METHODS AND APPARATUS TO PROVIDE USER-LEVEL ACCESS AUTHORIZATION FOR CLOUD-BASED FIELD-PROGRAMMABLE GATE ARRAYS

• US 20190087606A1
• Filed: 09/15/2017
• Published: 03/21/2019
• Est. Priority Date: 09/15/2017
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Subhaschandra, Suchit, Krishnan, Srivatsan, Thomas, Brent, Marolia, Pratik
• Granted Patent: US 10,528,768 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/76 in application-specific integrated circuits [ASIC] or field-programmable devices, e.g. field-programmable gate arrays [FPGA] or programmable logic devices [PLD]

Abstract

Methods and apparatus to provide user-level access authorization for cloud-based filed-programmable gate arrays are disclosed. An example apparatus includes a field-programmable gate array (FPGA) including a first memory and a second memory different from the first memory. The first memory stores a bitstream. The second memory stores a first user tag associated with the bitstream. The example apparatus further includes a kernel having an FPGA driver operatively coupled to the FPGA. The FPGA driver is to receive a command associated with accessing the FPGA from a user-executed application. The FPGA driver is further to identify a second user tag associated with the command. The FPGA driver is further to determine whether the command is to be accepted based on the second user tag.

Claims

1. An apparatus, comprising:

a field-programmable gate array (FPGA) including a first memory and a second memory different from the first memory, the first memory storing a bitstream, the second memory storing a first user tag associated with the bitstream; and

a kernel having an FPGA driver operatively coupled to the FPGA, the FPGA driver to;

receive a command associated with accessing the FPGA from a user-executed application;

identify a second user tag associated with the command; and

determine whether the command is to be accepted based on the second user tag.

2. The apparatus as defined in claim 1, wherein the first memory is a write-only random access memory and the second memory is a read-write random access memory.

3. The apparatus as defined in claim 1, wherein the first user tag includes a user identifier and access control metadata associated with the user identifier.

4. The apparatus as defined in claim 1, wherein the kernel further includes a partial reconfiguration controller operatively coupled to the first memory and the second memory of the FPGA, the partial reconfiguration controller to load the bitstream into the first memory and to load the first user tag into the second memory.

5. The apparatus as defined in claim 1, wherein the FPGA driver is further to:

access the first user tag from the second memory of the FPGA;

determine whether the second user tag matches the first user tag; and

accept the command in response to determining that the second user tag matches the first user tag.

6. The apparatus as defined in claim 5, wherein the FPGA driver is further to:

reject the command in response to determining that the second user tag does not match the first user tag; and

send a denied access notification to the user-executed application in response to rejecting the command.

7. The apparatus as defined in claim 1, wherein the FPGA driver is further to send the command and the second user tag to the FPGA.

8. The apparatus as defined in claim 7, wherein the FPGA further includes a tag controller to:

access the first user tag from the second memory of the FPGA;

determine whether the second user tag matches the first user tag;

accept the command in response to determining that the second user tag matches the first user tag; and

send a granted access notification to the FPGA driver in response to accepting the command.

9. The apparatus as defined in claim 8, wherein the tag controller is further to:

reject the command in response to determining that the second user tag does not match the first user tag; and

send a denied access notification to the FPGA driver in response to rejecting the command, the FPGA driver to send the denied access notification to the user-executed application.

10. A non-transitory computer readable storage medium comprising instructions that, when executed, cause one or more processors to at least:

load a bitstream into a first memory of a field-programmable gate array (FPGA);

load a first user tag into a second memory of the FPGA different from the first memory, the first user tag being associated with the bitstream;

identify a command associated with accessing the FPGA received from a user-executed application;

identify a second user tag associated with the command; and

determine whether the command is to be accepted based on the second user tag.

11. The non-transitory computer readable storage medium as defined in claim 10, wherein the instructions, when executed, further cause the one or more processors to:

access the first user tag from the second memory of the FPGA;

determine whether the second user tag matches the first user tag; and

accept the command in response to determining that the second user tag matches the first user tag.

12. The non-transitory computer readable storage medium as defined in claim 11, wherein the instructions, when executed, further cause the one or more processors to:

reject the command in response to determining that the second user tag does not match the first user tag; and

send a denied access notification to the user-executed application in response to rejecting the command.

13. The non-transitory computer readable storage medium as defined in claim 10, wherein the instructions, when executed, further cause the one or more processors to send the command and the second user tag to the FPGA to invoke an access authorization determination to be implemented by the FPGA.

14. The non-transitory computer readable storage medium as defined in claim 13, wherein the access authorization determination to be implemented by the FPGA includes:

accessing the first user tag from the second memory of the FPGA;

determining whether the second user tag matches the first user tag;

accepting the command in response to determining that the second user tag matches the first user tag; and

returning a granted access notification from the FPGA in response to accepting the command.

15. The non-transitory computer readable storage medium as defined in claim 14, wherein the access authorization determination to be implemented by the FPGA includes:

rejecting the command in response to determining that the second user tag does not match the first user tag; and

returning a denied access notification from the FPGA in response to rejecting the command.

16. A method, comprising:

loading, by executing a computer readable instruction with one or more processors, a bitstream into a first memory of a field-programmable gate array (FPGA);

loading, by executing a computer readable instruction with the one or more processors, a first user tag into a second memory of the FPGA different from the first memory, the first user tag being associated with the bitstream;

receiving a command associated with accessing the FPGA from a user-executed application;

identifying, by executing a computer readable instruction with the one or more processors, a second user tag associated with the command; and

determining, by executing a computer readable instruction with the one or more processors, whether the command is to be accepted based on the second user tag.

17. The method as defined in claim 16, further including:

accessing the first user tag from the second memory of the FPGA;

determining whether the second user tag matches the first user tag; and

accepting the command in response to determining that the second user tag matches the first user tag.

18. The method as defined in claim 17, further including:

rejecting the command in response to determining that the second user tag does not match the first user tag; and

sending a denied access notification to the user-executed application in response to rejecting the command.

19. The method as defined in claim 16, further including sending the command and the second user tag to the FPGA to invoke an access authorization determination to be implemented by the FPGA.

20. The method as defined in claim 19, wherein the access authorization determination to be implemented by the FPGA includes:

accessing the first user tag from the second memory of the FPGA;

determining whether the second user tag matches the first user tag;

accepting the command in response to determining that the second user tag matches the first user tag; and

returning a granted access notification from the FPGA in response to accepting the command.