Remote memory direct access communication method and device based on DPU and program product

Abstract

The invention provides a remote memory direct access communication method and device based on a DPU and a program product, and relates to the technical field of data transmission. The method comprises the following steps: determining a target queue pair; the target queue pair comprises a sending queue for sending data; obtaining a symmetric key index by querying a queue pair attribute table; under the condition that the symmetric key index is valid, an engine is directly accessed through a memory, and a symmetric key entry is retrieved in the symmetric key table based on the symmetric key index; the symmetric key indexes corresponding to different queue pairs are the same or different; symmetric key entries corresponding to different symmetric key indexes are different; directly accessing the engine through the memory, taking out the symmetric key from the symmetric key entry, and encrypting the to-be-sent data by using the symmetric key to obtain encrypted data; sending the encrypted data to a second terminal through a PCIe module and a sending queue; according to the invention, the problem that a statically configured key is difficult to adapt to various user application scenes can be solved.

Description

Technical Field

[0001] The present invention relates to the technical field of data transmission, and in particular to a DPU-based remote memory direct access communication method, device and program product. Background Art

[0002] Remote Direct Memory Access (RDMA) is a network technology that allows computers to read and write data directly from the memory of a remote system without the intervention of the operating system. This technology can improve the efficiency of data transmission and reduce latency, and is particularly suitable for high-performance computing and data-intensive applications. However, although RDMA provides efficient data transmission, it also introduces potential security risks. Since RDMA allows direct memory access, data may be intercepted or tampered with by unauthorized third parties when transmitted over the network. Therefore, in order to prevent data from being tampered with or damaged during transmission and ensure that the received data is consistent with the sent data, encrypted transmission is required during the communication process of remote direct memory access.

[0003] Traditional remote memory direct access communication encryption methods include: manually setting and managing keys during the system configuration phase, and the communicating parties using a pre-shared static key for encryption.

[0004] However, statically configured encryption keys make it impossible to flexibly configure different keys for different queue pairs. This fixed key configuration method may not only bring challenges in key management, but may also be unable to adapt to dynamically changing environments or security policies, thereby limiting the flexibility and scalability of the system and making it difficult to adapt to various user application scenarios. Summary of the invention

[0005] In view of this, an embodiment of the present invention provides a DPU-based remote memory direct access communication method, device and program product to eliminate or improve one or more defects in the prior art.

[0006] One aspect of the present invention provides a remote memory direct access communication method based on a DPU, which is applied to a first terminal provided with a data processing unit, wherein a memory direct access engine and a PCIe module are also installed in the first terminal; the method comprises the following steps:

[0007] Determine a target queue pair from among the currently available queue pairs; the target queue pair includes a sending queue for sending data and a receiving queue for receiving data;

[0008] In the case of sending data, the symmetric key index corresponding to the target queue pair is obtained by querying the pre-stored queue pair attribute table;

[0009] When the symmetric key index is valid, the engine is directly accessed through the memory, and based on the symmetric key index, the symmetric key entry corresponding to the symmetric key index is retrieved from the pre-stored symmetric key table; the symmetric key indexes corresponding to different queue pairs are the same or different; and the symmetric key entries corresponding to different symmetric key indexes are different;

[0010] The symmetric key is retrieved from the symmetric key entry through the memory direct access engine, and the symmetric key is used to encrypt the data to be sent to obtain the encrypted data;

[0011] The encrypted data is sent to the second terminal through the PCIe module and the sending queue.

[0012] In some embodiments of the present invention, the symmetric key entry further includes a symmetric key index bit and a symmetric key bit; the symmetric key index bit includes a control bit and a symmetric key index, wherein the control bit is used to indicate whether the symmetric key entry is valid;

[0013] The queue pair attribute table includes a queue pair attribute bit and a symmetric key attribute bit; the symmetric key attribute bit includes an encryption identifier and a symmetric key index; the encryption identifier is used to indicate whether the queue pair attribute table is valid.

[0014] In some embodiments of the present invention, the symmetric key index also includes a symmetric key type; the symmetric key type includes an Advanced Encryption Standard AES type or a National Secret Algorithm SM4 type.

[0015] In some embodiments of the present invention, when the queue pair key attribute table is invalid, the data to be sent is sent to the second terminal through the PCIe module and the target queue pair.

[0016] In some embodiments of the present invention, before encrypting the data to be sent using a symmetric key and obtaining the encrypted data, the method further includes:

[0017] The memory address space of the first terminal is accessed through the PCIe bus, and the memory direct access engine reads the data to be sent from the memory block of the memory address space through the PCIe bus.

[0018] In some embodiments of the present invention, in the case of receiving data, the method further comprises:

[0019] Receive data through the receiving queue, package the received data, and obtain a data packet to be decrypted;

[0020] Obtain the symmetric key index through the queue pair attribute table;

[0021] Through the memory direct access engine, based on the symmetric key index, the symmetric key entry corresponding to the symmetric key index is retrieved from the symmetric key table;

[0022] The symmetric key is retrieved from the symmetric key entry through the memory direct access engine, and the symmetric key is used to decrypt the data packet to obtain the target data;

[0023] The target data is written into the memory block through the memory direct access engine.

[0024] In some embodiments of the present invention, before obtaining the symmetric key index corresponding to the target queue pair by querying the pre-stored queue pair attribute table, the method further includes: exchanging the pre-established symmetric key with the second terminal during the remote memory direct access link establishment process.

[0025] Another aspect of the present invention provides a DPU-based remote memory direct access communication device, including a DPU or a network card, and the DPU or the network card is used to implement the steps of the aforementioned DPU-based remote memory direct access communication method.

[0026] Another aspect of the present invention provides a computer-readable storage medium having a computer program / instruction stored thereon, which, when executed by a processor, implements the steps of the aforementioned DPU-based remote memory direct access communication method.

[0027] Another aspect of the present invention provides a computer program product, comprising a computer program / instruction, which, when executed by a processor, implements the steps of the aforementioned DPU-based remote memory direct access communication method.

[0028] The DPU-based remote memory direct access communication method, device and program product of the present invention determine a target queue pair in the currently available queue pair; the target queue pair includes a sending queue for sending data and a receiving queue for receiving data; in the case of sending data, the symmetric key index corresponding to the target queue pair is obtained by querying a pre-stored queue pair attribute table; in the case of valid symmetric key index, the symmetric key entry corresponding to the symmetric key index is retrieved from a pre-stored symmetric key table based on the symmetric key index through a memory direct access engine; the symmetric key indexes corresponding to different queue pairs are the same or different; the symmetric key entries corresponding to different symmetric key indexes are different ; Access the engine directly through the memory, take out the symmetric key from the symmetric key entry, and use the symmetric key to encrypt the data to be sent to obtain the encrypted data; send the encrypted data to the second terminal through the PCIe module and the sending queue; can solve the problem that the statically configured key is difficult to adapt to various user application scenarios; for different queue pairs, the symmetric key index can be set to the same value, or it can be set to different values; at the same time, different symmetric key indexes are mapped to different symmetric key entries; each queue pair can be independently configured with a symmetric key, multiple queue pairs can be configured to correspond to a symmetric key entry, or one queue pair can be configured to correspond to a symmetric key entry. Therefore, the key can be dynamically configured and managed as needed, which can solve the problem of insufficient flexibility of static key configuration, adapt to different application scenarios and security requirements, meet different user needs, and improve the adaptability to various application scenarios; at the same time, by setting different symmetric key indexes to correspond to different symmetric keys, the risk of symmetric keys being guessed or attacked is reduced, and the randomness and security of the system can be increased, and the concealment and randomness can be enhanced.

[0029] Additional advantages, purposes, and features of the present invention will be described in part in the following description, and will become apparent to those skilled in the art after studying the following, or may be learned from the practice of the present invention. The purposes and other advantages of the present invention may be achieved and obtained by the structures specifically indicated in the specification and the accompanying drawings.

[0030] Those skilled in the art will appreciate that the objectives and advantages that can be achieved with the present invention are not limited to the above specific description, and the above and other objectives that can be achieved by the present invention will be more clearly understood from the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The drawings described herein are used to provide a further understanding of the present invention, constitute a part of the present application, and do not constitute a limitation of the present invention. In the drawings:

[0032] Figure 1A schematic diagram of a structure of encrypted communication between a first terminal and a second terminal provided by an embodiment of the present invention.

[0033] Figure 2 A flowchart of a DPU-based remote memory direct access communication method provided by an embodiment of the present invention.

[0034] Figure 3 A schematic diagram of a queue pair attribute table and a symmetric key table provided in one embodiment of the present invention. DETAILED DESCRIPTION

[0035] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments and the accompanying drawings. Here, the illustrative embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0036] It should also be noted that, in order to avoid obscuring the present invention due to unnecessary details, only structures and / or processing steps closely related to the solutions according to the present invention are shown in the accompanying drawings, while other details that are not closely related to the present invention are omitted.

[0037] It should be emphasized that the term “include / comprises” when used herein refers to the presence of features, elements, steps or components, but does not exclude the presence or addition of one or more other features, elements, steps or components.

[0038] It should also be noted that, unless otherwise specified, the term “connection” herein may refer not only to a direct connection but also to an indirect connection involving an intermediate.

[0039] Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. In the accompanying drawings, the same reference numerals represent the same or similar components, or the same or similar steps.

[0040] Some names involved in the present invention are explained below:

[0041] Advanced Encryption Standard (AES): A symmetric encryption algorithm that uses the same key for encryption and decryption. It is also known as Rijndael encryption and supports three key lengths: 128 bits, 192 bits, and 256 bits. AES has the advantages of wide application range, short waiting time, relatively easy hiding, and high throughput.

[0042] National secret algorithm SM4: It is a block cipher algorithm mainly used for data encryption. The block length and key length are both 128 bits. The SM4 encryption algorithm uses a 32-round nonlinear iterative structure, including the encryption algorithm and the key expansion algorithm. A fixed S box is used in the encryption process to perform operations such as byte replacement. The SM4 algorithm is simple in design, safe and efficient, suitable for resource-constrained environments, and can achieve efficient encryption and decryption operations in both hardware and software.

[0043] Queue Pair: refers to the send queue and the receive queue, the sending and receiving ends in the communication process.

[0044] The following is an explanation of a communication encryption method based on direct access to remote memory provided by the present invention:

[0045] The present invention provides a remote memory direct access communication method based on DPU, which is applied to a first terminal provided with a data processing unit. The data processing unit (DPU) is a hardware accelerator for accelerating data processing. In the process of processing remote direct memory access (RDMA) communication, the data processing unit accelerates the remote direct memory access operation through hardware to improve the speed and efficiency of data transmission; at the same time, the remote direct memory access operation is accelerated through parallel processing and optimization algorithms, which can reduce delay and increase throughput.

[0046] Among them, Figure 1 As shown, a direct memory access (DMA) engine and a PCIe (Peripheral Component Interconnect Express) module are installed in the first terminal.

[0047] Among them, the memory direct access engine includes address register (Address Register), count register (CountRegister), control register (Control Register), status register (Status Register), data buffer (DataBuffer), DMA control logic (DMAController) and interrupt controller (InterruptController), etc.

[0048] The PCIe module refers to an expansion card or integrated circuit (such as a graphics card, a storage controller, a network interface card, etc.) installed in the first terminal, and is used for communication and data transmission with the mainboard or other devices through the PCIe bus.

[0049] The first terminal refers to a terminal that performs encrypted communication with other devices through a memory direct access engine and a PCIe module. It can be a computer (including desktops and laptops), a mobile phone or a tablet computer, etc., or a server. This embodiment does not limit the device type of the first terminal.

[0050] Figure 2 FIG. 1 is a flow chart of a communication encryption method based on remote memory direct access according to an embodiment of the present invention. Figure 2 As shown, the communication encryption based on remote memory direct access at least includes the following steps S201 to S205:

[0051] Step S201: determine a target queue pair from among currently available queue pairs.

[0052] When the first terminal needs to perform data transmission with other devices, it is necessary to first determine a target queue pair, wherein the target queue pair includes a send queue (Send Queue, SQ) for sending data and a receive queue (Receive Queue, RQ) for receiving data.

[0053] The send queue is a buffer or queue for storing data to be sent to other devices; when the first terminal wants to send data, the data to be sent is usually placed in the send queue first and waits to be sent. The receive queue is a buffer or queue for storing data packets (or data segments) received from the network. When data arrives at the first terminal, it is first placed in the receive queue and waits to be processed.

[0054] In some embodiments of the present invention, a target queue pair can be determined through network protocols and configurations, for example, based on the used network protocol (such as TCP, UDP, etc.) and network configuration (such as router, switch settings), the queue that can be used to send or receive data in the currently available queues is determined; or, the target queue pair is determined based on queue information input by the user, the first terminal provides an API or configuration option to the user through the operating system and application, receives configuration information from a specified user or administrator, and specifies and manages the sending queue or receiving queue through the target queue information indicated by the configuration information; or, the target queue pair is determined based on the current network status and load, for example, the most appropriate sending queue or receiving queue is selected according to the current network status (such as bandwidth utilization or network congestion) to ensure timely transmission and reception of data.

[0055] Step S202: In the case of sending data, the symmetric key index corresponding to the target queue pair is obtained by querying a pre-stored queue pair attribute table.

[0056] In some embodiments of the present invention, the queue pair attribute table is used to define and configure the queue pair. The queue pair attribute table includes at least one queue pair entry, each of which is used to configure the attributes of the queue pair and the corresponding symmetric key index. Specifically, refer to Figure 3 The column pair attribute table includes a queue pair attribute bit and a symmetric key attribute bit. The queue pair attribute bit is used to store configuration information related to the sending queue and the receiving queue, including but not limited to queue size, queue depth, queue position or optimization parameters.

[0057] Queue size refers to the buffer size of each send queue and receive queue, which determines the amount of data that can be cached; queue depth refers to the maximum depth of the send queue and receive queue, that is, the number of unprocessed data packets they can accommodate at the same time; queue position refers to the location of the queue in memory, or other related physical or virtual address information; optimization parameters include optimization technologies such as Fast Path or zero copy.

[0058] The symmetric key attribute bit is used to store a symmetric key index pointing to the actual symmetric key to uniquely identify a specific symmetric key. The symmetric key index can be a number, a character, or a combination of numbers and characters. This embodiment does not limit the implementation method of the symmetric key index.

[0059] In some embodiments of the present invention, when data needs to be sent, the queue pair attribute table is first viewed through the memory direct access engine to retrieve the corresponding symmetric key index.

[0060] Step S203: when the symmetric key index is valid, the engine is directly accessed through the memory, and based on the symmetric key index, a symmetric key entry corresponding to the symmetric key index is retrieved from a pre-stored symmetric key table.

[0061] In remote memory direct access applications, separate service processes are created for different users, and different numbers of queue pairs are allocated in the service processes. The number of queue pairs is determined by the user. Therefore, there is a possibility of the need to use a single or multiple queue pairs. Each queue pair is considered an independent resource. The same application may use the same key, or there may be multiple keys. Flexible configuration can meet user needs. However, in traditional remote memory direct access communication encryption methods, keys are usually statically configured. This limitation makes it impossible to flexibly configure keys for queue pairs, making it difficult to adapt to various user application scenarios (such as website security, email, file transfer, etc.). At the same time, statically configured keys cannot support Secure Sockets Layer (SSL) / Transport Layer Security (TLS) protocols, IPSec (Internet Protocol Security) protocols, etc.

[0062] In some embodiments of the present invention, the symmetric key indexes corresponding to different queue pairs are the same or different; in other words, for different queue pairs, the symmetric key indexes can be set to the same value or different values. At the same time, the symmetric key entries corresponding to different symmetric key indexes are different, that is, different symmetric key indexes are mapped to different symmetric key entries.

[0063] Each queue pair can be independently configured with a symmetric key. You can configure multiple queue pairs to correspond to one symmetric key entry, or you can configure one queue pair to correspond to one symmetric key entry. Therefore, you can dynamically configure and manage keys as needed, which can solve the problem of insufficient flexibility of static key configuration, adapt to different application scenarios and security requirements, meet different user needs, and improve adaptability to various application scenarios. At the same time, by setting different symmetric key indexes to correspond to different symmetric keys, the risk of symmetric keys being guessed or attacked is reduced, which can increase the randomness and security of the system, and enhance concealment and randomness.

[0064] For example: in the same communication process, multiple queue pairs are used, each queue pair uses the same symmetric key entry, or each queue pair uses a different symmetric key entry, or, among multiple queue pairs, some queue pairs use the same symmetric key entry, and the remaining queue pairs use different symmetric key entries.

[0065] When the queue pair key attribute table queried by the memory direct access engine is valid, it means that the data to be sent needs to be encrypted, and the corresponding symmetric key is retrieved through the symmetric key index stored in the queue pair key attribute table.

[0066] Specifically, in some embodiments of the present invention, the symmetric key attribute bit includes an encryption flag and a symmetric key index; wherein the encryption flag is used to indicate whether the queue is valid for the key attribute table. For example, taking the symmetric key attribute bit as 15 bits, the 0th bit position is the encryption flag bit, and when the encryption flag bit is 1, it indicates that the data to be sent needs to be encrypted, and when the control bit is 0, it indicates that the data to be sent does not need to be encrypted; bits 1 to 3 are reserved bits; bits 4 to 15 are represented as symmetric key indexes.

[0067] When the queue pair key attribute table is valid, the data to be sent is encrypted by a symmetric key and then sent to the second terminal through the PCIe module and the target queue pair; when the queue pair key attribute table is invalid, the data to be sent is sent to the second terminal equipped with a data processing unit through the PCIe module and the target queue pair.

[0068] like Figure 1 As shown, a direct memory access (DMA) engine and a PCIe (Peripheral Component Interconnect Express) module are also installed in the second terminal.

[0069] Among them, the memory direct access engine includes address register (Address Register), count register (CountRegister), control register (Control Register), status register (Status Register), data buffer (DataBuffer), DMA control logic (DMAController) and interrupt controller (InterruptController), etc.

[0070] The PCIe module refers to an expansion card or integrated circuit (such as a graphics card, a storage controller, a network interface card, etc.) installed in the second terminal, which is used for communication and data transmission with the mainboard or other devices through the PCIe bus.

[0071] The second terminal refers to a terminal that performs encrypted communication with other devices through a memory direct access engine and a PCIe module. It can be a computer (including desktops and laptops), a mobile phone or a tablet computer, etc., or a server. This embodiment does not limit the device type of the second terminal.

[0072] In addition, in practical applications, symmetric keys are usually randomly generated by the requesting party and expire quickly after the communication ends, with short-term validity. However, statically configured keys cannot achieve the short-term validity of encryption, resulting in low security and low scalability. Based on this, in order to achieve the short-term validity of encryption, in some embodiments of the present invention, the symmetric key is randomly generated in advance by the first terminal, and the corresponding symmetric key entry is generated and stored in the symmetric key table, and the corresponding queue pair entry is generated and stored in the queue pair key attribute table. Afterwards, during the process of establishing a remote memory direct access link between the first terminal and the second terminal, the symmetric key is exchanged.

[0073] Specifically, before obtaining the symmetric key index corresponding to the target queue pair by querying the pre-stored queue pair attribute table, the method further includes: exchanging the pre-established symmetric key with the second terminal during the remote memory direct access link establishment process.

[0074] In the process of establishing a link by direct access to the remote memory, the first terminal and the second terminal respectively define corresponding key areas in the private data area to store the exchanged symmetric keys.

[0075] The first terminal generates a symmetric key, encrypts the generated symmetric key using the public key of the second terminal, and sends the symmetric key to the second terminal; the second terminal decrypts the symmetric key using the private key to obtain the symmetric key.

[0076] In addition, in actual implementation, the first terminal and the second terminal may complete the key exchange through a privately defined agreement during the interaction process, for example. This embodiment does not limit the implementation method of the privately defined agreement between the first terminal and the second terminal.

[0077] In some embodiments of the present invention, after the first terminal generates a symmetric key, it generates a corresponding symmetric key entry and stores it in a symmetric key table. The symmetric key entry also includes a symmetric key index bit and a symmetric key bit; the symmetric key index bit includes a control bit and a symmetric key index, wherein the control bit is used to indicate whether the symmetric key entry is valid.

[0078] In addition, in some embodiments of the present invention, the symmetric key index also includes the symmetric key type; the symmetric key type includes the Advanced Encryption Standard AES type or the National Secret Algorithm SM4 type. For example: taking the symmetric key index as 15 bits as an example, the 0th bit position is the control bit, when the control bit is 1, it indicates that the symmetric key entry is valid, and when the control bit is 0, it indicates that the symmetric key entry is invalid; the 1st to 3rd bits indicate the type of the symmetric key (for example, 000-SM4128bit, 001-AES128bit, 010-AES192bit or 011-AES256bit, etc.); the 4th to 15th bits are represented as the symmetric key index.

[0079] Step S204, directly accessing the engine through the memory, taking out the symmetric key from the symmetric key entry, and using the symmetric key to encrypt the data to be sent to obtain encrypted data.

[0080] The data to be sent is pre-stored in the memory address space of the first terminal. Figure 1 As shown, before sending data, the first terminal accesses the host memory address space through the PCIe bus, and the memory direct access engine reads the data in the memory block of the first terminal through the PCIe bus as the data to be sent.

[0081] Specifically, the symmetric key is used to encrypt the data to be sent. Before obtaining the encrypted data, it also includes: accessing the memory address space of the first terminal through the PCIe bus, and the memory direct access engine reads the data to be sent from the memory block of the memory address space through the PCIe bus.

[0082] Step S205: Send the encrypted data to the second terminal through the PCIe module and the sending queue.

[0083] like Figure 1 As shown, in some embodiments of the present invention, after the second terminal receives the encrypted data through the receiving queue, it first packages the received encrypted data to obtain a data packet to be decrypted; then, it processes the data packet to be decrypted, obtains the symmetric key index through the queue pair attribute table corresponding to the receiving queue, obtains the symmetric key based on the obtained symmetric key index through the memory direct access engine, and uses the symmetric key to decrypt the data packet to be decrypted, and writes the decrypted target data into the memory block of the second terminal through the memory direct access engine.

[0084] In addition, when receiving data, the first terminal receives the data through the receiving queue in the target queue pair, obtains the symmetric key according to the symmetric key index, decrypts the received data to obtain decrypted data, and then the memory direct access engine stores the decrypted data in the memory block of the memory address space through the PCIe bus.

[0085] Specifically, in the case of receiving data, it also includes: receiving data through a receiving queue, packaging the received data, and obtaining a data packet to be decrypted; obtaining a symmetric key index through a queue to an attribute table; retrieving a symmetric key entry corresponding to the symmetric key index in a symmetric key table based on the symmetric key index through a memory direct access engine; taking out a symmetric key from the symmetric key entry through a memory direct access engine, and using the symmetric key to decrypt the data packet to be decrypted to obtain target data; and writing the target data into a memory block through a memory direct access engine.

[0086] In summary, the DPU-based remote memory direct access communication method provided by the present invention determines a target queue pair in the currently available queue pairs; the target queue pair includes a sending queue for sending data and a receiving queue for receiving data; in the case of sending data, the symmetric key index corresponding to the target queue pair is obtained by querying a pre-stored queue pair attribute table; when the symmetric key index is valid, the symmetric key entry corresponding to the symmetric key index is retrieved from a pre-stored symmetric key table based on the symmetric key index through a memory direct access engine; the symmetric key indexes corresponding to different queue pairs are the same or different; the symmetric key entries corresponding to different symmetric key indexes are different; The symmetric key is taken out from the symmetric key entry through the memory direct access engine, and the symmetric key is used to encrypt the data to be sent to obtain the encrypted data; the encrypted data is sent to the second terminal through the PCIe module and the sending queue; it can solve the problem that the statically configured key is difficult to adapt to various user application scenarios; for different queue pairs, the symmetric key index can be set to the same value, or it can be set to different values; at the same time, different symmetric key indexes are mapped to different symmetric key entries; each queue pair can be independently configured with a symmetric key, and multiple queue pairs can be configured to correspond to a symmetric key entry, or one queue pair can be configured to correspond to a symmetric key entry. Therefore, the key can be dynamically configured and managed as needed, which can solve the problem of insufficient flexibility of static key configuration, adapt to different application scenarios and security requirements, meet different user needs, and improve the adaptability to various application scenarios; at the same time, by setting different symmetric key indexes to correspond to different symmetric keys, the risk of symmetric keys being guessed or attacked is reduced, and the randomness and security of the system can be increased, and the concealment and randomness can be enhanced.

[0087] Corresponding to the above method, the present invention also provides a DPU-based remote direct memory access communication device, which includes a DPU or a network card, and the DPU or the network card is used to implement the steps of the aforementioned DPU-based remote direct memory access communication method.

[0088] The embodiment of the present invention also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above-mentioned DPU-based remote memory direct access communication method are implemented. The computer-readable storage medium can be a tangible storage medium, such as a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable storage disk, a CD-ROM, or any other form of storage medium known in the technical field.

[0089] An embodiment of the present invention also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the aforementioned DPU-based remote memory direct access communication method.

[0090] It should be understood by those skilled in the art that the exemplary components, systems and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software or a combination of the two. Whether it is performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present invention are programs or code segments used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link via a data signal carried in a carrier.

[0091] It should be clear that the present invention is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present invention.

[0092] In the present invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with features of other embodiments or replace features of other embodiments.

[0093] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the embodiments of the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A remote memory direct access communication method based on DPU, characterized in that: The method is applied to a first terminal provided with a data processing unit, wherein the first terminal is also provided with a memory direct access engine and a PCIe module; the method comprises the following steps: Determine a target queue pair from among the currently available queue pairs; the target queue pair includes a sending queue for sending data and a receiving queue for receiving data; In the case of sending data, the symmetric key index corresponding to the target queue pair is obtained by querying a pre-stored queue pair attribute table; When the symmetric key index is valid, the symmetric key entry corresponding to the symmetric key index is retrieved from a pre-stored symmetric key table based on the symmetric key index through the memory direct access engine; the symmetric key indexes corresponding to different queue pairs are the same or different; and the symmetric key entries corresponding to different symmetric key indexes are different; Retrieving a symmetric key from the symmetric key entry through the memory direct access engine, and using the symmetric key to encrypt the data to be sent to obtain encrypted data; The encrypted data is sent to the second terminal through the PCIe module and the sending queue.

2. The method according to claim 1, characterized in that The symmetric key entry further includes a symmetric key index bit and a symmetric key bit; the symmetric key index bit includes a control bit and the symmetric key index, wherein the control bit is used to indicate whether the symmetric key entry is valid; The queue pair attribute table includes queue pair attribute bits and symmetric key attribute bits; the symmetric key attribute bits include an encryption identifier and the symmetric key index; the encryption identifier is used to indicate whether the queue pair attribute table is valid.

3. The method according to claim 2, characterized in that The symmetric key index also includes a symmetric key type; the symmetric key type includes an Advanced Encryption Standard AES type or a National Secret Algorithm SM4 type.

4. The method according to claim 2, characterized in that: When the queue pair key attribute table is invalid, the to-be-sent data is sent to the second terminal through the PCIe module and the target queue pair.

5. The method according to claim 1, characterized in that Before encrypting the data to be sent using the symmetric key to obtain the encrypted data, the method further includes: The memory address space of the first terminal is accessed through the PCIe bus, and the memory direct access engine reads the data to be sent from the memory block of the memory address space through the PCIe bus.

6. The method according to claim 5, characterized in that In the case of receiving data, the method further comprises: Receive data through the receiving queue, and package the received data to obtain a data packet to be decrypted; Obtaining the symmetric key index through the queue pair attribute table; Retrieving, through the memory direct access engine, based on the symmetric key index, in the symmetric key table a symmetric key entry corresponding to the symmetric key index; Retrieving the symmetric key from the symmetric key entry through the memory direct access engine, and using the symmetric key to decrypt the data packet to be decrypted to obtain target data; The target data is written into the memory block through the memory direct access engine.

7. The method according to claim 1, characterized in that Before obtaining the symmetric key index corresponding to the target queue pair by querying the pre-stored queue pair attribute table, the method further includes: exchanging the pre-established symmetric key with the second terminal during the remote memory direct access link establishment process.

8. A DPU-based remote memory direct access communication device, comprising a DPU or a network card, characterized in that: The DPU or network card is used to implement the steps of the method as claimed in any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method as claimed in any one of claims 1 to 7 are implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images