REMOTE FUNCTIONALITY SELECTION

• US 20110202983A1
• Filed: 08/17/2010
• Published: 08/18/2011
• Est. Priority Date: 08/19/2009
• Status: Active Grant

• Current Assignee: Xilinx, Inc. (Advanced Micro Devices, Inc.)
• Original Assignee: SolarFlare Communications Incorporated (Advanced Micro Devices, Inc.)
• Inventors: Riddoch, David, Pope, Steven L.
• Granted Patent: US 9,210,140 B2
• Time in Patent Office: Days
• US Class Current: 726/7
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 41/0803 Configuration setting
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

A network interface device providing a set of functions in hardware and being operable in first and second modes: in a first mode, the network interface device being configured to operate with a selected configuration of the set of functions; and in a second mode, the network interface device being operable to select a particular configuration of the set of functions in accordance with configuration instructions received at the network interface device; the network interface device being configured to, on receiving a network message having one or more predetermined characteristics and comprising an authentication key and one or more configuration instructions defining a particular configuration of the set of functions: verify the authentication key; and if the authentication key is successfully verified, select the particular configuration of the set of functions defined in the configuration instructions of the network message.

Claims

1. A network interface device providing a set of functions in hardware and being operable in first and second modes:

in the first mode, the network interface device being configured to operate with a selected configuration of the set of functions; and

in the second mode, the network interface device being operable to select a particular configuration of the set of functions in accordance with configuration instructions received at the network interface device;

the network interface device being configured to, on receiving a network message having one or more predetermined characteristics and comprising an authentication key and one or more configuration instructions defining a particular configuration of the set of functions;

verify the authentication key; and

if the authentication key is successfully verified, select the particular configuration of the set of functions defined in the configuration instructions of the network message.

2. A network interface device as claimed in claim 1, wherein the configuration instructions defining the particular configuration of the set of functions comprises one or more of:

(a) enabling one or more functions of the set;

(b) disabling one or more functions of the set;

(c) modifying the parameters of a function of the set.

3. A network interface device as claimed in claim 1, wherein the network interface device is configured to effect the selection of the particular configuration of the set of functions defined in the configuration instructions by one or more of:

(a) selecting the state of one or more switches at the network interface device;

(b) writing values to a hardware register or non-volatile state memory of the network interface device; and

(c) updating firmware stored at the network interface device.

4. A network interface device as claimed in claim 1, wherein the network message comprises one or more data packets received in accordance with a predetermined messaging protocol.

5. A network interface device as claimed in claim 4, wherein the protocol is the Intelligent Platform Management Interface protocol, or an extension thereof.

6. A network interface device as claimed in claim 1, wherein the one or more predetermined characteristics include one or more of:

(a) a predetermined identifier in the headers of at least some of the data packets which together comprise the network message;

(b) a predetermined pattern of data in the network message; and

(c) address information in the network message identifying the endpoint to which the message is directed such as IP address and/or port number.

7. A network interface device as claimed in claim 1, wherein the network interface device is configured to enter the second mode on receiving the network message.

8. A network interface device as claimed in claim 1, wherein the network interface device is configured to enter the second mode on successfully verifying the authentication key.

9. A network interface device as claimed in claim 1, wherein the configuration instructions are encrypted and the authentication key is the encrypted configuration instructions.

10. A network interface device as claimed in claim 9, wherein the network interface device is configured to verify the authentication key by decrypting the encrypted configuration instructions, the authentication key being successfully verified if the encrypted configuration instructions are successfully decrypted.

11. A network interface device as claimed in claim 1, wherein the authentication key is one of a password, a cryptographically-signed certificate, a pseudorandom number or a hash of a set of predetermined data.

12. A network interface device as claimed in claim 1, wherein the network interface device is configured to verify the authentication key in accordance with the Transport Layer Security (TLS) protocol or Internet Protocol Security (IPsec) protocol.

13. A network interface device as claimed in claim 1, wherein the network message is received from a local network entity and the configuration instructions comprised in said network message originate at a remote network entity, the local network entity being a proxy for the remote network entity.

14. A network interface device as claimed in claim 1, wherein there exists a cryptographic pair of keys and the authentication key is generated using a private cryptographic key of the pair.

15. A network interface device as claimed in claim 14, wherein a public cryptographic key of the pair is stored at the network interface device and the network interface device is configured to verify the authentication key using the public key.

16. A network interface device as claimed in claim 14, wherein the network interface device is configured to use a public cryptographic key of the pair to establish an encrypted channel over which the network message is received.

17. A network interface device as claimed in claim 14, wherein a private cryptographic key of the pair is stored at a network entity from which the configuration instructions originate, the said network entity being configured to generate the authentication key and transmit the authentication key and configuration instructions to the network interface device.

18. A network interface device as claimed in claim 17, wherein the network entity is accessible to the network interface device over the internet.

19. A network interface device as claimed in claim 14, wherein the network interface device includes a Trusted Platform Module and the Trusted Platform Module holds a public cryptographic key of the pair.

20. A network interface device as claimed in claim 16, wherein the network interface device includes a Trusted Platform Module and an endorsement key of the Trusted Platform Module is used to establish the encrypted channel.

21. A network interface device as claimed in claim 16, wherein the encrypted channel is established in accordance with the Transport Layer Security (TLS) protocol or Internet Protocol Security (IPsec) protocol.

22. A network interface device as claimed in claim 1, wherein the network interface device is configured to verify the authentication key at a state machine or processor of the network interface device.

23. A network interface device as claimed in claim 1, wherein, on selecting the particular configuration of the set of functions defined in the configuration instructions, the network interface device is configured to message a network interface device driver supported at a data processing system attached to the network interface device to indicate that the function set of the network interface device has changed.

24. A network interface device as claimed in claim 1, wherein the network interface device is configured to accept the network message in a low power state.

25. A network interface device as claimed in claim 24, wherein the network interface device further comprises a management controller operable to perform said verification of the configuration instructions and cause the selection of the particular configuration of the set of functions defined in the configuration instructions, the management controller being active in the low power state.

26. A network interface device as claimed in claim 1, wherein the network interface device is attached to a data processing system comprising a Baseboard Management Controller and the network interface device is configured to pass Intelligent Platform Management Interface messages received at the network interface device to the Baseboard Management Controller.

27. A network interface device as claimed in claim 26, configured to, on selecting the particular configuration of the set of functions defined in the configuration instructions, message the Baseboard Management Controller to indicate that the function set of the network interface device has changed.

28. A network interface device as claimed in claim 1, further comprising a non-volatile memory and being configured to store the received configuration instructions in said memory and at a later time to perform the selection of the particular configuration of the set of functions defined in the configuration instructions of the network message at the instigation of a software entity supported at a data processing system attached to the network interface device.

29. A network interface device as claimed in claim 1, wherein the network interface device is coupled to one or more other devices each providing a set of functions in hardware and each being operable to select a particular configuration of their set of functions in accordance with configuration instructions received at the network interface device, the network interface device being configured to cause each of the one or more other devices to select a particular configuration of their set of functions in accordance with the configuration instructions defined in the network message.

30. A network interface device as claimed in claim 1, wherein the network interface device is operable to successfully verify at least two different authentication keys including a first authentication key and a second authentication key, the second authentication key having a lower privilege level than the first authentication key.

31. A network interface device as claimed in claim 30, wherein the first authentication key permits the network interface device to configure any of the set of functions of the network interface device and the second authentication key permits the network interface device to configure only a proper subset of the set of functions of the network interface device.

32. A network interface device as claimed in claim 30, wherein the first authentication key, on being successfully verified by the network interface device, allows the network interface device to enable one or more hardware functions;

and the second authentication key, on being successfully verified by the network interface device, allows the network interface device to modify one or more parameters of the hardware functions but does not allow the network interface device to enable one or more hardware functions.

33. A network interface device as claimed in claim 30, wherein the first authentication key is generated at a first network entity holding a private key and the second authentication key is generated at a second network entity holding a cryptographic key generated using that private key.

34. A network interface device as claimed in claim 33, wherein the first network entity is accessible to the network interface device over the internet.

35. A network interface device as claimed in claim 33, wherein the second network entity is operable to transmit a network message comprising configuration instructions and the second authentication key to the network interface device in accordance with the IPMI protocol.

36. A network interface device as claimed in claim 33, wherein the second network entity is on a network local to the network interface device.

37. A method for selecting a configuration of a set of hardware functions of a network interface device, the method comprising:

receiving at a network interface device a network message having one or more predetermined characteristics, the network message comprising an authentication key and configuration instructions defining a particular configuration of a set of functions of the network interface device;

in response to receiving the network message, verifying the authentication key at the network interface device; and

if the authentication key is successfully verified, selecting the particular configuration of the set of functions defined in the configuration instructions of the network message.

38. A network interface device and a baseboard management controller, the network interface device providing a set of functions in hardware and being operable in first and second modes:

in a first mode, the network interface device being configured to operate with a selected configuration of the set of functions; and

in a second mode, the network interface device being operable to select a particular configuration of the set of functions in accordance with configuration instructions received at the network interface device;

the network interface device being configured to, on receiving a network message having one or more predetermined characteristics and comprising an authentication key and one or more configuration instructions defining a particular configuration of the set of functions, pass the configuration instructions and authentication key to the baseboard management controller which;

verifies the authentication key; and

if the authentication key is successfully verified, causes the network interface device to select the particular configuration of the set of functions defined in the configuration instructions of the network message.

39. A network interface device and a baseboard management controller as claimed in claim 38, wherein the network interface device is further configured to pass Intelligent Platform Management Interface messages received at the network interface device to the Baseboard Management Controller.

40. A system for selecting a configuration of hardware functions of an electronic device, the system comprising:

an electronic device operable to select a configuration of its set of hardware functions; and

a network interface device coupled to the electronic device and operable to cause the selection of a particular configuration of the set of functions of the electronic device in accordance with configuration instructions received at the network interface device;

wherein the network interface device is configured to, on receiving a network message having one or more predetermined characteristics and comprising an authentication key and configuration instructions defining a particular configuration of the set of functions;

verify the authentication key; and

if the authentication key is successfully verified, cause the selection at the electronic device of the particular configuration of the set of functions defined in the configuration instructions of the network message.

41. A system as claimed in claim 40, wherein the electronic device and the network interface device are both supported at a data processing system.

42. A system as claimed in claim 41, wherein the electronic device is a peripheral device of the data processing system.

43. A system as claimed in claim 40, wherein the network interface device is configured to cause the selection at the electronic device of the particular configuration of the set of functions defined in the configuration instructions of the network message by storing the configuration instructions at a non-volatile memory of the network interface device optionally along with data indicating that the network interface device has configuration instructions for the electronic device.

44. A system as claimed in claim 43, wherein the electronic device and the network interface device are both supported at a data processing system,

wherein the network interface device is configured to cause the selection at the electronic device of the particular configuration of the set of functions defined in the configuration instructions of the network message by storing the configuration instructions at a non-volatile memory of the network interface device optionally along with data indicating that the network interface device has configuration instructions for the electronic device,

and wherein the selection at the electronic device of the set of functions defined in the configuration instructions of the network message is performed at the instigation of a software entity supported at the data processing system attached to the network interface device.

45. A method for selecting a configuration of hardware functions of an electronic device coupled to a network interface device, the method comprising:

receiving at a network interface device a network message having one or more predetermined characteristics, the network message comprising an authentication key and configuration instructions defining a particular configuration of a set of functions of an electronic device coupled to the network interface device;

in response to receiving the network message, verifying the authentication key at the network interface device; and

if the authentication key is successfully verified, causing the selection at the electronic device of the particular configuration of the set of functions defined in the configuration instructions of the network message.

46. A method for conducting a transaction between a vendor of a network interface device and a customer operating a data processing system supporting the network interface device, the network interface device having a cryptographic key and having one or more functions which are disabled in hardware, the method comprising:

the customer acquiring from the vendor access to one of the said functions and providing one or more identifiers of the network interface device to the vendor;

the vendor transmitting to the customer a network message comprising an authentication key and configuration instructions operable to cause the network interface device to enable one or more of the disabled functions of the network interface device;

the customer allowing the authentication key and configuration instructions to pass to the network interface device over a network to which the network interface device is attached;

using the cryptographic key, verifying the authentication key at the network interface device; and

if the authentication key is successfully verified, causing the network interface device to enable the one or more of the disabled functions of the network interface device specified in the configuration instructions;

wherein the authentication key is selected by the vendor in dependence on the identifier of the network interface device such that only the said network interface device has the cryptographic key operable to successfully verify the authentication key.