1. A method for managing one or more secure gateway virtual private network, VPN, devices in a secure VPN for cryptographically separated and tunnelled VPN communication, the method comprising:
receiving (401) VPN configuration data provided by a management system; and
encapsulating the received VPN configuration data and a domain type forming one or more data packets, said domain type identifying an administrative network domain for cryptographically separated and tunnelled management communication with a hardware separated administrative controller of said one or more secure gateway VPN devices, exclusively for management of said one or more secure gateway VPN devices by means of said VPN configuration data.
2. The method of claim 1, further comprising:
establishing the cryptographically separated and tunnelled management communication with the hardware separated administrative controller of said one or more secure gateway VPN devices; and
communicating (404) the data packets including the encapsulated VPN configuration data and domain type to the hardware separated administrative controller of said one or more of the secure gateway VPN devices by means of the cryptographically separated and tunnelled management communication over a virtual administrative network defining the administrative network domain for management of the one or more of the secure gateway VPN devices according to the VPN configuration data.
3. The method of claim 1, wherein encapsulating the received VPN configuration data and the domain type comprises: preparing data packets including a data filed with the VPN configuration data, a domain type identifying the administrative network domain, a header filed with a header and a trailer filed with a trailer.
4. The method of claim 1, wherein encapsulating the received VPN configuration data and the domain type further comprises: protecting the integrity of the VPN configuration data and the domain type.
5. The method of claim 4, wherein protecting the integrity of the VPN configuration data and the domain type further comprises: generating a digital signature of the data packets using certificates.
6. The method of claim 4, wherein protecting the integrity of the VPN configuration data and the domain type further comprises:
calculating a hash value of the VPN configuration data and the domain type; and
encrypting the domain type, the VPN configuration data, and the hash value filed by using a secret key.
7. The method of claim 6, further comprising: preparing data packets including a Key ID field indicating to the receiving secure gateway VPN device which key to be used for decryption.
8. The method of claim 4, wherein protecting the integrity of the VPN configuration data and the domain type further comprises:
calculating a keyed hash value of the VPN configuration data and the domain type; and
encrypting the VPN configuration data and the domain type by using a secret key.
9. A method for managing secure gateway virtual private network, VPN, devices in a secure VPN for cryptographically separated and tunnelled VPN communication, the method comprising:
receiving data packets comprising encapsulated VPN configuration data and a domain type, said domain type identifying an administrative network domain for cryptographically separated and tunnelled management communication with a hardware separated administrative controller of said one or more secure gateway VPN devices, exclusively for management of one or more secure gateway VPN devices;
extracting the VPN configuration data and the domain type from the data packets;
identifying the domain type;
if the domain type is identified to be the administrative network domain, configuring the one or more secure gateway VPN devices according to the received VPN configuration data.
10. An administration gateway device for managing one or more secure gateway virtual private network, VPN, devices in a secure VPN for cryptographically separated and tunnelled VPN communication, the administration gateway comprising:
a first communication interface adapted to receive VPN configuration data provided by a management system; and
an administrative gateway controller operatively connected to the first communication interface and a second communication interface, wherein the administrative gateway controller is adapted to:
encapsulate the received VPN configuration data and a domain type, said domain type identifying an administrative network domain for cryptographically separated and tunnelled management communication with a hardware separated administrative controller of said one or more secure gateway VPN devices, exclusively for management of said one or more secure gateway VPN devices by means of the VPN configuration data.
11. The administration gateway device of claim 10, wherein the administrative gateway controller is operatively connected to a second communication interface and is further adapted to establish the cryptographically separated and tunnelled management communication with the hardware separated administrative controller of said one or more secure gateway VPN devices; and
the second communication interface is adapted to communicate the encapsulated VPN configuration data and domain type to the hardware separated administrative controller of said one or more of the secure gateway VPN devices by means of the cryptographically separated and tunnelled management communication over a virtual administrative network (106) defining the administrative network domain exclusively for management of the one or more of the secure gateway VPN devices according to the VPN configuration data.
12. A secure gateway virtual private network, VPN, device for cryptographically separated and tunnelled VPN communication comprising:
a first communication interface adapted to receive data packets comprising encapsulated VPN configuration data and a domain type, said domain type identifying an administrative network domain for cryptographically separated and tunnelled management communication, via the cryptographically separated and tunnelled management communication separate from said cryptographically separated and tunnelled VPN communication, exclusively for management of the secure gateway VPN device by means of the VPN configuration data;
a hardware separated administrative controller operatively connected to the first communication interface and adapted to:
identify only the administrative network domain and to only extract configuration data from data packets of the administrative network domain; and
configure the secure gateway VPN device according to the received VPN configuration data, if the domain type is an administrative network domain.
13. The secure gateway virtual private network, VPN, device according to claim 12, comprising a plain text side controller operatively connected to the first communication interface and adapted to only identify plain text data packets of a red domain received by the first communication interface and forward the data packets to a red network via a red communication interface of the secure gateway VPN device, wherein data packets of any other domain type than the red domain are blocked.
14. The secure gateway virtual private network, VPN, device according to claim 12, wherein the encapsulated VPN configuration data and the domain type forming data packets including a data filed with the VPN configuration data, a domain type identifying the administrative network domain, a header filed with a header and a trailer filed with a trailer.
15. The secure gateway virtual private network, VPN, device according to claim 12, wherein the received VPN configuration data and the domain type forming data packets protecting the integrity of the VPN configuration data and the domain type.
16. The secure gateway virtual private network, VPN, device according to claim 12, wherein the integrity of the VPN configuration data and the domain type is protected by a digital signature of the data packets using certificates.
17. The secure gateway virtual private network, VPN, device according to claim 12, wherein the integrity of the VPN configuration data and the domain type is protected by a hash value calculated of the VPN configuration data and the domain type; and wherein the domain type, the VPN configuration data, and the hash value filed are encrypted by means of a secret key and forming part of the data packets.
18. The secure gateway virtual private network, VPN, device according to claim 17, wherein the data packets comprises a Key ID field indicating to the receiving secure gateway VPN device which key to be used for decryption.
19. The secure gateway virtual private network, VPN, device according to claim 12, wherein the integrity of the VPN configuration data and the domain type is protected by a keyed hash value of the VPN configuration data and the domain type; and the PN configuration data and the domain type are encrypted by means of a secret key.
20. A computer program comprising program instructions for causing a computer to perform the method of claim 1, when said program is run on a computer.
21. A computer program on a carrier and comprising computer executable instructions for causing a computer to perform the method according to claim 1, when said program is run on a computer.
22. The computer program according to claim 21, wherein said carrier is a record medium, computer memory, read-only memory, computer-readable medium or an electrical carrier signal.
23. A computer program product comprising a computer-readable medium, having thereon: computer program code means, when said program is loaded, to make the computer execute the method of claim 1.
The claims below are in addition to those above.
All refrences to claim(s) which appear below refer to the numbering after this setence.
1. A computer-implemented method, comprising:
assigning a respective set of barycentric coordinates to each of three vertices of a triangle, wherein the triangle comprises a control triangle for a quadratic B\xe9zier curve, and wherein each set of barycentric coordinates comprises three values; and
rendering the quadratic B\xe9zier curve using a graphics processing unit (GPU), wherein the rendering comprises evaluating a function of the barycentric coordinates.
2. The method as recited in claim 1, wherein the quadratic B\xe9zier curve is a rational quadratic B\xe9zier curve.
3. The method as recited in claim 1, further comprising:
sending to the GPU only two of the three values in the set of barycentric coordinates for each corresponding vertex of the triangle.
4. The method as recited in claim 1, further comprising:
determining a set of barycentric coordinates for each of a plurality of points on edges of the triangle and within the triangle, wherein the determining comprises interpolating between the sets of barycentric coordinates assigned to the three vertices of the triangle.
5. The method as recited in claim 1, wherein rendering the quadratic B\xe9zier curve using the GPU comprises evaluating the function of the barycentric coordinates to determine whether each point in the triangle lies above or below the quadratic B\xe9zier curve.
6. The method as recited in claim 1, wherein the function of the barycentric coordinates is evaluated in a pixel shader.
7. The method as recited in claim 1, wherein assigning the set of barycentric coordinates to each of the three vertices of the triangle comprises:
assigning a first set of barycentric coordinates (1,0,0) to a first vertex of the three vertices;
assigning a second set of barycentric coordinates (0,1,0) to a second vertex of the three vertices; and
assigning a third set of barycentric coordinates (0,0,1) to a third vertex of the three vertices.
8. The method as recited in claim 1, further comprising:
determining an integer representing each set of barycentric coordinates as a type of the corresponding vertex, wherein the integer comprises an index into a global array which stores a plurality of vertex parameters;
sending the integer representing each set of barycentric coordinates to the GPU as a texture parameter associated with the corresponding vertex of the triangle.
9. A computer-readable storage medium, comprising program instructions, wherein the program instructions are computer-executable to implement:
assigning a respective set of barycentric coordinates to each of three vertices of a triangle, wherein the triangle comprises a control triangle for a quadratic B\xe9zier curve, and wherein each set of barycentric coordinates comprises three values; and
rendering the quadratic B\xe9zier curve using a graphics processing unit (GPU), wherein the rendering comprises evaluating a function of the barycentric coordinates.
10. The computer-readable storage medium as recited in claim 9, wherein the quadratic B\xe9zier curve is a rational quadratic B\xe9zier curve.
11. The computer-readable storage medium as recited in claim 9, wherein the program instructions are computer-executable to implement:
sending to the GPU only two of the three values in the set of barycentric coordinates for each corresponding vertex of the triangle.
12. The computer-readable storage medium as recited in claim 9, wherein the program instructions are computer-executable to implement:
determining a set of barycentric coordinates for each of a plurality of points on edges of the triangle and within the triangle, wherein the determining comprises interpolating between the sets of barycentric coordinates assigned to the three vertices of the triangle.
13. The computer-readable storage medium as recited in claim 9, wherein rendering the quadratic B\xe9zier curve using the GPU comprises evaluating the function of the barycentric coordinates to determine whether each point in the triangle lies above or below the quadratic B\xe9zier curve.
14. The computer-readable storage medium as recited in claim 9, wherein the function of the barycentric coordinates is evaluated in a pixel shader.
15. The computer-readable storage medium as recited in claim 9, wherein assigning the set of barycentric coordinates to each of the three vertices of the triangle comprises:
assigning a first set of barycentric coordinates (1,0,0) to a first vertex of the three vertices;
assigning a second set of barycentric coordinates (0,1,0) to a second vertex of the three vertices; and
assigning a third set of barycentric coordinates (0,0,1) to a third vertex of the three vertices.
16. The computer-readable storage medium as recited in claim 9, wherein the program instructions are computer-executable to implement:
determining an integer representing each set of barycentric coordinates as a type of the corresponding vertex, wherein the integer comprises an index into a global array which stores a plurality of vertex parameters;
sending the integer representing each set of barycentric coordinates to the GPU as a texture parameter associated with the corresponding vertex of the triangle.
17. A system, comprising:
at least one processor;
a memory coupled to the at least one processor, wherein the memory is configured to store program instructions executable by the at least one processor to assign a respective set of barycentric coordinates to each of three vertices of a triangle, wherein the triangle comprises a control triangle for a quadratic B\xe9zier curve, and wherein each set of barycentric coordinates comprises three values; and
a graphics processing unit (GPU) coupled to the at least one processor, wherein the GPU is executable to render the quadratic B\xe9zier curve, wherein the rendering comprises evaluating a function of the barycentric coordinates.
18. The system as recited in claim 17, wherein the quadratic B\xe9zier curve is a rational quadratic B\xe9zier curve.
19. The system as recited in claim 17, wherein the program instructions are further executable by the at least one processor to:
send to the GPU only two of the three values in the set of barycentric coordinates for each corresponding vertex of the triangle.
20. The system as recited in claim 17, wherein the GPU is further executable to:
determine a set of barycentric coordinates for each of a plurality of points on edges of the triangle and within the triangle, wherein the determining comprises interpolating between the sets of barycentric coordinates assigned to the three vertices of the triangle.
21. The system as recited in claim 17, wherein, in rendering the quadratic B\xe9zier curve, the GPU is executable to evaluate the function of the barycentric coordinates to determine whether each point in the triangle lies above or below the quadratic B\xe9zier curve.
22. The system as recited in claim 17, wherein the function of the barycentric coordinates is evaluated in a pixel shader.
23. The system as recited in claim 17, wherein, in assigning the set of barycentric coordinates to each of the three vertices of the triangle, the program instructions are executable by the at least one processor to:
assign a first set of barycentric coordinates (1,0,0) to a first vertex of the three vertices;
assign a second set of barycentric coordinates (0,1,0) to a second vertex of the three vertices; and
assign a third set of barycentric coordinates (0,0,1) to a third vertex of the three vertices.
24. The system as recited in claim 17, wherein the program instructions are further executable by the at least one processor to:
determine an integer representing each set of barycentric coordinates as a type of the corresponding vertex, wherein the integer comprises an index into a global array which stores a plurality of vertex parameters;
send the integer representing each set of barycentric coordinates to the GPU as a texture parameter associated with the corresponding vertex of the triangle.