Secure Broadcast Protocol for Virtual Data Processing Accelerators
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data processing accelerators (DPAs) lack secure communication protocols, making it difficult for them to communicate securely with each other, which is essential for cooperative data processing tasks, as existing methods fail to ensure the integrity and confidentiality of data and computations among DPAs.
Innovation Solution
A broadcast protocol using virtual communication channels with unique session keys is implemented, allowing DPAs to securely communicate by encrypting messages with broadcast session keys and decrypting them using private keys, ensuring secure peer-to-peer communication and data processing tasks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If DPAs communicate peer-to-peer to perform cooperative data processing tasks, then productivity and efficiency are improved, but security and reliability deteriorate because existing communication methods cannot ensure confidentiality and integrity
Solution Approach 1:
The communication channel between DPAs is segmented into multiple virtual channels, each secured with its own encryption key. This allows selective secure communication paths to be established between specific DPA pairs while maintaining overall system productivity through parallel processing operations.
Solution Approach 2:
A host computing device acts as an intermediary to manage the establishment of secure communication channels between DPAs. The host coordinates key distribution and channel setup, enabling secure peer-to-peer communication without requiring direct trust relationships between all DPA pairs.
2Reliability
If secure communication protocols are implemented between DPAs, then security and reliability are improved, but device complexity and implementation difficulty increase
Solution Approach 1:
The communication interface is designed with universal secure communication capabilities that can be applied across all DPA pairs through a standardized protocol framework. This multi-functional approach allows the same security mechanism to serve multiple communication paths, reducing overall system complexity despite the added security layer.
Solution Approach 2:
Secure communication channels are established in advance through a setup phase where the host computing device pre-configures encryption keys and virtual channels between DPAs. This preliminary action eliminates the need for complex runtime security negotiations, simplifying the operational phase while maintaining high security standards.
3Reliability
If virtual channels with unique session keys are used for secure communication, then confidentiality and integrity are improved, but communication overhead and processing time increase
Solution Approach 1:
Session keys for virtual channels are established in advance during a setup phase, allowing encrypted communication to begin immediately without runtime key negotiation. This preliminary key establishment minimizes communication latency while maintaining strong confidentiality through unique session keys for each virtual channel.
Solution Approach 2:
Multiple virtual channels are combined within a single physical communication interface between host and DPA. This merging allows parallel secure communications to share underlying hardware resources, reducing overall communication overhead while maintaining the security benefits of individual encrypted channels.
Data Source
AI summary
Embodiments disclosed systems and methods to broadcast a message to one or more virtual data processing (DP) accelerators. In response to receiving a broadcast instruction from an application, the broadcast instruction designating one or more virtual DP accelerators of a plurality of virtual DP accelerators to receive a broadcast message, the system encrypts the broadcast message based on a broadcast session key for a broadcast communication session. The system determines one or more public keys of one or more security key pairs each associated with one of the designated virtual DP accelerators. The system encrypts the broadcast session key based on the determined one or more public keys. The system broadcasts the encrypted broadcast message, and the one or more encrypted broadcast session keys to adjacent virtual DP accelerators for propagation.