Remote memory access control method and remote memory access method

Abstract

The invention discloses a remote memory access control method and a remote memory access method, and relates to the technical field of computers. According to the server provided by the invention, the attack times of each memory region are recorded through the attack times record table, when the attack times of a certain memory region reach the first set threshold value, the memory region is about to be successfully attacked, and at the moment, the identification information of the memory region is updated, so that the memory region can be effectively prevented from being successfully attacked, and the security of the server is improved. And the user data stored in the target memory area is prevented from being stolen or tampered, so that accurate protection of the memory is realized, and the security of the server memory is improved. Compared with the prior art in which memory protection is carried out in an encryption and decryption data transmission mode, the embodiment of the invention does not need to carry out a complex encryption and decryption process, and can save the computing power of equipment, reduce the data transmission time delay and reduce the power consumption of the equipment.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a remote memory access control method and a remote memory access method. Background Art

[0002] Remote direct memory access (RDMA) is a new type of network transmission method that is widely used in data centers. RDMA uses the characteristics of hardware devices that can directly access the server memory in the data center remotely, so that network data transmission can be done without passing through the server's processor core, reducing the processor core's data copy overhead and improving network data transmission efficiency.

[0003] In scenarios where RDMA is used for network data transmission, a server or server cluster in a data center can be connected to multiple terminal devices, and different users can directly access the server's memory remotely through the clients installed on their respective terminal devices. When a server is connected to multiple clients, an attacker can disguise himself as a client and launch an attack on the server's memory, tamper with the server's memory or steal user data in the server's memory, threatening the security of user data.

[0004] Therefore, how to ensure the security of server memory is an urgent problem to be solved. Summary of the invention

[0005] The embodiments of the present application provide a remote memory access control method and a remote memory access method, which can ensure the security of server memory.

[0006] In a first aspect, an embodiment of the present application provides a remote memory access control method, which can be executed by a server or a chip in the server, wherein the memory of the server includes multiple memory areas. The method may include: determining the attacked target memory area according to the identification information of the pre-access memory area carried in the received erroneous remote memory access request; increasing the number of attacks on the target memory area in the attack count record table; if the number of attacks on the target memory area reaches a first set threshold, updating the identification information of the target memory area.

[0007] The remote memory access control method provided in the embodiment of the present application records the number of attacks on each memory area through an attack frequency record table. When the number of attacks on a certain memory area reaches a first set threshold, it indicates that the memory area is about to be successfully attacked. At this time, updating the identification information of the memory area can effectively prevent the memory area from being successfully attacked, and prevent the user data stored in the target memory area from being stolen or tampered with, thereby realizing precise memory protection and improving the security of server memory.

[0008] Compared with memory protection through encryption and decryption data transmission in related technologies, the embodiments of the present application do not require complex encryption and decryption processes, which can save the computing power of the device, reduce data transmission delays, and reduce device power consumption.

[0009] In an optional implementation, the identification information of each memory area of ​​the multiple memory areas of the server includes a virtual address range and a remote key value. A memory area in the multiple memory areas whose remote key value is consistent with the remote key value in the identification information of the pre-access memory area can be used as the target memory area; or a memory area in the multiple memory areas whose virtual address range includes the virtual address in the identification information of the pre-access memory area can be used as the target memory area.

[0010] In the above implementation, when the remote key value of a memory area is consistent with the remote key value of the pre-access memory area, or the virtual address range includes the virtual address of the pre-access memory area, the number of attacks on the memory area can be increased, and the attacked memory area can be detected more comprehensively.

[0011] In an optional implementation, before determining the target memory area under attack based on the identification information of the pre-access memory area carried in the received erroneous remote memory access request, it is possible to determine through the server's network card whether the received remote memory access request is an erroneous remote memory access request; if it is determined that the received remote memory access request is an erroneous remote memory access request, the identification information of the pre-access memory area is obtained from the erroneous remote memory access request through the server's network card.

[0012] In the above implementation, the network card of the server determines whether the received remote memory access request is an erroneous remote memory access request, which can save the computing power overhead of the processor of the server.

[0013] In an optional implementation, when a remote memory access request is received, the network card can search the memory address translation table for a candidate memory area corresponding to the remote key value of the pre-access memory area carried in the remote memory access request; if the candidate memory area is not found, it is determined that the remote memory access request is an erroneous remote memory access request.

[0014] If a candidate memory area is found, but the virtual address range of the pre-access memory area carried in the remote memory access request is not included in the virtual address range of the candidate memory area, it can also be determined that the remote memory access request is an erroneous remote memory access request.

[0015] In an optional implementation, the virtual address range of each memory area includes a starting address. When updating the identification information of the target memory area, the starting address of the target memory area can be marked as the original starting address, the remote key value of the target memory area can be marked as the original remote key value in the memory address translation table, and the new starting address and new remote key value of the target memory area can be added; the new starting address and new remote key value of the target memory area can be sent to the associated terminal device of the target memory area respectively; in the memory address translation table, the original starting address and original remote key value of the target memory area are deleted; in the attack count record table, the number of attacks on the target memory area is cleared.

[0016] In the above implementation, when updating the identification information of the target memory area, the new starting address and the new remote key value of the target memory area are first sent to the associated terminal devices of the target memory area, and then the original starting address and the original remote key value of the target memory area are deleted to ensure that each associated terminal device of the target memory area can normally access the server's memory even in the process of updating the target memory area.

[0017] In an optional implementation, the server may also obtain the request end address corresponding to the erroneous remote memory access request, increase the number of attacks of the request end address, and if the number of attacks of the request end address reaches a second set threshold, the request end address is prohibited from accessing the server's memory.

[0018] In the above implementation, when the number of times a request end address attacks the server memory reaches a second set threshold, the server address is considered to be the server address used by the attacker, and the attacker can be prohibited from using the request end address to access the server's memory again, further improving the security of the server memory.

[0019] In an optional implementation, the server may set the memory access link associated with the requester address to an invalid state; or, the server may add the requester address to a firewall list and deny the requester address from establishing a new memory access link.

[0020] In the above implementation, the server can prohibit the request end address from accessing the server's memory again in a variety of ways to prevent the server's memory from being attacked by attackers again.

[0021] In a second aspect, an embodiment of the present application provides a remote memory access method, which can be executed by a terminal device or a chip in the terminal device; the method may include: when initiating remote memory access to a server, determining whether the identification information of a server memory area stored in a set cache area is updated; if the identification information of the server memory area is updated, using the updated identification information of the server memory area to generate a remote memory access request; and sending a remote memory access request to the server.

[0022] In the remote memory access method provided in the embodiment of the present application, when a terminal device initiates remote memory access to a server, if it is determined that the identification information of the server memory area stored in the set cache area is updated, the updated identification information of the server memory area is used to send a remote memory access request to the server to ensure that the server memory can be correctly accessed.

[0023] In an optional implementation, a cache area is set to store identification information of a server memory area accessible to a terminal device; the identification information of the accessible server memory area is sent by the server to the terminal device during a process of registering the terminal device for remote memory access, or during a process of updating the identification information of the accessible server memory area. The terminal device may receive the identification information of the accessible server memory area sent by the server through a network card of the terminal device, and store it in the set cache area.

[0024] In a third aspect, an embodiment of the present application provides a remote memory access control device, which is applied to a server, wherein the memory of the server includes multiple memory areas; the device includes:

[0025] A memory area determination module is used to determine the target memory area under attack according to the identification information of the pre-access memory area carried in the received erroneous remote memory access request; and increase the number of attacks on the target memory area in the attack number record table;

[0026] The memory protection module is used to update the identification information of the target memory area if the number of attacks on the target memory area reaches a first set threshold.

[0027] In an optional implementation, the identification information of each memory area in the multiple memory areas includes a virtual address range and a remote key value; the memory area determination module can be specifically used to:

[0028] A memory area among the multiple memory areas whose remote key value is consistent with the remote key value in the identification information of the pre-access memory area is used as the target memory area; or

[0029] A memory area whose virtual address range includes the virtual address in the identification information of the pre-access memory area among the multiple memory areas is taken as the target memory area.

[0030] In an optional implementation, the virtual address range of each memory region includes a start address, and the memory protection module can be specifically used for:

[0031] In the memory address translation table, the starting address of the target memory area is marked as the original starting address, the remote key value of the target memory area is marked as the original remote key value, and the new starting address and new remote key value of the target memory area are added;

[0032] Send the new starting address and the new remote key value of the target memory area to the associated terminal device of the target memory area respectively;

[0033] In the memory address translation table, delete the original start address and the original remote key value of the target memory area;

[0034] In the attack count record table, clear the number of attacks on the target memory area.

[0035] In an optional implementation, the remote memory access control device may further include an attack source processing module, the attack source processing module being configured to:

[0036] Get the request end address corresponding to the erroneous remote memory access request;

[0037] Increase the number of attacks on the requesting end address;

[0038] If the number of attacks of the requesting end address reaches a second set threshold, the requesting end address is prohibited from accessing the memory of the server.

[0039] In an optional implementation, the attack source processing module may be specifically used for:

[0040] Set the memory access link associated with the requesting end address to an invalid state; or,

[0041] Add the requesting end address to the firewall list and deny the requesting end address from establishing new memory access links.

[0042] In a fourth aspect, an embodiment of the present application provides a remote memory access device, which is applied to a terminal device; the device includes:

[0043] A request generation module, used to determine whether the identification information of the server memory area stored in the set cache area is updated when initiating remote memory access to the server; if the identification information of the server memory area is updated, generate a remote memory access request using the updated identification information of the server memory area;

[0044] The request sending module is used to send a remote memory access request to the server.

[0045] In an optional implementation, a cache area is set to store identification information of a server memory area accessible to the terminal device; the identification information of the accessible server memory area is sent by the server to the terminal device during the remote memory access registration process of the terminal device.

[0046] In a fifth aspect, an embodiment of the present application further provides a server, comprising a memory and a processor, wherein a computer program is stored in the memory; the processor is used to read and execute the computer program stored in the memory so that any one of the methods provided in the first aspect is executed.

[0047] In the sixth aspect, an embodiment of the present application also provides a terminal device, including a memory and a processor, wherein a computer program is stored in the memory; the processor is used to read and execute the computer program stored in the memory so that any one of the methods provided in the second aspect is executed.

[0048] In the seventh aspect, an embodiment of the present application also provides a data transmission system, including a server and multiple terminal devices connected to the server; the server can adopt the server provided in the fifth aspect; the terminal device can adopt the terminal device provided in the sixth aspect.

[0049] In an eighth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute any one of the methods provided in the first or second aspect above.

[0050] In a ninth aspect, an embodiment of the present application provides a computer program product comprising computer executable instructions, which are used to enable a computer to execute any one of the methods provided in the first or second aspect above.

[0051] The technical effects that can be achieved in any of the third to ninth aspects mentioned above can refer to the description of the beneficial effects in the first or second aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 A schematic diagram of the structure of a data transmission system provided in an embodiment of the present application;

[0053] Figure 2 An interaction diagram between a terminal device and a server in a memory registration process provided by an embodiment of the present application;

[0054] Figure 3 A flowchart of a remote memory access control method provided in an embodiment of the present application;

[0055] Figure 4 A logic diagram of a remote memory access control method provided in an embodiment of the present application;

[0056] Figure 5 A schematic diagram of the number of times a remote key value is attacked provided in an embodiment of the present application;

[0057] Figure 6 A graph showing the relationship between the number of guesses and the probability of a correct guess provided in an embodiment of the present application;

[0058] Figure 7 An interaction diagram between a terminal device and a server in a process of updating a memory area provided in an embodiment of the present application;

[0059] Figure 8 A flowchart of an attack source processing process provided in an embodiment of the present application;

[0060] Fig. 9 A structural block diagram of a remote memory access control device provided in an embodiment of the present application;

[0061] Fig.10 A structural block diagram of another remote memory access control device provided in an embodiment of the present application;

[0062] Fig.11 A structural block diagram of a remote memory access device provided in an embodiment of the present application;

[0063] Fig.12 A schematic diagram of the structure of a server provided in an embodiment of the present application;

[0064] Fig.13 A schematic diagram of the structure of a terminal device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0065] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the embodiments of the present application will be described in detail below in conjunction with the accompanying drawings. The terms used in the implementation method section of the present application are only used to explain the specific embodiments of the present application, and are not intended to limit the present application.

[0066] Before introducing the specific solutions provided by the embodiments of the present application, some terms in the present application are explained to facilitate understanding by those skilled in the art, and the terms in the present application are not limited.

[0067] (1) Infiniband (IB) protocol: A computer network communication standard with high throughput and low latency for data interconnection between computing devices, where the computing device can be a server or a terminal device.

[0068] (2) GID address: An address of a node in a network, which has the same function as an IP address. An IP address is used to identify the address of a node in a network based on the TCP / IP protocol. A GID address is used to identify the address of a node in a network based on the IB protocol. In an IB network, nodes can communicate using GID addresses. Any device or network unit in a network can be called a node.

[0069] In the embodiments of the present application, "multiple" refers to two or more than two. In view of this, in the embodiments of the present application, "multiple" can also be understood as "at least two". "At least one" can be understood as one or more, for example, one, two or more. For example, including at least one means including one, two or more, and there is no restriction on which ones are included. For example, including at least one of A, B and C, then A, B, C, A and B, A and C, B and C, or A and B and C may be included. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / ", unless otherwise specified, generally indicates that the previously associated objects are in an "or" relationship.

[0070] Unless otherwise specified, the ordinal numbers such as "first" and "second" mentioned in the embodiments of the present application are used to distinguish multiple objects and are not used to limit the order, timing, priority or importance of the multiple objects.

[0071] The remote memory access control method provided in the embodiment of the present application can be applied to application scenarios such as cloud storage or cloud computing that use RDMA for network data transmission. In this application scenario, a server in a data center can be connected to multiple terminal devices, and a system consisting of multiple terminal devices and servers can be called a data transmission system.

[0072] Figure 1 The structural diagram of a data transmission system is shown as an example. Figure 1 As shown, the terminal device 210, the terminal device 220 and the terminal device 230 can be connected to the server 100 through a network. The terminal device can be any computing device with a specific communication function such as a computer, a smart phone, a vehicle-mounted terminal, etc. The terminal device can also be understood as a virtual device or a virtual machine running on a computing device, and multiple virtual devices or virtual machines can run on one computing device. Figure 1 Only three terminal devices are shown. In actual applications, the number of terminal devices connected to the server may be more than three or less than three, and this application does not limit this.

[0073] The server can provide storage database services for multiple terminal devices, and a client can be installed on each terminal device. The client can be understood as an application installed on the terminal device. Exemplarily, the client on the terminal device can be a database service client. Different users can directly access the memory of the server 100 remotely through the client installed on their respective terminal devices.

[0074] In some embodiments, multiple terminal devices can be connected to a server cluster, and a key-value storage database based on RDMA can be stored in the server cluster to form a high-performance, low-latency distributed storage system. The server cluster can include multiple servers, each of which can be used as a node of the key-value storage database based on RDMA, that is, the key-value storage database based on RDMA can include multiple nodes, each of which has its own memory and processor, and multiple nodes are interconnected through an RDMA network. Each node can independently store and manage a portion of data, and the client can read or write these data by sending a request to the server cluster. For example, the terminal device may include a network card, which may be a remote network interface controller (RNIC). The client can send a remote memory access request to the server through the RNIC on the terminal device. The server can also include a network card, which may also be an RNIC. The RNIC on the server can receive the remote memory access request sent by the terminal device, write data to the server's memory according to the remote memory access request, or read data from the server's memory. This process is called an RDMA process.

[0075] Since the RDMA process can avoid multiple replication and copying of data in the network, and can also avoid multiple copies of data between applications and operating systems through zero-copy technology, thereby reducing the overhead of data transmission, the key-value storage database based on RDMA has lower latency and higher throughput compared to the key-value storage database based on the TCP / IP protocol. In practical applications, the key-value storage database based on RDMA is usually used in scenarios that require fast reading, writing and processing of large amounts of data, such as distributed computing, machine learning, high-performance computing, etc.

[0076] In addition to being applicable to the above-mentioned RDMA application scenarios, the embodiments of the present application can also be applied to direct memory access (DMA) application scenarios.

[0077] A server or server cluster can provide local memory to multiple clients. When a server or a server cluster is connected to multiple clients, an attacker can disguise himself as a client and attack the server's memory. If the attack is successful, the attacker can tamper with the server's memory or steal user data in the server's memory without the user or server being aware of it, threatening the security of user data.

[0078] Based on this, an embodiment of the present application provides a remote memory access control method and a data transmission system. In an embodiment of the present application, a server in a data transmission system can manage the memory space in blocks. Exemplarily, the memory space of the server may include multiple memory regions (MRs), each MR corresponding to a continuous memory space. The server can control each MR separately, control the read and write permissions of the memory region, and when performing memory read and write operations on an MR, only operations permitted by the MR can be performed.

[0079] The server stores a memory address translation table, which stores the identification information of each MR and the memory translation table (MTT) of each MR. The MTT table is used for address translation, that is, the MTT table of each MR can be used to determine the physical address of the memory corresponding to the virtual address of the MR. In the memory address translation table, the identification information of each MR includes the virtual address range and remote key value (rkey) of the MR. Among them, the virtual address range of an MR can include the starting address and length of the virtual address (VA) of the MR. The rkey can be understood as the index for searching the MR. Through the rkey of the MR to be accessed, the virtual address range of the MR to be accessed and the MTT table of the MR to be accessed can be found in the memory address translation table, thereby determining the physical address of the MR to be accessed. By dividing the memory space into multiple MRs, it can be ensured that the read and write permissions of the memory can be restricted, and the client on each terminal device can only access a memory address area corresponding to the MR registered by it, and there will be no cross-border problems.

[0080] When a client on a terminal device is started, the process corresponding to the client runs on the terminal device, establishes a connection with the database service on the server through the process corresponding to the client, and performs memory access registration and memory access processes. Figure 2 As shown, the memory access registration and memory access process may include the following steps:

[0081] S201, the terminal device sends a memory access registration request to the server.

[0082] When the client on the terminal device is started, the terminal device establishes an RDMA connection with the database service on the server through the process corresponding to the client, and allocates a buffer area for the client, and the buffer area is used to store the identification information of the server memory area accessible to the terminal device, or in other words, the identification information of the server memory area accessible to the client on the terminal device. The terminal device generates queue pair (QP) information, and the QP information may include a queue pair number (QPN) and a packet sequence number (PSN), wherein the PSN may be the sequence number used by the client on the terminal device to send a data packet to the server.

[0083] The QP information generated by the terminal device is used when accessing the server's memory. Each terminal device has its own QP information, and each QP information has a protection domain (PD). Each QP information can only belong to one PD. Among them, PD is the protection domain of the server's memory, which is used to ensure the mutual isolation of RDMA resources and better ensure security in the RDMA protection mechanism. PD can be understood as a "container" that holds various resources, for example, a "container" that holds QP information and MR. A PD puts the resources it holds within the protection scope to prevent them from being accessed without authorization. A server can set one or more PDs, each of which can include multiple MRs, and the same MR can only belong to one PD. Before creating QP information, the terminal device can first obtain a PD through the interface of the IB protocol framework and obtain a pointer or handle to the PD. When creating QP information, the pointer or handle of the PD is passed in, and the PD information will be included in the QP information. Before creating an MR, the server can also obtain a PD through the interface of the IB protocol framework and obtain a pointer or handle to the PD. When creating an MR, pass in the pointer or handle of the PD, and the PD information will be included in the MR.

[0084] Each QP information can only access the MR under the PD to which it belongs, and the memories of different PDs are isolated from each other. When the terminal device sends and receives data packets between the server, the QP information and the PD of the MR will be verified. It can also be said that the isolation between PDs is similar to that between processes, and the isolation of memory areas is very good. However, due to resource limitations and memory sharing requirements, most PDs are created in units of processes, that is, there is only one PD under the same service process of the server, providing services to multiple different clients. The PD cannot support finer-grained internal memory access control, that is, each QP information under a PD can access all MRs under the PD.

[0085] After the terminal device establishes an RDMA connection with the database service on the server through the client, the terminal device can send a memory access registration request to the server, apply for the accessible MR through the memory access registration request, and establish a memory access link. The memory access registration request carries QP information and address information of the set cache area. The memory access registration request can also carry the address information of the terminal device so that the server stores the QP information and the address information of the terminal device in correspondence. The address information of the terminal device can be the GID address of the terminal device.

[0086] S202: The server allocates an accessible MR to the terminal device.

[0087] After receiving the memory access registration request sent by the terminal device, the server saves the address information of the set cache area of ​​the terminal device, allocates an accessible MR to the terminal device, saves the QP information of the terminal device in correspondence with the accessible MR, and uses the terminal device as the associated terminal device of the accessible MR. For example, terminal device A sends QP information and the address information of the set cache area to the server, and the server saves the address information of the set cache area of ​​terminal device A. The server allocates MR1 ​​to terminal device A, that is, MR1 is the MR accessible to terminal device A, and saves the QP information of terminal device A in correspondence with MR1, so that the associated terminal devices of MR1 include terminal device A.

[0088] The server may also store the QP information and the address information of the terminal device in correspondence, that is, the server stores the correspondence between the address information and the QP information of all the terminal devices that have completed the memory access registration.

[0089] S203: The server sends identification information of accessible MRs to the terminal device.

[0090] In some embodiments, the server saves the identification information of the accessible MR to the corresponding set cache area in the terminal device by remote writing according to the address information of the set cache area of ​​the terminal device. The terminal device completes the memory access registration process.

[0091] S204, the terminal device sends a memory read request to the server.

[0092] After the terminal device completes the memory access registration process, it can send a remote memory access request to the server via RDMA. The remote memory access request can be a read memory request (read) or a write memory request (write). Exemplarily, the terminal device can send a read memory request to the server via the network card of the terminal device, and the network card of the server can receive the read memory request sent by the network card of the terminal device. The read memory request can carry the QP information of the terminal device and the identification information of the pre-access MR. The identification information of the pre-access MR includes the rkey of the MR accessible to the terminal device and the virtual address range pre-accessed by the terminal device, wherein the virtual address range pre-accessed by the terminal device can include the VA starting address and length pre-accessed by the terminal device, and the virtual address range pre-accessed by the terminal device can be determined by the pre-accessed VA starting address and length. The virtual address range pre-accessed by the terminal device is contained in the virtual address range of the MR accessible to the terminal device.

[0093] S205, the server sends the read data to the terminal device.

[0094] The network card of the server receives the read memory request sent by the network card of the terminal device, obtains the identification information of the pre-access MR from the read memory request, searches the target MR pre-accessed by the terminal device in the memory address translation table according to the rkey in the identification information of the pre-access MR, and obtains the virtual address range and MTT table of the target MR. The network card of the server obtains the pre-access VA starting address and length from the read memory request, and can determine the virtual address range pre-accessed by the terminal device according to the pre-access VA starting address and length. If the virtual address range pre-accessed by the terminal device is included in the virtual address range of the found target MR, the network card of the server determines the physical address corresponding to the data that the terminal device needs to read according to the MTT table of the target MR and the pre-accessed virtual address range, and the network card of the server reads the data from the corresponding physical address of the server's memory and sends the read data to the terminal device. The process of reading data can be completed by the network card of the server without passing through the processor of the server.

[0095] Since the server can connect to multiple clients, the attacker can disguise himself as a client and launch an attack on the server's memory through his terminal device. As long as the identification information of the pre-access memory area carried in the remote memory access request sent by the attacker's terminal device to the server is correct, the server's memory can be accessed normally, and the server's memory can be tampered with or the user data in the server's memory can be stolen. The identification information of the pre-access memory area may include rkey, VA starting address and length, where the length is used to protect the read and write operations of the pre-access memory area from exceeding the boundary of the memory area. However, as long as the length set by the attacker is small enough, it will not exceed the boundary. At this time, only rkey and starting address can protect the server's memory.

[0096] As for the rkey in the identification information of the pre-access memory area, since the number of MRs under a PD is limited, the rkeys of each MR are allocated in a regular order and have the characteristics of static initialization. For attackers, the rkey of the MR is easy to guess. Even if the allocation of rkey has a certain randomness, after a limited number of guesses, there is still a high probability that the change pattern of the rkey can be obtained. As for the VA start address in the identification information of the pre-access memory area, since the virtual address allocation of MR has the characteristic of continuity, after the attacker knows the VA start address of an MR on the server, the VA start address of the MR adjacent to it can be predicted. Therefore, the rkey and VA start address of an MR are easier to be guessed by attackers, and the memory protected by the MR can be accessed by malicious QP information (attacker) under the PD to which the MR belongs.

[0097] From the attacker's perspective, although the QP information under the same PD can only access the MR under the current PD, there is no binding relationship between the QP information and the MR. Each QP information can successfully access the specified MR on the server as long as the correct rkey and VA information are used. In other words, after the attacker's terminal device establishes an RDMA connection with the server, it can guess the rkey of the specified MR based on the regularity of rkey allocation, and guess the VA of the specified MR based on the continuity of VA allocation under the same process. Generate a remote memory access request based on the guessed rkey and VA, re-establish the connection after the request fails, re-guess the rkey and VA of the specified MR, and resend the remote memory access request until the rkey and VA of the specified MR are successfully guessed, and the attack is successful.

[0098] Attacks on server memory are the most unacceptable attacks, which can cause other programs on the server to not work properly or attackers to steal key data. At the same time, due to the characteristics of RDMA bypassing the server's processor, the attacker's operations on the server's memory through RDMA are all completed on the network card, resulting in the attacker's inability to be discovered in time after a successful attack, causing more far-reaching impacts.

[0099] In order to prevent the server's memory from being attacked and to ensure the security of the server's memory, the embodiment of the present application sets an attack count record table in the server to record the number of attacks on each memory area. When the number of attacks on any memory area reaches a first set threshold, the identification information of the memory area is updated, that is, the rkey and virtual address range of the memory area are updated to prevent the attacker from successfully guessing the rkey and VA start address of the memory area when launching an attack next time, and successfully completing the attack on the memory area.

[0100] Figure 3 A processing flow chart of a server for receiving a remote memory access request is shown. Figure 4 FIG. 1 is a schematic diagram showing a process of a server processing a received remote memory access request. Figure 3 and Figure 4 As shown, the process may include the following steps:

[0101] S301, receiving a remote memory access request sent by a terminal device.

[0102] The server can receive a remote memory access request sent by any terminal device that has established an RDMA connection with the server through the network card of the terminal device through the network card of the server. The remote memory access request carries the QP information of the terminal device and the identification information of the pre-access memory area. For example, Figure 4 As shown, both the first terminal device and the second terminal device have established RDMA connections with the server. The server's network card can receive a remote memory access request sent by the network card of the first terminal device, and can also receive a remote memory access request sent by the network card of the second terminal device. The remote memory access request sent by the network card of the first terminal device carries the QP information of the first terminal device and the identification information of the pre-access memory area of ​​the first terminal device. The remote memory access request sent by the network card of the second terminal device carries the QP information of the second terminal device and the identification information of the pre-access memory area of ​​the second terminal device.

[0103] S302, determining whether the received remote memory access request is an erroneous remote memory access request; if yes, executing step S304; if no, executing step S303.

[0104] The network card of the server receives the remote memory access request sent by the network card of the terminal device, obtains the identification information of the pre-access memory area from the remote memory access request, and searches the memory address translation table for the candidate memory area corresponding to the rkey according to the rkey in the identification information of the pre-access memory area. If the candidate memory area is not found, the network card of the server determines that the remote memory access request is an erroneous remote memory access request.

[0105] If the candidate memory area is found, the server's network card obtains the virtual address range of the candidate memory area. The server's network card determines the virtual address range of the pre-access memory area based on the VA start address and length in the identification information of the pre-access memory area. The server's network card compares the virtual address range of the pre-access memory area carried in the remote memory access request with the virtual address range of the candidate memory area. If the virtual address range of the pre-access memory area carried in the remote memory access request is not included in the virtual address range of the candidate memory area, the server's network card determines that the remote memory access request is an erroneous remote memory access request.

[0106] If the virtual address range of the pre-access memory area carried in the remote memory access request is included in the virtual address range of the candidate memory area, the network card of the server determines that the remote memory access request is not an erroneous remote memory access request. For example, assuming that the candidate memory area is MR1 ​​according to the rkey in the identification information of the pre-access memory area, the VA starting address of MR1 is 0x5000, and the length is 1000, that is, the virtual address range of MR1 is 0x5000 to 0x6000. If the VA starting address of the pre-access memory area carried in the remote memory access request is 0x5900 and the length is 200, that is, the virtual address range of the pre-access memory area is 0x5900 to 0x6100. In this case, the virtual address range of the pre-access memory area is not included in the virtual address range of the candidate memory area, and it can be determined that the remote memory access request is an erroneous remote memory access request. If the VA starting address of the pre-access memory area carried in the remote memory access request is 0x5500 and the length is 200, that is, the virtual address range of the pre-access memory area is 0x5500 to 0x5700. In this case, if the virtual address range of the pre-accessed memory area is included in the virtual address range of the candidate memory area, it can be determined that the remote memory access request is not an erroneous remote memory access request.

[0107] S303: Access the memory of the server based on the remote memory access request, and feed back the access result to the terminal device.

[0108] If the server's network card determines that the remote memory access request is not an erroneous remote memory access request, the server's network card can use the candidate memory area as the destination memory area, obtain the MTT table of the destination memory area from the memory address translation table, and determine the physical address corresponding to the pre-access memory area of ​​the terminal device according to the MTT table of the destination memory area and the virtual address range of the pre-access memory area carried in the remote memory access request. The server's network card accesses the server's memory based on the obtained physical address and feeds back the access result to the terminal device.

[0109] For example, Figure 4 As shown, the network card of the server receives the remote memory access request sent by the first terminal device, determines that the remote memory access request is not an erroneous remote memory access request, and can determine the physical address corresponding to the pre-access memory area of ​​the first terminal device based on the remote memory access request. The network card of the server can access the memory of the server according to the obtained physical address, and feedback the access result to the terminal device. Exemplarily, if the remote memory access request sent by the first terminal device is a read memory request, the network card of the server can read data from the corresponding physical address of the server's memory according to the obtained physical address, and send the read data to the terminal device. If the remote memory access request sent by the first terminal device is a write memory request, the network card of the server can write data to the corresponding physical address of the server's memory according to the obtained physical address, and feedback the access result that the data has been written to the terminal device.

[0110] S304: Determine the target memory area under attack according to the identification information of the pre-access memory area carried in the remote memory access request.

[0111] If the network card of the server determines that the remote memory access request is an erroneous remote memory access request. The network card of the server can disconnect the connection between the terminal device that sends the remote memory access request and the server in accordance with the provisions of the Infiniband (IB) protocol, and set the QP information of the terminal device that sends the remote memory access request to an error state. The network card of the server can also report a memory access error event to the processor of the server, and notify the processor of the server of the error state of the QP information of the terminal device that sends the remote memory access request through the memory access error event. The memory access error event can also include identification information of the pre-access memory area carried in the remote memory access request. The identification information of the pre-access memory area can be obtained from the header information of the remote memory access request. Exemplarily, in some embodiments, the identification information of the pre-access memory area can be added to the memory access error event by hardware programming. The identification information of the pre-access memory area includes the remote key value of the pre-access memory area and the pre-accessed virtual address range, and the pre-accessed virtual address range includes the pre-accessed VA starting address and length.

[0112] For example, Figure 4 As shown, the network card of the server receives a remote memory access request sent by the second terminal device, determines that the remote memory access request is an erroneous remote memory access request, and can disconnect the connection between the second terminal device and the server, and set the QP information of the second terminal device to an error state. The kernel state driver of the server's processor can sense that the QP information of the second terminal device is set to an error state. Exemplarily, the network card of the server can report a memory access error event to the kernel state driver of the server, and the memory access error event includes a notification that the QP information of the second terminal device is in an error state. The network card of the server can also obtain the identification information of the pre-access memory area from the header information of the erroneous remote memory access request, and add the identification information of the pre-access memory area to the memory access error event by hardware programming. The identification information of the pre-access memory area includes the VA start address and length of the pre-access of the second terminal device, and the remote key value of the pre-access memory area of ​​the second terminal device.

[0113] The processor of the server receives the memory access error event reported by the network card of the server, and determines the target memory area under attack according to the identification information of the pre-access memory area carried in the memory access error event.

[0114] Exemplarily, the memory address translation table stores identification information of multiple memory regions, and the identification information of each memory region includes a virtual address range and a remote key value. The virtual address range of a memory region includes a VA start address and a length of the memory region.

[0115] In one embodiment, the processor of the server can compare the remote key value in the identification information of the pre-access memory area with the remote key values ​​of multiple memory areas one by one, and use the memory area in the multiple memory areas whose remote key value is consistent with the remote key value of the pre-access memory area as the target memory area. For example, assuming that the multiple memory areas include MR2, and the remote key value of MR2 is "0x202", if the remote key value of the pre-access memory area is also "0x202", the two are consistent, then MR2 can be determined as the target memory area.

[0116] In one embodiment, the processor of the server may compare the virtual address range in the identification information of the pre-access memory area with the virtual address ranges of multiple memory areas one by one, and use the memory area in the multiple memory areas whose virtual address range includes the virtual address in the identification information of the pre-access memory area as the target memory area. The virtual address in the identification information of the pre-access memory area may refer to the VA starting address in the identification information of the pre-access memory area. For example, assuming that the multiple memory areas include MR3, the VA starting address of MR3 is 0x8000, and the length is 1000, that is, the virtual address range of MR3 is 0x8000 to 0x9000. If the VA starting address of the pre-access memory area is 0x8100. The virtual address range of MR3 includes the VA starting address of the pre-access memory area, then MR3 can be determined as the target memory area.

[0117] S305, adding the number of attacks on the target memory area to the attack number record table.

[0118] The attack count record table may also be referred to as a memory region attack count record table. In one embodiment, assuming that the remote key value in the identification information of the pre-access memory region is the same as the remote key value of the memory region MR2, and the virtual address in the identification information of the pre-access memory region is included in the virtual address range of the memory region MR3, at this time, both MR2 and MR3 can be used as target memory regions, and the attack counts of MR2 and MR3 are increased simultaneously in the attack count record table.

[0119] S306: If the number of attacks on the target memory area reaches a first set threshold, update the identification information of the target memory area.

[0120] Since in the process of remote memory access, the remote key value, VA starting address and length of the pre-access memory area are generated by the connection manager (CM) of the terminal device and then added to the header information of the remote memory access request, in the above process, it is possible that a normal terminal device generates an erroneous remote memory access request or an illegal remote memory access request due to a coding error. Therefore, it is not feasible to judge whether an attack has occurred based solely on an erroneous remote memory access request. When the server processor determines that a certain memory area is attacked, it does not directly update the identification information of the target memory area, but performs statistics and analysis. When the number of attacks on a certain memory area reaches a first set threshold, it is considered that the memory area is attacked and the attack may be about to succeed, so the identification information of the memory area is updated. In this way, the occurrence of misjudgments can be reduced and the accuracy of judgment can be improved.

[0121] In the embodiment of the present application, an attack count record table is provided in the server to record the number of attacks on each memory area. Figure 4 As shown, after the target memory region is attacked, the number of attacks on the target memory region can be increased in the attack count record table. For example, when MR2 is determined to be the target memory region, the number of attacks on MR2 can be updated from 23 to 24 in the attack count record table. When MR3 is determined to be the target memory region, the number of attacks on MR3 can be updated from 49 to 50 in the attack count record table.

[0122] In an optional embodiment, an attack count record table may be set for all memory areas. In another optional embodiment, an attack count record table may be set for a memory area under a PD. In actual applications, the attacker's terminal device can only attack the MR under the PD to which its QP information belongs, but the specific MR cannot be determined. Therefore, the attacker will only pose a threat to the MR under the same PD. An attack count record table may be set for a memory area under a PD. When there are multiple PDs, multiple attack count record tables may be set.

[0123] The processor of the server can monitor the number of attacks on each memory area recorded in the attack frequency record table. When it is monitored that the number of attacks on any memory area is greater than or equal to the first set threshold, the identification information of the memory area can be updated. Among them, the first set threshold can be determined according to the experimental results, and can also be set according to the actual required protection level. Considering that the optimal attack method for an attacker is to traverse the remote key values ​​according to the probability, the setting of the threshold needs to be associated with the regularity of the occurrence of the remote key values. The remote key values ​​can be sorted according to the probability of occurrence, and guessed from high to low. According to the number of guesses, the probability of guessing the remote key value is calculated. In an experiment, 500,000 MRs were registered through the simulation software, and a plot was drawn based on the experimental results. Figure 5 The frequency difference diagram of the remote key values ​​of consecutive MRs is shown. Figure 5 The horizontal axis in the figure is multiple remote key values, and the vertical axis is the number of occurrences of the remote key values. Among them, the number of occurrences of the remote key value 0x101 is about 14,000 times, and the number of occurrences of the remote key value 0x202 is about 8,000 times. Figure 5 It can be seen that among all the occurrences of remote key values, the occurrence frequency of remote key value 0x101 is as high as 2.6%. And, through the experiment, the Figure 6 The relationship between the number of guesses and the probability of a correct guess is shown in Figure 1. Figure 6 It can be seen that there is a 10% chance of guessing the remote key value after 10 guesses, and the size of the first set threshold is related to the probability of successful attack. Therefore, the corresponding threshold can be set according to the protection level. When the protection level is low, the first set threshold can be set larger, and when the protection level is high, the first set threshold can be set smaller.

[0124] Exemplarily, in one embodiment, the first set threshold may be set to 50. When the processor of the server monitors that the number of attacks on the target memory area is greater than or equal to 50, it determines that the identification information of the target memory area is in a dangerous state, and may update the identification information of the target memory area.

[0125] The virtual address range of the target memory area may include the starting address and length of the target memory area. When updating the identification information of the target memory area, the length of the target memory area may remain unchanged, and only the starting address of the target memory area is updated. Exemplarily, the processor of the server may mark the starting address of the target memory area as the original starting address, mark the remote key value of the target memory area as the original remote key value in the memory address conversion table, and add the new starting address and new remote key value of the target memory area, and send the new starting address and new remote key value of the target memory area to the associated terminal device of the target memory area, respectively. Among them, the associated terminal device refers to a terminal device that can access the target memory area. Since each terminal device saves the QP information of the terminal device in correspondence with the memory area accessible to the terminal device A when registering for memory access, the server can determine the terminal device that can access the target memory area, that is, the associated terminal device of the target memory area, by querying the QP information saved corresponding to the target memory area.

[0126] After the server sends the new starting address and new remote key value of the target memory area to the associated terminal devices of the target memory area, the server waits for a set time, and then deletes the original starting address and the original remote key value of the target memory area in the memory address conversion table, and clears the number of attacks on the target memory area in the attack count record table; or, after the server sends the new starting address and the new remote key value of the target memory area to the associated terminal devices of the target memory area, and receives the successful saving feedback information fed back by each associated terminal device, the server can delete the original starting address and the original remote key value of the target memory area in the memory address conversion table, and clear the number of attacks on the target memory area in the attack count record table.

[0127] For example, when the server detects that the number of attacks on MR3 is equal to 50, it determines that MR3 is in a dangerous state. In the memory address translation table, the server can mark the virtual address range of MR3 as the original virtual address range, mark the remote key value of MR3 as the original remote key value, and add the new virtual address range and new remote key value of MR3, and send the new virtual address range and new remote key value of MR3 to the associated terminal devices of MR3 respectively.

[0128] In some embodiments, the server stores address information of the setting cache area of ​​each associated terminal device of MR3, and the new start address and new remote key value of MR3 can be directly stored in the setting cache area of ​​each associated terminal device via RDMA.

[0129] After receiving the successful saving feedback information fed back by each associated terminal device, the original starting address and the original remote key value of MR3 can be deleted in the memory address conversion table, and the number of attacks on MR3 can be cleared to zero in the attack number record table.

[0130] When updating the identification information of the target memory area, the original starting address and the original remote key value will exist at the same time as the new starting address and the new remote key value, and will not become invalid immediately due to the update of the identification information. Therefore, it can be ensured that the terminal device that is accessing the target memory area can successfully complete the memory access and correctly receive the access result returned by the server.

[0131] In the above process of updating the identification information of the target memory area, considering that there may be a time difference between the time when different terminal devices receive the new start address and the new remote key value, a shared memory method can be used to point multiple virtual addresses to the same physical address, that is, different terminal devices can be allowed to access the same memory area using different identification information. In other words, in the process of updating the identification information of the target memory area, there is no need to copy the memory, and different terminal devices can use different virtual address ranges and remote key values ​​to access the same memory address.

[0132] For example, in the process of updating the identification information of MR3, assuming that the original starting address of MR3 is 0x2500, the length is 1000, the original remote key value is 0x303, the new starting address of MR3 is 0x4500, the length remains unchanged, still 1000, and the new remote key value is 0x808. The associated terminal devices of MR3 include terminal device B and terminal device C. If terminal device B has received the new starting address and new remote key value of MR3, terminal device C has not yet received the new starting address and new remote key value of MR3. At this time, if terminal device C needs to access MR3, it can still send a remote memory access request to the server based on the original starting address 0x2500 and the original remote key value 0x303. If terminal device B needs to access MR3, it can send a remote memory access request to the server based on the new starting address 0x4500 and the new remote key value 0x808. After the identification information of MR3 is updated, the server deletes the original starting address and the original remote key value of MR3 in the memory address translation table. All associated terminal devices of MR3 send remote memory access requests to the server based on the new starting address 0x4500 and the new remote key value 0x808.

[0133] In the above embodiment, the shared memory method is adopted to ensure that the virtual address of the updated memory area and the original virtual address point to the same physical address, thereby avoiding memory copying and greatly improving the efficiency of the memory update process.

[0134] In some embodiments, the processor of the server can determine the attacked target memory area through the remote memory access control device, increase the number of attacks on the target memory area in the attack count record table, and update the identification information of the target memory area when the number of attacks on the target memory area reaches a first set threshold. The remote memory access control device can also be called a dynamic library.

[0135] In the above embodiment, the server implements attack detection by counting the number of attacks on each memory area, and when the number of attacks on a certain memory area reaches a first set threshold, the identification information of the memory area is updated. In this way, the occurrence of misjudgment can be reduced, the accuracy and precision of the judgment can be improved, and the memory area that is about to be successfully attacked can be updated, effectively preventing the memory area from being successfully attacked, thereby achieving precise protection.

[0136] The server only sends the new starting address and new remote key value of the target memory area to the terminal devices associated with the target memory area, which does not affect the memory access of the terminal devices normally connected to the server. The attacker does not know that the virtual address and remote key value of the target memory area have changed, thereby making the attacker's attack on the original virtual address and original remote key value of the target memory area meaningless, preventing user data stored in the target memory area from being stolen or tampered with, and improving the security of server memory.

[0137] Compared with the traditional method of protecting memory through protection methods (encryption and decryption data transmission methods), the remote memory access control method provided in the embodiment of the present application uses a detection method and does not require a complex encryption and decryption process. It can save the computing power of the device, reduce data transmission delays, and reduce device power consumption.

[0138] The following takes terminal device D as an example to illustrate the interaction process between the terminal device and the server in the process of updating the identification information of the target memory area. Among them, terminal device D is an associated terminal device of the target memory area. Figure 7 As shown, the interaction process may include the following steps:

[0139] S701, the server sends new identification information of the target memory area to the terminal device D.

[0140] The new identification information of the target memory area includes a new start address and a new remote key value of the target memory area. After the server adds the new start address and the new remote key value of the target memory area to the memory address translation table, it can send the new start address and the new remote key value of the target memory area to each associated terminal device of the target memory area.

[0141] Taking terminal device D as an example, the server stores the address information of the set cache area sent by terminal device D when it is registered. The new starting address and new remote key value of the target memory area can be saved to the corresponding set cache area in terminal device D through remote writing.

[0142] In some embodiments, after saving the starting address of the target memory area and the new remote key value to the set cache area, the terminal device D may also send a save success feedback message to the server based on the RDMA mechanism. After the server receives the save success feedback message sent by all associated terminal devices of the target memory area, it may delete the original starting address and the original remote key value of the target memory area in the memory address conversion table.

[0143] In some embodiments, when the server determines that the number of attacks on the target memory area reaches a first set threshold, it indicates that the data stored in the memory space corresponding to the target memory area may be tampered with or stolen, and can also send prompt information to each associated terminal device of the target memory area, prompting the users of each associated terminal device to pay attention to the security of the data in a timely manner. When the server updates the identification information of the target memory area, it can also send update notification information to each associated terminal device of the target memory area to inform the users of each associated terminal device that the target memory area will use new identification information.

[0144] S702: Terminal device D generates a remote memory access request based on new identification information of the target memory area.

[0145] When the terminal device D initiates a remote memory access to the server, it can determine whether the identification information of the target memory area stored in the set cache area is updated. If the identification information of the target memory area stored in the set cache area is updated, it means that the server has updated the memory area, and the remote memory access request is generated using the updated new identification information of the target memory area to ensure that the correct access result is obtained.

[0146] In some embodiments, when an application installed on the terminal device D initiates remote memory access to the server in response to a user's request, the RDMA interface function may be called to determine whether the identification information of the target memory area stored in the set cache area is updated. If an update occurs, the remote memory access request is generated using the new identification information of the updated target memory area.

[0147] S703, terminal device D sends a remote memory access request to the server.

[0148] S704: The server sends the access result to terminal device D.

[0149] The server receives the remote memory access request sent by the terminal device D. The processing process of the remote memory access request can be performed with reference to step S302 and step S303, which will not be repeated here.

[0150] In some embodiments, considering that when launching an attack, an attacker may first make multiple memory access errors before guessing the correct identification information of a memory area and successfully attacking the memory area. In order to prevent an attacker from successfully attacking a memory area after multiple memory access errors, the server may also prohibit a requesting end that has sent multiple erroneous remote memory access requests from accessing the server's memory again.

[0151] Exemplarily, after determining that an erroneous remote memory access request has been received, the server may also execute Figure 8 The following steps are shown:

[0152] S801, obtaining a request end address corresponding to an erroneous remote memory access request.

[0153] After the server receives a remote memory access request sent by any terminal device through the server's network card, if the server's network card determines that the remote memory access request is an erroneous remote memory access request, the server's network card can generate a memory access error event and report the memory access error event to the server's processor. The memory access error event includes the QP information corresponding to the erroneous remote memory access request, and the server's processor can determine the address information of the terminal device that sent the erroneous remote memory access request, that is, the request end address, based on the QP information corresponding to the erroneous remote memory access request and the correspondence between the stored QP information and the address information of the terminal device.

[0154] S802, increase the number of attacks on the requesting end address.

[0155] In one embodiment, the server may also store an attack source attack count record table, in which the attack source attack count record table stores the attack counts corresponding to the address information of one or more terminal devices.

[0156] Table 1

[0157] Address information of the terminal device Number of attacks GID1 2 GID4 3 GID5 1 …… ……

[0158] After obtaining the request end address, the server processor can check whether there is address information consistent with the request end address in the attack source attack count record table. If so, the attack count corresponding to the address information consistent with the request end address is increased by 1. If there is no address information consistent with the request end address in the attack source attack count record, the request end address is added to the attack source attack count record table, and the attack count corresponding to the request end address is set to 1.

[0159] For example, assuming that the acquired request end address is GID4, GID4 exists in the attack source attack count record table, and the attack count corresponding to GID4 is 2, then the attack count corresponding to GID4 is increased by 1 and updated to 3.

[0160] S803: If the number of attacks of the requesting end address reaches a second set threshold, the requesting end address is prohibited from accessing the memory of the server.

[0161] Taking into account that normal terminal devices may occasionally generate erroneous remote memory access requests, it is not necessary to determine that a certain request end address is the address information of a terminal device used by an attacker based solely on a single erroneous remote memory access request. The server can count the number of attacks corresponding to each address information. When the number of attacks corresponding to a certain address information is greater than or equal to the second set threshold, it can be considered that the address information is the address information of the terminal device used by the attacker, and therefore the address information can be prohibited from accessing the server's memory. By using the second set threshold, the attacker's terminal device and normal terminal device can be more accurately distinguished. Among them, the second set threshold can be set according to actual needs. For example, the second set threshold can be set to 5 or 8, etc. Exemplarily, if the number of attacks corresponding to the above-mentioned request end address GID4 reaches the second set threshold, the request end address GID4 is prohibited from accessing the server's memory again.

[0162] The server can prohibit the requesting end address from accessing the server's memory in one of the following ways, or in a combination of the following two ways:

[0163] Method 1: Set the memory access link associated with the request end address to an invalid state. The invalid state can also be referred to as an error state. Exemplarily, the server can use the request end address as an index, find all QP information corresponding to the request end address in the correspondence between the saved QP information and the address information of the terminal device, set all the memory access links corresponding to these QP information to an error state, and refuse to receive remote memory access requests sent by the terminal devices corresponding to these QP information. It can also be understood as disconnecting the memory access link corresponding to the QP information associated with the request end address so that the terminal devices corresponding to these QP information can no longer continue to access the server's memory.

[0164] Method 2: Add the requesting end address to the firewall list, and refuse to establish a new memory access link for the requesting end address. Exemplarily, the server can prohibit the requesting end address from accessing the server's memory through the firewall mechanism. The server can add the requesting end address to the firewall list, and when receiving a memory access registration request sent by any terminal device, compare the address information of the terminal device carried in the memory access registration request with the address information stored in the firewall list. If the firewall list does not contain the address information of the terminal device carried in the memory access registration request, the memory access registration request can be responded to normally and a memory access link can be established. If the address information of the terminal device carried in the memory access registration request is included in the firewall list, the memory access registration request is ignored, and the memory access link is not allowed to be established, so as to prevent the attacker from using the terminal device to re-establish the memory access link and conduct illegal memory access attacks again.

[0165] Through the above process, it is possible to prevent an attacker from using the same request end address to continuously carry out illegal memory attacks. When all the request end addresses owned by the attacker are disabled, the attacker cannot carry out illegal memory access attacks again.

[0166] In the above process, since in the RDMA process, when the terminal device accesses the server memory, the remote memory access request sent to the server is a data packet in RDMA format, the header format of the data packet in RDMA format is that the server network card can directly process the data packet, and the protocol stack is completely implemented in hardware without passing through the server processor. However, the current firewall mechanism cannot support data packets in RDMA format, so it is impossible to implement a firewall for data packets in RDMA format in hardware. While the embodiment of the present application performs illegal memory attack detection at the software layer, it also sets a corresponding firewall mechanism at the software layer to provide subsequent protection support for illegal memory attack detection.

[0167] Since the data packets in RDMA format only pass through the network card of the server, that is, only pass through the characteristics of the hardware, the firewall implemented in the software layer cannot analyze the data packets in RDMA format one by one and intercept the data packets from the attacker. Therefore, the firewall implemented in the software layer of the embodiment of the present application does not detect each data packet, but detects the information of each link that can be obtained in the software layer. First, all memory access links saved in the server are screened, and the memory access link associated with the request end address used by the attacker is set to the error state; although the data packets of RDMA do not pass through the processor of the server, the control layer of RDMA requires the participation of the software layer and the processor. After the state of the memory access link is set to the error state at the software layer, the network card driver will automatically synchronize the state of the memory access link to the network card of the server, and the memory access link will no longer be able to be used normally; second, by adding the request end address used by the attacker to the firewall list, the request end address is rejected to establish a new memory access link, and the memory access link cannot be established, and the attacker cannot use the request end address again to perform illegal memory access attacks. In other words, without a normal memory access link, the remote memory access request in RDMA format will be discarded by the server's network card, and the network card will not notify the server's processor and upper-layer applications, so attackers cannot perform illegal memory attacks.

[0168] The embodiment of the present application realizes a firewall for the attacker's request end address at the software layer by utilizing the packet loss principle of the RDMA mechanism, and prevents the attacker from using the same request end address (address information of the terminal device) to continuously carry out illegal memory attacks by disabling the request end address through the firewall. Since the address information of each terminal device can only carry out a limited number of attack attempts not exceeding the second set threshold, considering the attack cost, the attacker cannot have unlimited terminal devices, that is, the attacker cannot have unlimited computing devices, and it is impossible to create unlimited virtual devices on the cloud service side. When all the attacker's request end addresses are disabled, the attacker cannot carry out illegal memory access attacks again. Even if the attacker has sufficient conditions, he can use hundreds or more terminal devices to continuously carry out attack attempts. When the number of attacks on a certain memory area reaches the first set threshold, the server can update the identification information of the memory area to avoid the attacker from guessing the correct identification information through continuous attack attempts, thereby ensuring the memory security of the server.

[0169] Based on the same design concept as the above method embodiment, the present application embodiment also provides a remote memory access control device. The remote memory access control device can be applied to a server, for example, Figure 1 The remote memory access control device can be used to implement the above Figure 3The functions of the method embodiment shown in the figure can thus achieve the beneficial effects of the above method embodiment. Fig. 9 As shown, the remote memory access control device 900 may include a memory area determination module 901 and a memory protection module 902 .

[0170] The memory region determination module 901 is used to determine the target memory region to be attacked according to the identification information of the pre-access memory region carried in the received erroneous remote memory access request; in the attack count record table, the number of attacks on the target memory region to avoid the memory region being successfully attacked is increased;

[0171] The memory protection module 902 is configured to update identification information of the target memory area if the number of attacks on the target memory area reaches a first set threshold.

[0172] In some embodiments, Fig.10 As shown, the remote memory access control device 900 may also include an attack source processing module 903, which may be used to: obtain the request end address corresponding to the erroneous remote memory access request; increase the number of attacks on the request end address; if the number of attacks on the request end address reaches a second set threshold, prohibit the request end address from accessing the server's memory.

[0173] It should be noted that, in other embodiments, the memory area determination module 901 can be used to execute any step in the remote memory access control method, the memory protection module 902 can also be used to execute any step in the remote memory access control method, and the attack source processing module 903 can also be used to execute any step in the remote memory access control method. The steps that the memory area determination module 901, the memory protection module 902, and the attack source processing module 903 are responsible for implementing can be specified as needed. The memory area determination module 901, the memory protection module 902, and the attack source processing module 903 respectively implement different steps in the remote memory access control method to realize all the functions of the remote memory access control device.

[0174] Each functional module in the embodiment of the present application can be integrated into one processor, or each module can exist physically separately, or two or more modules can be integrated into one module. The above integrated modules can be implemented in the form of hardware or in the form of software functional units.

[0175] Based on the same design concept as the above method embodiment, the present application embodiment also provides a remote memory access device. The remote memory access device can be applied to a terminal device, such as Figure 1The remote memory access device can be used to implement the functions performed by the terminal device in the above method embodiment, so the beneficial effects of the above method embodiment can be achieved. Fig.11 As shown, the remote memory access device 1100 may include a request generating module 1101 and a request sending module 1102 .

[0176] The request generation module 1101 is used to determine whether the identification information of the server memory area stored in the set cache area is updated when initiating remote memory access to the server; if the identification information of the server memory area is updated, the updated identification information of the server memory area is used to generate a remote memory access request;

[0177] The request sending module 1102 is used to send the remote memory access request to the server.

[0178] It should be noted that, in other embodiments, the request generation module 1101 can be used to execute any step in the communication method, and the request sending module 1102 can be used to execute any step in the communication method. The steps that the request generation module 1101 and the request sending module 1102 are responsible for implementing can be specified as needed, and the request generation module 1101 and the request sending module 1102 respectively implement different steps in the remote memory access method to realize all functions of the remote memory access device.

[0179] Each functional module in the embodiment of the present application can be integrated into one processor, or each module can exist physically separately, or two or more modules can be integrated into one module. The above integrated modules can be implemented in the form of hardware or in the form of software functional units.

[0180] Based on the same technical concept as the above method embodiment, a server is also provided in the embodiment of the present application. The server can be Figure 1 The server 100 shown in FIG. 1 can be used to implement the above Figure 3 The functions of the method embodiment shown can therefore achieve the beneficial effects of the above method embodiment.

[0181] In some embodiments, the structure of the server 1200 can be as follows: Fig.12As shown, it includes a processor 1201 and a memory 1202 connected to the processor 1201. The processor 1201 and the memory 1202 can be connected to each other through a bus. The processor 1201 can be a general-purpose processor, such as a microprocessor, or other conventional processors. The bus can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, etc.

[0182] Among them, the memory 1202 can be used to store software programs and modules, and the processor 1201 executes various functional applications and data processing of the server 1200 by running the software programs and modules stored in the memory 1202, such as the remote memory access control method provided in the embodiment of the present application.

[0183] The memory 1202 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, at least one application program, etc.; the data storage area may be used to store user data, etc. In addition, the memory 1202 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0184] The processor 1201 in the server 1200 is used to run the computer instructions or programs stored in the memory 1202 to perform the functions of any of the above method embodiments. In some embodiments, the processor 1201 may include one or more processing units, and different processing units may be independent devices or integrated in one or more processors. The processor 1201 may also include a controller, which may generate an operation control signal based on the instruction opcode and the timing signal to complete the control of fetching and executing instructions.

[0185] In one embodiment, the server 1200 may further include a communication module, which may be the network card described above, for communicating with a terminal device.

[0186] It is understood that the structure illustrated in the embodiment of the present application does not constitute a specific limitation on the server. In other embodiments of the present application, the chip may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0187] Based on the same technical concept as the above method embodiment, a terminal device is also provided in the embodiment of the present application. The terminal device can be Figure 1 Any terminal device shown in . The terminal device can be used to implement the functions performed by the terminal device in the above method embodiment, so the beneficial effects possessed by the above method embodiment can be achieved.

[0188] In some embodiments, the structure of the terminal device 1300 can be as follows: Fig.13 As shown, it includes a processor 1301 and a memory 1302 connected to the processor 1301. The processor 1301 and the memory 1302 can be connected to each other through a bus. The processor 1301 can be a general-purpose processor, such as a microprocessor, or other conventional processors. The bus can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, etc.

[0189] Among them, the memory 1302 can be used to store software programs and modules, and the processor 1301 executes various functional applications and data processing of the terminal device 1300 by running the software programs and modules stored in the memory 1302, such as the remote memory access method provided in the embodiment of the present application.

[0190] The memory 1302 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, at least one application program, etc.; the data storage area may be used to store user data, etc. In addition, the memory 1302 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0191] The processor 1301 in the terminal device 1300 is used to run the computer instructions or programs stored in the memory 1302 to perform the functions in any of the above method embodiments. In some embodiments, the processor 1301 may include one or more processing units, and different processing units may be independent devices or integrated in one or more processors. The processor 1301 may also include a controller, which may generate an operation control signal according to the instruction operation code and the timing signal to complete the control of fetching and executing instructions.

[0192] In one embodiment, the terminal device 1300 may further include a communication module, which may be the network card described above, for communicating with the server.

[0193] It is understood that the structure illustrated in the embodiment of the present application does not constitute a specific limitation on the terminal device. In other embodiments of the present application, the chip may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0194] The present application also provides a computer program product, which includes computer executable instructions. In one embodiment, the computer executable instructions are used to enable a computer to execute the functions of the above method embodiment.

[0195] The computer executable instructions may be stored in a computer readable storage medium. The present application also provides a computer readable storage medium, wherein the computer readable storage medium stores the executable instructions. In one embodiment, the computer executable instructions are used to enable a computer to execute the functions in the above method embodiment.

[0196] The computer-readable storage medium provided in the embodiments of the present application may be a random access memory (RAM), a flash memory, a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a register, a hard disk, a mobile hard disk, a CD-ROM, or any other form of computer-readable storage medium known in the art.

[0197] Computer executable instructions may be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium. For example, the computer program or instructions may be transferred from one website, computer, server or data center to another website, computer, server or data center by wired or wireless means. The computer readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium, such as a floppy disk, a hard disk, or a magnetic tape; it may also be an optical medium, such as a digital video disc (DVD); it may also be a semiconductor medium, such as a solid state drive.

[0198] In each embodiment of the present application, if there is no special explanation and logical conflict, the terms and / or descriptions between different embodiments are consistent and can be referenced to each other, and the technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationships. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, including a series of steps or units. Methods, systems, products or devices are not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0199] Although the present application has been described in conjunction with specific features and embodiments thereof, it is apparent that various modifications and combinations may be made thereto without departing from the spirit and scope of the present application. Accordingly, the present specification and the accompanying drawings are merely exemplary illustrations of the schemes defined by the appended claims, and are deemed to have covered any and all modifications, variations, combinations or equivalents within the scope of the present application.

[0200] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the embodiments of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A remote memory access control method, characterized in that: Applied to a server, the memory of the server includes multiple memory areas; the method includes: Determine the attacked target memory area according to the identification information of the pre-access memory area carried in the received erroneous remote memory access request; In the attack count record table, increase the number of attacks on the target memory area; If the number of attacks on the target memory area reaches a first set threshold, the identification information of the target memory area is updated.

2. The method according to claim 1, characterized in that The identification information of each memory area in the multiple memory areas includes a virtual address range and a remote key value; and determining the attacked target memory area according to the identification information of the pre-access memory area carried in the received erroneous remote memory access request includes: A memory area among the multiple memory areas whose remote key value is consistent with the remote key value in the identification information of the pre-access memory area is used as the target memory area; or A memory area in the multiple memory areas, the memory area whose virtual address range includes the virtual address in the identification information of the pre-access memory area, is used as the target memory area.

3. The method according to claim 2, characterized in that Before determining the attacked target memory area according to the identification information of the pre-access memory area carried in the received erroneous remote memory access request, the method further includes: Determining, by the network card of the server, whether the received remote memory access request is an erroneous remote memory access request; If it is determined that the received remote memory access request is an erroneous remote memory access request, the identification information of the pre-access memory area is obtained from the erroneous remote memory access request through the network card of the server.

4. The method according to claim 3, characterized in that The determining, by the network card of the server, whether the received remote memory access request is an erroneous remote memory access request comprises: When a remote memory access request is received, searching, through the network card, in a memory address translation table, a candidate memory area corresponding to a remote key value of a pre-access memory area carried in the remote memory access request; If the candidate memory area is not found, it is determined that the remote memory access request is an erroneous remote memory access request.

5. The method according to claim 4, characterized in that After searching the memory address translation table through the network card for the memory area corresponding to the remote key value carried in the remote memory access request, the method further includes: If the candidate memory area is found and the virtual address range of the pre-access memory area carried in the remote memory access request is not included in the virtual address range of the candidate memory area, it is determined that the remote memory access request is an erroneous remote memory access request.

6. The method according to any one of claims 2 to 5, characterized in that: The virtual address range of each memory area in the multiple memory areas includes a start address, and updating the identification information of the target memory area includes: In the memory address translation table, the starting address of the target memory area is marked as the original starting address, the remote key value of the target memory area is marked as the original remote key value, and the new starting address and new remote key value of the target memory area are added; Sending the new starting address and the new remote key value of the target memory area to the associated terminal device of the target memory area respectively; In the memory address translation table, deleting the original starting address and the original remote key value of the target memory area; In the attack count record table, the number of attacks on the target memory area is cleared.

7. The method according to any one of claims 1 to 6, characterized in that: Before or after determining the target memory area to be attacked, the method further includes: Obtaining a request end address corresponding to the erroneous remote memory access request; Increasing the number of attacks on the requesting end address; If the number of attacks of the request end address reaches a second set threshold, the request end address is prohibited from accessing the memory of the server.

8. The method according to claim 7, characterized in that The prohibiting the requesting end address from accessing the memory of the server includes: Setting the memory access link associated with the request end address to an invalid state; or, The request end address is added to the firewall list, and the request end address is denied to establish a new memory access link.

9. A remote memory access method, characterized in that: Applied to terminal equipment; the method comprises: When initiating remote memory access to the server, determining whether identification information of the server memory area stored in the set cache area is updated; If the identification information of the server memory area is updated, the updated identification information of the server memory area is used to generate a remote memory access request; The remote memory access request is sent to the server.

10. The method according to claim 9, characterized in that The set cache area is used to store identification information of the server memory area accessible to the terminal device; the identification information of the accessible server memory area is sent by the server to the terminal device during the process of the terminal device performing remote memory access registration.

11. A remote memory access control device, characterized in that: Applied to a server, the memory of the server includes multiple memory areas; the device includes: A memory area determination module, used to determine the attacked target memory area according to the identification information of the pre-access memory area carried in the received erroneous remote memory access request; and increase the number of attacks on the target memory area in the attack number record table; The memory protection module is used to update the identification information of the target memory area if the number of attacks on the target memory area reaches a first set threshold.

12. The device according to claim 11, characterized in that The identification information of each memory area in the plurality of memory areas includes a virtual address range and a remote key value; the memory area determination module is specifically used to: Among the multiple memory areas, a memory area whose remote key value is consistent with the remote key value in the identification information of the pre-access memory area is used as the target memory area; or, A memory area in the multiple memory areas, the memory area whose virtual address range includes the virtual address in the identification information of the pre-access memory area, is used as the target memory area.

13. The device according to claim 12, characterized in that The virtual address range of each memory area in the multiple memory areas includes a start address, and the memory protection module is specifically used to: In the memory address translation table, the starting address of the target memory area is marked as the original starting address, the remote key value of the target memory area is marked as the original remote key value, and the new starting address and new remote key value of the target memory area are added; Sending the new starting address and the new remote key value of the target memory area to the associated terminal device of the target memory area respectively; In the memory address translation table, deleting the original starting address and the original remote key value of the target memory area; In the attack count record table, the number of attacks on the target memory area is cleared.

14. The device according to any one of claims 11 to 13, characterized in that The device further includes an attack source processing module, wherein the attack source processing module is configured to: Obtaining a request end address corresponding to the erroneous remote memory access request; Increasing the number of attacks on the requesting end address; If the number of attacks of the request end address reaches a second set threshold, the request end address is prohibited from accessing the memory of the server.

15. The device according to claim 14, characterized in that The attack source processing module is specifically used to: Setting the memory access link associated with the request end address to an invalid state; or, The request end address is added to the firewall list, and the request end address is denied to establish a new memory access link.

16. A remote memory access device, characterized in that: Applied to terminal equipment; the device comprises: A request generation module, used to determine whether the identification information of the server memory area stored in the set cache area is updated when initiating remote memory access to the server; if the identification information of the server memory area is updated, generate a remote memory access request using the updated identification information of the server memory area; A request sending module is used to send the remote memory access request to the server.

17. The device according to claim 16, characterized in that The set cache area is used to store identification information of the server memory area accessible to the terminal device; the identification information of the accessible server memory area is sent by the server to the terminal device during the process of the terminal device performing remote memory access registration.

18. A server, characterized in that: including memory and processor; The memory stores a computer program; The processor is used to call the computer program stored in the memory to execute the method according to any one of claims 1 to 8.

19. A terminal device, characterized in that: including memory and processor; The memory stores a computer program; The processor is used to call the computer program stored in the memory to execute the method according to any one of claims 9 to 10.

20. A data transmission system, characterized in that: It includes a server and a plurality of terminal devices connected to the server; The server adopts the server described in claim 18; the terminal device adopts the terminal device described in claim 19.

21. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed on a processor, the processor executes the method according to any one of claims 1 to 8, or the method according to any one of claims 9 to 10.

22. A computer program product, characterized in that The method comprises computer executable instructions, wherein the computer executable instructions are used to make a computer execute the method according to any one of claims 1 to 8, or the method according to any one of claims 9 to 10.

Images