secret information has been distributed to instance S. Subsequently, the communication path construction unit 14 uses the secret information distributed to instance S and network interface N to construct a secure communication path between instance S and network interface N. If the referencing results in finding that the authentication method is PKI (Public Key Infrastructure) authentication and that secret information for establishing a secure communication path between instance S and network interface N does not exist within network interface N, the communication path construction unit 14 is notified that the secret information does not exist.

[0017] In this case, the communication path construction unit 14 constructs a secure communication path by encrypting the communication between instance S and network interface N using a predetermined encryption method. An example of a predetermined encryption method is IPsec (Internet Protocol security), which uses the IP address assigned to instance S and the IP address assigned to network interface N in the virtual network constructed between instance S and network interface N. When the predetermined encryption method is IPsec, a secure communication path is constructed using the common key used in IPsec. Subsequently, instance S and network interface N send and receive data to and from external device 2 using the secure communication path constructed by the communication path construction unit 14 (step S2). Network interface N may also send and receive data to and from external device 2 using a secure communication path different from the secure communication path constructed by the communication path construction unit 14. If the secure path between instance S and network interface N is designated as the first secure path, and the secure path between network interface N and external device 2 is designated as the second secure path, network interface N decrypts the data encrypted for communication on the first secure path and encrypts the decrypted data for communication on the second secure path. Alternatively, network interface N may decrypt encrypted data for communication over the second secure path, and then encrypt the decrypted data for communication over the first secure path. In this way, network interface N may perform what is known as encryption overwriting.

[0018] An example of a second secure path is a secure communication path established using MACsec (Media Access Control security). That is, network interface N may send and receive frames encrypted at the data link layer with external device 2. In this case, instance S and network interface N will send and receive data link layer frames transmitted and received via the second secure path via the first secure path. In this way, the communication path construction unit 14 can encrypt communication between instance S and network interface N by constructing a secure communication path between instance S and network interface N. This makes it possible to protect communication between the instance and network interface without depending on the implementation of the application using TLS, etc. As mentioned earlier, authentication used in encrypted communication includes authentication using PKI (Public Key Infrastructure), which is widely used in encrypted communication such as TLS, and authentication using ID-based authentication key exchange (IBAKE), which requires less computation than the PKI method. There are also multiple encryption methods that can be used in encrypted communication. Ideally, these methods should be used interchangeably depending on the system requirements. However, because the processing flow from authentication to encrypted communication differs—for example, the timing of encryption key generation differs—users may not be able to use them correctly unless they understand the details of each method.

[0019] When attempting to perform encrypted communication over a virtual network between instance S and network interface N while allowing the use of different authentication and encryption methods, it was necessary to understand the details of each method and configure instance S and network interface N accordingly. Furthermore, because the timing of the generation of encryption keys, which are an example of confidential information, differed, it was necessary to check whether the encryption key had already been generated or to verify its status before performing encrypted communication. Therefore, achieving the above required the user to manage the settings and the status of the encryption key, resulting in a cumbersome operation for the user. By having the management unit 11 manage on behalf of the user, secure offloading becomes available, enabling encrypted communication between instance S and network interface N even for users who do not know the details of authentication for network interface N or the encryption method for communication between instance S and network interface N. In other words, the burden on the user can be reduced. [Modification] The specific configuration of the embodiment of the disclosed technology described above is not limited to the configuration described above. The specific configuration of the embodiment of the disclosed technology can be modified as appropriate, without departing from the spirit of the embodiment of the disclosed technology.

[0020] The various processes described in the embodiments of the disclosed technology may be performed not only in chronological order according to the order described, but also in parallel or individually as necessary, depending on the processing capacity of the device performing the processes. For example, data exchange between components of the communication device may be performed directly or via a storage unit (not shown). The authentication unit 12 may be able to detect whether a new network interface capable of executing a predetermined program has been installed on the communication device 1. In this case, if the authentication unit 12 detects a new network interface, the aforementioned processes are performed on the detected new network interface. This enables authentication of the network interface installed on the communication device 1. Furthermore, the invention may also have a device (terminal) for using the device, system, or method of the present invention via a network (telecommunication line). The "device (terminal) for use" may be equipped with functions necessary to obtain the effects of implementing the device, system, or method of the present invention (e.g., control functions, decoding functions, restoration functions, input / output functions, etc.). Needless to say, other modifications can be made as appropriate without departing from the spirit of the invention.

[0021] All documents, patent applications, and technical standards described herein are incorporated by reference to the same extent as if each individual document, patent application, and technical standard were specifically and individually incorporated by reference. [Programs, Recording Media] The functions realized by the components described herein may be implemented in circuitry or processing circuitry, including general-purpose processors, application-specific processors, integrated circuits, ASICs (Application Specific Integrated Circuits), CPUs (a Central Processing Unit), conventional circuits, and / or combinations thereof, programmed to realize the described functions. A processor includes transistors and other circuits and is considered circuitry or processing circuitry. A processor may be a programmed processor that executes a program stored in memory. In this specification, circuitry, unit, and means are hardware programmed to realize or perform the described functions. Such hardware may be any hardware disclosed herein, or any hardware known to be programmed to realize or perform the described functions.

[0022] If the hardware is a processor considered to be of a circuit type, then the circuit, means, or unit is a combination of hardware and software used to constitute the hardware and / or processor. The various processes described above can be carried out by loading a program that executes each step of the above method into the recording unit 2020 of the computer 2000 shown in Figure 3, and then causing the control unit 2010, input unit 2030, output unit 2040, display unit 2050, etc. to operate. The program describing the processing content can be recorded on a computer-readable recording medium. The computer-readable recording medium can be anything, such as a magnetic recording device, optical disc, magneto-optical recording medium, or semiconductor memory. The program describing the processing content may also be included in a computer program product. Furthermore, the distribution of this program can be carried out, for example, by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM on which the program is recorded. In addition, the program may be stored in the storage device of a server computer and distributed by transferring the program from the server computer to other computers via a network.

[0023] A computer executing such a program may, for example, first store the program recorded on a portable storage medium or a program transferred from a server computer in its own storage device. Then, when processing is to be executed, the computer reads the program stored on its own storage medium and executes the processing according to the read program. Alternatively, the computer may directly read the program from the portable storage medium and execute the processing according to that program, or it may sequentially execute the processing according to the received program each time a program is transferred to it from a server computer. Furthermore, the processing may be executed using a so-called ASP (Application Service Provider) type service, where the processing function is realized only by issuing execution instructions and obtaining results, without transferring the program from the server computer to this computer.In addition, the processing may be executed using a so-called SaaS (Software as a Service) type service, where a part of the server computer is made available to the user along with the program. Furthermore, the term "program" in this form includes information used for processing by an electronic computer that is equivalent to a program (data, etc., that is not a direct instruction to the computer but has the property of defining the processing of the computer).

[0024] Furthermore, in this configuration, the device is configured by executing a predetermined program on a computer, but at least a part of these processes may be implemented in hardware.

Claims

1. A communication device comprising: a management unit that receives information about an instance, which is a virtual entity constructed within the communication device, and a network interface installed in the communication device that can execute a predetermined program; an authentication unit that authenticates the network interface; a secret information storage unit that stores information about whether secret information exists for constructing a secure communication path between the instance and the network interface after authentication; and a communication path construction unit that, after authentication, if it is determined that the secret information exists by referring to the secret information storage unit, uses the secret information to construct a secure communication path between the instance and the network interface, wherein the instance and the network interface mutually transmit and receive data to and from external devices using the secure communication path.

2. A communication device according to claim 1, wherein the authentication unit authenticates the network interface after receiving a request from the management unit to execute an authentication process, the management unit stores information in the secret information storage unit regarding whether secret information exists for constructing a secure communication path between the instance and the network interface after the authentication, and after the authentication, if the management unit finds that the secret information exists by referring to the secret information storage unit, the communication path construction unit constructs a secure communication path between the instance and the network interface using the secret information.

3. A communication device according to claim 1 or 2, wherein the secret information generated by the authentication is stored in the network interface.

4. A communication method comprising: a management unit receiving information about an instance, which is a virtual entity constructed within a communication device, and a network interface installed in the communication device that is capable of executing a predetermined program; an authentication unit authenticating the network interface; and a communication path construction unit, after authentication, referring to a secret information storage unit that stores information about whether secret information exists for constructing a secure communication path between the instance and the network interface, and if it finds that the secret information exists, using the secret information to construct a secure communication path between the instance and the network interface, wherein the instance and the network interface mutually transmit and receive data to and from an external device using the secure communication path.

5. A program for causing a computer to perform each step of the communication method of claim 4.

Images