Remote functionality selection

• US 9,210,140 B2
• Filed: 08/17/2010
• Issued: 12/08/2015
• Est. Priority Date: 08/19/2009
• Status: Active Grant

• Current Assignee: Xilinx, Inc. (Advanced Micro Devices, Inc.)
• Original Assignee: SolarFlare Communications Incorporated (Advanced Micro Devices, Inc.)
• Inventors: Pope, Steven L., Riddoch, David
• Primary Examiner(s): Tolentino, Roderick
• Application Number:
  US12/858,345
• Publication Number:
  US 20110202983A1
• Time in Patent Office: 1,939 Days
• Field of Search: 726 14- 16
• US Class Current: 1/1
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 41/0803 Configuration setting
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

A network interface device providing a set of functions in hardware and being operable in first and second modes: in a first mode, the network interface device being configured to operate with a selected configuration of the set of functions; and in a second mode, the network interface device being operable to select a particular configuration of the set of functions in accordance with configuration instructions received at the network interface device; the network interface device being configured to, on receiving a network message having one or more predetermined characteristics and comprising an authentication key and one or more configuration instructions defining a particular configuration of the set of functions: verify the authentication key; and if the authentication key is successfully verified, select the particular configuration of the set of functions defined in the configuration instructions of the network message.

Claims

1. A network interface device providing a set of virtual network interfaces, comprising:

one or more physical network ports and being configured to communicate with a data processing system via an internal physical data bus, and

the network interface device configured to, on receiving a network message having one or more predetermined characteristics and comprising an authentication key and configuration instructions defining a new virtual network interface;

verify the authentication key; and

when the authentication key is successfully verified, create the new virtual network interface defined in the configuration instructions of the network message,

wherein the virtualized data processing system is configured further to run a plurality of quest operating systems running atop a hypervisor, the network interface device being configured to support a different virtual network interface for each of the plurality of guest operating systems,

and wherein the network interface device is configured to, in conjunction with creating the new virtual network interface defined in the configuration instructions, via a network interface device driver of the network interface device, message the hypervisor to map the new virtual network interface into a new guest operating system created at the data processing system.

2. The network interface device as claimed in claim 1, wherein said configuration instructions further comprise modifying the parameters of a virtual network interface of the set.

3. The network interface device as claimed in claim 1, wherein the network interface device is configured to effect the creation of the new virtual network interface by writing values to a hardware register or non-volatile state memory of the network interface device.

4. The network interface device as claimed in claim 1, wherein the network message comprises one or more data packets received in accordance with a predetermined messaging protocol.

5. The network interface device as claimed in claim 4, wherein the protocol is the Intelligent Platform Management Interface protocol, or an extension thereof.

6. The network interface device as claimed in claim 1, wherein the one or more predetermined characteristics include one or more of:

(a) a predetermined identifier in the headers of at least some of the data packets which together comprise the network message;

(b) a predetermined pattern of data in the network message; and

(c) address information in the network message identifying the endpoint to which the message is directed such as IP address and/or port number.

7. The network interface device as claimed in claim 1, wherein the configuration instructions are encrypted and the authentication key is the encrypted configuration instructions.

8. The network interface device as claimed in claim 7, wherein the network interface device is configured to verify the authentication key by decrypting the encrypted configuration instructions, the authentication key being successfully verified if the encrypted configuration instructions are successfully decrypted.

9. The network interface device as claimed in claim 1, wherein the authentication key is one of a password, a cryptographically-signed certificate, a pseudorandom number or a hash of a set of predetermined data.

10. The network interface device as claimed in claim 1, wherein the network interface device is configured to verify the authentication key in accordance with the Transport Layer Security (TLS) protocol or Internet Protocol Security (IPsec) protocol.

11. The network interface device as claimed in claim 1, wherein the network message is received from a local network entity and the configuration instructions comprised in said network message originate at a remote network entity, the local network entity being a proxy for the remote network entity.

12. The network interface device as claimed in claim 1, wherein there exists a cryptographic pair of keys and the authentication key is generated using a private cryptographic key of the pair.

13. The network interface device as claimed in claim 12, wherein a public cryptographic key of the pair is stored at the network interface device and the network interface device is configured to verify the authentication key using the public key.

14. The network interface device as claimed in claim 12, wherein the network interface device is configured to use a public cryptographic key of the pair to establish an encrypted channel over which the network message is received.

15. The network interface device as claimed in claim 12, wherein the cryptographic key of the pair is stored at a network entity from which the configuration instructions originate, the said network entity being configured to generate the authentication key and transmit the authentication key and configuration instructions to the network interface device.

16. The network interface device as claimed in claim 15, wherein the network entity is accessible to the network interface device over the internet.

17. The network interface device as claimed in claim 12, wherein the network interface device includes a Trusted Platform Module and the Trusted Platform Module holds a public cryptographic key of the pair.

18. The network interface device as claimed in claim 14, wherein the network interface device includes a Trusted Platform Module and an endorsement key of the Trusted Platform Module is used to establish the encrypted channel.

19. The network interface device as claimed in claim 14, wherein the encrypted channel is established in accordance with the Transport Layer Security (TLS) protocol or Internet Protocol Security (IPsec) protocol.

20. The network interface device as claimed in claim 1, wherein the network interface device is configured to verify the authentication key at a state machine or processor of the network interface device.

21. The network interface device as claimed in claim 1, wherein the network interface device is configured to accept the network message in a low power state.

22. The network interface device as claimed in claim 21, wherein the network interface device further comprises a management controller configured to perform said verification of the configuration instructions and cause the creation of the new virtual network interface defined in the configuration instructions, the management controller being active in the low power state.

23. The network interface device as claimed in claim 1, wherein the data processing system comprises a Baseboard Management Controller and the network interface device is configured to pass Intelligent Platform Management Interface messages received at the network interface device to the Baseboard Management Controller.

24. The network interface device as claimed in claim 23, configured to, on creating the new virtual network defined in the configuration instructions, message the Baseboard Management Controller to indicate that the set of virtual network interfaces has changed.

25. The network interface device as claimed in claim 1, further comprising a non-volatile memory and being configured to store the received configuration instructions in said memory and at a later time to perform the creation of the new virtual network interface defined in the configuration instructions of the network message at the instigation of a software entity supported at the data processing system.

26. The network interface device as claimed in claim 1, wherein the network interface device is configured to successfully verify at least two different authentication keys including a first authentication key and a second authentication key, the second authentication key having a lower privilege level than the first authentication key.

27. A method configuring a network interface device providing a set of virtual network interfaces, the method comprising:

receiving at a network interface device a network message having one or more predetermined characteristics, the network message comprising an authentication key and configuration instructions defining a new virtual network, wherein the network interface device has one or more physical network ports and is configured to communicate with a data processing system via an internal physical data bus;

in response to receiving the network message, verifying the authentication key at the network interface device; and

when the authentication key is successfully verified, creating the new virtual network interface defined in the configuration instructions of the network message,

wherein the virtualized data processing system is configured further to run a plurality of guest operating systems running atop a hypervisor, the network interface device being configured to support a different virtual network interface for each of the plurality of guest operating systems,

and wherein the network interface device is configured to, in conjunction with creating the new virtual network interface defined in the configuration instructions, via a network interface device driver of the network interface device, message the hypervisor to map the new virtual network interface into a new guest operating system created at the data processing system.

28. A system comprising:

a baseboard management controller, and

a network interface device providing a set of virtual network interfaces, the network interface device having one or more physical network ports and being configured to communicate with a data processing system via an internal physical data bus,

the network interface configured to, on receiving a network message having one or more predetermined characteristics and comprising an authentication key and configuration instructions defining a new virtual network interface, pass the configuration instructions and authentication key to the baseboard management controller which;

verifies the authentication key; and

when the authentication key is successfully verified, causes the network interface device to create the new virtual network interface defined in the configuration instructions of the network message,

wherein the virtualized data processing system is configured further to run a plurality of guest operating systems running atop a hypervisor, the network interface device being configured to support a different virtual network interface for each of the plurality of guest operating systems,

and wherein the network interface device is configured to, in conjunction with creating the new virtual network interface defined in the configuration instructions, via a network interface device driver of the network interface device, message the hypervisor to map the new virtual network interface into a new guest operating system created at the data processing system.

29. The system as claimed in claim 28, wherein the network interface device is further configured to pass Intelligent Platform Management Interface messages received at the network interface device to the Baseboard Management Controller.

30. A virtualized data processing system comprising a network interface device which is configured to provide a set of virtual network interfaces,

the network interface device configured to, on receiving a network message having one or more predetermined characteristics and comprising an authentication key and configuration instructions defining a new virtual network interface:

verify the authentication key; and

when the authentication key is successfully verified, create the new virtual network interface defined in the configuration instructions of the network message,

wherein the virtualized data processing system is configured further to run a plurality of guest operating systems running atop a hypervisor, the network interface device being configured to support a different virtual network interface for each of the plurality of guest operating systems,

and wherein the network interface device is configured to, in conjunction with creating the new virtual network interface defined in the configuration instructions, via a network interface device driver of the network interface device, message the hypervisor to map the new virtual network interface into a new guest operating system created at the data processing system.

31. The virtualized data processing system as claimed in claim 30, wherein the network interface device is further configured to store state for connections of the guest operating systems.

32. The virtualized data processing system as claimed in claim 31, wherein the new guest operating system has migrated to the data processing system from another data processing system and the configuration instructions include state for connections of the migrated guest operating system.