Communication method and device based on remote direct memory access, computer equipment and storage medium

Abstract

The invention relates to a communication method and device based on remote direct memory access, computer equipment and a storage medium. The method comprises the following steps: when a first terminal detects an access connection request sent to a second terminal through an access function, intercepting the access connection request through a pre-configured dynamic link library, obtaining context information, packaging the context information into an authorization request, and sending the authorization request to an access security manager, and under the condition that a capability credential returned by the access security manager based on a preset security policy is received, injecting the capability credential into a private data field of the access connection request to obtain a target connection request, calling an access function to send the target connection request to the second terminal, and establishing remote access connection with the second terminal. By adopting the method, the network access security can be improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a communication method, apparatus, computer device, and storage medium based on remote direct memory access. Background Technology

[0002] With the rapid development of applications such as distributed storage, large-scale machine learning, and high-performance databases, the requirements for network latency and bandwidth within data centers are becoming increasingly stringent. Remote Direct Memory Access (RDMA) technology, especially its RoCEv2 protocol implemented over Ethernet, is gradually becoming the preferred network technology for modern cloud data centers due to its superior low latency and high throughput characteristics. RDMA bypasses the operating system kernel, allowing user-mode applications to directly manipulate the network interface card (NIC) for data transmission and reception, thereby eliminating the performance overhead caused by multiple data copies and context switches in the traditional TCP / IP protocol stack.

[0003] However, RDMA's performance advantage stems precisely from its bypass of the operating system kernel and protocol stack—software layers where traditional network security strategies (such as firewalls, TLS encryption, and IPsec) are implemented. This architectural bypass, while significantly boosting performance, also creates a security vacuum. RDMA was originally designed for physically isolated, mutually trusted high-performance computing (HPC) clusters, where its built-in security model is sufficient. However, when this trusted model derived from HPC is directly ported to a zero-trust, multi-tenant shared cloud environment, its inherent security flaws become glaringly apparent, posing a serious threat and failing to provide effective confidentiality and integrity guarantees. Summary of the Invention

[0004] Therefore, it is necessary to provide a communication method, apparatus, computer device, and storage medium based on remote direct memory access that can improve network access security, addressing the aforementioned technical problems.

[0005] In a first aspect, this application provides a communication method based on remote direct memory access, comprising:

[0006] Upon detecting an access connection request sent to the second terminal via an access function, the access connection request is intercepted using a pre-configured dynamic link library, and context information is obtained. The context information includes process identifier, user identifier, container identifier or container group name, source Internet Protocol address, destination Internet Protocol address, and port.

[0007] The context information is encapsulated into an authorization request, and the authorization request is sent to the access security manager;

[0008] Upon receiving capability credentials returned by the access security manager based on a preset security policy, the capability credentials are injected into the private data field of the access connection request to obtain the target connection request; the capability credentials include the permission scope, validity period, and anti-replay random number;

[0009] Call the access function to send a target connection request to the second terminal and establish a remote access connection with the second terminal.

[0010] In one embodiment, the method further includes:

[0011] A shadow remote key is generated by intercepting access connection requests through a pre-configured dynamic link library.

[0012] Upon detecting a data path operation, obtain the physical remote key associated with the shadow remote key, and construct hardware instructions based on the physical remote key.

[0013] In one embodiment, the preset security policy includes accessing the security manager to query the policy library to see if there is a policy that allows the first terminal to connect to the second terminal; the capability credential is generated by the access security manager after the authorization request is verified according to the preset security policy.

[0014] In one embodiment, the method further includes:

[0015] Upon receiving a connection instruction from the access security manager, update the parameters of the access function according to the connection instruction;

[0016] Send an access connection request to the second terminal using the updated access function.

[0017] Secondly, this application also provides a communication method based on remote direct memory access, including:

[0018] Upon receiving a connection request from the first terminal, capability credentials are extracted from the received connection request using a pre-configured dynamic link library.

[0019] Send the capability credentials to the access security manager and receive the verification results from the access security manager for the capability credentials; the verification results include the verification results for the capability credentials' validity period, anti-replay status, and information matching.

[0020] If the verification result is successful, the accept function is called to establish a remote access connection with the first terminal.

[0021] In one embodiment, the method further includes:

[0022] If the verification result is that the verification fails, the rejection function is called to return a connection rejection response to the first terminal.

[0023] Thirdly, this application also provides a communication device based on remote direct memory access, comprising:

[0024] The access interception module is used to intercept access connection requests sent to the second terminal through access functions and obtain context information by means of a pre-configured dynamic link library. The context information includes process identifier, user identifier, container identifier or container group name, source Internet Protocol address, destination Internet Protocol address and port.

[0025] The information encapsulation module is used to encapsulate context information into an authorization request and send the authorization request to the access security manager;

[0026] The credential injection module is used to inject capability credentials returned by the access security manager based on a preset security policy into the private data field of the access connection request to obtain the target connection request; the capability credentials include the permission scope, validity period and anti-replay random number;

[0027] The remote access module is used to call the access function to send a target connection request to the second terminal and establish a remote access connection with the second terminal.

[0028] Fourthly, this application also provides a communication device based on remote direct memory access, comprising:

[0029] The credential extraction module is used to extract capability credentials from the received connection request through a pre-configured dynamic link library when a connection request is received from the first terminal.

[0030] The credential verification module is used to send capability credentials to the access security manager and receive the verification results of the access security manager for the capability credentials; the verification results include the verification results of the capability credentials' validity period, anti-replay status, and information matching.

[0031] The access acceptance module is used to call the acceptance function to establish a remote access connection with the first terminal if the verification result is successful.

[0032] Fifthly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the method steps in the first and second aspects described above.

[0033] Sixthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method steps in the first and second aspects described above.

[0034] In a seventh aspect, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the method steps in the first and second aspects described above.

[0035] The aforementioned communication method, apparatus, computer device, and storage medium based on remote direct memory access, upon detecting an access connection request sent to a second terminal via an access function, intercepts the access connection request using a pre-configured dynamic link library, obtains context information, encapsulates the context information into an authorization request, and sends the authorization request to an access security manager. Upon receiving capability credentials returned by the access security manager based on a preset security policy, the capability credentials are injected into the private data field of the access connection request to obtain the target connection request. The access function is then invoked to send the target connection request to the second terminal, establishing a remote access connection with the second terminal. This enables zero-trust authentication and access control in a multi-tenant environment, ensuring the integrity and confidentiality of connection requests, thereby improving network access security. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0037] Figure 1 This is an application environment diagram of a communication method based on remote direct memory access in one embodiment;

[0038] Figure 2 This is a flowchart illustrating a communication method based on remote direct memory access in one embodiment;

[0039] Figure 3 This is a flowchart illustrating a communication method based on remote direct memory access in one embodiment;

[0040] Figure 4 This is a flowchart illustrating a communication method based on remote direct memory access in another embodiment;

[0041] Figure 5 This is a structural block diagram of a communication device based on remote direct memory access in one embodiment;

[0042] Figure 6 This is a structural block diagram of a communication device based on remote direct memory access in one embodiment;

[0043] Figure 7This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0044] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0045] The communication method based on remote direct memory access provided in this application can be applied to, for example... Figure 1 In the application environment shown, the first terminal 102 communicates with the second terminal 104 via a network. A data storage system can store the data that the second terminal 104 needs to process. The data storage system can be integrated into the second terminal 104 or placed in the cloud or on another network-connected second terminal. The first terminal 102, upon detecting an access connection request sent to the second terminal via an access function, intercepts the access connection request using a pre-configured dynamic link library, obtains context information, encapsulates the context information into an authorization request, sends the authorization request to the access security manager, injects it into the private data field of the access connection request, obtains the target connection request, calls the access function to send the target connection request to the second terminal, and establishes a remote access connection with the second terminal. The first terminal 102 or the second terminal 104 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, drones, low-altitude aircraft, IoT devices, and portable wearable devices. IoT devices can be smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, projection devices, etc. Portable wearable devices can be smartwatches, smart bracelets, head-mounted devices, etc. Head-mounted devices can include virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc.

[0046] In one exemplary embodiment, such as Figure 2 As shown, a communication method based on remote direct memory access is provided, which can be applied to... Figure 1 Taking the first terminal 102 as an example, the explanation includes the following steps 202 to 208. Wherein:

[0047] S202: Upon detecting an access connection request sent to a second terminal via an access function, the access connection request is intercepted using a pre-configured dynamic link library, and context information is obtained. The context information includes process identifier, user identifier, container identifier or container group name, source Internet Protocol address, destination Internet Protocol address, and port.

[0048] Optionally, when a tenant's first terminal application initiates an access connection request to a second terminal via an RDMA access function, a dynamic link library (DLL) pre-loaded into the application process via a DLL pre-loading mechanism will capture the call to this access function and suspend the execution of the original request. Simultaneously, the interception library proactively collects multi-dimensional context information, covering two key dimensions: identity and network location, ensuring that subsequent authorization accurately associates the request subject with the access target. The DLL, as the interception library, is designed to be injected into the target tenant application's process address space during startup via a DLL pre-loading mechanism. Internally, the interception library implements a series of wrapper functions with the same names and signatures as key functions in the standard RDMA library. When the application calls these standard functions, the actual function executed is the wrapper function from the interception library. The intercepted key functions include, but are not limited to, connection management, resource management, and data path functions.

[0049] The identity identifiers include process identifiers (PID, identifying the specific process initiating the request), user identifiers (UID / GID, associated with the user's permissions within the tenant), and container identifiers or container group names (such as Docker container ID, K8sPod name, adapting to multi-tenant containerized scenarios and accurately distinguishing resources from different tenants). The network location identifiers include the source internet protocol address (first terminal IP, confirming the request source) and the destination internet protocol address and port (second terminal IP and port, specifying the access target). This information is the core basis for the subsequent access security manager to determine the legitimacy of the request, avoiding misjudgments of authorization due to missing information.

[0050] S204: Encapsulate the context information into an authorization request and send the authorization request to the access security manager.

[0051] Optionally, the interception library encapsulates the collected structured context information into an authorization request (such as structured data containing identity and network information) according to a preset format and sends it to the centralized Access Security Manager (RSPM) via an encrypted channel. The encrypted channel prevents the authorization request from being stolen or tampered with during transmission, ensuring that the context information received by RSPM is authentic and reliable. RSPM, as the trusted authorization core of the solution, performs two key operations based on the received authorization request: first, it verifies the identity of the requesting entity (e.g., confirming tenant legitimacy through UID / GID and container identifier); second, it matches a preset security policy (e.g., tenant A is only allowed to access tenant B's RDMA service on port 3306), providing a basis for subsequent credential issuance decisions.

[0052] S206: Upon receiving capability credentials returned by the access security manager based on a preset security policy, inject the capability credentials into the private data field of the access connection request to obtain the target connection request; the capability credentials include the permission scope, validity period, and anti-replay random number.

[0053] Optionally, when the interception library receives a valid capability credential returned by RSPM, it injects the credential into the private data field of the original access connection request (i.e., the field in the RDMA protocol that allows carrying custom data), forming the target connection request. If no valid credential is received (e.g., the request is rejected by RSPM), an error is directly returned to the application, blocking the connection. The capability credential includes key fields such as permission scope, validity period, and anti-replay random number. The permission scope is used to explicitly define allowed access operations (e.g., RDMA read / write permissions) and associated resources (e.g., specifying QP, MR), ensuring the request does not exceed the authorized boundaries; the validity period limits the credential's usage time, preventing expired credentials from being reused and reducing the risk of leakage; the anti-replay random number (nonce) prevents attackers from stealing credentials and repeatedly initiating connection requests, further enhancing security. These fields, combined with RSPM's private key signature, ensure that the credential is unforgeable, unalterable, and unreusable.

[0054] S208: Call the access function to send a target connection request to the second terminal and establish a remote access connection with the second terminal.

[0055] Optionally, after completing the credential injection, the interception library calls the original RDMA access function to submit the target connection request carrying the capability credentials to the RDMA network card. The hardware then forwards the request to the second terminal according to the RoCEv2 protocol. The interception library on the second terminal extracts the credentials from the fields and requests RSPM verification again. After successful verification, it calls the access function to complete the connection, ultimately establishing a legitimate RDMA remote access connection between the first and second terminals. Without modifying the core logic of the RDMA access function, security enhancement is achieved solely through parameter injection (credentials). This ensures both the low-latency performance advantages of RDMA kernel bypass and zero-copy, while also meeting the deployment requirements of being transparent to applications and not dependent on specific hardware.

[0056] In the aforementioned communication method based on remote direct memory access, upon detecting an access connection request sent to the second terminal via an access function, the method intercepts the access connection request using a pre-configured dynamic link library, obtains context information, encapsulates the context information into an authorization request, and sends the authorization request to the access security manager. Upon receiving capability credentials returned by the access security manager based on a preset security policy, the capability credentials are injected into the private data field of the access connection request to obtain the target connection request. The method then calls the access function to send the target connection request to the second terminal, establishing a remote access connection with the second terminal. This method enables zero-trust authentication and access control in a multi-tenant environment, ensuring the integrity and confidentiality of connection requests, thereby improving network access security.

[0057] In an exemplary embodiment, the method further includes: generating a shadow remote key when an access connection request is intercepted via a pre-configured dynamic link library; and obtaining the physical remote key associated with the shadow remote key when a data path operation is detected, and constructing hardware instructions based on the physical remote key.

[0058] Optionally, when the first terminal application initiates an RDMA access connection request, it typically needs to first perform a memory registration operation to register the local memory region (MR) to be remotely accessed with the RDMA network interface card (RNIC). This operation is intercepted by a pre-configured dynamic link library to ensure that the security control of memory registration and connection requests forms a closed loop. After intercepting the access function call, the interception library does not directly execute the original function. Instead, it first generates a shadow remote key (distinct from the physical key generated by the RDMA network card) in its own security module using a random algorithm (such as a pseudo-random number generation algorithm with high encryption strength). Subsequently, the interception library internally calls the standard access function to initiate a real memory registration request to the RDMA network card and obtains the physical remote key (the hardware-level legitimate key used for actual memory access) and memory region identifier (MR handle) returned by the network card. The interception library establishes a mapping relationship between the shadow remote key and the physical remote key, MR handle, and access permissions in its internal secure storage module (such as an encrypted hash table). (This mapping is only accessible to the interception library and must be stored in an encrypted manner to prevent tampering.) Ultimately, the interception library returns the generated shadow remote key to the first terminal application instead of the real physical remote key. The application mistakenly believes that the shadow key is a legitimate memory access key, and all subsequent data path operations will use the shadow key.

[0059] Furthermore, when the first terminal application completes memory registration and initiates a data path operation, the interception library will detect this operation in real time and intercept it again. The data path operation is directly related to memory access and is a critical step for attackers attempting to illegally access memory by stealing the rkey; therefore, key replacement is necessary to ensure security. After intercepting the data path operation function call, the interception library first extracts the shadow remote key from the parameters passed by the application (the application still uses the shadow key to initiate the request). The interception library queries the mapping relationship in the internal secure storage and matches the extracted shadow remote key with the corresponding physical remote key, MR handle, and access permissions. If no matching record is found (e.g., the shadow key is invalid or expired), an error is directly returned to the application, blocking the data path operation. If a valid physical remote key is found, the interception library modifies the core parameters of the data path operation, replacing the shadow remote key passed by the application with the real physical remote key, and combines this with information such as the MR handle and data transmission length to construct hardware instructions conforming to the RDMA network card interface specification. Finally, the interception library calls the raw interface of the standard RDMA function, submits the hardware instruction carrying the physical remote key to the RDMA network card, and after the network card verifies the legality of the physical rkey, it performs zero-copy, kernel-bypassed data transmission operation.

[0060] In this embodiment, by intercepting access connection requests through a pre-configured dynamic link library, a shadow remote key is generated. When a data path operation is detected, the physical remote key associated with the shadow remote key is obtained. Hardware instructions are constructed based on the physical remote key, which can ensure the confidentiality and integrity of memory access, decouple the application layer from the hardware key, and improve the flexibility of security management.

[0061] In an exemplary embodiment, the preset security policy includes accessing the security manager to query the policy library to see if there is a policy that allows the first terminal to connect to the second terminal; the capability credential is generated by the access security manager after the authorization request is verified according to the preset security policy.

[0062] Optionally, the preset security policy is a set of dynamically updatable access control rules pre-configured by the administrator in the RSPM policy library based on the security requirements of the multi-tenant cloud environment. These policies cover the association logic of tenant identity, access target, and operation permission. For example, at the tenant level: only allow the application container group of tenant A to initiate RDMA connections to the second terminal within tenant A, and prohibit cross-tenant access. As the core data module of RSPM, the policy library stores these rules in a structured format, supporting administrators to dynamically add, delete, modify, and query through a visual interface or API, meeting the flexible security management needs of the cloud environment. When RSPM receives an authorization request sent by the first terminal interception library, it first extracts the tenant identity of the first terminal from the context information of the authorization request to ensure that the request subject can be accurately located. It matches the destination IP and port in the authorization request with the allowed second terminal address / port in the policy library to filter out candidate policies related to the access target. In the candidate policies, it further verifies whether the identity and application type of the first terminal tenant meet the subject conditions allowed to initiate the request in the policy, and at the same time confirms whether the requested RDMA operation (such as connection establishment) is within the permission scope allowed by the policy. If a perfectly matching preset security policy exists, the authorization request is deemed to have passed verification; if no matching policy exists (e.g., cross-tenant access is unauthorized, or the access port is not in the allowed list), the verification is deemed to have failed, and a rejection response is returned to the first terminal interception library.

[0063] Furthermore, RSPM will only initiate the capability credential generation process after the authorization request passes the preset security policy verification. This credential is a cryptographically secure digital token generated by RSPM based on an asymmetric encryption algorithm, and its core content strictly corresponds to the verified preset security policy. After generating the capability credential, RSPM will return it to the first terminal interception database through an encrypted channel. The encrypted channel ensures that the credential is not stolen or tampered with during transmission. Once received, the first terminal interception database can use it for subsequent operations to inject access connection requests.

[0064] In an exemplary embodiment, the method further includes: upon receiving a connection instruction returned by the access security manager, updating the parameters of the access function according to the connection instruction; and sending an access connection request to the second terminal through the updated access function.

[0065] Optionally, the connection command is a dynamic control command issued by RSPM to the first terminal interception library after completing the authorization request verification. It, along with the capability credentials, constitutes RSPM's authorization output; the former focuses on parameter-level control, and the latter on identity-level verification. After sending the authorization request to RSPM, the first terminal interception library continuously monitors RSPM's response. Upon receiving the connection command, it first performs a preset format validation, then parses the key control fields in the command, converting them into parameter adjustment rules applicable to the RDMA access function. Based on the parameter adjustment rules of the connection command, the interception library corrects the key parameters of the access function for compliance. After the parameters are updated, the interception library calls the updated access function to initiate an RDMA access connection request to the second terminal. At this point, the request parameters fully comply with RSPM's preset security policy. After this request is sent, it triggers interception by the second terminal's interception library. The second terminal interception library submits this information to RSPM for secondary verification. After successful verification, it calls the accept function to complete the connection establishment.

[0066] In this embodiment, by updating the parameters of the access function according to the connection instruction returned by the access security manager, and sending the access connection request to the second terminal through the updated access function, parameter-level compliance control of access requests can be achieved, the dynamic implementation capability of security policies can be strengthened, and the flexible needs of cloud environments can be adapted to, thereby improving access security.

[0067] In one exemplary embodiment, such as Figure 3 As shown, a communication method based on remote direct memory access is provided, which can be applied to... Figure 1 Taking the second terminal 104 as an example, the explanation includes the following steps 302 to 306. Wherein:

[0068] S302: Upon receiving a connection request from the first terminal, extract capability credentials from the received connection request using a pre-configured dynamic link library.

[0069] Optionally, when the second terminal receives a connection request from the first terminal via the RDMA protocol, a dynamic link library pre-injected into the second terminal's application process will actively intercept the connection request reception process. Subsequently, the interception library extracts the capability credentials injected by the first terminal from the fields of the connection request. This field is a reserved field in the RDMA protocol that allows carrying custom data, and the second terminal's interception library can obtain the credential content by parsing this field. The core prerequisite for this extraction operation is the consistency of the credential storage location. Both the first and second terminal interception libraries follow preset rules for injecting private fields into the capability credentials, ensuring that the second terminal can accurately locate and extract the credential. Simultaneously, the extracted capability credentials must be stored in association with the context of the connection request sent by the first terminal, providing data support for subsequent information matching verification.

[0070] S304: Send the capability credentials to the access security manager and receive the verification results of the access security manager for the capability credentials; the verification results include the verification results of the capability credentials' validity period, anti-replay status, and information matching.

[0071] Optionally, the second terminal interception library packages the extracted capability credentials along with the actual context information of the current connection request (such as the source IP of the first terminal, the destination IP / port of the second terminal, and the tenant identifier of the second terminal application) and sends it to RSPM via a TLS encrypted channel to initiate a credential verification request. RSPM, as the only trusted verification party in the scheme, performs three core verifications on the capability credentials. The first is credential validity verification, which involves parsing the expiration time field in the credential and determining whether the current time is between the expiration time and the effective time. If the expiration time has expired, the verification fails. The second is anti-replay status verification, which involves extracting the anti-replay random number from the credential, querying the internal list of used anti-replay random numbers, and determining that the verification fails if the random number already exists (indicating that the credential has been reused). If the random number does not exist, the anti-replay random number is recorded to prevent subsequent replays. The third is information matching verification, which involves comparing the first terminal identity (such as tenant ID) and target access information (such as the IP / port of the second terminal) carried in the credential with the actual connection context information submitted by the second terminal interception library. If the two are inconsistent, the verification fails. After RSPM completes the verification, it returns a result of successful or failed verification to the second terminal interception database (if it fails, it will include a reason, such as expired credentials or mismatched information). This result is also transmitted through an encrypted channel to ensure that it is not tampered with.

[0072] S306: If the verification result is successful, call the accept function to establish a remote access connection with the first terminal.

[0073] Optionally, if the second terminal interception library receives a successful verification result from RSPM, it will resume the suspended connection event handling process and call the accept function in the standard RDMA library. This function is the native function in the RDMA protocol for the second terminal to respond to the first terminal's connection request and establish a bidirectional communication link. The interception library calls the unmodified standard function to ensure compliance with the RoCEv2 protocol specification. After the function is called, the second terminal's RDMA network card will complete link negotiation (such as QP pairing and memory area permission confirmation) with the first terminal's RDMA network card, and finally establish a remote access connection between the first and second terminals.

[0074] In this embodiment, upon receiving a connection request from the first terminal, capability credentials are extracted from the received connection request using a pre-configured dynamic link library. These capability credentials are then sent to the access security manager, and the verification result of the access security manager is received. If the verification result is successful, an acceptance function is called to establish a remote access connection with the first terminal. This enables zero-trust authentication and access control in a multi-tenant environment, ensuring the integrity and confidentiality of connection requests, thereby improving network access security.

[0075] In an exemplary embodiment, the method further includes: if the verification result is that the verification fails, calling a rejection function to return a connection rejection response to the first terminal.

[0076] Optionally, if the verification result is a failure, the second terminal interception library will directly call the RDMA native connection rejection function to destroy the current connection request and return an error message to the second terminal application, thereby blocking the establishment of an illegal connection, filling the RDMA native security vulnerability, preventing illegal requests from occupying the second terminal resources, and ensuring service availability.

[0077] In one exemplary embodiment, such as Figure 4 As shown, a communication method based on remote direct memory access is provided, which includes the following steps:

[0078] When the first terminal detects an access connection request sent to the second terminal through an access function, it intercepts the access connection request through a pre-configured dynamic link library and obtains context information. The context information includes process identifier, user identifier, container identifier or container group name, source Internet Protocol address, destination Internet Protocol address, and port.

[0079] When the first terminal intercepts the access connection request through a pre-configured dynamic link library, it generates a shadow remote key; when a data path operation is detected, it obtains the physical remote key associated with the shadow remote key and constructs hardware instructions based on the physical remote key.

[0080] The first terminal encapsulates the context information into an authorization request and sends the authorization request to the access security manager.

[0081] Upon receiving the capability credentials returned by the access security manager based on a preset security policy, the first terminal injects the capability credentials into the private data field of the access connection request to obtain the target connection request. The capability credentials include the permission scope, validity period, and a replay protection random number. The preset security policy includes the access security manager querying the policy library to see if there is a policy that allows the first terminal to connect to the second terminal. The capability credentials are generated by the access security manager after the authorization request is verified and approved according to the preset security policy.

[0082] The first terminal calls the access function to send a target connection request to the second terminal, establishing a remote access connection with the second terminal.

[0083] Upon receiving the connection instruction returned by the access security manager, the first terminal updates the parameters of the access function according to the connection instruction; and sends an access connection request to the second terminal through the updated access function.

[0084] When the second terminal receives a connection request from the first terminal, it extracts capability credentials from the received connection request through a pre-configured dynamic link library; sends the capability credentials to the access security manager, and receives the verification result of the access security manager for the capability credentials; the verification result includes the verification result of the capability credentials' validity period, anti-replay status, and information matching; if the verification result is successful, it calls the accept function to establish a remote access connection with the first terminal.

[0085] If the second terminal fails the verification, it calls the rejection function to return a connection rejection response to the first terminal.

[0086] In this embodiment, when the first terminal detects an access connection request sent to the second terminal via an access function, it intercepts the access connection request through a pre-configured dynamic link library, obtains context information, encapsulates the context information into an authorization request, and sends the authorization request to the access security manager. Upon receiving the capability credentials returned by the access security manager based on a preset security policy, the first terminal injects the capability credentials into the private data field of the access connection request to obtain the target connection request. It then calls the access function to send the target connection request to the second terminal, establishing a remote access connection with the second terminal. This enables zero-trust authentication and access control in a multi-tenant environment, ensuring the integrity and confidentiality of the connection request, thereby improving network access security.

[0087] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0088] Based on the same inventive concept, this application also provides a remote direct memory access-based communication device for implementing the aforementioned communication method based on remote direct memory access. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more embodiments of the communication device based on remote direct memory access provided below can be found in the limitations of the communication method based on remote direct memory access described above, and will not be repeated here.

[0089] In one exemplary embodiment, such as Figure 5 As shown, a communication device based on remote direct memory access is provided, including: an access interception module 502, an information encapsulation module 504, a credential injection module 506, and a remote access module 508, wherein:

[0090] The access interception module 502 is used to intercept the access connection request and obtain context information by means of a pre-configured dynamic link library when an access connection request sent to the second terminal through an access function is detected. The context information includes process identifier, user identifier, container identifier or container group name, source Internet Protocol address, destination Internet Protocol address and port.

[0091] The information encapsulation module 504 is used to encapsulate the context information into an authorization request and send the authorization request to the access security manager.

[0092] The credential injection module 506 is used to inject the capability credentials returned by the access security manager based on a preset security policy into the private data field of the access connection request to obtain the target connection request; the capability credentials include the permission scope, validity period and anti-replay random number.

[0093] The remote access module 508 is used to call the access function to send a target connection request to the second terminal and establish a remote access connection with the second terminal.

[0094] In an exemplary embodiment, the access interception module 502 is further configured to generate a shadow remote key when an access connection request is intercepted through a pre-configured dynamic link library; and to obtain the physical remote key associated with the shadow remote key and construct hardware instructions based on the physical remote key when a data path operation is detected.

[0095] In an exemplary embodiment, the preset security policy involved in the credential injection module 506 includes accessing the security manager to query whether there is a policy in the policy library that allows the first terminal to connect to the second terminal; the capability credential is generated by the access security manager after the authorization request is verified according to the preset security policy.

[0096] In an exemplary embodiment, the remote access module 508 is further configured to, upon receiving a connection instruction returned by the access security manager, update the parameters of the access function according to the connection instruction; and send an access connection request to the second terminal through the updated access function.

[0097] In one exemplary embodiment, such as Figure 6 As shown, a communication device based on remote direct memory access is provided, including: a credential retrieval module 602, a credential verification module 604, and an access receiving module 606, wherein:

[0098] The credential extraction module 602 is used to extract capability credentials from the received connection request through a pre-configured dynamic link library when a connection request is received from the first terminal.

[0099] The credential verification module 604 is used to send capability credentials to the access security manager and receive the verification results of the access security manager for the capability credentials; the verification results include the verification results of the capability credentials' validity period, anti-replay status, and information matching.

[0100] The access receiving module 606 is used to call the receiving function to establish a remote access connection with the first terminal if the verification result is successful.

[0101] In an exemplary embodiment, the access acceptance module 606 is further configured to call a rejection function to return a connection rejection response to the first terminal if the verification result is a verification failure.

[0102] The modules in the aforementioned communication device based on remote direct memory access can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can invoke and execute the operations corresponding to each module.

[0103] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 7 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When the computer program is executed by the processor, it implements a communication method based on remote direct memory access. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0104] Those skilled in the art will understand that Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0105] In an exemplary embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to perform the following steps: upon detecting an access connection request sent to a second terminal via an access function, the processor intercepts the access connection request through a pre-configured dynamic link library and obtains context information; the context information includes a process identifier, a user identifier, a container identifier or container group name, a source Internet Protocol address, a destination Internet Protocol address, and a port; the processor encapsulates the context information into an authorization request and sends the authorization request to an access security manager; upon receiving capability credentials returned by the access security manager based on a preset security policy, the processor injects the capability credentials into the private data field of the access connection request to obtain a target connection request; the capability credentials include the scope of permissions, validity period, and a replay-protected random number; the processor calls the access function to send the target connection request to the second terminal, establishing a remote access connection with the second terminal.

[0106] In one embodiment, when the processor executes the computer program, it further performs the following steps: generating a shadow remote key if an access connection request is intercepted via a pre-configured dynamic link library; and obtaining the physical remote key associated with the shadow remote key and constructing hardware instructions based on the physical remote key if a data path operation is detected.

[0107] In one embodiment, the preset security policy involved when the processor executes the computer program includes accessing the security manager to query the policy library to see if there is a policy that allows the first terminal to connect to the second terminal; the capability credential is generated by the access security manager after the authorization request is verified according to the preset security policy.

[0108] In one embodiment, when the processor executes the computer program, it further performs the following steps: upon receiving a connection instruction returned by the access security manager, updating the parameters of the access function according to the connection instruction; and sending an access connection request to the second terminal through the updated access function.

[0109] In one exemplary embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to perform the following steps: upon receiving a connection request sent by a first terminal, extracting capability credentials from the received connection request through a pre-configured dynamic link library; sending the capability credentials to an access security manager, and receiving the verification result of the access security manager for the capability credentials; the verification result includes verification results for the capability credentials' validity period, anti-replay status, and information matching; if the verification result is successful, calling an accept function to establish a remote access connection with the first terminal.

[0110] In one embodiment, when the processor executes the computer program, it further performs the following steps: if the verification result is that the verification fails, it calls a rejection function to return a connection rejection response to the first terminal.

[0111] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, it performs the following steps: upon detecting an access connection request sent to a second terminal via an access function, the access connection request is intercepted through a pre-configured dynamic link library, and context information is obtained; the context information includes a process identifier, a user identifier, a container identifier or container group name, a source Internet Protocol address, a destination Internet Protocol address, and a port; the context information is encapsulated into an authorization request, and the authorization request is sent to an access security manager; upon receiving capability credentials returned by the access security manager based on a preset security policy, the capability credentials are injected into the private data field of the access connection request to obtain a target connection request; the capability credentials include the scope of permissions, validity period, and a replay-protected random number; the access function is invoked to send the target connection request to the second terminal, establishing a remote access connection with the second terminal.

[0112] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: generating a shadow remote key if an access connection request is intercepted via a pre-configured dynamic link library; and obtaining the physical remote key associated with the shadow remote key and constructing hardware instructions based on the physical remote key if a data path operation is detected.

[0113] In one embodiment, the preset security policy involved when the computer program is executed by the processor includes accessing the security manager to query the policy library to see if there is a policy that allows the first terminal to connect to the second terminal; the capability credential is generated by the access security manager after the authorization request is verified according to the preset security policy.

[0114] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: upon receiving a connection instruction returned by the access security manager, updating the parameters of the access function according to the connection instruction; and sending an access connection request to the second terminal through the updated access function.

[0115] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, it performs the following steps: upon receiving a connection request sent by a first terminal, extracting capability credentials from the received connection request through a pre-configured dynamic link library; sending the capability credentials to an access security manager, and receiving the verification result of the access security manager for the capability credentials; the verification result includes verification results for the capability credentials' validity period, anti-replay status, and information matching; if the verification result is successful, calling an accept function to establish a remote access connection with the first terminal.

[0116] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: if the verification result is that the verification fails, it calls the rejection function to return a connection rejection response to the first terminal.

[0117] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps: upon detecting an access connection request sent to a second terminal via an access function, intercepting the access connection request through a pre-configured dynamic link library and obtaining context information; the context information includes a process identifier, a user identifier, a container identifier or container group name, a source Internet Protocol address, a destination Internet Protocol address, and a port; encapsulating the context information into an authorization request and sending the authorization request to an access security manager; upon receiving capability credentials returned by the access security manager based on a preset security policy, injecting the capability credentials into the private data field of the access connection request to obtain a target connection request; the capability credentials include the scope of permissions, validity period, and a replay-protected random number; and calling the access function to send the target connection request to the second terminal, establishing a remote access connection with the second terminal.

[0118] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: generating a shadow remote key if an access connection request is intercepted via a pre-configured dynamic link library; and obtaining the physical remote key associated with the shadow remote key and constructing hardware instructions based on the physical remote key if a data path operation is detected.

[0119] In one embodiment, the preset security policy involved when the computer program is executed by the processor includes accessing the security manager to query the policy library to see if there is a policy that allows the first terminal to connect to the second terminal; the capability credential is generated by the access security manager after the authorization request is verified according to the preset security policy.

[0120] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: upon receiving a connection instruction returned by the access security manager, updating the parameters of the access function according to the connection instruction; and sending an access connection request to the second terminal through the updated access function.

[0121] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps: upon receiving a connection request from a first terminal, extracting capability credentials from the received connection request through a pre-configured dynamic link library; sending the capability credentials to an access security manager, and receiving the verification result of the access security manager for the capability credentials; the verification result includes verification results for the capability credentials' validity period, anti-replay status, and information matching; if the verification result is successful, calling an accept function to establish a remote access connection with the first terminal.

[0122] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: if the verification result is that the verification fails, it calls the rejection function to return a connection rejection response to the first terminal.

[0123] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0124] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0125] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A communication method based on remote direct memory access, characterized in that, Applied to a first terminal; the method includes: Upon detecting an access connection request sent to the second terminal via an access function, the access connection request is intercepted through a pre-configured dynamic link library, and context information is obtained; the context information includes process identifier, user identifier, container identifier or container group name, source Internet Protocol address, destination Internet Protocol address, and port; The context information is encapsulated into an authorization request, and the authorization request is sent to the access security manager; Upon receiving the capability credentials returned by the access security manager based on a preset security policy, the capability credentials are injected into the private data field of the access connection request to obtain the target connection request; the capability credentials include the permission scope, validity period, and anti-replay random number; The access function is invoked to send a target connection request to the second terminal, thereby establishing a remote access connection with the second terminal.

2. The method according to claim 1, characterized in that, The method further includes: In the case of intercepting the access connection request through a pre-configured dynamic link library, a shadow remote key is generated; Upon detecting a data path operation, the physical remote key associated with the shadow remote key is obtained, and hardware instructions are constructed based on the physical remote key.

3. The method according to claim 1, characterized in that, The preset security policy includes the access security manager querying the policy library to see if there is a policy that allows the first terminal to connect to the second terminal; the capability credential is generated by the access security manager after the authorization request is verified and approved according to the preset security policy.

4. The method according to claim 1, characterized in that, The method further includes: Upon receiving a connection instruction returned by the access security manager, update the parameters of the access function according to the connection instruction; The updated access function is used to send an access connection request to the second terminal.

5. A communication method based on remote direct memory access, characterized in that, Applied to a second terminal; the method includes: Upon receiving a connection request from the first terminal, capability credentials are extracted from the received connection request using a pre-configured dynamic link library. The capability credential is sent to the access security manager, and the verification result of the access security manager for the capability credential is received; the verification result includes the verification result of the capability credential's validity period, anti-replay status, and information matching. If the verification result is successful, the accept function is called to establish a remote access connection with the first terminal.

6. The method according to claim 5, characterized in that, The method further includes: If the verification result is that the verification fails, the rejection function is invoked to return a connection rejection response to the first terminal.

7. A communication device based on remote direct memory access, characterized in that, Applied to a first terminal; the device includes: The access interception module is used to intercept the access connection request sent to the second terminal through the access function and obtain context information by means of a pre-configured dynamic link library when an access connection request is detected. The context information includes process identifier, user identifier, container identifier or container group name, source Internet Protocol address, destination Internet Protocol address and port. The information encapsulation module is used to encapsulate the context information into an authorization request and send the authorization request to the access security manager; The credential injection module is used to inject the capability credential returned by the access security manager based on a preset security policy into the private data field of the access connection request to obtain the target connection request; the capability credential includes the permission scope, validity period and anti-replay random number; The remote access module is used to call the access function to send a target connection request to the second terminal and establish a remote access connection with the second terminal.

8. A communication device based on remote direct memory access, characterized in that, Applied to a second terminal; the device includes: The credential extraction module is used to extract capability credentials from the received connection request through a pre-configured dynamic link library when a connection request is received from the first terminal. The credential verification module is used to send the capability credential to the access security manager and receive the verification result of the access security manager for the capability credential; the verification result includes the verification result of the capability credential's validity period, anti-replay status, and information matching. The access acceptance module is used to call the acceptance function to establish a remote access connection with the first terminal if the verification result is successful.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images