JP2015511434A - Network node with network-attached stateless security offload device - Google Patents

Abstract

A network node for communicating data packets protected using a security protocol via a communication network. The network node includes a host information processing system (IHS) and one or more external security offload devices coupled by a secure data link. The host IHS communicates state information about the data packet, and the external security offload device uses a security protocol to provide stateless secure packet data encapsulation and de-encapsulation. The external network interface controller or internal network interface controller communicates the encapsulated data packet to the final destination via the communication network. Packet encapsulation and decapsulation by an external security offload device reduces network latency and reduces the computational load on the processor in the host IHS. Maintaining state information in the host IHS allows hot swapping of external security offload devices without loss of information. The external security offload device can be included in a firewall or intrusion detection device, and IPsec can be implemented in the device. [Selection] Figure 2

Description

  The present invention generally relates to data security in an information handling system (IHS), and more specifically to data security in communication between network-connected IHSs.

  Network communication security can be enhanced by authenticating the source IHS and the destination IHS. Further, encryption of communication between the source IHS and the destination IHS can also enhance the security of network communication.

  A method and network node are provided for communicating data packets protected using a security protocol over a communication network.

  In one aspect, a security offload method is disclosed that includes storing security metadata associated with a data packet by a host information processing system (IHS). The method also includes determining by the host IHS whether the data packet is a data packet that requires security processing. The method further includes providing the data packet to the internal network interface controller by the host IHS if the host IHS determines that the data packet does not require security processing, The controller sends a data packet to the communication network for communication to an IHS other than the host IHS. If the host IHS determines that the data packet requires security processing, the method causes the host IHS to send the data packet and associated security metadata over a secure data link to a stateless external security The method further includes offloading to the offload device, thus providing the offloaded data packet, the stateless external security offload device being external to the host IHS. The method also includes encrypting and encapsulating the offloaded data packet with a stateless external security offload device, thereby providing the encapsulated and encrypted data packet. The method further includes returning the encapsulated and encrypted data packet by the stateless external security offload device to the host IHS via the secure data link for further processing. The method also includes the step of transmitting the encapsulated / encrypted data packet to the communication network for communication to an IHS other than the host IHS by the host IHS internal network interface controller.

  In another aspect, a network node that includes a host information processing system (IHS) is disclosed. This host IHS includes an internal network interface controller. The network node includes a secure data link that connects to the host IHS. The network node also includes a stateless external security offload device that couples to the host IHS via this secure data link. This external security offload device is external to the host IHS. The host IHS is configured to store security metadata associated with the data packet. The host IHS also offloads the data packet and associated security metadata to a stateless external security offload device over a secure data link, thus the offloaded data packet. Configured to provide. The stateless external security offload device is configured to receive the offloaded data packet and the security metadata. The stateless external security offload device is also configured to encrypt and encapsulate the offloaded data packet, thus providing the encapsulated and encrypted data packet. The stateless external security offload device is further configured to send the encapsulated and encrypted data packet back to the host IHS for further processing. The host IHS is also configured to send the encapsulated / encrypted data packet to the communication network via the host IHS internal network interface controller for communication to an IHS other than the host IHS. .

  In yet another aspect, including receiving a data packet from a communication network and providing the received data packet by an internal network interface controller internal to a host information processing system (IHS). A security offload method is disclosed. The method also includes determining by the host IHS whether the received data packet is an encapsulated / encrypted data packet requiring security processing. If the host IHS determines that the received data packet is not an encapsulated / encrypted data packet that requires security processing, the method processes the received data packet with the IHS. The method further includes the step of transferring to an application in the host IHS. When the host IHS determines that the received data packet is an encapsulated / encrypted data packet that requires security processing, the method sends the received data packet to the host IHS. Further offloading to a stateless external security offload device via a secure data link, the stateless external security offload device being external to the host IHS. The method also includes the steps of decapsulating and decrypting the received data packet by a stateless external security offload device, thereby providing the decapsulated and decrypted data packet. . The method uses a stateless external security offload device to a host IHS over a secure data link for decapsulated and decrypted data packets for further processing by applications in the host IHS. The method further includes a step of returning.

  In another aspect, a network node that includes a host information processing system (IHS) is disclosed. This host IHS includes an internal network interface controller. The network node includes a secure data link that connects to the host IHS. The network node also includes a stateless external security offload device that connects to the host IHS via a secure data link. This external security offload device is external to the host IHS. The host IHS is configured to receive data packets from the communication network via an internal interface controller and provide the received data packets. The host IHS is also configured to determine whether the received data packet is an encapsulated / encrypted data packet that requires security processing. If the host IHS determines that the data packet received by the host IHS is not an encapsulated / encrypted data packet that requires security processing, the host IHS is processing the received data packet in the host IHS for processing. Configured to forward to other applications. If the host IHS determines that the data packet received by the host IHS is an encapsulated / encrypted data packet that requires security processing, the host IHS converts the received data packet to a secure data packet. It is further configured to offload over the link to a stateless external security offload device, thus providing an offloaded data packet. The stateless external security offload device is configured to decapsulate and decrypt the offloaded data packet, thus providing the decapsulated and decrypted data packet. The stateless external security offload device also sends the decapsulated and decrypted data packet back to the host IHS over the secure data link for further processing by the application in the host IHS. It is configured as follows.

  Further features of the invention are defined in the other claims appended hereto.

  For purposes of illustration only, embodiments (groups) of the present invention are described below with reference to the accompanying drawings.

1 is a block diagram of a network system of the present disclosure. FIG. 3 is a block diagram of a network node that can be used by the network system of the present disclosure. FIG. 4 is a flow chart representing one method of processing outbound data packets with an external security offload device at a network node. FIG. 4 is a flow chart representing one method of processing inbound data packets with an external security offload device at a network node. 6 is a flow chart representing another method of processing outbound data packets with an external security offload device at a network node. FIG. 6 is a flow chart representing another method of processing inbound data packets with an external security offload device at a network node.

  In the network system of the present disclosure, the network node includes a host information processing system (IHS) that couples to a stateless external security offload device via a secure data link. The stateless external security offload device is coupled to an external network interface controller that communicates with one or more other network nodes in the network system. The host IHS offloads security-related tasks to an external security offload device to reduce the security-related workload on the host IHS. For example, the external security offload device can append additional optional headers to the data packet on behalf of the host IHS, or apply cryptographic techniques to the data packet, or both be able to. The host IHS can offload security-related tasks, such as encapsulation and decapsulation, encryption and decryption, and authentication, to an external security offload device that is a network attached device. In one embodiment, the host IHS stores state information, such as IPsec sequence numbers, in the host IHS's TCP / IP stack rather than in an external security offload device, so that the stateful external It is possible to have a stateless external security offload device rather than a security offload device.

  FIG. 1 is a block diagram of a network system 100 of the present disclosure that includes a plurality of network nodes, such as network nodes 101 and 101 ′, coupled together via a communication network 102. The communication network 102 may be virtually any type of communication device, including wired or wireless links or both. For example, the communication network 102 may include transmission lines, routers, switches, hubs, network fabrics, Internet connections, local area networks (LANs), and wide area networks (WANs). The network node 101 or the network node 101 ′ can be a data packet transmission source that requires security processing. When network node 101 is the source of a data packet, network node 101 'may be the destination of that data packet. Conversely, when the network node 101 'is the source of the data packet, the network node 101 can be the destination of the data packet. Network system 100 may include more network nodes than shown in FIG.

  The network node 101 includes a host IHS 103 with an internal network interface controller 107 that couples the host IHS 103 to the communication network 102. The network node 101 also includes an external security offload device 104 that is coupled to the host IHS 103 via a secure data link 105. In one embodiment, external security offload device 104 is a “network attached” device. External network interface controller 106 couples external security offload device 104 to communication network 102. In one embodiment, the external network interface controller 106 is coupled to an external security offload device 104 as shown. In another embodiment, the external network interface controller 106 is internal to the external security offload device 104 but is still external to the host IHS 103. Similarly, the network node 101 ′ includes a host IHS 103 ′ with an internal network interface controller 107 ′ that couples the host IHS 103 ′ to the communication network 102. The network node 101 'also includes an external security offload device 104' that couples to the host IHS 103 'via a secure data link 105'. In one embodiment, the external security offload device 104 'is a network attached device. External network interface controller 106 ′ couples external security offload device 104 ′ to communication network 102.

  FIG. 2 illustrates a network node that the network system 100 can use as the network node 101 or the network node 101 ′ or both, and as other network nodes (not shown) of the network system 100. 101 is a block diagram of FIG. More particularly, FIG. 2 shows a network node 101 that includes a host information processing system (IHS) 103 coupled to an external security offload device 104 via a secure data link 105.

  Secure data link 105 prevents unencrypted traffic from being viewed or altered by unintended third parties. In order to achieve security, the secure data link 105 includes Open System Interconnection (OSI) Layer 1 physical separation, OSI Layer 2 encryption, and other OSI layers or others. Security policies or both. The host IHS 103 includes a processor 110 that may include multiple cores and an SRAM cache 150. The host IHS 103 processes, transmits, communicates, modifies, stores, or otherwise handles information in digital format, analog format, or other formats. The host IHS 103 includes a bus 115 that couples the system memory 120 to the processor 110 via a memory controller 125 and a memory bus 130. In one embodiment, system memory 120 is external to processor 110. The system memory 120 may be an array of static random access memory (SRAM) or an array of dynamic random access memory (DRAM) or both. Video graphics controller 135 couples display 140 to bus 115. Non-volatile storage 145, such as a hard disk drive, CD drive, DVD drive, or other non-volatile storage, is coupled to bus 115 and provides permanent storage of information to host IHS 103. An I / O device 190 such as a keyboard and mouse pointing device is coupled to the bus 115 via an I / O controller 155 and an I / O bus 160. One or more expansion buses 165, such as USB, IEEE 1394 bus, ATA, SATA, PCI, PCIE, DVI, HDMI, and other expansion buses, facilitate the connection of peripheral devices and devices to the host IHS 103. It is linked to. A dotted line 103 in FIG. 2 represents the host IHS 103 and the housing and / or chassis of the host IHS 103. As described above, the structure of the host IHS 103 inside the dotted line 103 is inside the host IHS 103, and the structure of the network node 101 outside the dotted line 103 is outside the host IHS 103.

  The host IHS 103 of the network node 101 includes an internal network interface controller 107, which is coupled to the bus 115, and the host IHS 103 is connected to a network such as the communication network 102 by wire or wirelessly and a network node 101 ′. For example, it is possible to connect to other information processing systems and network nodes. The host IHS 103 may take the form of a desktop, server, portable device, laptop, notebook or other form factor computer or data processing system. The host IHS 103 may take other form factors, such as a gaming device, a personal digital assistant (PDA), a mobile phone device, a communication device, or other device including a processor and memory. . The host IHS 103 can also take the form of a portable device, laptop, notebook, gaming device, PDA, or any battery powered device. In one embodiment, the performance of the host IHS 103 is particularly susceptible to computationally intensive processes (such as packet security and IPsec processes) that can increase network latency.

  Host IHS 103 may include a computer program product on digital media 175 such as a CD, DVD, or other media. In one embodiment, digital media 175 includes application 182. The user can load application 182 on non-volatile storage 145 as application 182 '. Non-volatile storage 145 can store an operating system 181 and can include network software 183 in the system. When the host IHS 103 is initialized, the host IHS executes the operating system 181 and the application 182 ′ in the system memory 120 for execution as the operating system 181 ′, the network software 183 ′, and the application 182 ″. The operating system 181 ′ can include network software 183 ′ and controls the operation of the host IHS 103. The host IHS 103 is connected to the external security offload network via the secure data link 105. Coupled to device 104. External security offload device 104 is coupled to an external network interface controller 106. However, external Ttowaku interface controller 106 is a device of the "network included". A “network attached” device serves as a wired and / or wireless portal to a communication network, such as communication network 102, that can interconnect multiple network nodes. For example, external network interface controllers 106 and 106 ′ and internal network interface controllers 107 and 107 ′ may be wired and / or wireless to interconnect network nodes 101 and 101 ′ via communication network 102. Serves as a portal. Host IHS 103, together with secure data link 105, external security offload device 104, and external network interface controller 106, collectively communicates data packets to other network nodes. Form node 101. In one embodiment, the host IHS 103 cooperates with the external security offload device 104 to send these data packets to a security protocol, such as the Internet Protocol Security (IPsec) protocol suite. Can be used to secure.

  In one embodiment, the external security offload device 104 of the network node 101 performs an Internet protocol (IP) communication to secure the Internet Protocol (IP) communication on behalf of the host IHS 103 under the direction of the host IHS 103. Protocol security (IPsec) protocol group can be used. External security offload device 104 facilitates encapsulation and decapsulation of data packets, facilitates encryption and decryption of data packets, authenticates data packets, and optionally firewalls and intrusions It may be an information processing system that includes a detection service (IDS) and a processor (not shown) for performing any other service for data packets. External security offload device 104 may also include memory (not shown) and storage (not shown).

  The external security offload device 104 can use a security protocol that authenticates IP data packets and encapsulates the authenticated IP data packets. After encapsulating the authenticated IP data packet, the encapsulated IP data packet can be encrypted by a security protocol. For example, the IPsec protocol authenticates and encrypts each IP data packet of a communication session. In addition, IPsec includes a protocol for establishing mutual authentication between agents at the start of a communication session and a protocol for negotiating encryption keys used during the communication session. Host IHS 103 and host IHS 103 'are examples of such agents. More specifically, this portion of network software 183 with security is an agent that operates under the direction of a human security administrator. In one embodiment, the external security offload device 104 can provide all IPsec encapsulation and decapsulation operations, as well as encryption, decryption, and authentication for the network node 101. . This reduces the security-related workload of the host IHS 103 in the network node 101.

  A security policy allows a designer, programmer, or other entity program to instruct a protocol how to process data packets received by a particular device, within a security protocol such as the IPsec protocol. It is a rule to program. For example, a security policy can determine whether a particular data packet requires IPsec protocol security processing. Data packets that do not require security processing may bypass authentication header (AH) protocol processing or encapsulating security payload (ESP) protocol processing. If the device determines that a particular data packet requires security protocol processing, the security policy can instruct the device to use guidelines for handling security for that data packet. . In one embodiment, the host IHS 103 or the external security offload device 104 or both can store security policies in a security policy database (not shown) within these devices. Security Association (SA) information is a set of security information that represents a particular type of secure connection between two devices. This SA information includes specific security mechanisms that the two devices can use to securely communicate with each other.

  In one embodiment, the external security offload device 104 operates as a network attached device. A network-attached device may be an information processing system (IHS) that connects to the network and provides a file-based storage service or other specialized service or both. In one embodiment, the external security offload device 104 provides specialized security-related services such as encapsulation, decapsulation, encryption, decryption, and authentication.

  In one embodiment of the network system 100 of the present disclosure, the TCP / IP stack 184 of the network software 183 ′ in the operating system 181 ′ of the host IHS 103 rather than the external security offload device 104 is Maintain all of the security association (SA) state information. This arrangement allows the external security offload device 104 to be a stateless device. In some embodiments, for external security offload device 104, e.g., for firewall services, intrusion detection services, and unencrypted data that also passes through the network node's external security offload device, Other network services such as deep packet inspection services can be incorporated. In one embodiment, the physical separation between the external security offload device 104 and the host IHS 103 of the network node 101, and the stateless nature of the external security offload device 104 are: (1) minimal system Facilitates “hot swapping” or switching of external security offload device 104 with interference or interruption, and (2) multiple external security for additional balance or hot standby without state synchronization disruption Enable offload devices to be configured, and (3) dynamically enable and disable external security offload devices for system maintenance or for multihomed hosts Enable. A multihomed host includes multiple network connections. A multihomed host can connect to multiple networks or the same network.

  In one embodiment of the network system 100 of the present disclosure, security processing is offloaded from the host IHS 103 to the external security offload device 104 of the network node 101. The TCP / IP stack 184 of the network software 183 'in the operating system 181' of the host IHS 103 maintains state information. The network software 183 ′ in the operating system 181 ′ of the host IHS 103 communicates the selection of outbound metadata for the IP data packet to the external security offload device 104. The outbound metadata can include information about IP data packets that the network software 183 ′ of the host IHS 103 sends to the external security offload device 104. Outbound metadata may include IPsec security association (SA) information and associated SA state information that applies to IP data packets. Security Association (SA) information includes specifications that allow network traffic to use a tunnel (eg, IPsec can limit this to a specific network address or protocol), selection of an encryption algorithm for authentication, It refers to negotiated SA attributes, such as encryption and decryption, encryption keys used for these algorithms, and methods for encapsulating data. For example, IPsec allows for encapsulated tunnels and transmission modes. The SA state information refers to an SA attribute that changes over the lifetime, such as a counter used for preventing replay or a counter used to limit the amount of data protected by the SA.

  The network software 183 'of the IHS operating system 181' can attach outbound metadata to the IP data packet by inserting an Internet Protocol (IP) header into the IP data packet. The IP data packet and the outbound metadata can be sent to the external security offload device 104, or the network software 183 ′ can send the IP data packet and the outbound metadata. It is also possible to send a dedicated Ethernet frame for communication to the external security offload device 104.

  In one embodiment, the network software 183 'includes SA policy rules that control the encapsulation of IP data packets using a security protocol such as the IPsec protocol. In other embodiments, other security protocols can be used. In one embodiment, TCP / IP stack 184 in host IHS 103 sends IP data packets to external security offload device 104. The SA policy rule of the network software 183 ′ in the operating system 181 ′ of the host IHS 103 defines a rule for controlling packet encapsulation using IPsec. Network software 183 'implementing TCP / IP stack 184 selects the appropriate IPsec SA to use to encapsulate the data packet. Corresponding required outbound metadata includes a security parameter index (SPI) and a tunnel protocol, for example, an authentication header (AH) protocol or an encapsulated security payload (ESP) protocol. Specific protocols that the tunnel uses for data transmission. Also, the outbound metadata is used by the external security offload device 104 to encapsulate the IP data packet, so the TCP / IP stack 184 has chosen for the external security offload device 104. It is also possible to include an IPsec sequence number.

  In another embodiment, the external security offload device 104 uses the internal network interface controller 107 to send to the final destination via the communication network 102 for corresponding encrypted and encapsulated IPsec data. Return the packet to the TCP / IP stack 184 in the network software 183 ′ of the host IHS 103. The external security offload device 104 responds to inbound metadata in response to a request for encapsulation and / or encryption of IP data packets received from the TCP / IP stack 184 by the external security offload device. Can be returned to the TCP / IP stack 184. This inbound metadata can include a result code that represents the success or failure of the encapsulation operation.

  In yet another embodiment, the TCP / IP stack 184 in the network software 183 ′ of the host IHS 103 sends IPsec packets to the external security offload device 104 for decryption and decapsulation. TCP / IP stack 184 may send outbound metadata along with encapsulated data packets that require decapsulation. This outbound metadata can include selection information that instructs the external security offload device 104 to perform the decapsulation operation.

  In yet another embodiment, the external security offload device 104 sends the decapsulated packet to the TCP / IP stack 184 in the network software 183 ′ of the host IHS 103 for inbound data packet processing. Return to The external security offload device 104 can send inbound metadata to the TCP / IP stack 184 along with the decapsulated data packet. This inbound metadata is communicated with the SPI so that the TCP / IP stack 184 can check which SA the external security offload device 104 used for TCP / IP policy rules for data packets. AH or ESP protocol of the tunnel that the network 102 used to transmit the data packet. This metadata can also include the IPsec replay sequence number that the TCP / IP stack 184 observed for the packet. The TCP / IP stack 184 performs a final stateful check to verify whether the data packet has been “replayed” and is therefore invalid.

  In summary, metadata information that can be exchanged between the TCP / IP stack 184 in the network software 183 ′ of the operating system 181 ′ in the host IHS 103 and the external security offload device 104 is encapsulated. Selection, or display of operations performed, encapsulated, decapsulated, decapsulated, etc. This metadata can contain important information, such as result codes for operations and tunnel protocol and SPI selection and display, where appropriate. This important information can also include selection and display of packet replay sequence numbers. The packet replay sequence number is state information that allows the external security offload device to operate in a stateless manner.

  Table 1 below shows important information (metadata) that can be exchanged between the TCP / IP stack 184 of the network software 183 ′ of the operating system 181 ′ in the host IHS 103 and the external security offload device 104. FIG. 4 illustrates an exemplary inbound or outbound IP options header including. These fields include an “option type” ipo_type and an “option length” ipo_len, each of which is 1 byte long. A 1-byte long “flow function code” ipo_secoff_function can include # 1-decapsulate, # 2-decapsulate, # 3-encapsulate, or # 4-encapsulate. . The 1-byte ipo_secoff_rc represents a “return code” for the flow # 1 or # 4. The “primary protocol” field may be ipo_decoff_protocol having a length of 1 byte. For flow # 2 or # 3, ipo_decoff_protocol represents the protocol associated with the SPI. For example, AH, ESP, or SPI can be specified for a tunnel that can be used by both AH and ESP. Table 1 reserves the 3-byte ipo_secoff_rsvd field for future use. The 4-byte long field ipo_secoff_spi specifies the local SPI in the original inbound packet for flow # 2 or the remote SPI that is scheduled for use for the outbound packet in flow # 3. The 4-byte long ipo_secoff_seq field can be the sequence number in the original inbound packet for flow # 2, or the sequence number specified by the metadata for the outbound packet of flow # 3. . Both the AH header and ESP header should use the value of ipo_secoff_seq provided for flow # 3 if both AH and ESP protocols are used.

  FIGS. 3 and 4 show a network switch, router, firewall or intrusion detection device as a gateway or gate keeper for data traffic flowing through the TCP / IP stack 184 in the operating system network software in the host IHS. 6 is a flow chart representing an embodiment of an “in-band” process that can be performed when performing the role of “In-band” processing occurs within the external security offload device 104. “In-band” processing means that the external security offload device 104 encapsulates and encrypts the packet for direct transmission to the final network destination without having to send the packet back to the TCP / IP stack 184. Before the incoming data packet is sent back to the TCP / IP stack 184, it can be decapsulated for immediate processing by the external security offload device. FIGS. 5 and 6 described below show an embodiment of an “out-of-band” process in which all data packets are encrypted / encapsulated or decapsulated / encrypted. It is sent from the TCP / IP stack 184 to the external security offload device 104 for decryption and then returned to the TCP / IP stack 184 for final processing. The “out-of-band” processing is processing performed outside the external security offload device 104. Out-of-band processing may require another traffic between the external security offload device and the host IHS 103.

  The flow chart of FIG. 3 represents one embodiment of the disclosed method for applying a data security protocol to outbound data packets at the stateless external security offload device 104. An outbound data packet is a data packet that the host IHS 103 of the network node 101 transmits to another network. In addition to providing data security protocol operations for outbound data packets on behalf of the host IHS 103, the external security offload device 104 can be a firewall or intrusion detection service (IDS) or both, Other networking functions can be implemented, such as providing data security protocol operations. The external security offload device 104 performs security operations on the outbound data packets and sends them to the destination node without having to send them back to the host IHS 103 for further security processing. Sending provides “in-band” processing of outbound data packets. For simplicity, the stateless external security offload device 104 is referred to as an “offload device” in the flow chart of FIG. Each block in the flow chart of FIG. 3 has a description such as “offload device” or “host IHS” to identify the structure that performs the function of each block in one embodiment. Including.

  More particularly, the process flow begins at start block 205. At block 210, the application 182 "in the host IHS 103 sends a data packet to the network software 183 'of the operating system 181' of the host IHS 103. At decision block 215, the network transmission of the data packet is a security process. If the network software 183 'in the operating system 181' of the host IHS 103 sends the data packet over the network to the external security offload device 104 at block 245, the external network Sending directly to the final destination network node via the interface controller 106, the process flow ends at block 250.

  On the other hand, if, at decision block 215, the network software 183 'of the operating system 181' determines that the network transmission requires application of a data security protocol, the network software 183 ' According to the flow # 3 in Table 1, security metadata and status data can be attached to the data packet. Such metadata is outbound metadata. The network software 183 ′ of the operating system 181 ′ sends the metadata and data packet to the external security offload device 104 via the network secure data link 105 at block 225. The external security offload device 104 receives and reads the data packet and corresponding metadata, including status data, at block 230. The external security offload device 104 can perform any processing, such as a firewall service and / or intrusion detection service (IDS), on the data packet at block 235, and at block 240, the data Encrypt and encapsulate the packet. The external security offload device 104 sends the encapsulated and encrypted data packet at block 245 via the external network interface controller 106 directly over the network to the final destination network node. To do. The process flow ends at block 250.

  The flow chart of FIG. 4 represents one embodiment of the disclosed method for receiving inbound data packets from the network via the external security offload device 104. An inbound data packet is a data packet that the host IHS 103 of the network node 101 receives from another network node. The external security offload device 104 receives inbound data packets and performs security operations on the inbound data packets without having to send such data packets back to the host IHS 103 for further security processing. Provides “in-band” processing of inbound data packets. In one embodiment, the external security offload device 104 sends the decapsulated and decrypted data packets to the host IHS 103, which performs other security operations on these data packets. There is no need to do. Rather, applications in the host IHS 103 can directly use the decapsulated and decrypted data packets that the host IHS 103 received from the external security offload device 104.

  More particularly, the process flow begins at start block 305. The external security offload device 104 receives data packets from the network via the external network interface controller 106 at block 310. The external security offload device 104 performs a test at decision block 320 to determine whether the data packet requires security processing. To determine whether the data packet requires security processing, the external security offload device 104 checks the IPsec protocol header in the data packet, or the external security offload The device 104 checks the static security policy and SA information received from the host IHS 103. Note that the SA state information may still exist in the network software 183 ′ of the host IHS 103. If the external security offload device 104 determines that the packet does not require security processing, the external security offload device 104 may provide a firewall service and / or IDS service at block 345. Any processing may be performed, such as sending a data packet to the host IHS 103 via the secure data link 105 at block 350.

  On the other hand, if the packet requires security processing, the external security offload device 104 decapsulates and decrypts the packet at block 330, and optionally at block 335, such as a firewall and / or IDS. This process or any other process is performed. The external security offload device 104 can add inbound metadata including state data at block 340 according to flow # 2 of Table 1 and at block 350 via the secure data link 105. A data packet is transmitted to the host IHS 103. The network software 183 ′ in the operating system 181 ′ of the host IHS 103 receives the data packet from the external security offload device 104 at block 355 and performs a status check at block 360. The network software 183 'in the operating system 181' processes the data packet at block 365 and forwards the data packet to the application 182 '. The process flow ends at block 370.

  The flow chart of FIG. 5 represents another embodiment of the disclosed method of applying security to outbound data packets on behalf of the host IHS 103 at the external security offload device 104. This embodiment uses “out-of-band” processing to handle such data packets that require security operations such as encryption and encapsulation. In such out-of-band processing, the stateless external security offload device 104 uses a security packet such as encryption and encapsulation of the data packet received from the host IHS 103 for security processing by the stateless external security offload device 104. Handle operations. On the other hand, the stateless external security offload device 104 returns the obtained encapsulated / encrypted data packet to the host IHS 103 for transmission to the destination of the data packet. The external security offload device 104 can also perform other networking functions, such as providing a firewall or IDS.

  More particularly, the process flow begins at start block 405. The application 182 ″ in the host IHS 103 sends the data packet to the network software 183 ′ of the operating system 181 ′ of the host IHS 103 at block 410. The network software 183 ′ receives the data packet at decision block 415. The network software 183 ′ makes this determination with reference to the security policy to determine whether the network transmission of the network requires application of a security protocol to the data packet. The application 182 ″ can instruct the TCP / IP stack 184 of the network software 183 ′ to initiate a decision on the application of the security protocol to the data packet. If the network software 183 ′ determines that the data packet does not require application of a security protocol, the host IHS 103, at block 445, directs the packet directly to the final destination via the internal network interface controller 107. To other network nodes. The process flow ends at block 450.

  On the other hand, if the network transmission requires security to be applied to the data packet, the network software 183 ′ in the operating system 181 ′, in block 420, in accordance with the flow # 3 of Table 1, the metadata and You can attach status data. This metadata is outbound metadata. The network software 183 ′ of the operating system 181 ′ of the host IHS 103 sends the metadata and data packets to the external security offload device 104 via the network secure data link 105 at block 425. The external security offload device 104 receives and reads the data packet and metadata at block 430. Also, the external security offload device 104 can perform any processing, such as firewall processing and / or IDS, at block 435. The external security offload device 104 encapsulates and encrypts the data packet at block 440 and sends the encrypted and encapsulated data packet via the secure data link 105 to the operating system 181. Return to 'Network software 183'. The network software 183 'in the operating system 181' receives the encapsulated packet at block 443. The network software 183 ′ sends the encapsulated data packet to the final destination network node via the communication network 102 via the internal network interface controller 107 at block 445. The process flow ends at block 450.

  The flow chart of FIG. 6 represents another embodiment of the disclosed method of receiving data packets from the network via the internal network interface controller 107. This embodiment uses “out-of-band” processing to handle inbound data packets that require security operations such as decapsulation and decryption. Inbound data packets are data packets that the host IHS 103 receives from other network nodes. In out-of-band processing, the stateless external security offload device 104 provides security such as decryption and decapsulation of the data packet received by the stateless external security offload device 104 from the host IHS 103 for security processing. -Handle operations. Meanwhile, the stateless external security offload device 104 returns the obtained decapsulated and decrypted data packet to the host IHS 103 for transfer to the destination application 182 'of the data packet.

  More particularly, the process flow begins at start block 505. Network software 183 ′ in operating system 181 ′ receives data packets from internal network interface controller 107 at block 510. This received data packet is an inbound data packet received from another network node by the host IHS 103 of the network node 101. The network software 183 'performs a test at decision block 520 to determine whether the data packet requires security processing. If the data packet does not require security processing, the network software 183 ′ in the operating system 181 ′ processes the data packet at block 565 and forwards the data packet to the application 182 ″. The flow ends at block 570.

  On the other hand, if the data packet requires security processing, the network software 183 ′ in the operating system 181 ′ removes the data packet via the secure data link 105 at block 525. Transmit to load device 104. The external security offload device 104 receives the packet at block 530 and decapsulates and decrypts the packet at block 535. External security offload device 104 may optionally perform firewall processing and / or IDS or other services at block 540. The external security offload device 104 may add security metadata including state data to the packet at block 545 according to flow # 3 of Table 1. The external security offload device 104 sends the decapsulated and decrypted data packet to the network software 183 ′ in the operating system 181 ′ via the secure data link 105 at block 550. Return it. 'Network software 183' in operating system 181 receives the decapsulated and decrypted data packet from external security offload device 104 at block 555 and performs a status check at block 560. . The network software 183 'in the host IHS 103 then processes the data packet and forwards the data packet to the application 182 "at block 565. This processing of the data packet by the network software 183' It may include a protocol and integrity check prior to presenting the data packet to application 182 ". The process flow ends at block 570.

  In the in-band embodiment of FIG. 4, the external security offload device 104 can independently determine whether a security packet with the external security offload device 104 requires security processing. Thus, a copy of the static SA information is stored. All four embodiments: the in-band embodiment of FIG. 3, the in-band embodiment of FIG. 4, the out-of-band embodiment of FIG. 5, and the in-band of FIG. In an embodiment, the external security offload device 104 can store SA information. However, in the in-band embodiment of FIG. 4, in order to be able to determine independently whether a security packet with an external security offload device 104 requires security processing, the security It may be necessary for the offload device 104 to store immutable SA information, ie static SA information.

  The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, the singular forms “a”, “an”, and “the” unless the context clearly indicates otherwise. Is intended to be included. Further, it is to be understood that “comprise” and / or “comprising”, or both, are used herein to describe any function, integer, step, block, or function described. , Operation, element, or component, or combination thereof, but one or more other functions, integers, steps, blocks, operations, elements, components, or groups thereof, or the above It does not exclude the presence or addition of combinations.

  The corresponding structure, materials, operations and equivalents of all means-plus-function or step-plus-function elements in the appended claims may be combined with other specifically claimed elements to perform their functions. It is intended to encompass any structure, material, or operation to accomplish. The description of the present invention has been presented for purposes of illustration and description, and is not intended to be exhaustive or limited to the invention in the form disclosed. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the invention. For example, those skilled in the art are well aware that reversing the logic sense (logic high (1), logic low (0)) of the devices and methods described herein will provide equivalent results. Like. This embodiment best describes the principles and practical applications of the present invention, and other persons skilled in the art will understand the present invention in terms of various embodiments with various modifications suitable for the specific intended use. It has been selected and explained as possible.

Claims (32)

Storing security metadata associated with the data packet by a host information processing system (IHS);
Determining by the host IHS whether the data packet is a data packet requiring security processing;
If the host IHS determines that the data packet does not require security processing, the host IHS provides the data packet to an internal network interface controller, the internal network interface The controller sends the data packet to a communication network for communication to an IHS other than the host IHS, the providing step;
If the host IHS determines that the data packet requires security processing, the host IHS sends the data packet and associated security metadata over a secure data link to a stateless external security Offloading to an offload device, thus providing an offloaded data packet, wherein the stateless external security offload device is external to the host IHS;
Encrypting and encapsulating the offloaded data packet by the stateless external security offload device, thereby providing an encapsulated and encrypted data packet;
Sending the encapsulated and encrypted data packet back to the host IHS via the secure data link for further processing by the stateless external security offload device;
Transmitting the encapsulated / encrypted data packet to a communication network for communication to an IHS other than the host IHS by the internal network interface controller of the host IHS;
Including methods.   The method of claim 1, wherein an external network interface controller is incorporated within the stateless external security offload device.   The method of claim 1 or claim 2, wherein the security metadata includes state data.   The encryption and encapsulation of the data packet is performed according to instructions in the associated security metadata that the host IHS sends to the stateless external security offload device. The method according to claim 1, wherein the method is carried out by: A host information processing system (IHS) including an internal network interface controller;
A secure data link coupled to the host IHS;
A stateless external security offload device coupled to the host IHS via the secure data link, the external security offload device being external to the host IHS; and
A network node comprising:
The host IHS is configured to store security metadata associated with a data packet, and the host IHS transmits the data packet and associated security metadata over the secure data link. Further configured to offload to a stateless external security offload device, thus providing an offloaded data packet;
The stateless external security offload device is:
Receiving the offloaded data packet and associated security metadata;
Encrypting and encapsulating said offloaded data packet, thus providing an encapsulated and encrypted data packet;
Sending the encapsulated / encrypted data packet back to the host IHS for further processing;
It is configured as
The host IHS is
Transmitting the encapsulated / encrypted data packet to a communication network via the internal network interface controller of the host IHS for communication to an IHS other than the host IHS;
As further configured,
Network node.   The network node of claim 5, wherein the security metadata includes state data.   The encryption and encapsulation of the data packet is performed by the stateless external security offload device as directed by the associated security metadata that the stateless external security offload device receives from the host IHS. The network node according to claim 5 or 6, implemented by: Receiving a data packet from a communication network by an internal network interface controller internal to a host information processing system (IHS) and thus providing the received data packet;
Determining by the host IHS whether the received data packet is an encapsulated / encrypted data packet requiring security processing;
If the host IHS determines that the received data packet is not an encapsulated / encrypted data packet that requires security processing, the host IHS processes the received data packet. Transferring to an application in the host IHS for:
If the host IHS determines that the received data packet is an encapsulated / encrypted data packet that requires security processing, the received data packet is transmitted by the host IHS. Offloading to a stateless external security offload device over a secure data link, wherein the stateless external security offload device is external to the host IHS; and
Decapsulating and decrypting the received data packet by the stateless external security offload device, thereby providing a decapsulated and decrypted data packet;
The unencapsulated and decrypted data packet is sent by the stateless external security offload device via the secure data link for further processing by the application in the host IHS. Step back to
Including methods.   9. The method of claim 1 or claim 8, further comprising deploying the host IHS, secure data link, and stateless external security offload device to form a network node.   9. The method of claim 1 or claim 8, wherein the stateless external security offload device uses an IPsec protocol.   9. The method of claim 8, further comprising adding security metadata to the decapsulated and decrypted data packet by the stateless external security offload device.   9. The method of claim 8, further comprising performing a status check on the decapsulated and decrypted data packet by the host IHS. A host information processing system (IHS) including an internal network interface controller;
A secure data link coupled to the host IHS;
A stateless external security offload device coupled to the host IHS via the secure data link, the external security offload device being external to the host IHS; and
A network node containing
The host IHS is
Receiving a data packet from a communication network via the internal network interface controller, thus providing the received data packet;
Determining whether the received data packet is an encapsulated / encrypted data packet requiring security processing;
If the host IHS determines that the received data packet is not an encapsulated / encrypted data packet that requires security processing, the received data packet is sent to the host IHS for processing. Forward to the application inside
If the host IHS determines that the received data packet is an encapsulated / encrypted data packet that requires security processing, the received data packet is designated as the secure data packet. Offloading over the link to the stateless external security offload device, thus providing offloaded data packets;
It is configured as
The stateless external security offload device is:
Decapsulating and decrypting said offloaded data packet, thus providing an unencapsulated and decrypted data packet;
Sending the decapsulated and decrypted data packet back to the host IHS via the secure data link for further processing by the application in the host IHS;
Configured as
Network node.   14. A network node according to claim 5 or claim 13, wherein the stateless external security offload device uses the IPsec protocol.   The network node of claim 13, wherein the stateless external security offload device is further configured to append security metadata to the decapsulated and decrypted data packet.   The network node of claim 13, wherein the host IHS is further configured to perform a status check on the decapsulated and decrypted data packet.   The network node according to claim 13, wherein the stateless external security offload device is further configured to provide at least one of a firewall service and an intrusion detection service. Storing security metadata related to data packets by a host information processing system (IHS);
Offloading the data packet and security metadata by the host IHS via a secure data link to a stateless external security offload device external to the host IHS;
Receiving the data packet and security metadata by the stateless external security offload device;
Encrypting and encapsulating the data packet by the stateless external security offload device, thereby providing an encapsulated and encrypted data packet;
Sending the encapsulated and encrypted data packet by the stateless external security offload device to an external network interface controller;
Transmitting the encapsulated / encrypted data packet by the external network interface controller to a communication network for communication with an IHS other than the host IHS;
Including methods.   The method of claim 18, wherein the security metadata includes state data.   The encryption and encapsulation of the data packet is performed by the stateless external security offload device as directed by the security metadata received by the stateless external security offload device from the host IHS. 19. The method of claim 18, wherein: A host information processing system (IHS) including an internal network interface controller;
A secure data link coupled to the host IHS;
A stateless external security offload device coupled to the host IHS via the secure data link, the external security offload device being external to the host IHS; and
An external network interface controller coupled to the stateless external security offload device, the external network interface controller being external to the host IHS; and
A network node containing
The host IHS stores security metadata related to data packets and off the data packets and security metadata to the stateless external security offload device via the secure data link. Configured to load,
The stateless external security offload device is:
Receiving the data packet and security metadata;
Encrypting and encapsulating said data packet, thus providing an encapsulated and encrypted data packet;
Sending the encapsulated / encrypted data packet to the external network interface controller;
It is configured as
The external network interface controller is configured to transmit the encapsulated data packet to a communication network for communication with an IHS other than the host IHS;
Network node.   The network node according to claim 21, wherein the security metadata includes state data.   The encryption and encapsulation of the data packet is performed by the stateless external security offload device as directed by the security metadata received by the stateless external security offload device from the host IHS. The network node according to claim 21, wherein: Receiving a data packet from a communication network by an external network interface controller external to a host information processing system (IHS), and providing the received data packet;
Determining whether the received data packet is an encapsulated / encrypted data packet requiring security processing by a stateless external security offload device external to the host IHS;
If the stateless external security offload device determines that the received data packet is a data packet that does not require security processing, the stateless external security offload device keeps the received data packet as it is. Transmitting to the host IHS by an offload device;
If the stateless external security offload device determines that the received data packet is an encapsulated / encrypted data packet that requires security processing, the stateless external security offload device Decapsulating and decrypting the received data packet by a load device, thereby providing an unencapsulated and decrypted data packet;
Sending the decapsulated and decrypted data packet by the stateless external security offload device to the host IHS over a secure data link;
Including methods.   25. The method of claim 18 or 24, further comprising deploying the host IHS, secure data link, stateless external security offload device, and external network interface controller to form a network node. the method of.   25. The method of claim 18 or claim 24, wherein the external network interface controller is incorporated within the stateless external security offload device.   25. The method of claim 18 or claim 24, wherein the stateless external security offload device uses an IPsec protocol.   25. The method of claim 24, further comprising adding security metadata to the data packet by the stateless external security offload device. A host information processing system (IHS) including an internal network interface controller;
A secure data link coupled to the host IHS;
A stateless external security offload device coupled to the host IHS via the secure data link, the external security offload device being external to the host IHS; and
An external network interface controller coupled to the stateless external security offload device, the external network interface controller being external to the host IHS; and
A network node containing
The stateless external security offload device is:
Receives encapsulated / encrypted data packets from the communication network,
Decapsulating and decrypting the encapsulated / encrypted data packet, thereby providing an unencapsulated / decrypted data packet;
Sending the decapsulated and decrypted data packet to the host IHS;
Configured as
Network node.   30. A network node according to claim 21 or claim 29, wherein the external network interface controller is incorporated in the stateless external security offload device.   30. A network node according to claim 21 or claim 29, wherein the stateless external security offload device uses the IPsec protocol.   30. A network node according to claim 21 or claim 29, wherein the stateless external security offload device adds security metadata to the data packet.

Images