Data encryption transmission method and system based on RDMA

Abstract

The invention relates to a data encryption transmission method and system based on RDMA (Remote Direct Memory Access), and the method comprises the steps: in a user mode driver or a kernel mode driver, when an application calls a create qp function, defaulting to distribute a memory buffer with a fixed size, and registering the memory buffer into an mr to obtain a memory mr specially used for encryption mode transmission; when a user application program calls a modify qp function to switch the QP state to RTS, the distributed memory cache is initialized, an encrypted character is generated and filled in the memory mr, and the encrypted character is packaged into a network frame through RDMA hardware and then sent to a receiving end; the sending end analyzes the encrypted character and modifies the operation mode of the RDMA hardware DMA access memory corresponding to the configuration; and the receiving end analyzes the encrypted characters, modifies and configures the opposite operation mode into a register of a DMA access memory of RDMA hardware, and performs corresponding data increase and decrease operation through the configured DMA operation mode to complete decryption and recovery of the data. According to the invention, the security problem of data transmission can be solved.

Description

Technical Field

[0001] The present invention belongs to the field of communication technology, and in particular relates to a data encryption transmission method and system based on RDMA. Background Art

[0002] Remote Direct Memory Access (RDMA) is a high-performance data communication technology that can quickly transfer data directly from the memory of one system to the memory of another remote system, without requiring the involvement of the operating system or central processing unit (CPU). Compared to traditional TCP transmission methods, RDMA reduces CPU consumption during data transmission, reduces memory bandwidth and CPU cycles, and improves system performance. RDMA offers high bandwidth, low latency, and low CPU utilization. When performing RDMA operations, existing smart network cards typically encapsulate the data in the memory (MR) registered by the application into network frames through hardware and send them out. If the application does not encrypt the data in this memory cache, it can easily be intercepted by intermediate nodes such as switches and their contents can be obtained by sniffing the data packets, posing security risks. Encrypting the data in the application increases complexity and consumes CPU resources, reducing performance.

[0003] In modern enterprise-level data centers, RDMA technology is gaining more and more attention and is being used by more and more applications. In actual scenarios, in addition to dealing with network bandwidth and latency performance, it is also necessary to pay attention to the security of the network transmission itself, especially in systems such as online finance, where network transmission security is crucial. As a relatively new communication technology in data centers, RDMA still has some imperfections in terms of data transmission security. Currently, RDMA data encryption mainly relies on the CPU to encrypt the data first, and then the RDMA hardware obtains the encrypted data for transmission. This method is actually more complex and cumbersome to implement, and it also stifles the high-performance advantage of RDMA to a certain extent. The technical defects of using pure software encryption methods and hardware encryption methods are as follows:

[0004] 1. Using pure software encryption method:

[0005] The sending application first encrypts the data to be sent, and then tells the receiving application the specific encryption method. Finally, after the receiving application receives the data, it uses the corresponding decryption method to decrypt the data before processing the specific business of the application. This method not only consumes a lot of CPU computing resources, but also increases the processing flow and complexity of the application, reducing the performance of the application. The existing RDMA sending process is as follows Figure 1 shown.

[0006] 2. Using hardware encryption:

[0007] By adding an encryption chip to the hardware and then encrypting the data before sending it, the hardware design complexity and production cost will be increased. In addition, after the hardware is produced, its encryption algorithm cannot be upgraded or changed, which lacks flexibility. Figure 2 As shown, the existing hardware receiving process is as follows Figure 3 shown. Summary of the Invention

[0008] The purpose of the present invention is to provide a data encryption transmission method and system based on RDMA. By modifying the RDMA hardware and driver, the method prevents user data from being transmitted in plain text. Even if the data packet is monitored and captured, its valid content cannot be obtained, thereby solving the security problem of data transmission.

[0009] The present invention provides a data encryption transmission method based on RDMA, comprising the following steps:

[0010] Step 1: In the user-mode driver or kernel-mode driver, when the application calls the create qp function, a fixed-size memory buffer is allocated by default and registered in an mr, obtaining a memory mr specifically for encrypted transmission.

[0011] Step 2: When the user application calls the modify qp function to switch the QP state to RTS, the driver automatically initializes the memory buffer allocated in step 1 through the post send function, generates an encrypted character and fills it into the memory mr. The initialized memory mr is then encapsulated into a network frame through the RDMA hardware and sent to the receiving end.

[0012] Step 3: The sending end parses the encrypted characters generated in step 2 and modifies the corresponding RDMA hardware DMA memory access operation mode, including data addition and subtraction operations, so that the network frame sent by the RDMA hardware is encrypted data after DMA processing;

[0013] In step 4, after receiving the memory mr filled with encrypted characters automatically sent by the driver in step 2, the receiving end parses the encrypted characters and modifies the operation mode opposite to that in step 3 to the register of the DMA access memory of the RDMA hardware. This allows the receiving end to perform the corresponding data addition and subtraction operations through the configured DMA operation mode when the DMA moves the data packets sent by the subsequent application to the user-allocated memory after receiving the data packets, thereby completing the decryption and restoration of the data.

[0014] Furthermore, the memory mr described in step 1 is not perceived by the user application and is only used within the driver.

[0015] Furthermore, in step 2, the memory mr is sent in plain text.

[0016] Furthermore, in step 2, the memory mr is sent using a predetermined fixed encryption method.

[0017] Furthermore, the fixed encryption method includes adding an interface and setting an encryption method by a user program.

[0018] The present invention also provides an RDMA-based data encryption transmission system, comprising a data encryption transmission module, wherein the data encryption transmission module executes the RDMA-based data encryption transmission method.

[0019] The present invention also provides a non-transitory computer-readable storage medium, which stores computer instructions. When the computer instructions are executed by a processor, the RDMA-based data encryption transmission method is implemented.

[0020] The present invention also provides an electronic device, comprising:

[0021] A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the RDMA-based data encryption transmission method by executing the computer instructions.

[0022] The above solution, through the RDMA-based data encryption transmission method and system, has the following technical effects:

[0023] (1) It does not require the perception and participation of the application. The application does not need to encrypt its business data and can directly send data to memory, avoiding wasting CPU resources.

[0024] (2) Simple mathematical operations such as addition, subtraction, and XOR supported by existing DMA hardware are directly applied to encrypt data. There is no need to add a dedicated encryption module to the RDMA hardware, which avoids the complexity of hardware design and reduces hardware production costs.

[0025] (3) Each QP can use a different encryption method, which increases the difficulty of cracking and also increases flexibility; there is no need for application management and exchange of encryption methods, which simplifies application development while ensuring security.

[0026] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention and implement it according to the contents of the specification, the following is a detailed description of the preferred embodiments of the present invention with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 Send flow chart for existing RDMA;

[0028] Figure 2 Send flow charts for existing hardware;

[0029] Figure 3 Receive flow charts for existing hardware;

[0030] Figure 4 This is the RDMA sending flow chart of the present invention;

[0031] Figure 5 Sending a flow chart for the hardware of the present invention;

[0032] Figure 6 This is a flowchart of the hardware receiving process of the present invention;

[0033] Figure 7 This is an overall flow chart of the RDMA-based data encryption transmission method of the present invention;

[0034] Figure 8 The figure is a schematic structural diagram of an electronic device of the present invention. DETAILED DESCRIPTION

[0035] The following embodiments of the present invention are described in further detail with reference to the accompanying drawings and examples. The following examples are used to illustrate the present invention but are not intended to limit the scope of the present invention.

[0036] Explanation of terms:

[0037] RDMA: remote direct memory access

[0038] QP:queue pair

[0039] mr:memory region

[0040] DMA: direct memory access

[0041] RTS: ready to send.

[0042] Ginseng Figure 7 As shown, this embodiment provides a data encryption transmission method based on RDMA, including the following steps:

[0043] In step S1, when an application calls the createqp function in a user-mode or kernel-mode driver, a fixed-size memory buffer is allocated by default and registered in an mr, resulting in a memory mr specifically for encrypted transmission. This memory mr is used exclusively for subsequent encrypted transmission and is not visible to the user application, but is used only within the driver.

[0044] In step S2, when the user application calls the modify qp function to switch the QP state to RTS, the driver automatically initializes the memory cache allocated in step S1 through the post send function, generates an encrypted character (which can be in a special format) and fills it into the memory mr. The initialized memory mr is encapsulated into a network frame through the RDMA hardware and sent to the receiving end.

[0045] In step S3, the sending end parses the encrypted characters generated in step S2 and modifies the corresponding RDMA hardware's DMA memory access operation, including data addition and subtraction operations, so that the network frames sent by the RDMA hardware are encrypted data processed by DMA. In this step, the data subsequently read by DMA from user memory mr is not directly packaged into network frames. Instead, the DMA first performs configuration operations, such as which ranges of values ​​need to be incremented or decremented. Finally, the network frames sent by the hardware are encrypted data processed by DMA.

[0046] In step S4, after receiving the memory mr filled with encrypted characters automatically sent by the driver in step 2, the receiving end parses the encrypted characters and modifies the operation mode opposite to that in step S3 into the register of the DMA access memory of the RDMA hardware. This allows the receiving end to perform corresponding data addition and subtraction operations through the configured DMA operation mode when the DMA moves the data packets sent by the subsequent application to the user-allocated memory after receiving the data packets, thereby completing the decryption and restoration of the data.

[0047] This data encryption transmission is a method for secure data transmission by encrypting and decrypting RDMA messages through software and hardware collaboration. This method allows applications to simply and efficiently process business data without having to worry about the encryption and decryption process of RDMA data messages. At the same time, the application does not need to add new interfaces and does not require any modification. It is directly compatible with old applications and supports different encryption methods for different qp. The RDMA sending process, hardware sending and receiving process of the present invention are described in detail. Figures 4 to 6 shown.

[0048] In this embodiment, the encrypted memory mr can be sent either in plain text (the actual meaning of the encrypted characters is also driver-specific and does not cause security issues) or in a pre-defined fixed encryption method.

[0049] In this embodiment, the encryption mode of the encrypted cache MR is randomly generated when creating a QP. In other examples, an interface can be added to allow the user program to set an encryption mode. In this way, not only each QP has a different encryption mode, but also the user can change the encryption mode at different times according to the needs of the same QP, and different QPs can also use the same encryption mode.

[0050] This embodiment further provides an RDMA-based data encryption transmission system, including a data encryption transmission module, which executes the RDMA-based data encryption transmission method.

[0051] This embodiment further provides a non-transitory computer-readable storage medium, which stores computer instructions. When the computer instructions are executed by a processor, the RDMA-based data encryption transmission method is implemented.

[0052] Ginseng Figure 8 As shown, this embodiment further provides an electronic device, including:

[0053] The memory 201 and the processor 202 are communicatively connected to each other. The memory 201 stores computer instructions. The processor 202 executes the computer instructions to perform the RDMA-based data encryption transmission method.

[0054] The present invention has the following technical effects:

[0055] (1) Applications do not need to be aware of or involved. Applications do not need to encrypt their business data and can directly send data to memory, avoiding wasting CPU resources. By modifying the user-mode and kernel-mode drivers to perform hardware encryption on RDMA transmitted data, the security of RDMA operations is increased. At the same time, no application modification or intervention is required, saving CPU computing resources.

[0056] (2) Data encryption is performed directly using simple mathematical operations such as addition, subtraction, and XOR supported by existing DMA hardware. This eliminates the need for specialized encryption modules in the RDMA hardware, reduces hardware design complexity, and lowers hardware production costs. By directly using the RDMA hardware to perform DMA memory access operations, user memory data is manipulated, eliminating the need for hardware encryption chip modules and reducing hardware complexity and costs.

[0057] (3) Each QP can use a different encryption method, which increases the difficulty of cracking and also increases flexibility. Applications do not need to manage and exchange encryption methods, which simplifies application development while ensuring security. Encrypted memory is allocated in the RDMA driver's createqp method, and the memory is initialized and sent when the modifyqp method switches the RTS. This ensures that each QP used by the user program uses a different encryption method. Furthermore, encryption function initialization and exchange can be completed before the user sends normal data, ensuring that all data packets sent by the user program are encrypted.

[0058] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A data encryption transmission method based on RDMA, characterized in that: The steps include: Step 1: In the user-mode driver or kernel-mode driver, when the application calls the create qp function, a fixed-size memory buffer is allocated by default and registered in an mr, obtaining a memory mr specifically for encrypted transmission. Step 2: When the user application calls the modify qp function to switch the QP state to RTS, the driver automatically initializes the memory buffer allocated in step 1 through the post send function, generates an encrypted character and fills it into the memory mr. The initialized memory mr is then encapsulated into a network frame through the RDMA hardware and sent to the receiving end. Step 3: The sending end parses the encrypted characters generated in step 2 and modifies the corresponding RDMA hardware DMA memory access operation mode, including data addition and subtraction operations, so that the network frame sent by the RDMA hardware is encrypted data after DMA processing; In step 4, after receiving the memory mr filled with encrypted characters automatically sent by the driver in step 2, the receiving end parses the encrypted characters and modifies the operation mode opposite to that in step 3 to the register of the DMA access memory of the RDMA hardware. This allows the receiving end to perform the corresponding data addition and subtraction operations through the configured DMA operation mode when the DMA moves the data packets sent by the subsequent application to the user-allocated memory after receiving the data packets, thereby completing the decryption and restoration of the data.

2. The RDMA-based data encryption transmission method according to claim 1, characterized in that: The memory mr described in step 1 is not perceived by the user application and is only used within the driver.

3. The RDMA-based data encryption transmission method according to claim 1, characterized in that: In step 2, the memory mr is sent in plain text.

4. The RDMA-based data encryption transmission method according to claim 1, characterized in that: In step 2, the memory mr is sent using a predetermined fixed encryption method.

5. The RDMA-based data encryption transmission method according to claim 4, characterized in that: The fixed encryption method includes adding an interface and setting an encryption method by a user program.

6. A data encryption transmission system based on RDMA, characterized in that: It comprises a data encryption transmission module, which executes the RDMA-based data encryption transmission method according to any one of claims 1 to 5.

7. A non-transitory computer-readable storage medium, characterized in that The non-transitory computer-readable storage medium stores computer instructions, and when the computer instructions are executed by a processor, the RDMA-based data encryption transmission method according to any one of claims 1 to 5 is implemented.

8. An electronic device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the RDMA-based data encryption transmission method according to any one of claims 1 to 5 by executing the computer instructions.

Images