US 11,943,340 B2
Process-to-process secure data movement in network functions virtualization infrastructures
Bo Cui, Shanghai (CN); Cunming Liang, Shanghai (CN); Jr-Shian Tsai, Portland, OR (US); Ping Yu, Shanghai (CN); Xiaobing Qian, Changning (CN); Xuekun Hu, Shanghai (CN); Lin Luo, Shanghai (CN); Shravan Nagraj, Bengaluru (IN); Xiaowen Zhang, Shanghai (CN); Mesut A. Ergin, Portland, OR (US); Tsung-Yuan C. Tai, Portland, OR (US); and Andrew J. Herdrich, Hillsboro, OR (US)
Assigned to Intel Corporation, Santa Clara, CA (US)
Appl. No. 17/437,342
Filed by Intel Corporation, Santa Clara, CA (US)
PCT Filed Apr. 19, 2019, PCT No. PCT/CN2019/083396
§ 371(c)(1), (2) Date Sep. 8, 2021,
PCT Pub. No. WO2020/211071, PCT Pub. Date Oct. 22, 2020.
Prior Publication US 2022/0150055 A1, May 12, 2022
Int. Cl. H04L 9/06 (2006.01); G06F 21/33 (2013.01); G06F 21/72 (2013.01); G06F 21/78 (2013.01); H04L 9/08 (2006.01); H04L 9/40 (2022.01)
CPC H04L 9/0825 (2013.01) [H04L 9/0631 (2013.01); H04L 9/085 (2013.01); H04L 63/0236 (2013.01)] 21 Claims
OG exemplary drawing
 
1. An apparatus for process-to-process communication in network functions virtualization (NFV) infrastructures, the apparatus comprising:
a memory; and
at least one processor comprising a memory controller and a crypto circuitry, the at least one processor to:
execute a first network function within a virtual machine;
execute a second network function within a second virtual machine;
provide a virtual channel for communication between the first network function and the second network function, wherein the first network function is to perform one or more of: next destination determination, routing, firewall, Intrusion detection systems (IDS), intrusion prevention systems (IPS), gateway general packet radio service support node (GGSN), serving general packet radio service support node (SGSN), Radio Network Controller (RNC), or Evolved Packet Core (EPC) and wherein the second network function is to perform one or more of: next destination determination, routing, firewall, IDS, IPS, GGSN, SGSN, RNC, or EPC; and
in response to the first network function requesting a copy of data for access by the second network function, the at least one processor is to copy the data without modification to an intermediate buffer, store a reference to a key for the data, and copy the data from the intermediate buffer to a destination buffer by use of the crypto circuitry to decrypt the data based on the key and encrypt the data prior to storage in a destination buffer accessible to the second network function, wherein the copied data comprises data processed by the first network function.