Method for safely using cross-bus domain RNIC devices for RDMA operations

Abstract

This invention discloses a method for securely performing RDMA operations using a cross-bus domain RNIC device. The method includes: after entering a secure task running state, acquiring transmission data between the borrowing device's bus and the virtualized RNIC device; if the transmission data is application data for RDMA transmission, acquiring a specific communication key, which is independent of the communication key used for data transmission between the lending device's bus and the borrowing device's bus, and the application data for RDMA transmission includes memory data that has been registered in memory; and based on the specific communication key, performing security enhancement processing on the application data for RDMA transmission, which is independent of the communication security processing between the lending device's bus and the borrowing device's bus. This invention, through security enhancement processing, can solve the data security issues during RDMA operations using a virtualized RNIC device by the borrowing device.

Description

Technical Field

[0001] This invention relates to the field of device virtualization technology, and in particular to a method for securely performing RDMA operations using cross-bus domain RNIC devices. Background Technology

[0002] Existing technologies address the issue of secure use of virtualized devices by the borrower. Specifically, assuming the borrower itself is secure, the security of data exchanged between the borrower and the virtualized device can be guaranteed, as well as preventing unauthorized access to the virtualized device by other unauthorized devices. In existing technologies, the data actually used by the virtualized device is in plaintext. While this poses no security issue in devices like GPUs that provide computing power but do not store persistent data, it is problematic for RNIC devices. Since their purpose is to directly exchange data with the outside world via RDMA, the data transmitted during RDMA is also in plaintext, making it impossible to guarantee data security during transmission.

[0003] Therefore, existing technologies still need to be improved and enhanced. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a method for safely using cross-bus domain RNIC devices to perform RDMA operations, addressing the aforementioned deficiencies of the prior art. The technical solution adopted by the present invention is as follows:

[0005] In a first aspect, the present invention provides a method for securely performing RDMA operations using a cross-bus-domain RNIC device, wherein the method includes:

[0006] After entering the running security task state, acquire the transmission data between the device borrower bus and the virtualized RNIC device;

[0007] If the transmitted data is application data for RDMA transmission, then a specific communication key is obtained. This communication key is independent of the communication key for data transmission between the device lender bus and the device borrower bus. The application data for RDMA transmission includes memory data that has been registered in memory.

[0008] Based on the specific communication key, the application data transmitted via RDMA is subjected to security enhancement processing, which is independent of the communication security processing between the device lender bus and the device borrower bus.

[0009] In one implementation, the method further includes:

[0010] A security enhancement address region is set in the control bridge, which is used to trigger the security enhancement process.

[0011] In one implementation, the security enhancement processing of the application data transmitted via RDMA based on the specific communication key includes:

[0012] When a virtual RNIC device in the device lending bus accesses the device lending bus through the control bridge, it is determined whether the access address falls within the security-enhanced address region of the control bridge.

[0013] If the access address falls within the security-enhanced address region of the control bridge, the control bridge performs security enhancement processing on the application data being transmitted via RDMA based on the specific communication key.

[0014] In one implementation, if the access address falls within the security-enhanced address region of the control bridge, the control bridge performs security enhancement processing on the application data undergoing RDMA transmission based on the specific communication key, including:

[0015] If the access address falls within the security-enhanced address region of the control bridge, the control bridge encrypts the application data input to the control bridge for RDMA transmission based on the specific communication key, and decrypts the application data output by the control bridge for RDMA transmission.

[0016] In one implementation, if the access address falls within the security-enhanced address region of the control bridge, the control bridge, based on the specific communication key, encrypts the application data input to the control bridge for RDMA transmission and decrypts the application data output by the control bridge for RDMA transmission, including:

[0017] After decrypting all data input from the device's lending bus, the application data input to the control bridge for RDMA transmission is encrypted based on the specific communication key;

[0018] After decrypting the application data for RDMA transmission output by the control bridge based on the specific communication key, the control bridge then encrypts all data output to the device lending bus.

[0019] In one implementation, the method further includes:

[0020] The device borrower intercepts the memory registration request for the virtual RNIC device driver;

[0021] Register the memory regions that need to be registered to the security-enhanced address region of the control bridge, and submit the memory registration request after successful registration.

[0022] In one implementation, the method further includes:

[0023] The device borrower intercepts the memory release request from the virtual RNIC device driver and, after processing, unregisters the memory region that has been registered in the security-enhanced address region of the control bridge.

[0024] Secondly, embodiments of the present invention provide a system for securely using cross-bus domain RNIC devices to perform RDMA operations, wherein the system is applied to the method for securely using cross-bus domain RNIC devices to perform RDMA operations as described in the above scheme, and the system includes: a device borrower, a device lender, and a connection bridge, wherein the connection bridge is used to connect the buses corresponding to the device borrower and the device lender respectively.

[0025] The device lender includes the control bridge and the virtualized RNIC device, and the control bridge is used to connect the bus of the virtualized RNIC device and the device lender;

[0026] The connection bridge is used to receive access request information and forward the access request information to the bus domain of the device borrower.

[0027] The control bridge includes at least:

[0028] The data acquisition module is used to acquire the data transmission between the device borrower bus and the virtualized RNIC device after entering the running security task state.

[0029] A specific communication key acquisition module is used to acquire a specific communication key if the transmitted data is application data for RDMA transmission. The communication key is independent of the communication key for data transmission between the device lender bus and the device borrower bus. The application data for RDMA transmission includes memory data that has been registered in memory.

[0030] The security enhancement processing module is used to perform security enhancement processing on the application data transmitted via RDMA based on the specific communication key. The security enhancement processing is independent of the communication security processing between the device lender bus and the device borrower bus.

[0031] Thirdly, embodiments of the present invention also provide a terminal, wherein the terminal includes a memory, a processor, and a program stored in the memory and executable on the processor for securely using a cross-bus domain RNIC device to perform RDMA operations. When the processor executes the program for securely using a cross-bus domain RNIC device to perform RDMA operations, it implements the steps of the method for securely using a cross-bus domain RNIC device to perform RDMA operations as described in any of the above solutions.

[0032] Fourthly, embodiments of the present invention also provide a computer-readable storage medium, wherein the computer-readable storage medium stores a program for securely performing RDMA operations using a cross-bus-domain RNIC device, wherein when the program for securely performing RDMA operations using a cross-bus-domain RNIC device is executed by a processor, it implements the steps of the method for securely performing RDMA operations using a cross-bus-domain RNIC device as described in any of the above schemes.

[0033] Beneficial Effects: Compared with existing technologies, this invention provides a method for securely performing RDMA operations using cross-bus domain RNIC devices. First, after entering a secure task running state, the invention acquires the transmission data between the borrowing device's bus and the virtualized RNIC device. If the transmission data is application data for RDMA transmission, a specific communication key is acquired. This communication key is independent of the communication key used for data transmission between the lending device's bus and the borrowing device's bus. The application data for RDMA transmission includes memory data that has been registered in memory. Next, based on the specific communication key, security enhancement processing is performed on the application data for RDMA transmission. This security enhancement processing is independent of the communication security processing between the lending device's bus and the borrowing device's bus. This invention further provides a method for ensuring data security when an RNIC device performs RDMA data transmission, which can solve the problem of data security during RDMA operations using a virtualized RNIC device by the borrowing device. Attached Figure Description

[0034] Figure 1 A flowchart illustrating a preferred embodiment of a method for securely performing RDMA operations using cross-bus domain RNIC devices, as provided in this invention.

[0035] Figure 2 This is a structural diagram of a system for securely using cross-bus domain RNIC devices to perform RDMA operations, as provided in an embodiment of the present invention.

[0036] Figure 3 This is a schematic diagram of the RDMA principle in the method for securely using cross-bus domain RNIC devices to perform RDMA operation provided in an embodiment of the present invention.

[0037] Figure 4 This is a process diagram of RDMA transmission in the method for securely using cross-bus domain RNIC devices to perform RDMA operation, provided in an embodiment of the present invention.

[0038] Figure 5 A schematic diagram of a terminal provided in an embodiment of the present invention. Detailed Implementation

[0039] To make the objectives, technical solutions, and effects of this invention clearer and more explicit, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0040] Those skilled in the art will understand that, unless specifically stated otherwise, the singular forms “a,” “an,” “the,” and “the” used herein may also include the plural forms. It should be further understood that the term “comprising” as used in this specification means the presence of the stated features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof. It should be understood that when we say an element is “connected” or “coupled” to another element, it can be directly connected or coupled to the other element, or there may be intermediate elements. Furthermore, “connected” or “coupled” as used herein can include wireless connections or wireless coupling. The term “and / or” as used herein includes all or any units and all combinations of one or more associated listed items.

[0041] It will be understood by those skilled in the art that, unless otherwise defined, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. It should also be understood that terms such as those defined in general dictionaries should be understood to have the same meaning as in the context of the prior art, and should not be interpreted in an idealized or overly formal sense unless specifically defined as herein.

[0042] This embodiment provides a method for securely performing RDMA operations using a cross-bus domain RNIC device. The invention first enters a secure task running state and then acquires the transmission data between the borrowing device's bus and the virtualized RNIC device. If the transmission data is application data for RDMA transmission, a specific communication key is acquired. This communication key is independent of the communication key used for data transmission between the lending device's bus and the borrowing device's bus. The application data for RDMA transmission includes memory data that has been registered in memory. Next, based on the specific communication key, security enhancement processing is performed on the application data for RDMA transmission. This security enhancement processing is independent of the communication security processing between the lending device's bus and the borrowing device's bus. Through this security enhancement processing, the invention can solve the data security issues during RDMA operations using a virtualized RNIC device by the borrowing device.

[0043] like Figure 1As shown, the method for securely using cross-bus domain RNIC devices to perform RDMA operations in this embodiment can be applied to terminals or servers. When applied to a terminal, the method for securely using cross-bus domain RNIC devices to perform RDMA operations in this embodiment includes the following steps:

[0044] Step S100: After entering the running security task state, obtain the transmission data between the device borrower bus and the virtualized RNIC device;

[0045] Step S200: If the transmitted data is application data for RDMA transmission, then obtain a specific communication key. The communication key is independent of the communication key for data transmission between the device lender bus and the device borrower bus. The application data for RDMA transmission includes memory data that has been registered in memory.

[0046] Step S300: Based on the specific communication key, perform security enhancement processing on the application data transmitted via RDMA. The security enhancement processing is independent of the communication security processing between the device lender bus and the device borrower bus.

[0047] In practical implementation, this embodiment provides a system for securely using cross-bus domain RNIC devices for RDMA operations, such as... Figure 2 As shown, the system includes: a device borrower, a device lender, a connection bridge, and a control bridge. The device borrower includes a virtual RNIC device; in this embodiment, the RNIC device refers to an Ethernet card device. The device lender includes the virtualized RNIC device. The connection bridge connects the buses corresponding to the device borrower and the device lender, respectively. The control bridge connects the buses of the virtualized device and the device lender. In this embodiment, the connection bridge is a PCIe non-transparent bridge, which appears as a PCIe EP (Endpoint) in both the PCIe buses of the device borrower and the device lender. Of course, in other implementations, this embodiment may include two device borrowers and two device lenders, as detailed below. Figure 2 As shown.

[0048] RDMA (such as) Figure 3As shown, Remote Direct Memory Access (RDMA) is a host-offload, host-bypass technology that allows applications (including storage) to directly transfer data between their memory spaces, enabling low-latency, high-bandwidth direct memory-to-memory data communication. An Ethernet card with an RDMA engine (RNIC), instead of the host, manages the reliable connection between the source and destination. Applications using RNICs communicate using command queues (QP and CQ). RDMA has three different hardware implementations: InfiniBand, RoCE (RDMA over Ethernet, a network protocol that allows RDMA to be executed over Ethernet), and iWARP (RDMA over TCP, a network protocol that allows RDMA to be executed over TCP), but they all follow the same Verbs interface at the software protocol level. RDMA supports three types of queues: send queue (SQ), receive queue (RQ), and completion queue (CQ). SQs and RQs are usually created in pairs, called Queue Pairs (QPs); RDMA is a message-based transport protocol, and all packet assembly is done on the RDMA hardware. Figure 4 As shown, the basic process is as follows:

[0049] a. The host submits a work request (WR) to the work queue (WQ): The work queue consists of a send queue (SQ) and a receive queue (RQ). Each element in the work queue is called a WQE, which is the WR.

[0050] b. The Host obtains Work Completion (WC) from the Completion Queue (CQ): Each item in the Completion Queue is called a CQE, which is WC (Work Completion).

[0051] c. Hardware with an RDMA engine is essentially a queue element processor. The RDMA hardware continuously retrieves work requests (WR) from the work queue (WQ) for execution, and after execution, places the completed work (WC) in the completion queue (CQ). From a producer-consumer perspective, this means:

[0052] d. The host produces the WR and puts the WR into the WQ.

[0053] e. RDMA hardware consumption WR

[0054] f. RDMA hardware produces WC, and WC is placed into CQ.

[0055] g. Host consumes WC.

[0056] The purpose of RDMA is to bypass the host and transfer data from memory. Verbs provides MemoryRegistration to register memory regions that need to transfer data. Only memory regions that have been registered can be used for RDMA data transfer. Registered memory regions are called Memory Regions (MRs). RDMA data transfer includes Send / Recv, Write, and Read.

[0057] Send / Recv: The sending RNIC reads the data to be sent from the MR via RDMA according to the parameters in WQE, assembles the data into packets, and sends them to the receiving end; after receiving the message, the receiving RNIC writes the received data into the MR via DMA according to the parameters in WQE.

[0058] Write: The initiating RNIC reads the data to be written to the peer from the WR via DMA according to the parameters in the WQE, assembles the data into a packet, and sends it to the peer; after receiving the message, the peer RNIC writes the data to the MR via DMA according to the parameters in the message.

[0059] Read: The initiating RNIC assembles a packet according to the parameters in WQE and sends it to the peer; after receiving the message, the peer RNIC reads the data from MR via DMA according to the parameters in the message, assembles the packet, and sends it to the initiating RNIC; after receiving the message, the initiating RNIC writes the data into MR via DMA according to the parameters in WQE.

[0060] The purpose of this embodiment is to provide additional data security guarantees when the RNIC device performs RDMA data transmission. This does not include the transmission of other data via the RDMA protocol, such as connection maintenance data, because these data do not involve the privacy of the device borrower's application. Therefore, security enhancement is only required for the memory data that has been registered in memory (i.e., the transmission of RDMA data). This involves encrypting the data output to the remote end and decrypting the data input from the remote end. The decrypted data is then secured using a secure communication processing method between the device lender's bus and the device borrower's bus.

[0061] To this end, this embodiment sets up a security-enhanced address region in the control bridge, which is used to trigger the security enhancement process. When a virtual RNIC device accesses external PCIe devices through the control bridge, if the address falls within this security-enhanced address region, the control bridge performs security enhancement processing on the access payload. During memory registration, the device borrower in this embodiment intercepts the memory registration request of the virtual RNIC device driver, for example, by modifying the RNIC device driver or the operating system. Then, the memory region requiring memory registration is registered to the security-enhanced address region of the control bridge, and the memory registration request is submitted only after successful registration. After memory registration, the registered memory region is obtained. The device borrower intercepts the memory release request of the virtual RNIC device driver, and after processing, unregisters the registered memory region in the security-enhanced address region of the control bridge.

[0062] Furthermore, after the control bridge is powered on, it enters the initialization state, and after the initialization is completed, the control bridge enters the available state. After receiving the command to start the security task, the control bridge enters the authentication state, where the control bridge is authenticated and the communication key is obtained. At this time, the communication key is the communication key for data transmission between the device lender bus and the device borrower bus.

[0063] After entering the secure task running state, the system acquires the transmission data between the borrowing bus and the virtualized RNIC device. If the transmission data is application data for RDMA transmission, a specific communication key, independent of the communication key used for data transmission between the lending bus and the borrowing bus, is used to enhance the security of the RDMA transmission application data. Specifically, when the virtualized RNIC device on the lending bus accesses the borrowing bus through the control bridge, it determines whether the access address falls within the security-enhanced address region of the control bridge. If the access address falls within this region, the control bridge, based on the specific communication key, encrypts the RDMA transmission application data input to the control bridge and decrypts the RDMA transmission application data output from the control bridge.

[0064] In practical applications, the security enhancement processing in this embodiment is an additional addition to the communication security between the device lender bus and the device borrower bus. Therefore, in this embodiment, after decrypting all data input from the device lender bus based on the communication key, if the transmitted data is application data for RDMA transmission, the application data for RDMA transmission input to the control bridge is encrypted based on a specific communication key, and the application data for RDMA transmission output from the control bridge is decrypted based on the specific communication key. Then, the control bridge uses the communication key to encrypt all data output to the device lender bus.

[0065] In this embodiment, the specific communication key used for security enhancement processing is independent of the communication key used for data transmission between the device lending bus and the device borrowing bus. The acquisition methods are the same, and it is necessary to ensure that the specific communication keys used for security enhancement at both ends of the application data transmission performing RDMA are consistent.

[0066] Based on the above embodiments, the present invention also provides a system for securely using cross-bus domain RNIC devices for RDMA operations. The system is applied to the method described in the above method embodiments for securely using cross-bus domain RNIC devices for RDMA operations. The system includes: a device borrower, a device lender, and a connection bridge. The connection bridge connects the buses corresponding to the device borrower and the device lender, respectively. The device lender includes the control bridge and the virtualized RNIC device. The control bridge connects the virtualized RNIC device and the bus of the device lender. The connection bridge receives access request information and forwards the access request information to the bus domain of the device borrower. Specifically, the control bridge includes at least: a data acquisition module, a specific communication key acquisition module, and a security enhancement processing module. Specifically, the data acquisition module, after entering a secure task running state, acquires the data transmission between the device borrower's bus and the virtualized RNIC device. The specific communication key acquisition module is used to acquire a specific communication key if the transmitted data is application data for RDMA transmission. This communication key is independent of the communication key used for data transmission between the device lender bus and the device borrower bus. The application data for RDMA transmission includes memory data that has been registered in memory. The security enhancement processing module is used to perform security enhancement processing on the application data for RDMA transmission based on the specific communication key. This security enhancement processing is independent of the communication security processing between the device lender bus and the device borrower bus.

[0067] In this embodiment, the functions of each module in the system for securely using cross-bus domain RNIC devices for RDMA operations are the same as those in the steps described in the above method embodiments, and will not be repeated here.

[0068] Based on the above embodiments, the present invention also provides a terminal, the principle block diagram of which can be as follows: Figure 5 As shown. The terminal may include one or more processors 100 ( Figure 5 (Only one is shown in the image), memory 101, and a computer program 102 stored in memory 101 and executable on one or more processors 100, such as a program for securely performing RDMA operations using a cross-bus domain RNIC device. When one or more processors 100 execute computer program 102, they can implement the various steps in the method embodiment for securely performing RDMA operations using a cross-bus domain RNIC device. Alternatively, when one or more processors 100 execute computer program 102, they can implement the functionality of various modules / units in the method embodiment for securely performing RDMA operations using a cross-bus domain RNIC device, which is not limited here.

[0069] In one embodiment, the processor 100 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0070] In one embodiment, memory 101 may be an internal storage unit of an electronic device, such as a hard drive or RAM. Memory 101 may also be an external storage device of the electronic device, such as a plug-in hard drive, smart media card (SMC), secure digital (SD) card, flash card, etc. Furthermore, memory 101 may include both internal and external storage units. Memory 101 is used to store computer programs and other programs and data required by the terminal. Memory 101 can also be used to temporarily store data that has been output or will be output.

[0071] Those skilled in the art will understand that Figure 5 The block diagram shown is merely a partial structural diagram related to the present invention and does not constitute a limitation on the terminal to which the present invention is applied. A specific terminal may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0072] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the methods described above. Any references to memory, storage, operational databases, or other media used in the embodiments provided by this invention can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual operating data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0073] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for securely performing RDMA operations using cross-bus domain RNIC devices, characterized in that, The method includes: After entering the running security task state, acquire the transmission data between the device borrower bus and the virtualized RNIC device; If the transmitted data is application data for RDMA transmission, then a specific communication key is obtained. This specific communication key is independent of the communication key for data transmission between the device lender bus and the device borrower bus. The application data for RDMA transmission includes memory data that has been registered in memory. Based on the specific communication key, security enhancement processing is performed on the application data transmitted via RDMA, including: When a virtual RNIC device in the device lending bus accesses the device lending bus through the control bridge, it is determined whether the access address falls within the security-enhanced address region of the control bridge. If the access address falls within the security-enhanced address region of the control bridge, the control bridge, based on the specific communication key, encrypts the application data input to the control bridge for RDMA transmission and decrypts the application data output by the control bridge for RDMA transmission, including: After decrypting all data input from the device's lending bus, the application data input to the control bridge for RDMA transmission is encrypted based on the specific communication key; After decrypting the application data for RDMA transmission output by the control bridge based on the specific communication key, the control bridge then encrypts all data output to the device lender bus. The security enhancement process is an additional step added on top of the existing security processing for communication between the device lender's bus and the device borrower's bus. A security-enhanced address region is set in the control bridge, which is used to trigger the security-enhanced processing. When a virtual RNIC device accesses all external PCIe devices through the control bridge, as long as the address falls within the security-enhanced address region, the control bridge performs security-enhanced processing on the payload of the access. During memory registration, the device borrower intercepts the memory registration request of the virtual RNIC device driver, registers the memory region that needs to be registered to the security-enhanced address region of the control bridge, and submits the memory registration request again after successful registration. After memory registration, the registered memory region is obtained. The device borrower intercepts the memory release request of the virtual RNIC device driver, and after processing, unregisters the registered memory region in the security-enhanced address region of the control bridge.

2. A system for securely using cross-bus domain RNIC devices for RDMA operations, characterized in that, The system is applied to the method for securely using cross-bus domain RNIC devices to perform RDMA operations as described in claim 1 above. The system includes: a device borrower, a device lender, and a connection bridge, wherein the connection bridge is used to connect the buses corresponding to the device borrower and the device lender, respectively. The device lender includes the control bridge and the virtualized RNIC device, and the control bridge is used to connect the bus of the virtualized RNIC device and the device lender; The connection bridge is used to receive access request information and forward the access request information to the bus domain of the device borrower. The control bridge includes at least: The data acquisition module is used to acquire the data transmission between the device borrower bus and the virtualized RNIC device after entering the running security task state. A specific communication key acquisition module is used to acquire a specific communication key if the transmitted data is application data for RDMA transmission. The specific communication key is independent of the communication key for data transmission between the device lender bus and the device borrower bus. The application data for RDMA transmission includes memory data that has been registered in memory. The security enhancement processing module is used to perform security enhancement processing on the application data transmitted via RDMA based on the specific communication key. The security enhancement processing is an additional step on top of the communication security processing between the device lender bus and the device borrower bus.

3. A terminal, characterized in that, The terminal includes a memory, a processor, and a program stored in the memory and executable on the processor for securely using a cross-bus domain RNIC device to perform RDMA operations. When the processor executes the program for securely using a cross-bus domain RNIC device to perform RDMA operations, it implements the steps of the method for securely using a cross-bus domain RNIC device to perform RDMA operations as described in claim 1.

4. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a program for securely using a cross-bus-domain RNIC device to perform RDMA operations. When the program for securely using a cross-bus-domain RNIC device to perform RDMA operations is executed by a processor, it implements the steps of the method for securely using a cross-bus-domain RNIC device to perform RDMA operations as described in claim 1.

Images