Time-Based Key Communication for Secure FPGA Cluster Links
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing security solutions for FPGA accelerator clusters face issues of network congestion and security degradation due to frequent key establishment between servers and accelerators, leading to increased energy consumption and vulnerability to network attacks like DDOS, with no secure communication mechanism within the cluster.
Innovation Solution
A communication method involving the computation of time-based keys using initial keys generated by servers and encryption dedicated FPGA accelerators, generating data and verification messages, and verifying their validity using verification keys to ensure secure communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If frequent key establishment is performed between servers and FPGA accelerators, then security is improved, but network congestion and energy consumption increase
Solution Approach 1:
The system performs preliminary key establishment between servers and encryption-dedicated FPGA accelerators before actual data transmission. These pre-established keys are stored and reused for multiple communications, eliminating the need for frequent key establishment. The encryption-dedicated FPGA accelerators hold the keys in advance, allowing computation-dedicated FPGA accelerators to communicate securely without repeated key negotiation, thus reducing energy consumption while maintaining security.
Solution Approach 2:
The patent introduces encryption-dedicated FPGA accelerators as intermediary components that specialize in key management. These intermediaries store and manage encryption keys, separating the key management function from computation-dedicated FPGA accelerators. When communication is needed, the intermediary provides pre-established keys rather than requiring direct key establishment between all server and accelerator pairs, reducing network congestion and energy usage.
2Reliability
If more servers are added to handle key establishment, then security is improved, but energy consumption and system complexity increase
Solution Approach 1:
The system segments the FPGA accelerator cluster into different functional types: encryption-dedicated FPGA accelerators that specialize in key management and computation-dedicated FPGA accelerators that perform computational tasks. This segmentation allows key management functions to be handled by specialized components rather than requiring multiple general-purpose servers, reducing system complexity while maintaining security.
Solution Approach 2:
The encryption-dedicated FPGA accelerators serve multiple purposes: they store encryption keys, manage key distribution to computation-dedicated accelerators, and enable secure communication across the entire cluster. This multi-functionality eliminates the need for separate servers dedicated solely to key management, reducing the number of components needed and simplifying the overall system architecture.
3Device complexity
If no secure communication mechanism is constructed within the FPGA accelerator cluster, then device complexity is reduced, but vulnerability to network attacks increases
Solution Approach 1:
The patent implements localized security measures within the FPGA accelerator cluster by equipping each encryption-dedicated FPGA accelerator with encryption capabilities and stored keys. Rather than requiring a complex centralized security infrastructure, each node has the necessary encryption functionality locally, enabling secure communication without exposing the entire cluster to network attacks while keeping the added complexity minimal and distributed.
Data Source
AI summary
Disclosed are a communication method, apparatus, and device, and a non-volatile readable storage medium, which relate to the technical field of data security. The communication method includes: a key corresponding to current time is computed according to initial keys, where the initial keys include at least one first initial key and a second initial key; a data message is generated according to the key and to-be-transmitted data; the data message is transmitted to a message receiving end; a verification data message is generated according to verification keys, where the verification keys include at last one first verification key and a second verification key; and the verification data message is transmitted to the message receiving end, and validity of the data message is caused to be verified by the message receiving end according to the initial keys and the verification data message.