Method for performing RDMA (Remote Direct Memory Access) operation by safely using inter-bus domain RNIC (Radio Network Interface Controller) equipment

Abstract

The invention discloses a method for safely using a cross-bus domain RNIC device to carry out RDMA operation, and the method comprises the steps: obtaining transmission data between a device borrower bus and a virtualized RNIC device after entering a safe task operation state; if the transmission data is application data for RDMA transmission, a specific communication key is obtained, the communication key is independent of a communication key for data transmission between an equipment lender bus and an equipment borrowing bus, and the application data for RDMA transmission comprises memory data for memory registration; and based on the specific communication key, performing security enhancement processing on the application data subjected to RDMA transmission, the security enhancement processing being independent of communication security processing between an equipment lender bus and an equipment borrower bus. According to the invention, through security enhancement processing, the security of data in the process that the equipment borrower uses the virtual RNIC equipment to carry out the RDMA operation can be ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of device virtualization, and in particular to a method for safely using a cross-bus domain RNIC device to perform RDMA operations. Background Art

[0002] In the prior art, the problem of the device borrower's safe use of the virtualized device is solved. Specifically, under the premise that the device borrower itself is safe, the interactive data between the device borrower and the virtualized device can be guaranteed to be safe, and the virtualized device can also be guaranteed not to be illegally accessed by other unauthorized devices. In the prior art, the data actually used by the virtualized device is all in plain text. There is no security problem in devices like GPUs that provide computing power but do not store persistent data. However, for RNIC devices, its purpose is to directly exchange data with the outside through the RDMA operation mode, that is, the data transmitted by this method during RDMA is also in plain text, and the security of the data during transmission cannot be guaranteed.

[0003] Therefore, the prior art still needs to be improved and enhanced. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide a method for safely using a cross-bus domain RNIC device to perform RDMA operations in view of the above-mentioned defects of the prior art. The technical solution adopted by the present invention is as follows:

[0005] In a first aspect, the present invention provides a method for securely using a cross-bus domain RNIC device to perform RDMA operations, wherein the method comprises:

[0006] After entering the running safety task state, the transmission data between the device borrower bus and the virtualized RNIC device is obtained;

[0007] If the transmission data is application data for RDMA transmission, a specific communication key is obtained, the communication key is independent of the communication key for data transmission between the device lender bus and the device borrower bus, and the application data for RDMA transmission includes memory data that has been registered in memory;

[0008] Based on the specific communication key, security enhancement processing is performed on the application data that is subjected to RDMA transmission, and the security enhancement processing is independent of the communication security processing between the device lender bus and the device borrower bus.

[0009] In one implementation, the method further includes:

[0010] A security enhancement address area is set in the control bridge, and the security enhancement address area is used to trigger the security enhancement process.

[0011] In one implementation, the security enhancement processing of the application data for RDMA transmission based on the specific communication key includes:

[0012] When the virtualized RNIC device in the device lender bus accesses the device borrower bus through the control bridge, determining whether the access address falls within the security enhanced address area in the control bridge;

[0013] If the access address falls within the security-enhanced address area in the control bridge, the control bridge performs security-enhanced processing on the application data for RDMA transmission based on the specific communication key.

[0014] In one implementation, if the access address falls within the security enhanced address area in the control bridge, the control bridge performs security enhancement processing on the application data for RDMA transmission based on the specific communication key, including:

[0015] If the access address falls within the security enhanced address area in the control bridge, the control bridge encrypts the application data for RDMA transmission input to the control bridge and decrypts the application data for RDMA transmission output from the control bridge based on the specific communication key.

[0016] In one implementation, if the access address falls within the security enhanced address area in the control bridge, the control bridge encrypts the application data for RDMA transmission input to the control bridge and decrypts the application data for RDMA transmission output from the control bridge based on the specific communication key, including:

[0017] After decrypting all data input from the device lender bus, encrypting the application data input to the control bridge for RDMA transmission based on the specific communication key;

[0018] After decrypting the application data for RDMA transmission output by the control bridge based on the specific communication key, the control bridge then encrypts all data output to the device lender bus.

[0019] In one implementation, the method further includes:

[0020] The device borrower intercepts the memory registration request of the driver of the virtual RNIC device;

[0021] The memory area that needs to be registered is registered in the security enhanced address area of ​​the control bridge, and the memory registration request is submitted after the registration is successful.

[0022] In one implementation, the method further includes:

[0023] The device borrower intercepts the memory release request of the driver of the virtual RNIC device, and after processing, unregisters the memory area that has been memory registered in the security enhanced address area of ​​the control bridge.

[0024] In a second aspect, an embodiment of the present invention provides a system for securely using a cross-bus domain RNIC device to perform RDMA operations, wherein the system is applied to the method for securely using a cross-bus domain RNIC device to perform RDMA operations described in the above scheme, and the system includes: a device borrower, a device lender, and a connection bridge, wherein the connection bridge is used to connect the buses corresponding to the device borrower and the device lender respectively;

[0025] The device lender includes the control bridge and the virtualized RNIC device, and the control bridge is used to connect the bus of the virtualized RNIC device and the device lender;

[0026] The connection bridge is used to receive access request information and forward the access request information to the bus domain of the device borrower;

[0027] Wherein, the control bridge at least includes:

[0028] The transmission data acquisition module is used to obtain the transmission data between the device borrower bus and the virtualized RNIC device after entering the running safety task state;

[0029] A specific communication key acquisition module, used for acquiring a specific communication key if the transmission data is application data for RDMA transmission, the communication key being independent of the communication key for data transmission between the device lender bus and the device borrower bus, and the application data for RDMA transmission includes memory data that has been memory registered;

[0030] The security enhancement processing module is used to perform security enhancement processing on the application data for RDMA transmission based on the specific communication key, wherein the security enhancement processing is independent of the communication security processing between the device lender bus and the device borrower bus.

[0031] In the third aspect, an embodiment of the present invention further provides a terminal, wherein the terminal includes a memory, a processor, and a program for safely using cross-bus domain RNIC devices to perform RDMA operations stored in the memory and executable on the processor, and when the processor executes the program for safely using cross-bus domain RNIC devices to perform RDMA operations, the steps of the method for safely using cross-bus domain RNIC devices to perform RDMA operations in any one of the above-mentioned schemes are implemented.

[0032] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein a program for safely using cross-bus domain RNIC devices to perform RDMA operations is stored on the computer-readable storage medium, and when the program for safely using cross-bus domain RNIC devices to perform RDMA operations is executed by a processor, the steps of the method for safely using cross-bus domain RNIC devices to perform RDMA operations described in any one of the above-mentioned schemes are implemented.

[0033] Beneficial effect: Compared with the prior art, the present invention provides a method for securely using cross-bus domain RNIC devices to perform RDMA operations. The present invention first enters the running security task state and then obtains the transmission data between the device borrower bus and the virtualized RNIC device. If the transmission data is application data for RDMA transmission, a specific communication key is obtained. The communication key is independent of the communication key for data transmission between the device lender bus and the device borrower bus. The application data for RDMA transmission includes memory data that has been registered in memory. Then, based on the specific communication key, security enhancement processing is performed on the application data for RDMA transmission. The security enhancement processing is independent of the communication security processing between the device lender bus and the device borrower bus. The present invention additionally provides a method for ensuring data security when the RNIC device performs RDMA data transmission, which can solve the data security in the process of the device borrower using the virtualized RNIC device to perform RDMA operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 A flowchart of a preferred embodiment of a method for securely using cross-bus domain RNIC devices to perform RDMA operations provided by an embodiment of the present invention.

[0035] Figure 2 A structural diagram of a system for securely using cross-bus domain RNIC devices to perform RDMA operations provided by an embodiment of the present invention.

[0036] Figure 3 A schematic diagram of RDMA in a method for securely using a cross-bus domain RNIC device to perform RDMA operations provided by an embodiment of the present invention.

[0037] Figure 4 A process diagram of RDMA transmission in a method for securely using a cross-bus domain RNIC device to perform RDMA operations provided by an embodiment of the present invention.

[0038] Figure 5 A functional block diagram of a terminal provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solution and effect of the present invention clearer and more specific, the present invention is further described in detail with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0040] It will be understood by those skilled in the art that, unless expressly stated, the singular forms "one", "said", and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present invention refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. It should be understood that when we refer to an element as being "connected" or "coupled" to another element, it may be directly connected or coupled to the other element, or there may be intermediate elements. In addition, the "connection" or "coupling" used herein may include wireless connection or wireless coupling. The term "and / or" used herein includes all or any unit and all combinations of one or more associated listed items.

[0041] It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as generally understood by those skilled in the art in the art to which the present invention belongs. It should also be understood that terms such as those defined in general dictionaries should be understood to have meanings consistent with the meanings in the context of the prior art, and will not be interpreted with idealized or overly formal meanings unless specifically defined as herein.

[0042] The present embodiment provides a method for securely using cross-bus domain RNIC devices to perform RDMA operations. The present invention first enters the running security task state and then obtains the transmission data between the device borrower bus and the virtualized RNIC device. If the transmission data is application data for RDMA transmission, a specific communication key is obtained. The communication key is independent of the communication key for data transmission between the device lender bus and the device borrower bus. The application data for RDMA transmission includes memory data that has been registered in memory. Then, based on the specific communication key, security enhancement processing is performed on the application data for RDMA transmission. The security enhancement processing is independent of the communication security processing between the device lender bus and the device borrower bus. The present invention can solve the data security in the process of the device borrower using the virtualized RNIC device to perform RDMA operations through security enhancement processing.

[0043] like Figure 1As shown, the method for securely using a cross-bus domain RNIC device to perform RDMA operations in this embodiment can be applied to a terminal or a server. When applied to a terminal, the method for securely using a cross-bus domain RNIC device to perform RDMA operations in this embodiment includes the following steps:

[0044] Step S100: after entering the running safety task state, obtaining the transmission data between the device borrower bus and the virtualized RNIC device;

[0045] Step S200: if the transmission data is application data for RDMA transmission, a specific communication key is obtained, the communication key is independent of the communication key for data transmission between the device lender bus and the device borrower bus, and the application data for RDMA transmission includes memory data that has been registered in memory;

[0046] Step S300: Based on the specific communication key, security enhancement processing is performed on the application data for RDMA transmission, and the security enhancement processing is independent of the communication security processing between the device lender bus and the device borrower bus.

[0047] In specific implementation, this embodiment provides a system for safely using cross-bus domain RNIC devices to perform RDMA operations, such as Figure 2 As shown in , the system includes: a device borrower, a device lender, a connection bridge and a control bridge. The device borrower includes a virtual RNIC device. The RNIC device in this embodiment refers to an Ethernet card device. The device lender includes a virtualized RNIC device. The connection bridge is used to connect the buses corresponding to the device borrower and the device lender respectively. The control bridge is used to connect the bus of the virtualized device and the bus of the device lender. In this embodiment, the connection bridge is a PCIe non-transparent bridge (Non-transparent Bridge), which appears as a PCIe EP (Endpoint) in the PCIe bus of the device borrower and the device lender. Of course, in other implementations, this embodiment may include two device borrowers and two device lenders, as shown in FIG. Figure 2 shown.

[0048] RDMA (such as Figure 3As shown in the figure, Remote Direct Memory Access (RDMA) is a host-offload, host-bypass technology that allows applications (including storage) to transfer data directly between their memory spaces, making low-latency, high-bandwidth direct memory-to-memory data communication possible. The Ethernet card (RNIC) with an RDMA engine, rather than the host, is responsible for managing reliable connections between the source and the target. Applications using RNIC communicate using command queues (QP and CQ). RDMA has three different hardware implementations, InfiniBand (InfiniBand), RoCE (RDMA over Ethernet, a network protocol that allows RDMA to be performed over Ethernet), and iWARP (RDMA over TCP, a network protocol that allows RDMA to be performed over TCP), but they all follow the same Verbs interface at the software protocol level. RDMA supports three queues in total, send queue (SQ), receive queue (RQ), and completion queue (CQ). Among them, SQ and RQ are usually created in pairs, called Queue Pairs (QP); RDMA is a message-based transmission protocol, and the assembly of all data packets is completed on the RDMA hardware. As Figure 4 As shown, the basic process is as follows:

[0049] a. The host submits a work request (Work Requet, WR) to the work queue (Work Queue, WQ): The work queue includes the send queue (SQ) and the receive queue (RQ). Each element of the work queue is called a WQE, which is a WR.

[0050] b. Host obtains work completion (WC) from the completion queue (CQ): Each one in the completion queue is called CQE, which is WC (Work Completion).

[0051] c. Hardware with RDMA engine is a queue element processor. RDMA hardware continuously takes work requests (WR) from work queue (WQ) to execute, and after execution, it places work completion (WC) in completion queue (CQ). From the perspective of producer-consumer, it can be understood as follows:

[0052] d. Host produces WR and puts WR into WQ

[0053] e. RDMA hardware consumption WR

[0054] f. RDMA hardware produces WC and puts WC into CQ

[0055] g. Host consumes WC.

[0056] The purpose of RDMA is to bypass the host to transfer memory data. Verbs provides MemoryRegistration to register the memory of data to be transferred. Only the memory that has been registered can be used for RDMA data transfer. The registered memory is called Memory Region (MR). RDMA data transmission includes: Send / Recv, Write, and Read.

[0057] Send / Recv: The RNIC on the sending end reads the data to be sent from the MR through RDMA according to the parameters in the WQE, packages it, and sends it to the receiving end. After receiving the message, the RNIC on the receiving end writes the received data to the MR through DMA according to the parameters in the WQE.

[0058] Write: The initiator's RNIC reads the data to be written to the other end from the WR through DMA according to the parameters in the WQE, packages it and sends it to the other end; after receiving the message, the other end's RNIC writes the data to the MR through DMA according to the parameters in the message;

[0059] Read: The initiator's RNIC assembles the data according to the parameters in the WQE and sends it to the peer end. After receiving the message, the peer end's RNIC reads the data from the MR through DMA according to the parameters in the message, assembles the data and sends it to the initiator. After receiving the message, the initiator writes the data to the MR through DMA according to the parameters in the WQE.

[0060] The purpose of this embodiment is to provide additional data security protection when the RNIC device performs RDMA data transmission, which does not include other data transmitted by the RDMA protocol, such as data for maintaining the connection, because these data do not have the privacy of the device borrower application itself. Therefore, only the memory data that has been registered with the memory (that is, the transmission of RDMA transmission data) needs to be security enhanced, that is, the data output to the remote end is encrypted, and the data input from the remote end is decrypted. The decrypted data is securely guaranteed by using the communication security processing method between the device lender bus and the device borrower bus.

[0061] To this end, this implementation sets a security enhancement address area in the control bridge, and the security enhancement address area is used to trigger the security enhancement processing. The virtual RNIC device accesses all external PCIe through the control bridge. As long as the address falls in the security enhancement address area, the control bridge implements security enhancement processing on the accessed payload. When performing memory registration, the device borrower of this embodiment intercepts the memory registration request of the driver of the virtual RNIC device, such as by modifying the driver of the RNIC device or modifying the operating system. Then, the memory region (Memory Region) that needs to be registered is registered in the security enhancement address area of ​​the control bridge, and the memory registration request is submitted after the registration is successful. After the memory registration is performed, the memory region that has been registered is obtained. The device borrower intercepts the memory release request of the driver of the virtual RNIC device, and after the processing is completed, the memory region that has been registered is deregistered in the security enhancement address area of ​​the control bridge.

[0062] Furthermore, when the control bridge is powered on, it enters the initialization state, and after completing the initialization, the control bridge enters the available state; after receiving the instruction to start the safety task, the control bridge enters the authentication state, in which the identity of the control bridge is authenticated and the communication key is obtained. At this time, the communication key is the communication key for data transmission between the device lender bus and the device borrower bus.

[0063] After entering the running security task state, the transmission data between the device borrower bus and the virtualized RNIC device is obtained. If the transmission data is application data for RDMA transmission, a specific communication key can be used at this time. The communication key is independent of the communication key for data transmission between the device lender bus and the device borrower bus. The specific communication key is used to perform security enhancement processing on the application data for RDMA transmission. Specifically, when the virtualized RNIC device in the device lender bus accesses the device borrower bus through the control bridge, it is determined whether the access address falls within the security enhancement address area in the control bridge; if the access address falls within the security enhancement address area in the control bridge, the control bridge encrypts the application data for RDMA transmission input to the control bridge based on the specific communication key, and decrypts the application data for RDMA transmission output from the control bridge.

[0064] In specific applications, the security enhancement processing of this embodiment is additionally added on the basis of the communication security between the device lender bus and the device borrower bus. Therefore, this embodiment is based on the communication key. After decrypting all data input from the device lender bus, if the transmitted data is application data for RDMA transmission, the application data for RDMA transmission input to the control bridge is encrypted based on a specific communication key, and the application data for RDMA transmission output from the control bridge is decrypted based on the specific communication key, and then the control bridge uses the communication key to encrypt all data output to the device lender bus.

[0065] The specific communication key used for security enhancement processing in this embodiment is independent of the communication key for data transmission between the device lender bus and the device borrower bus, and the acquisition method is the same. In addition, it is necessary to ensure that the specific communication keys for security enhancement at both ends of the application data transmitted by RDMA are consistent.

[0066] Based on the above embodiments, the present invention also provides a system for securely using cross-bus domain RNIC devices to perform RDMA operations. The system is applied to the method for securely using cross-bus domain RNIC devices to perform RDMA operations described in the above method embodiments. The system includes: a device borrower, a device lender, and a connection bridge, the connection bridge is used to connect the buses corresponding to the device borrower and the device lender respectively; the device lender includes the control bridge and the virtualized RNIC device, the control bridge is used to connect the bus of the virtualized RNIC device and the device lender; the connection bridge is used to receive request access information and forward the request access information to the bus domain of the device borrower. Specifically, the control bridge includes at least: a transmission data acquisition module, a specific communication key acquisition module, and a security enhancement processing module. Specifically, the transmission data acquisition module is used to obtain the transmission data between the device borrower bus and the virtualized RNIC device after entering the running security task state. The specific communication key acquisition module is used to acquire a specific communication key if the transmission data is application data for RDMA transmission, the communication key being independent of the communication key for data transmission between the device lender bus and the device borrower bus, and the application data for RDMA transmission includes memory data that has been registered in memory. The security enhancement processing module is used to perform security enhancement processing on the application data for RDMA transmission based on the specific communication key, the security enhancement processing being independent of the communication security processing between the device lender bus and the device borrower bus.

[0067] The functions of the various modules in the system for securely using cross-bus domain RNIC devices to perform RDMA operations in this embodiment are the same as those in the various steps in the above method embodiment, and will not be repeated here.

[0068] Based on the above embodiment, the present invention further provides a terminal, the principle block diagram of the terminal can be as follows: Figure 5 The terminal may include one or more processors 100 ( Figure 5 Only one is shown), a memory 101 and a computer program 102 stored in the memory 101 and executable on one or more processors 100, for example, a program for securely using cross-bus domain RNIC devices to perform RDMA operations. When one or more processors 100 execute the computer program 102, the various steps in the method embodiment for securely using cross-bus domain RNIC devices to perform RDMA operations can be implemented. Alternatively, when one or more processors 100 execute the computer program 102, the functions of the various modules / units in the method embodiment for securely using cross-bus domain RNIC devices to perform RDMA operations can be implemented, which is not limited here.

[0069] In one embodiment, the processor 100 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0070] In one embodiment, the memory 101 may be an internal storage unit of an electronic device, such as a hard disk or memory of the electronic device. The memory 101 may also be an external storage device of the electronic device, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the electronic device. Further, the memory 101 may also include both an internal storage unit of the electronic device and an external storage device. The memory 101 is used to store computer programs and other programs and data required by the terminal. The memory 101 may also be used to temporarily store data that has been output or is to be output.

[0071] Those skilled in the art will understand that Figure 5 The principle block diagram shown in the figure is only a block diagram of a partial structure related to the scheme of the present invention, and does not constitute a limitation on the terminal to which the scheme of the present invention is applied. The specific terminal may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0072] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, operating database or other media used in the embodiments provided by the present invention may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double operational data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0073] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for securely using a cross-bus domain RNIC device to perform RDMA operations, characterized in that: The method comprises: After entering the running safety task state, the transmission data between the device borrower bus and the virtualized RNIC device is obtained; If the transmission data is application data for RDMA transmission, a specific communication key is obtained, the communication key is independent of the communication key for data transmission between the device lender bus and the device borrower bus, and the application data for RDMA transmission includes memory data that has been registered in memory; Based on the specific communication key, security enhancement processing is performed on the application data that is subjected to RDMA transmission, and the security enhancement processing is independent of the communication security processing between the device lender bus and the device borrower bus.

2. The method for securely using cross-bus domain RNIC devices to perform RDMA operations according to claim 1, characterized in that: The method further comprises: A security enhancement address area is set in the control bridge, and the security enhancement address area is used to trigger the security enhancement process.

3. The method for securely using cross-bus domain RNIC devices to perform RDMA operations according to claim 2, characterized in that: The performing security enhancement processing on the application data for RDMA transmission based on the specific communication key includes: When the virtualized RNIC device in the device lender bus accesses the device borrower bus through the control bridge, determining whether the access address falls within the security enhanced address area in the control bridge; If the access address falls within the security-enhanced address area in the control bridge, the control bridge performs security-enhanced processing on the application data for RDMA transmission based on the specific communication key.

4. The method for securely using cross-bus domain RNIC devices to perform RDMA operations according to claim 3, characterized in that: If the access address falls within the security enhanced address area in the control bridge, the control bridge performs security enhancement processing on the application data for RDMA transmission based on the specific communication key, including: If the access address falls within the security enhanced address area in the control bridge, the control bridge encrypts the application data for RDMA transmission input to the control bridge and decrypts the application data for RDMA transmission output from the control bridge based on the specific communication key.

5. The method for securely using cross-bus domain RNIC devices to perform RDMA operations according to claim 4, characterized in that: If the access address falls within the security enhanced address area in the control bridge, the control bridge encrypts the application data for RDMA transmission input into the control bridge and decrypts the application data for RDMA transmission output from the control bridge based on the specific communication key, including: After decrypting all data input from the device lender bus, encrypting the application data input to the control bridge for RDMA transmission based on the specific communication key; After decrypting the application data for RDMA transmission output by the control bridge based on the specific communication key, the control bridge then encrypts all data output to the device lender bus.

6. The method for securely using cross-bus domain RNIC devices to perform RDMA operations according to claim 5, characterized in that: The method further comprises: The device borrower intercepts the memory registration request of the driver of the virtual RNIC device; The memory area that needs to be registered is registered in the security enhanced address area of ​​the control bridge, and the memory registration request is submitted after the registration is successful.

7. The method for securely using cross-bus domain RNIC devices to perform RDMA operations according to claim 6, characterized in that: The method further comprises: The device borrower intercepts the memory release request of the driver of the virtual RNIC device, and after processing, unregisters the memory area that has been memory registered in the security enhanced address area of ​​the control bridge.

8. A system for securely using cross-bus domain RNIC devices to perform RDMA operations, characterized in that: The system is applied to the method for securely using a cross-bus domain RNIC device to perform RDMA operations as described in any one of claims 1 to 7 above, and the system comprises: a device borrower, a device lender, and a connection bridge, wherein the connection bridge is used to connect the buses corresponding to the device borrower and the device lender respectively; The device lender includes the control bridge and the virtualized RNIC device, and the control bridge is used to connect the bus of the virtualized RNIC device and the device lender; The connection bridge is used to receive access request information and forward the access request information to the bus domain of the device borrower; Wherein, the control bridge at least comprises: The transmission data acquisition module is used to obtain the transmission data between the device borrower bus and the virtualized RNIC device after entering the running safety task state; A specific communication key acquisition module, used for acquiring a specific communication key if the transmission data is application data for RDMA transmission, the communication key being independent of the communication key for data transmission between the device lender bus and the device borrower bus, and the application data for RDMA transmission includes memory data that has been memory registered; The security enhancement processing module is used to perform security enhancement processing on the application data for RDMA transmission based on the specific communication key, wherein the security enhancement processing is independent of the communication security processing between the device lender bus and the device borrower bus.

9. A terminal, characterized in that: The terminal includes a memory, a processor, and a program stored in the memory and executable on the processor for securely using cross-bus domain RNIC devices to perform RDMA operations. When the processor executes the program for securely using cross-bus domain RNIC devices to perform RDMA operations, the steps of the method for securely using cross-bus domain RNIC devices to perform RDMA operations as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a program for securely using cross-bus domain RNIC devices to perform RDMA operations. When the program for securely using cross-bus domain RNIC devices to perform RDMA operations is executed by a processor, the steps of the method for securely using cross-bus domain RNIC devices to perform RDMA operations as described in any one of claims 1-7 are implemented.

Images