Trusted NIC Isolation Circuitry for Multi-Tenant Data Separation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network interface devices lack effective mechanisms for isolating and securing data flows between different trust areas, which can lead to unauthorized access and data breaches, particularly in multi-tenant environments where different applications share the same hardware resources.
Innovation Solution
A network interface device is designed with distinct areas of trust, each equipped with isolation circuitry that controls data passage based on header values and modifies data as needed, ensuring secure communication between these areas while supporting customizable data processing pipelines.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If multiple applications share the same hardware resources in a multi-tenant environment, then resource utilization and cost efficiency are improved, but security and data isolation between applications deteriorate
Solution Approach 1:
The network interface device is divided into multiple distinct areas of trust (first area of trust, second area of trust, etc.), each with its own isolation circuitry. This segmentation allows different applications or tenants to share the same physical hardware while maintaining logical and security isolation through the communication links and isolation circuitry between areas.
Solution Approach 2:
Isolation circuitry is introduced as an intermediary component between different areas of trust. This isolation circuitry controls and monitors data passage between areas, acting as a mediator that enables communication while maintaining security boundaries. The isolation circuitry inspects header values and modifies data as needed before allowing passage between trust areas.
2Reliability
If isolation circuitry is added to control data passage between trust areas, then security is improved, but device complexity increases
Solution Approach 1:
The isolation circuitry is designed to perform multiple functions: it controls data passage based on header values, modifies data formats, adds/removes encapsulation data, and determines protocol adherence. By making the isolation circuitry multi-functional, the patent reduces the need for separate dedicated components for each function, thereby limiting the increase in overall device complexity while maintaining comprehensive security capabilities.
3Reliability
If data is modified and encapsulation is added for isolation, then data security and compatibility are improved, but processing time and throughput deteriorate
Solution Approach 1:
The isolation circuitry performs data modification and encapsulation actions in advance before data needs to be securely transmitted between trust areas. By preparing the data in the required format ahead of time, the system reduces processing delays during actual data transmission, thereby maintaining higher throughput while ensuring security requirements are met.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
A network interface device comprises a first area of trust comprising a first part of the network interface device, the first part comprising one or more first kernels. A second area of trust comprising a second part of the network interface device different to said first part is provided, the second part comprising one or more second kernels. A communication link is provided between the first area of trust and the second area of trust. At least one of the first and second areas of trust is provided with isolation circuitry configured to control which data which is passed to the other of the first and second areas via the communication link.