WO2016195624A1

WO2016195624A1 - Transferring an image file over a network

Info

Publication number: WO2016195624A1
Application number: PCT/US2015/033167
Authority: WO
Inventors: Shivanna Suhas; Sriram Subramanian
Original assignee: Hewlett Packard Enterprise Development Lp
Priority date: 2015-05-29
Filing date: 2015-05-29
Publication date: 2016-12-08

Abstract

An example client device to transfer an image file over a network may include a hardware accelerator library to maintain a number of encryption files compatible with programmable hardware accelerators on the client device, a discovery module to discover the programmable hardware accelerators and input/output (IO) devices with remote direct memory access (RDMA) capable devices on the client device, and a download module to initiate the programing of the discovered hardware accelerators on the client device with the encryption files and use the discovered RDMA devices to securely transfer a number of image files over a network from a remote computing device.

Description

TRANSFERRING AN IMAGE FILE OVER A NETWORK

BACKGROUND

[0001] Pre-boot execution environment (PXE) is a computer specification that describes a client-server environment that boots software from a remote computing device such as a remote server. The trivial file transfer protocol (TFTP) allows a user of a PXE enabled computing device to retrieve an image file over a network.

BRIEF DESCRIPTION OF THE DRAWINGS

[0002] The accompanying drawings illustrate various examples of the principles described herein and are a part of the specification. The illustrated examples are given merely for illustration, and do not limit the scope of the claims.

[0003] Fig. 1 is a block diagram of a client device to securely transfer an image file over a network according to one example of the principles described herein.

[0004] Fig. 2 is a block diagram of a client device to securely transfer an image file over a network according to another example of the principles described herein.

[0005] Fig. 3 is a block diagram of a system for securely transferring an image file over a network according to one example of the principles described herein.

[0006] Fig. 4 is a flowchart showing a method of securely transferring an image file over a network according to one example of the principles described herein. [0007] Fig. 5 is a flowchart showing a method of securely transferring an image file over a network according to another example of the principles described herein.

[0008] Throughout the drawings, identical reference numbers designate similar, but not necessarily identical, elements.

DETAILED DESCRIPTION

[0009] As described above, PXE is an industry specification that allows a user of a computing device, along with TFTP, to install and deploy file images remotely to a client device. With an increase in the number of security breaches in computing environments, however, PXE boot is becoming a less attractive method of retrieving the file images for installation on a client device. The TFTP is insecure and incompatible in some ways with a firewall configuration.

[0010] Along with a lack of security in PXE, image files used in pre- boot operating systems are constantly increasing in size with the size of some image files being 2 to 4 gigabytes. These sizes of image files increase the time to deploy and boot onto client devices from those image files. Relatively more secure protocols like hypertext transfer protocol secure (HTTPS) used in unified extensible firmware interface (UEFI) are beginning to replace PXE. The device and method described herein enables a very fast and secure method to download large images and is completely application independent. The secure and fast download capability and the ability to use this device and method to dynamically create new bootable devices on client devices with, for example, non-volatile random-access memory (NVRAM) may increase the efficiency of deployment of the image files on a number of client devices.

[0011] The present specification therefore describes a client device including a hardware accelerator library to maintain a number of encryption files compatible with programmable hardware accelerators on the client device, a discovery module to discover the programmable hardware accelerators and input/output (IO) devices with remote direct memory access (RDMA) capable devices on the client device, and a download module initiate the programing of the discovered hardware accelerators on the client device with the encryption files and use the discovered RDMA devices to securely transfer a number of image files over a network from a remote computing device.

[0012] The present specification also describes a method of securely transferring an image file over a network including discovering, with a discovery module on a client device, programmable hardware accelerators and input/output (IO) devices with remote direct memory access (RDMA) capabilities on the client device, and programing, with the client device, discovered hardware accelerators on the client device with encryption files and use the discovered RDMA capable devices to securely transfer a number of image files over a network from a remote computing device.

[0013] Further, the present specification describes a computer program product for securely transferring data files over a network, the computer program product including a computer readable storage medium comprising computer usable program code embodied therewith, the computer usable program code that, when executed by a processor discovers, with a discovery module on a client device, programmable hardware accelerators and input/output (IO) devices with remote direct memory access (RDMA) capabilities on the client device and programs, with the client device, discovered hardware accelerators on the client device with encryption files and use the discovered RDMA capable devices to securely transfer a number of image files over a network from a remote computing device.

[0014] As used in the present specification and in the appended claims, the term "a number of" or similar language is meant to be understood broadly as any positive number comprising 1 to infinity.

[0015] In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the present systems and methods. It will be apparent, however, to one skilled in the art that the present apparatus, systems and methods may be practiced without these specific details. Reference in the specification to "an example" or similar language means that a particular feature, structure, or characteristic described in connection with that example is included as described, but may not be included in other examples.

[0016] Fig. 1 is a block diagram of a client device (105) to securely transfer an image file over a network according to one example of the principles described herein. The client device (105) may include a hardware accelerator library (1 10) comprising a number of encryption libraries and/or files (1 15), a discovery module (120), a download module (130), a number of hardware accelerators (135), and a remote direct memory access (RDMA) capable device (125). The client device (105) may allow a user to access and download large image files in a pre-boot environment and subsequently create bootable devices inside the client device (105). The client device (105) allows a user to access the large image files securely and quickly while, in one example, transferring the image files directly to or from application memory in a remote computing device (145) such as a server using the RDMA capable devices (125).

[0017] The client device (105) may be implemented in a computing device. Examples of computing devices include servers, desktop computers, laptop computers, personal digital assistants (PDAs), mobile devices, smartphones, gaming systems, and tablets, among other computing devices. The client device (105) may be utilized in any data processing scenario including, stand-alone hardware, mobile applications, through a computing network, or combinations thereof. Further, the client device (105) may be used in a computing network, a public cloud network, a private cloud network, a hybrid cloud network, other forms of networks, or combinations thereof. In one example, the methods provided by the client device (105) are provided as a service over a network by, for example, a third party. In this example, the service may include, for example, the following: a Software as a Service (SaaS) hosting a number of applications; a Platform as a Service (PaaS) hosting a computing platform comprising, for example, operating systems, hardware, and storage, among others; an Infrastructure as a Service (laaS) hosting equipment such as, for example, servers, storage components, network, and components, among others; application program interface (API) as a service (APIaaS), other forms of network services, or combinations thereof. The present systems and devices may be implemented on one or multiple hardware platforms, in which the modules in the client device (105) can be executed on one or across multiple platforms. Such modules can run on various forms of cloud

technologies and hybrid cloud technologies or offered as a SaaS (Software as a service) that can be implemented on or off the cloud. In another example, the methods provided by the client device (105) are executed by a local

administrator with, for example, a remote administrator computing device.

[0018] To achieve its desired functionality, the client device (105) includes various hardware components. Among these hardware components may be a number of processors a number of data storage devices, a number of peripheral device adapters, and a number of network adapters. These hardware components may be interconnected through the use of a number of busses and/or network connections. In one example, the processor, data storage device, peripheral device adapters, and a network adapter may be communicatively coupled via a bus.

[0019] The client device (105) may include a hardware accelerator library (1 10) comprising a number of encryption files (1 15). In one example, the hardware accelerator library (1 10) along with the encryption files (1 15) may be maintained on a storage device such as Random Access Memory (RAM), Read Only Memory (ROM), and Hard Disk Drive (HDD) memory. Each of the encryption files (1 15) may be designed to work on a hardware accelerator (135). As will be described in more detail below, the hardware accelerator (135) may be programed using at least one encryption file (1 15) to, in a pre-boot environment on the client device (105), encrypt and/or decrypt messages and files from a remote computing device (145) such as a server hosting a number of image files. In one example, the hardware accelerator library (1 10) may include encryption files (1 15) written in OpenCL. OpenCL is a framework for writing programs that execute across heterogeneous platforms consisting of central processing units (CPUs), graphics processing units (GPUs), digital signal processors (DSPs), field-programmable gate arrays (FPGAs) and other processors and includes a language for programming these devices, and application programming interfaces (APIs) to control the platform and execute programs on the compute devices. In one example, the hardware accelerator (135) is a field programmable gate array that includes an array of

programmable logic blocks, and a hierarchy of reconfigurable interconnects that allow the blocks to be wired together in various configurations. The

programming of the FPGA may be accomplished via a processor associated with the client device (105) using the encryption files (1 15) stored on the hardware accelerator library (1 10). These programmed FPGAs may then be seen by the client device (105) as separate modules executed by a processor that provide additional driver-type functionality during a booting process.

[0020] The hardware accelerator library (1 10) may further comprise compression files to compress a number of files in order to efficiently transfer those files over the network (140). In this example, a hardware accelerator (135) may be programmed by a processor with the compression files so that the client device (105) and/or the remote computing device (145) may compress relatively large files such as ISO image files. The hardware accelerator library (1 10) may further comprise decompression files to decompress a number of files received over the network (140). Similarly, a hardware accelerator (135) may be programmed by a processor with the decompression files so that the client device (105) and/or the remote computing device (145) may decompress files received over the network.

[0021] The client device (105) may further include a discovery module (120). The discovery module (120) may discover hardware accelerators (135) as well as input/output (IO) devices having RDMA capable device (125) within the client device (105) and other computing devices such as the remote computing device (145) communicatively coupled to the same network the client device (105) is coupled to. As briefly described above, during booting of the client device (105) a basic input/output system (BIOS) may load a number of the programmed hardware accelerators (135) to provide additional functionality. In one example, the hardware accelerator (135) may be programmed using an encryption file (1 15) such that, during a booting process, the BIOS will load the programmed hardware accelerator (135) to securely transfer image files from a remote computing device (145) to the client device (105). Therefore, when a secure download protocol such as simple file transfer protocol (SFTP) or hypertext transfer protocol secure (HTTPS) boot is enabled, the BIOS deploys an encryption module on a programmable hardware accelerator (135) such as FPGA based on configured ciphers.

[0022] The discovery module (120) may further determine whether RDMA capable devices (125) are present on the client device (105) as well as, in one example, present on a remote computing device (145) from which the image files are to be retrieved. If the discovery module (120) discovers RDMA capable devices (125) (i.e., Ethernet with RDMA capability), the BIOS of the client device (105) may install additional drivers as a programed hardware accelerator (135) or as a software driver to use the RDMA capability of any IO cards, for example, during data transfer of image files from a remote computing device (145).

[0023] The client device (105) may further include a download module (130). The download module (130) may initiate the programing of any discovered hardware accelerators on the client device with the encryption files as well as use the discovered RDMA capable devices to securely transfer a number of image files over a network from a remote computing device (145). When a client device (105) boots and attempts to securely download image files from a remote computing device (145), the BIOS of the client device (105) may run the discovery module (120) in order to detect those hardware accelerator (135) and RDMA capable devices (125). If a programmable hardware accelerator (135) is discovered, the BIOS may program the hardware accelerator (135) such as the FPGA with encryption files (1 15), thereby enabling hardware based encryption/decryption capability in the server. This allows for a relatively faster way of transferring encrypted data such as the image files to and from the client device (105).

[0024] As part of an initial exchange of messages between the client device (105) attempting to boot and the remote computing device (145), where the remote computing device (145) is discovered to have an RDMA hosted image or RDMA capability, the remote computing device (145) may load a number of RDMA drivers and use an RDMA protocol to transfer data from/to the remote computing device (145). The image files on the remote computing device (145) may be in-memory or hosted using an image manager.

[0025] The use of the hardware accelerators (135) and RDMA capable devices (125) and technology in a pre-boot environment of the client device (105) improves latency and performance for image file download and deployment on the client device (105). Based on the capability and location of the hardware accelerators (135), further optimizations can be completed by directly mapping memory containing encrypted output from the hardware accelerators (135) to a memory associated with the RDMA capable devices (125). This allows for zero copy implementations by eliminating the need to copy data between any application memories and, for example, data buffers in the client device (105). On client devices (105) with persistent memory, the received image file from the remote computing device (145) may be stored in non-volatile random-access memory (NVRAM) and the BIOS can be enhanced to dynamically create and add a new block bootable device using the retrieved image files. Consequently, this provides for an automated, fast, and secure deployment solution with no user intervention. Other examples of non-volatile memory may be used including, but not limited to non-volatile dual in-line memory module (NVDIMM), read-only memory, flash memory, ferroelectric RAM, hard disk drives, optical disks.

[0026] Fig. 2 is a block diagram of a client device to securely transfer an image file over a network according to another example of the principles described herein. The client device (105) may include a hardware accelerator library (1 10) comprising a number of encryption files, a discovery module (120), a download module (130), a number of hardware accelerators (135), and a remote direct memory access (RDMA) capable device (125) as described in connection with Fig. 1. Additionally, the client device (105) may include a processor (205), a data storage device (210), and a peripheral device adapter (215).

[0027] The processor (205) may include the hardware architecture to retrieve executable code from the data storage device (210) and execute the executable code. The executable code may, when executed by the processor (205), cause the processor (205) to implement at least the functionality of discovering programmable hardware accelerators and input/output (10) devices with remote direct memory access (RDMA) capable devices on the client device and initiating the programing of the discovered hardware accelerators on the client device with the encryption files and use the discovered RDMA devices to securely transfer a number of image files over a network from a remote computing device according to the methods of the present specification described herein. In the course of executing code, the processor (205) may receive input from and provide output to a number of the remaining hardware units.

[0028] The data storage device (210) may store data such as executable program code that is executed by the processor (205) or other processing device. As will be discussed, the data storage device (210) may specifically store computer code representing a number of applications that the processor (205) executes to implement at least the functionality described herein.

[0029] The data storage device (210) may include various types of memory modules, including volatile and nonvolatile memory. For example, the data storage device (210) of the present example includes Random Access Memory (RAM), Read Only Memory (ROM), and Hard Disk Drive (HDD) memory. Many other types of memory may also be utilized, and the present specification contemplates the use of many varying type(s) of memory in the data storage device (210) as may suit a particular application of the principles described herein. In certain examples, different types of memory in the data storage device (210) may be used for different data storage needs. For example, in certain examples the processor (205) may boot from Read Only Memory (ROM), maintain nonvolatile storage in the Hard Disk Drive (HDD) memory, and execute program code stored in Random Access Memory (RAM).

[0030] Generally, the data storage device (210) may include a computer readable medium, a computer readable storage medium, or a non- transitory computer readable medium, among others. For example, the data storage device (210) may be, but not limited to a system, apparatus, or device implementing electronic, magnetic, optical, electromagnetic, infrared, or semiconductor principles, or any suitable combination of the foregoing. More specific examples of the computer readable storage medium may include, for example, the following: an electrical connection having a number of wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a portable compact disc read-only memory (CD- ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer readable storage medium may be any tangible medium that can contain, or store computer usable program code for use by or in connection with an instruction execution system, apparatus, or device. In another example, a computer readable storage medium may be any non-transitory medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.

[0031] The peripheral device adapter (215) in the client device (105) enables the processor (205) to interface with various other hardware elements, external and internal to the client device (105). For example, the peripheral device adapters (215) may provide an interface to input/output devices, such as, for example, display device, a mouse, or a keyboard. The peripheral device adapter (215) may also provide access to other external devices such as an external storage device, a number of network devices such as, for example, servers, switches, and routers, client devices, other types of computing devices, and combinations thereof.

[0032] The client device (105) further comprises a number of modules used in the implementation of the method described herein. The various modules within the client device (105) comprise executable program code that may be executed separately. In this example, the various modules may be stored as separate computer program products. In another example, the various modules within the client device (105) may be combined within a number of computer program products; each computer program product comprising a number of the modules.

[0033] As described above, the hardware accelerator library (1 10) may further comprise compression files (220) and decompression files (225). As described above, the compression files (220) and decompression files (225) may be used by the processor (205) to program, a number of hardware accelerators (135). This may be done so as compress and decompress, respectively, files transferred over the network (140). This allows the client device (105) to transfer relatively large files to and from the remote computing device (145) in a relatively more efficient manner.

[0034] Fig. 3 is a block diagram of a system (300) for securely transferring an image file over a network according to one example of the principles described herein. As described above, the client device (105) may be communicatively coupled to a remote computing device (305). The remote computing device (305) may be any type of computing device including servers, desktop computers, laptop computers, personal digital assistants (PDAs), mobile devices, smartphones, gaming systems, and tablets, among other computing devices. In one example, the remote computing device (305) is a server used by a number of client devices (105) as a source of image files (310) for those client devices (105). Similar to the client device (105), the remote computing device (305) may also comprise a RDMA capable device (315) used to securely transfer a number of image files over a network.

[0035] During operation, the client device (105) may initially send a request to the remote computing device (305) requesting an image file such as an ISO, a Disk Golden Image, or other images hosted by the remote computing device (305). The initial request, as well as all other communications, may be encrypted using the programmed hardware accelerators (135) as described above. Each of the client device (105) and remote computing device (305) may comprise an encryption and/or decryption module that can receive encrypted messages and decrypt those messages.

[0036] The client device (105) may also, through the discovery module (120) determine whether an RDMA capable devices (125, 315) are present in the client device (105) and remote computing device (305). If either the client device (105) or remote computing device (305) do not include an RDMA capable device (125, 315), when the client device (105) requests the image files (310) from the remote computing device (305), the remote computing device (305) may copy the image to a buffer for delivery to the client device (105). Where both the client device (105) and remote computing device (305) comprise RDMA capable devices (125, 315), the image file (310) is sent to the client device (105) without involving either devices (105, 305) operating system thereby eliminating the need to copy data between application memory and the data buffers in an operating system of either the client device (105) or remote computing device (305).

[0037] Upon request by the client device (105) and verification by the remote computing device (305), an image file (310) hosted on the remote computing device (305) may be sent to the client device (105). The remote computing device (305) may maintain the image files on a buffer or other volatile or non-volatile memory devices. Based on the capability and location of the hardware accelerators (135) further optimizations may be done by directly mapping memory containing encrypted output from hardware accelerators (135) to the RDMA capable devices (125, 315) for zero copy implementations.

[0038] Once it has received the image file (310), the client device (105) may buffer the image file (310) in a buffer (320). In one example, the received image file (310) from the remote computing device (305) may be stored in a storage device (325) such as non-volatile random-access memory (NVRAM) or another type of data storage device such as disk storage and the BIOS of the client device (105) may be enhanced to dynamically create and add a new block bootable device using the retrieved image file (310).

[0039] Fig. 4 is a flowchart showing a method (400) of securely transferring an image file over a network according to one example of the principles described herein. The method (400) may begin with discovering (405), with a discovery module (120) on a client device (105), programmable hardware accelerators (135) and input/output (IO) devices (125) with remote direct memory access (RDMA) capabilities on the client device (105). As described above, the hardware accelerators (135) may be programmed via a processor (205) with a number of encryption files (1 15). The programmed hardware accelerators (135) may act as drivers during a boot process of the client device (105) to be used to encrypt messages sent to and decrypt messages received from a remote computing device (305). The RDMA capable devices (125, 315) are discovered in order to streamline the delivery of an image file (310) to the client device (105).

[0040] The method (400) may continue by programing (410), with the client device, discovered hardware accelerators on the client device with encryption files and use the discovered RDMA capable devices to securely transfer a number of image files (310) over a network (140) from a remote computing device (305).

[0041] Fig. 5 is a flowchart showing a method (500) of securely transferring an image file over a network according to another example of the principles described herein. As described above, the method (500) may begin with discovering (505), with a discovery module (120) on a client device (105), programmable hardware accelerators (135) and input/output (IO) devices (125) with remote direct memory access (RDMA) capabilities on the client device (105). The method (500) may continue with programing (510), with the client device, discovered hardware accelerators on the client device with encryption files and use the discovered RDMA capable devices to securely transfer a number of image files (310) over a network (140) from a remote computing device (305). This method (500) of Fig. 5 may further include storing (515) the image files in a persistent memory to create bootable images from transferred image files. In one example, the persistent memory may include a non-volatile dual in-line memory module (NVDIMM) that retains the image files as well as other data on the client device when electrical power is removed from the client device.

[0042] Aspects of the present system and method are described herein with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to examples of the principles described herein. Each block of the flowchart illustrations and block diagrams, and combinations of blocks in the flowchart illustrations and block diagrams, may be implemented by computer usable program code. The computer usable program code may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the computer usable program code, when executed via, for example, the processor (205) of the client device (105) or other programmable data processing apparatus, implement the functions or acts specified in the flowchart and/or block diagram block or blocks. In one example, the computer usable program code may be embodied within a computer readable storage medium; the computer readable storage medium being part of the computer program product. In one example, the computer readable storage medium is a non- transitory computer readable medium.

[0043] The specification and figures describe a computing device and method of securely transferring an image file over a network. This computing device and method may provide a fast and secure method of downloading large images such as ISOs that is completely application independent. The use of intelligent discovery, dynamic enablement of hardware based encryption capability and RDMA data transfer in a pre-boot environment provides for a very fast and secure method and device for downloading large images. The ability to securely create and add persistent bootable block devices on the fly using server NVRAM may provide for many common deployment and recovery operations. Additionally, the device and method may provide for faster deployment and secure remote boot.

[0044] The preceding description has been presented to illustrate and describe examples of the principles described. This description is not intended to be exhaustive or to limit these principles to any precise form disclosed. Many modifications and variations are possible in light of the above teaching.

Claims

CLAIMS WHAT IS CLAIMED IS:

1. A client device to transfer an image file over a network comprising:

a hardware accelerator library to maintain a number of encryption files compatible with programmable hardware accelerators on the client device; a discovery module to discover the programmable hardware accelerators and input/output (IO) devices with remote direct memory access (RDMA) capable devices on the client device; and

a download module to initiate the programing of the discovered hardware accelerators on the client device with the encryption files and use the discovered RDMA devices to securely transfer a number of image files over a network from a remote computing device.

2. The client device of claim 1 , wherein the encryption files within the hardware accelerator library are written in OpenCL.

3. The client device of claim 2, wherein the programmable hardware accelerators are field-programmable gate arrays (FPGAs) that are executed in a pre-boot environment on the client device.

4. The client device of claim 3, wherein the FPGA is programed within a basic input/output system (BIOS) of the client device.

5. The client device of claim 1 , wherein, during booting of the client device, the discovery module is loaded from a basic input/output system (BIOS) of the client device.

6. The client device of claim 1 , wherein the client device determines whether the remote computing device comprises a RDMA device.

7. The client device of claim 6, wherein, upon discovery of the RDMA device in the remote computing device, the client device securely sends an initial transfer message to the remote computing device requesting that the number of image files be transferred to the client device using the RDMA device.

8. A method of transferring an image file over a network, comprising:

discovering, with a discovery module on a client device, programmable hardware accelerators and input/output (10) devices with remote direct memory access (RDMA) capabilities on the client device; and

programming, with the client device, discovered hardware accelerators on the client device with encryption files and using the discovered RDMA capable devices to securely transfer a number of image files over a network from a remote computing device.

9. The method of claim 8, wherein the encryption files are maintained on a hardware accelerator library on the client device.

10. The method of claim 9, wherein the discovery module of the client device determines whether the remote computing device comprises a RDMA device.

1 1 . The method of claim 10, wherein upon discovery of the RDMA device in the remote computing device, the client device sends an initial transfer message to the remote computing device requesting that the number of image files be transferred to the client device using the RDMA device.

12. A computer program product for transferring data files over a network, the computer program product comprising:

a computer readable storage medium comprising computer usable program code embodied therewith, the computer usable program code that, when executed by a processor: discovers, with a discovery module on a client device, programmable hardware accelerators and input/output (10) devices with remote direct memory access (RDMA) capabilities on the client device; and

programs, with the client device, discovered hardware accelerators on the client device with encryption files and uses the discovered RDMA capable devices to securely transfer a number of image files over a network from a remote computing device.

13. The computer program product of claim 12, further comprising computer usable program code that, when executed by a processor, programs the hardware accelerators within a basic input/output system (BIOS) of the client device.

14. The computer program product of claim 12, further comprising computer usable program code that, when executed by a processor, loads the download module as part of a basic input/output system (BIOS) of the client device.

15. The computer program product of claim 12, further comprising computer usable program code that, when executed by a processor, determines whether the remote computing device comprises a RDMA device.