RDMA-oriented user data access control method and system

Abstract

The invention provides an RDMA-oriented user data access control method and system, and relates to the technical field of computer network information security, and the method comprises the steps: initializing an RDMA network, and building a communication protocol mechanism; in the communication process, a key generation center is deployed in the RDMA network, and after a request of accessing the RDMA network by a terminal node is obtained, terminal node identity registration and identity authentication are performed on the key generation center, and then a shared key of the terminal node and the key generation center and a shared session key between the terminal nodes are generated; after the communication receiving end receives the encrypted message, the message is decrypted by using the shared session key between the terminal nodes and the SM4 algorithm; and then MAC verification is carried out on the data sent by the sending end by using the message identification code, the message is accepted if verification succeeds, otherwise, the message is discarded, and one-time data transmission is completed.

Description

Technical Field

[0001] The present disclosure relates to the technical field of computer network information security, and in particular to a user data access control method and system oriented to RDMA. Background Art

[0002] The statements in this section merely provide background information related to the present disclosure and do not necessarily constitute prior art.

[0003] When designing Remote Direct Memory Access (RDMA) technology, it is generally assumed that the environment in which it runs is secure, so almost no cryptographic security protection mechanism is considered. However, in a computing network, users may need to submit computing tasks to multiple computing providers, or require multiple computing providers to collaborate to complete computing tasks. In this scenario, RDMA technology is needed to improve the efficiency of reading memory data between different computing nodes.

[0004] However, these computing nodes belong to different computing power providers or data centers, and their security policies, security protection measures, and security management and operation mechanisms are different. It is difficult to regard them as the same security domain. For RDMA memory data access across security domains, simple boundary protection cannot protect RDMA traffic well, and RDMA security reinforcement is required. The InfiniBand (IB) protocol is a new protocol designed entirely for RDMA. The IB protocol itself has almost no security protection measures, which may lead to various malicious attacks. The risk of data being attacked is relatively high and the security is relatively low. Therefore, the security enhancement of RDMA is mainly focused on the IB protocol. Summary of the invention

[0005] In order to solve the above problems, the present disclosure proposes a user data access control method and system for RDMA, which enhances the security of the IB protocol and further enhances the security control mechanism of RDMA for data access.

[0006] According to some embodiments, the present disclosure adopts the following technical solutions:

[0007] The user data access control method for RDMA includes:

[0008] Initialize the RDMA network and establish a communication protocol mechanism;

[0009] During the communication process, a key generation center is deployed in the RDMA network. After receiving the request from the terminal node to access the RDMA network, the terminal node identity is registered with the key generation center. After identity authentication, a shared key between the terminal node and the key generation center is generated.

[0010] When terminal nodes transmit data securely through the RDMA mechanism, they first use the shared key between each terminal node and the key generation center to generate a shared session key between the terminal nodes, then use the domestic cryptographic algorithm SM3 to generate a message authentication code MAC for the data to be transmitted, and use the domestic cryptographic algorithm SM4 to encrypt the data payload and send it to the communication receiving end;

[0011] After receiving the encrypted message, the communication receiving end first uses the shared session key between the terminal nodes and the SM4 algorithm to decrypt the message; then uses the message authentication code to perform MAC check on the data sent by the sender. If the check is successful, the message is accepted; otherwise, the message is discarded, completing a data transmission.

[0012] According to some embodiments, the present disclosure adopts the following technical solutions:

[0013] User data access control system for RDMA, including:

[0014] Initialization module, used to initialize the RDMA network and establish a communication protocol mechanism;

[0015] The data communication control module is used to deploy a key generation center in the RDMA network during the communication process, register the terminal node identity with the key generation center after obtaining the terminal node's request to access the RDMA network, and generate a shared key between the terminal node and the key generation center after identity authentication;

[0016] When terminal nodes transmit data securely through the RDMA mechanism, they first use the shared key between each terminal node and the key generation center to generate a shared session key between the terminal nodes, then use the domestic cryptographic algorithm SM3 to generate a message authentication code MAC for the data to be transmitted, and use the domestic cryptographic algorithm SM4 to encrypt the data payload and send it to the communication receiving end;

[0017] After receiving the encrypted message, the communication receiving end first uses the shared session key between the terminal nodes and the SM4 algorithm to decrypt the message; then uses the message authentication code to perform MAC check on the data sent by the sender. If the check is successful, the message is accepted; otherwise, the message is discarded, completing a data transmission.

[0018] According to some embodiments, the present disclosure adopts the following technical solutions:

[0019] A non-transitory computer-readable storage medium is used to store computer instructions. When the computer instructions are executed by a processor, the RDMA-oriented user data access control method is implemented.

[0020] According to some embodiments, the present disclosure adopts the following technical solutions:

[0021] An electronic device comprises: a processor, a memory and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory, so that the electronic device executes and implements the RDMA-oriented user data access control method.

[0022] Compared with the prior art, the present invention has the following beneficial effects:

[0023] The disclosed RDMA-oriented user data access control method uses a domestic cryptographic algorithm to enhance the security of the IB protocol, and can enhance the original RDMA plaintext data transmission to encrypted communication and realize data access control. The main process includes: before the terminal node performs secure communication, deploying a key generation center KGC in the RDMA network to manage, generate, and distribute the shared session keys required for secure communication of the terminal node; encrypting the transmitted data through the domestic SM4 algorithm to realize ciphertext data transmission; changing the original CRC check in the IB protocol packet structure, and using the cryptographic message authentication code MAC, which not only has the function of message integrity verification, but also implicitly contains the function of identity authentication. In short, the security-enhanced IB protocol adopts a lightweight security mechanism, which can enhance the security control mechanism of RDMA for data access without affecting the performance of RDMA itself. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The accompanying drawings constituting a part of the present disclosure are used to provide a further understanding of the present disclosure. The illustrative embodiments of the present disclosure and their descriptions are used to explain the present disclosure and do not constitute an improper limitation on the present disclosure.

[0025] Figure 1 This is a structural diagram of an IB protocol data packet according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0026] The present disclosure is further described below in conjunction with the accompanying drawings and embodiments.

[0027] It should be noted that the following detailed descriptions are all illustrative and are intended to provide further explanation of the present disclosure. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present disclosure belongs.

[0028] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present disclosure. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0029] Example 1

[0030] In one embodiment of the present disclosure, a method for controlling user data access to RDMA is provided, the steps comprising:

[0031] Step 1: Initialize the RDMA network and establish a communication protocol mechanism;

[0032] Step 2: During the communication process, a key generation center is deployed in the RDMA network. After receiving the request from the terminal node to access the RDMA network, the terminal node identity is registered with the key generation center. After identity authentication, a shared key between the terminal node and the key generation center is generated.

[0033] Step 3: When the terminal nodes transmit data securely through the RDMA mechanism, the shared key between each terminal node and the key generation center is first used to generate a shared session key between the terminal nodes, and then the domestic cryptographic algorithm SM3 is used to generate a message authentication code MAC for the data to be transmitted, and the domestic cryptographic algorithm SM4 is used to encrypt the data payload and send it to the communication receiving end;

[0034] Step 4: After receiving the encrypted message, the communication receiving end first uses the shared session key between the terminal nodes and the SM4 algorithm to decrypt the message; then uses the message authentication code to perform MAC verification on the data sent by the sender. If the verification is successful, the message is accepted; otherwise, the message is discarded, completing a data transmission.

[0035] As an embodiment, in the RDMA-oriented user data access control method disclosed in the present invention, a method for enhancing the security of RDMA is provided, which is specifically manifested as the security enhancement of the IB protocol. The enhanced IB protocol can enhance the security control mechanism of RDMA for data access without affecting the performance of RDMA itself. The specific implementation process is as follows:

[0036] like Figure 1 As shown, the structure of the IB protocol data packet includes: LRH (36 bits), LRH (36 bits) is the local routing header, including the source port local ID (16 bits) and the destination port local ID (16 bits). The former represents the local subnet ID of the sender, and the latter represents the local subnet ID of the destination.

[0037] GRH (256 bits), GRH (256 bits) is the global routing header, including the source port global ID (128 bits) and the destination port global ID (128 bits).

[0038] BTH, BTH is the basic transmission header, including the operation type Opcode, the destination QP (Queue Pair), and the sequence number PSN (Packet Sequence Number).

[0039] Other Header, which is other optional header.

[0040] Payload (ciphertext), which is the encrypted ciphertext data payload;

[0041] And MAC, where the MAC is a cryptographic message authentication code.

[0042] The process of using IB protocol data packets to control user data access includes:

[0043] First, the shared key is generated to generate the key used for subsequent data encryption and message authentication code, including the node registration stage, which is used to generate the shared key between the terminal node and the key generation center; the shared session key generation stage between the terminal nodes, using the shared key between the terminal node and the key generation center to generate the shared session key between the terminal nodes; then the data packet authentication, using the shared session key between the terminal nodes to generate the message authentication code, used to ensure the integrity check of the transmitted data; finally, data encryption and decryption, using the shared session key between the terminal nodes to generate the data encryption key, encrypting and decrypting the data payload, used to ensure the confidentiality of the transmitted data, which is described in detail below:

[0044] Step 1: Generate a shared key

[0045] Before the terminal nodes communicate securely, the communicating parties establish a shared key and deploy a key generation center KGC in the RDMA network. The key generation center KGC is used to manage, generate and distribute the shared session keys required for secure communication of the terminal nodes.

[0046] The shared key generation process includes two stages: node registration and generation:

[0047] 1) Node registration phase

[0048] Before accessing the RDMA network, the terminal node registers with the key generation center KGC. After the terminal node passes the identity authentication of the key generation center KGC, a shared key between the key generation center KGC and the node is generated. During this process, the identity authentication and the transmission of the shared key are both performed in an offline and secure manner.

[0049] 2) Shared session key generation phase between terminal nodes

[0050] If terminal node A wants to communicate with B, A first sends a request to the key generation center KGC to generate a shared session key between A and B. The key generation center KGC generates a random number n ab The random number is sent to A and B respectively. After receiving it, A and B calculate the shared key of this session through the hash function. The detailed process is as follows:

[0051] A-->KGC:{A,B,nonce a}K as

[0052] KGC-->A:{A,B,n ab ,nonce s1}K as

[0053] KGC-->B:{B,A,n ab ,nonce s2}K bs

[0054] The shared key is: K ab =SM3(A,B,n ab )

[0055] Among them, SM3 is the domestic hash function algorithm standard, nonce a 、nonce s1 、nonce s2 It is a timestamp to ensure the freshness of the message. as , K bs They are the shared key between terminal node A and KGC, and the shared key between terminal node B and KGC generated during the node registration phase.

[0056] Through the shared key K ab Generation protocol, the terminal node only needs to ask the key generation center KGC to generate a shared key for it when communication is needed, and the key generation center KGC does not directly generate a shared key for A and B. The random number it generates is generated as needed and is not stored, which reduces the security requirements for the key generation center KGC itself.

[0057] Step 2: Packet Authentication

[0058] Specifically, the CRC check in the IB protocol packet structure is changed, and the cryptographic message authentication code MAC is used to calculate according to the following formula:

[0059] K mac =SM3(K ab ||PSN)

[0060] MAC=SM3(K mac ||LRH||GRH||BTH||Other Header||Payload)

[0061] Among them, SM3 is the domestic hash function algorithm standard, and PSN is the sequence number in the BTH header of the IB protocol data packet. In this way, the key used for the MAC check of each data packet is different.

[0062] After receiving the data packet, the communication receiving end first performs MAC verification. If the message content is changed during the transmission process, the verification will fail and the data packet will be discarded.

[0063] The message authentication code not only has the function of message integrity verification, but also has the implicit function of identity authentication. Since the key used is only known by the legitimate communicating parties, if the attacker changes the source address in the data packet or other contents in the packet header, it will not pass the verification. At the same time, the data packet that passes the verification can also prove that it comes from the legitimate communication sender.

[0064] Although an attacker may be able to forge legitimate data packets by listening to the PSN of the memory window, if the attacker does not have access to the memory window, he cannot perform the shared key generation protocol with the other end to generate a shared session key, and still cannot complete communication.

[0065] The key K used by the MAC mac The lifetime of the shared key K ab The lifetime of the shared key K ab If K fails mac Invalid.

[0066] To further reduce the number of iterations in the SM3 calculation process, the message authentication code can be calculated in the following simplified manner:

[0067] MAC=SM3(K||LRH||GRH||BTH)

[0068] That is, only the packet header in the IB protocol data packet is calculated, and MAC calculation is no longer performed on the actual transmitted data, so the length of the input data is fixed.

[0069] Step 3: Encryption and decryption verification process

[0070] Specifically, in order to prevent all memory block QPs from using the same symmetric key for encryption and decryption, and to reduce the storage requirements for the key, it is necessary to first generate a data encryption key for each QP on the fly:

[0071] K QP =SM3(K ab ||GRH a ||GRH b ||QP a ||QP b )

[0072] Among them, GRHa and GRHb are the global routing IDs of the communicating parties, and QPa and QPb are the ID numbers of the QPs of the communicating parties respectively.

[0073] In the original IB protocol specification, it is necessary to know the QP of the communication peer, that is, the DestQP field in the BTH header, so both parties can know the GRH of the other party. b and QP b , so the same shared key can be calculated according to the above formula.

[0074] When the two communicating parties perform remote memory reading and writing through QP, there is no need to store the encryption key. The shared key can be generated on the fly, and then the SM4 cryptographic algorithm is used to encrypt and decrypt the data payload:

[0075] Payload (ciphertext) = SM4 (Payload) K QP

[0076] The key K used by the encryption mechanism OP The lifetime of the shared key K ab The lifetime of the shared key K ab If K fails QP Invalid.

[0077] When the communication peer receives Figure 1 After receiving a data packet in the data format shown in the figure, first execute step 3 to decrypt the payload, and then execute step 2 to verify the plaintext MAC code. If the verification fails, the data packet is discarded.

[0078] Example 2

[0079] In one embodiment of the present disclosure, a user data access control system for RDMA is provided, including:

[0080] Initialization module, used to initialize the RDMA network and establish a communication protocol mechanism;

[0081] The data communication control module is used to deploy a key generation center in the RDMA network during the communication process, register the terminal node identity with the key generation center after obtaining the terminal node's request to access the RDMA network, and generate a shared key between the terminal node and the key generation center after identity authentication;

[0082] When terminal nodes transmit data securely through the RDMA mechanism, they first use the shared key between each terminal node and the key generation center to generate a shared session key between the terminal nodes, then use the domestic cryptographic algorithm SM3 to generate a message authentication code MAC for the data to be transmitted, and use the domestic cryptographic algorithm SM4 to encrypt the data payload and send it to the communication receiving end;

[0083] After receiving the encrypted message, the communication receiving end first uses the shared session key between the terminal nodes and the SM4 algorithm to decrypt the message; then uses the message authentication code to perform MAC check on the data sent by the sender. If the check is successful, the message is accepted; otherwise, the message is discarded, completing a data transmission.

[0084] Example 3

[0085] In one embodiment of the present disclosure, a non-transitory computer-readable storage medium is provided, wherein the non-transitory computer-readable storage medium is used to store computer instructions, and when the computer instructions are executed by a processor, the RDMA-oriented user data access control method is implemented.

[0086] Example 4

[0087] In one embodiment of the present disclosure, an electronic device is provided, including: a processor, a memory, and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory, so that the electronic device executes the RDMA-oriented user data access control method.

[0088] The present disclosure is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present disclosure. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1A device that provides the functions specified in a block or multiple blocks.

[0089] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0090] Although the above describes the specific implementation methods of the present disclosure in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present disclosure. Technical personnel in the relevant field should understand that on the basis of the technical solution of the present disclosure, various modifications or variations that can be made by those skilled in the art without creative work are still within the scope of protection of the present disclosure.

Claims

1. A user data access control method for RDMA, characterized in that: include: Initialize the RDMA network and establish a communication protocol mechanism; During the communication process, a key generation center is deployed in the RDMA network. After receiving the request from the terminal node to access the RDMA network, the terminal node identity is registered with the key generation center. After identity authentication, a shared key between the terminal node and the key generation center is generated. When terminal nodes transmit data securely through the RDMA mechanism, they first use the shared key between each terminal node and the key generation center to generate a shared session key between the terminal nodes, then use the domestic cryptographic algorithm SM3 to generate a message authentication code MAC for the data to be transmitted, and use the domestic cryptographic algorithm SM4 to encrypt the data payload and send it to the communication receiving end; After receiving the encrypted message, the communication receiving end first uses the shared session key between the terminal nodes and the SM4 algorithm to decrypt the message; then uses the message authentication code to perform MAC check on the data sent by the sender. If the check is successful, the message is accepted; otherwise, the message is discarded, completing a data transmission.

2. The RDMA-oriented user data access control method according to claim 1, characterized in that: The terminal node registers with the key generation center before accessing the RDMA network. After the terminal node passes the identity authentication of the key generation center, the key generation center generates a shared key between the key generation center and the terminal node. The identity authentication and the transmission of the shared key are both performed offline.

3. The RDMA-oriented user data access control method according to claim 1, characterized in that: If terminal node A wants to communicate with B, A first initiates a request to the key generation center, requesting the key generation center to generate a shared session key between A and B. The key generation center generates a random number and sends it to A and B respectively. After receiving it, A and B calculate the shared key for this session through the hash function.

4. The RDMA-oriented user data access control method according to claim 3, characterized in that: Through the shared key generation protocol, the terminal node only needs to ask the key generation center to generate a shared key for it when communication is needed. The key generation center does not directly generate the shared key for A and B. The random number it generates is generated as needed and is not stored.

5. The RDMA-oriented user data access control method according to claim 1, characterized in that: The communication receiving end uses the message authentication code to perform MAC check on the data packet sent by the sending end. The message authentication code MAC is calculated according to the following formula: K mac =SM3(K ab ||PSN) MAC=SM3(K mac ||LRH||GRH||BTH||Other Header||Payload) Among them, SM3 is the hash function algorithm standard, PSN is the sequence number in the BTH header of the IB protocol data packet, K ab is a shared key.

6. The RDMA-oriented user data access control method according to claim 1, characterized in that: When the two communicating parties perform remote memory reading and writing, there is no need to store the encryption key. The shared key is generated instantly, and then the cryptographic algorithm SM4 is used to encrypt and decrypt the Payload. The key K used by the encryption mechanism QP The lifetime and shared key Ka b The lifetime of the shared key K ab If K fails QP Invalid.

7. The RDMA-oriented user data access control method according to claim 1, characterized in that: At the receiving end of the communication, the data payload is first decrypted and then the plaintext MAC code is verified. If the verification fails, the data packet is discarded.

8. A user data access control system for RDMA, characterized in that: include: Initialization module, used to initialize the RDMA network and establish a communication protocol mechanism; The data communication control module is used to deploy a key generation center in the RDMA network during the communication process, register the terminal node identity with the key generation center after obtaining the terminal node's request to access the RDMA network, and generate a shared key between the terminal node and the key generation center after identity authentication; When terminal nodes transmit data securely through the RDMA mechanism, they first use the shared key between each terminal node and the key generation center to generate a shared session key between the terminal nodes, then use the domestic cryptographic algorithm SM3 to generate a message authentication code MAC for the data to be transmitted, and use the domestic cryptographic algorithm SM4 to encrypt the data payload and send it to the communication receiving end; After receiving the encrypted message, the communication receiving end first uses the shared session key between the terminal nodes and the SM4 algorithm to decrypt the message; then uses the message authentication code to perform MAC check on the data sent by the sender. If the check is successful, the message is accepted; otherwise, the message is discarded, completing a data transmission.

9. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium is used to store computer instructions, and when the computer instructions are executed by the processor, the RDMA-oriented user data access control method as described in any one of claims 1-7 is implemented.

10. An electronic device, characterized in that: include: A processor, a memory and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory so that the electronic device executes the RDMA-oriented user data access control method as described in any one of claims 1 to 7.

Images