DPU Snapshot Client for Secure Bare-Metal Remote Snapshots
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current datacenter snapshot management systems are inadequate for bare-metal machines due to the absence of virtualized system management components, leading to security concerns and the inability to employ secure snapshot management.
Innovation Solution
Employing data processing units (DPUs) at edge locations to facilitate snapshotting on bare-metal host devices, interfacing with cloud-based servers for secure snapshot management and storage, using hardware accelerators to encrypt and transfer swap files to remote storage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If hypervisors are used for snapshot management, then secure snapshot functionality is achieved, but bare-metal machines cannot utilize this capability due to absence of virtualized components
Solution Approach 1:
The patent introduces a DPU intermediary component that mediates between the bare-metal host and cloud-based snapshot management services. The DPU captures snapshot data from the bare-metal system and transfers it to cloud storage, enabling hypervisor-like snapshot functionality without requiring actual virtualized system management components on the bare-metal machine itself.
2Adaptability or versatility
If cloud-based snapshot management is implemented for bare-metal machines, then snapshot functionality is enabled, but security concerns arise due to direct exposure to untrusted cloud infrastructure
Solution Approach 1:
The DPU acts as a security intermediary that sits between the bare-metal host and the untrusted cloud infrastructure. It establishes a secure boundary that allows snapshot data to be transferred to cloud storage while protecting the bare-metal system from direct exposure to potential security threats in the cloud environment.
Solution Approach 2:
The system segments the snapshot management functionality into distinct components: local data capture on the bare-metal host, intermediary processing through the DPU, and remote storage in the cloud. This segmentation isolates security-critical operations on the host while allowing convenient cloud-based storage and management.
3Reliability
If DPUs are deployed at edge locations to facilitate snapshotting, then secure snapshot management is achieved, but device complexity increases
Solution Approach 1:
The DPU is designed as a self-contained unit that autonomously performs snapshot data capture, encryption, and transfer operations. It self-manages the security protocols and data protection mechanisms, reducing the complexity burden on the bare-metal host while maintaining robust security through the edge-located DPU's independent operation.
Data Source
AI summary
An integrated circuit includes a host interface, operatively coupled to a host device executing a tenant operating system (OS) on bare metal, and one or more hardware accelerators, operatively coupled to the host interface. The one or more hardware accelerators encrypt a swap file retrieved from the host device and initiate transfer of the encrypted swap file to a network storage device coupled to a cloud-based server. A central processing unit (CPU) is operatively coupled to the host interface and, with the one or more hardware accelerators, are to host a hardware-accelerated snapshot client that coordinates snapshot activities, associated with the encrypted swap file, between a snapshot manager, hosted by the cloud-based server, and a snapshot user interface executed on the host device.