Information-processing system, information-processing apparatus, management apparatus, and processing method

• US 10,560,262 B2
• Filed: 02/02/2017
• Issued: 02/11/2020
• Est. Priority Date: 02/25/2016
• Status: Active Grant

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Shimizu, Takashi, Miyoshi, Takashi
• Primary Examiner(s): Chiang, Jason
• Application Number:
  US15/423,053
• Publication Number:
  US 20170250802A1
• Time in Patent Office: 1,104 Days
• Field of Search: None
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G09C 1/00 Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system cryptographic typewriters G09C3/00
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 9/0816 Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

An apparatus includes a first-processor, and a programmable integrated circuit coupled to the first-processor; a second-processor, and a memory coupled to the second-processor, the second-processor being configured to access the first-processor; and a third-processor to manage the first-processor, wherein the first-processor is configured to write, to the rewritable-integrated circuit, a computation circuit to perform computation according to information from the second-processor, and an encryption circuit to generate encrypted data by encrypting a computation result computed by the computation circuit, by using an encryption key for the computation circuit, the third-processor is configured to manage the encryption key in association with the computation circuit and notify the second-processor of the encryption key for the computation circuit, and the second-processor is configured to read out the encrypted data from the memory for storing the encrypted data, and decrypt the read encrypted data by using the encryption key notified from the third-processor.

Claims

1. An information-processing system comprising:

a host system with a first processor, an encryption circuit and an integrated circuit capable of reconfiguration of circuits, the first processor being coupled to the integrated circuit;

a shared memory coupled to the first processor and the integrated circuit;

a second processor, and a memory coupled to the second processor, the second processor being configured to access the first processor; and

a computer, separate from the host system, with a third processor configured to manage the first processor, wherein

the first processor is configured to write, to the integrated circuit, a processing circuit, an encryption circuit and identification information for at least an area of the processing circuit,

the processing circuit is configured to perform processing, according to information transmitted by the second processor, to provide a service using the identification information,

the encryption circuit is configured to generate encrypted data by encrypting a processing result of the processing circuit, by using an encryption key for the processing circuit,

the third processor is configured to manage the encryption key in association with the processing circuit and to notify the second processor of the encryption key for the processing circuit, and

the second processor is configured to read out the encrypted data from the memory for storing the encrypted data, and decrypt the read encrypted data by using the encryption key notified from the third processor.

2. The information-processing system according to claim 1, wherein the first processor is configured to write the processing circuit and the encryption circuit based on first information to be used to write the processing circuit and second information to be used to write the encryption circuit, the first information and the second information being received from the third processor.

3. The information-processing system according to claim 1, wherein the third processor is configured to control to write the processing circuit and the encryption circuit to the integrated circuit based on first information to be used to write the processing circuit and second information to be used to write the encryption circuit.

4. The information-processing system according to claim 1, wherein the encrypted data generated by the encryption circuit is written to the shared memory based on management information managing an address in the shared memory.

5. An information-processing apparatus communicating with a management machine, separate from the information-processing apparatus, to manage the information-processing apparatus, and a client machine configured to access the information-processing apparatus, the information-processing apparatus comprising:

an integrated circuit capable of re-configuration of circuits; and

a first processor configured to write, to the integrated circuit, a processing circuit configured to perform processing according to input information and an encryption circuit configured to generate encrypted data by encrypting a processing result, generated by the processing circuit in providing a service using identification information for at least an area of the processing circuit, by using an encryption key for the processing circuit supplied by the management machine,

wherein the management machine is configured to manage the encryption key in association with the processing circuit and to notify the client machine of the encryption key, and the client machine is configured to obtain the encrypted data from the information-processing apparatus and decrypt the encrypted data by using the encryption key notified from the management machine.

6. The information-processing apparatus according to claim 5,

further comprising a shared memory coupled to the first processor and the integrated circuit,

wherein the encryption key is managed in association with the processing circuit by a third processor in the management machine configured to manage the information-processing apparatus, and

wherein the encrypted data is read out by a second processor from the shared memory for storing the encrypted data, and decrypted by the second processor by using the encryption key notified from the third processor.

7. The information-processing apparatus according to claim 5,

further comprising a port configured to be coupled to a third processor in the management machine configured to manage the information-processing apparatus, and

wherein the processing circuit and the encryption circuit are written to the integrated circuit through the port by the third processor.

8. The information-processing apparatus according to claim 5, wherein the first processor configured to write the processing circuit and the encryption circuit to the integrated circuit based on first information to be used to write the processing circuit and second information to be used to write the encryption circuit.

9. The information-processing apparatus according to claim 5, wherein

the integrated circuit includes a plurality of pairs of the processing circuit and management information managing an address in a shared memory, at least one pair or any combination thereof among the plurality of pairs further includes the encryption circuit,

the processing circuit of the at least one pair or the any combination writes encrypted data to the shared memory at an address that is based on the management information of the at least one pair or the any combination, the encrypted data being obtained by the encryption circuit through encryption of a processing result of the processing circuit of the at least one pair or the any combination, and

the processing circuit of each of the plurality of pairs other than the at least one pair or the combination thereof writes a processing result thereof to the shared memory at an address that is based on the management information of the each pair.

10. The information-processing apparatus according to claim 9, wherein

in the management information of the each pair, a different address other than an address defined in advance exclusively with respect to an address defined in the management information of the at least one pair or the combination is set, and

the different address coincides with the address defined in the management information of the at least one pair or the combination.

11. The information-processing apparatus according to claim 9, wherein

in the management information of the each pair, an address is set, the address being defined in advance exclusively with respect to an address defined in the management information of the at least one pair or the combination,

the processing circuit of each of the plurality of pairs other than the at least one pair or the combination changes an address read out from the management information of the each pair to a different address other than the read address and writes the processing result thereof to the different address, and

the different address coincides with the address defined in the management information of the at least one pair or the combination.

12. A management apparatus communicating with and separate from a host system, having a first processor and an integrated circuit, and a client system having a second processor and a memory coupled to the second processor, comprising:

a receiver configured to receive, from the second processor, a request to write a processing circuit to the integrated circuit, capable of re-configuration of circuits, the processing circuit being configured to perform processing according to information transmitted by the second processor; and

a third processor configured to

perform control of the first processor to write the processing circuit and an encryption circuit to the integrated circuit based on first information defining the processing circuit and second information defining the encryption circuit, the encryption circuit being configured to generate encrypted data by encrypting a processing result computed by the processing circuit, by using an encryption key for the processing circuit, the integrated circuit providing a service using identification information for at least an area of the processing circuit, and

notify the client system of the encryption key;

wherein the second processor is configured to read out the encrypted data from the memory and decrypt the encrypted data by using the encryption key notified from the third processor.

13. The management apparatus according to claim 12, wherein the first processor is configured to acquire the first information and the second information, and perform the write of the processing circuit and the encryption circuit to the integrated circuit based on the first information and the second information.

14. The management apparatus according to claim 12, wherein the first processor performs control to cause a storage apparatus for holding a plurality of pieces of first information corresponding to a plurality of types of processing circuits, to write to the integrated circuit the processing circuit that is based on a piece of first information satisfying the request from the second processor.

15. The management apparatus according to claim 14, wherein

the storage apparatus further holds the second information, and

the first processor performs control to cause the storage apparatus to write to the integrated circuit the processing circuit that is based on the piece of first information for satisfying the request from the second processor and the encryption circuit that is based on the second information.

16. The management apparatus according to claim 14, wherein the first processor is configured to acquire the second information, and perform control to write the encryption circuit to the integrated circuit based on the acquired second information.

17. The management apparatus according to claim 12, wherein the first processor is configured to

manage the encryption key in association with the processing circuit,

notify the second processor of the encryption key for the processing circuit, and

transmit the first information and the second information to an information-processing apparatus including the integrated circuit.

18. A non-transitory, computer-readable recording medium having stored therein a program for causing a computer to execute a process, the process comprising:

receiving a request from another computer to write a processing circuit to an integrated circuit capable of re-configuration of circuits of the computer, the processing circuit being configured to perform processing according to first and second information transmitted by the other computer; and

performing control to write the processing circuit and an encryption circuit to the integrated circuit based on the first information defining the processing circuit and the second information defining the encryption circuit, the encryption circuit being configured to generate encrypted data by encrypting a processing result computed by the processing circuit, by using an encryption key for the processing circuit defined in the second information supplied by the other computer, the integrated circuit providing a service using identification information for at least an area of the processing circuit,

wherein a client system obtains the encrypted data from the computer and decrypts the encrypted data by using the encryption key obtained from the other computer.

19. The non-transitory, computer-readable recording medium according to claim 18, further having stored therein another program for causing the other computer to preform another method comprising:

transmitting the encryption key to a terminal; and

transmitting the first information and the second information from the other computer to the computer.

20. A processing method for a computer, comprising:

receiving, from a terminal, a request to write a processing circuit to an integrated circuit capable of re-configuration of circuits, the integrated circuit being included in an information-processing apparatus separate from the computer;

transmitting to the information-processing apparatus first and second information defining the processing circuit and an encryption circuit to the integrated circuit, the first information defining the processing circuit and second information defining the encryption circuit, the encryption circuit being configured to generate encrypted data by encrypting a processing result computed by the processing circuit, the integrated circuit providing a service using identification information for at least an area of the processing circuit; and

notifying the terminal of an encryption key used by the encryption circuit to encrypt a processing result of the processing circuit,

wherein the terminal obtains the encrypted data from the information-processing apparatus and decrypts the encrypted data by using the encryption key obtained from the computer.