An access control method, system, device, storage medium and computer device

Abstract

The application provides an access control method, system and device, storage medium and computer equipment, adopts RDMA-based QP transmission semantics to define logical conditions of an access control strategy, generates fine-grained access control strategies suitable for two types of paths by defining and distinguishing key semantic fields (such as QP numbers, virtual addresses, etc.) of RDMA messages on control paths and data paths. By converting the access control strategy into specific access control rules and distributing them to the host, fine-grained and accurate access control of the complete RDMA communication behavior of the communication parties from the establishment of the QP connection to the specific memory operation can be realized on the host side, effectively solving the problem of insufficient control accuracy and incomplete coverage caused by the lack of expression semantics in traditional methods, and significantly improving the accuracy of access control of tenant RDMA communication behavior.

Description

Technical Field

[0001] This application relates to the field of Internet technology, and more specifically, to an access control method, system, apparatus, storage medium, and computer device. Background Technology

[0002] Remote Direct Memory Access (RDMA), a direct memory access technology, enables the transfer of memory data from a local computer to the memory of another computer without the need for a Central Processing Unit (CPU), significantly improving network transmission performance. With the continuous pursuit of ultimate network transmission performance, various RDMA cloud providers have emerged. Different tenants can purchase RDMA cloud nodes from these providers as needed for application deployment, thereby enjoying ultra-high throughput and ultra-low latency network performance.

[0003] In scenarios where large-scale tenants lease different RDMA cloud nodes, since each tenant shares the underlying RDMA cloud network, access control is required for tenants' RDMA communication behavior to achieve communication isolation between tenants, communication isolation between different applications / services within the same tenant, and to prevent malicious RDMA communication behavior from threatening tenant communication security. However, current access control methods for RDMA communication behavior suffer from insufficient control granularity, affecting the accuracy of access control. Summary of the Invention

[0004] In view of this, this application provides an access control method, system, apparatus, storage medium, and computer device to solve the problem of insufficient granularity of access control, thereby improving the accuracy of access control in RDMA communication.

[0005] Specifically, this application is implemented through the following technical solution: In a first aspect, embodiments of this application provide an access control method applied to a controller in a Remote Direct Memory Access (RDMA) cluster, comprising: Receive an application request for a set of access control policies for a tenant; the set of access control policies includes various access control policies for RDMA communication behavior; the access control policies carry logical conditions and control actions indicating access permissions; the logical conditions are set according to the queued QP transmission semantics under RDMA communication behavior. In response to the application request, access control rules corresponding to RDMA communication behaviors are generated according to each of the access control policies; the access control rules include control path rules corresponding to the control path, and / or data path rules corresponding to the data path; the control path and data path are used to transmit different types of RDMA messages; The access control rules are sent to the host where the communication node associated with the access control rules is located; the host is used to perform access control on the RDMA messages from the communication node according to the access control rules.

[0006] In one optional implementation, the QP transport semantics includes an entity field for identifying the communication nodes corresponding to both parties of the communication tenant, and a behavioral semantic field for identifying the RDMA message type; The logical conditions include matching rules for the entity fields and the behavioral semantic fields.

[0007] In one optional implementation, the behavioral semantic field under the data path includes at least a destination queue pair number field, an opcode field, and a virtual address field; the destination queue pair number field is used to indicate the queue pair in the communication node corresponding to the communication receiver; the virtual address field is used to identify the target memory address of the required operation; and the opcode field is used to identify the operation type for the target memory address. The behavioral semantic field under the control path includes at least a queue pair field and a request type field corresponding to both communication tenants respectively; the request type field is used to indicate the link request type of both communication tenants.

[0008] Secondly, embodiments of this application also provide an access control method applied to a host in a Remote Direct Memory Access (RDMA) cluster, comprising: The system receives access control rules sent by the controller in the RDMA cluster. The access control rules are generated by the controller based on each access control policy in the set of access control policies carried in the received application request. The access control policy carries logical conditions and control actions that indicate access permissions. The logical conditions are set according to the queued QP transmission semantics under RDMA communication behavior. In response to receiving an RDMA message from a communication node corresponding to any tenant, access control is performed on the RDMA message according to the access control rules.

[0009] In one optional implementation, receiving the access control rules sent by the controller in the RDMA cluster includes: The access control rules are received using the central processing unit (CPU) in the data processing unit, and the access control rules are stored in the data path accelerator in the data processing unit. The step of responding to receiving an RDMA message from a communication node corresponding to any tenant, and performing access control on the RDMA message according to the access control rules, includes: In response to receiving the RDMA message, the data path accelerator is used to perform access control on the RDMA message according to the access control rules and the message information in the RDMA message that is related to the QP transmission semantics.

[0010] Thirdly, embodiments of this application also provide an access control system, the system including a controller and multiple hosts, wherein: The controller is configured to receive an application request for a set of access control policies for a tenant; the set of access control policies includes various access control policies for RDMA communication behavior; each access control policy carries logical conditions and control actions indicating access permissions; the logical conditions are set according to the queued QP transmission semantics under the RDMA communication behavior; in response to the application request, the controller generates access control rules corresponding to the RDMA communication behavior according to each access control policy; the access control rules include control path rules corresponding to the control path and / or data path rules corresponding to the data path; the control path and data path are used to transmit different types of RDMA messages; and the controller sends the access control rules to the host where the communication node associated with the access control rules is located. The host is configured to receive access control rules sent by the controller in the RDMA cluster; and in response to receiving an RDMA message from a communication node corresponding to any tenant, to perform access control on the RDMA message according to the access control rules.

[0011] Fourthly, embodiments of this application also provide an access control device applied to a controller in a Remote Direct Memory Access (RDMA) cluster, the device comprising: The first receiving module is used to receive an application request for a set of access control policies for a tenant; the set of access control policies includes various access control policies for RDMA communication behavior; the access control policies carry logical conditions and control actions indicating access permissions; the logical conditions are set according to the queued QP transmission semantics under RDMA communication behavior. A generation module is used to respond to the application request and generate access control rules corresponding to RDMA communication behaviors according to each access control policy; the access control rules include control path rules corresponding to the control path and / or data path rules corresponding to the data path; the control path and data path are used to transmit different types of RDMA messages; The sending module is used to send the access control rules to the host where the communication node associated with the access control rules is located; the host is used to perform access control on the RDMA messages from the communication node according to the access control rules.

[0012] Fifthly, embodiments of this application also provide an access control device for use on a host in a Remote Direct Memory Access (RDMA) cluster, the device comprising: The second receiving module is used to receive access control rules sent by the controller in the RDMA cluster; the access control rules are generated by the controller based on each access control policy in the set of access control policies carried in the received application request; the access control policy carries logical conditions and control actions indicating access permissions; the logical conditions are set according to the queued QP transmission semantics under RDMA communication behavior; The control module is configured to, in response to receiving an RDMA message from a communication node corresponding to any tenant, perform access control on the RDMA message according to the access control rules.

[0013] In a sixth aspect, an optional implementation of this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the first aspect above, or any possible implementation of the first aspect.

[0014] In a seventh aspect, an optional implementation of this application also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the first aspect above, or any possible implementation of the first aspect.

[0015] The access control method, system, apparatus, storage medium, and computer device provided in this application define access control policies for controlling RDMA communication behavior using QPs (Quality of Purchase) as the basic transmission unit of RDMA, and then have them converted into specific access control rules by the controller. This is in contrast to existing technologies that define access control rules based on the TCP / IP 5-tuple, which fails to accurately express the RDMA communication behavior to be controlled, resulting in incomplete control scope and insufficient precision. The present application, by defining logical conditions and corresponding control actions based on QP transmission semantics, allows user-defined tenant-specific access control policies to cover different paths in RDMA communication behavior, thereby achieving fine-grained management of the entire RDMA communication process from connection establishment to data operations. By converting the access control policies through the controller, fine-grained rules that accurately describe the diverse QP behaviors in RDMA communication can be determined. By distributing access control rules to the host, the host can use fine-grained access control rules to manage the various communication behaviors of tenants under various paths, thereby achieving effective and precise access control for each complete RDMA connection.

[0016] Furthermore, the access control method, system, apparatus, storage medium, and computer device provided in this application, by specifically dividing the QP transmission semantics into entity fields that identify communication nodes and behavioral semantic fields that identify message types, and defining their matching rules respectively, not only reduces the difficulty for users to formulate access control policies, but also achieves the separation and precise description of communication node identification and data operation behavior at the access control policy formulation level.

[0017] Furthermore, the access control method, system, device, storage medium, and computer equipment provided in this application embodiment, by defining the behavioral semantic fields under the data path and the behavioral semantic fields under the control path respectively, enable the generated access control policy to accurately match the specific memory operation behavior on the data path and the connection management behavior on the control path, thereby realizing the fine-grained identification and control of different types of RDMA messages based on the complete QP semantics expressed by the defined behavioral semantic fields.

[0018] The access control method, system, apparatus, storage medium, and computer equipment and apparatus provided in this application embodiment enable the host to implement fine-grained control over various communication behaviors of tenants under various paths by using access control rules based on the obtained QP transmission semantic definition, thereby achieving effective and precise access control for each complete RDMA connection.

[0019] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0020] Figure 1 This is a flowchart illustrating an exemplary embodiment of the present application of an access control method for a controller in a Remote Direct Memory Access (RDMA) cluster; Figure 2 This is a flowchart illustrating an exemplary embodiment of the present application of an access control method for a host in a Remote Direct Memory Access (RDMA) cluster; Figure 3 This is a schematic diagram illustrating an access control architecture according to an exemplary embodiment of this application; Figure 4 This is a schematic diagram of an access control system illustrated in an exemplary embodiment of this application; Figure 5 This is a schematic diagram illustrating an access control device applied to a controller in an RDMA cluster, as shown in an exemplary embodiment of this application; Figure 6 This is a schematic diagram illustrating an access control device applied to a host in an RDMA cluster, as shown in an exemplary embodiment of this application; Figure 7 This is a schematic diagram of the structure of a computer device shown in an exemplary embodiment of this application. Detailed Implementation

[0021] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0022] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0023] It should be understood that although the terms first, second, third, etc., may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0024] Research has revealed that RDMA cloud providers face similar challenges to traditional TCP / IP clouds in RDMA cloud network environments. On one hand, RDMA cloud administrators need to manage tenant RDMA communication behavior. This requires isolating not only all RDMA communication between different tenants but also sensitive applications and services within the same tenant to protect tenant data security. On the other hand, RDMA security management methods are not yet perfect. Malicious attackers can construct malicious RDMA requests to launch attacks, such as unauthorized memory control access and RDMA connection hijacking, seriously threatening tenant RDMA communication security. Considering that Access Control Lists (ACLs) are an effective means of managing tenant network communication permissions in TCP / IP scenarios, in TCP / IP scenarios, administrators formulate access control rules for cloud nodes and distribute them to cloud hosts. The cloud hosts then check each received TCP / IP packet according to the access control rules. Based on matching allow / drop access control rules, the packets are allowed / denied. Therefore, by introducing the ACL management method from TCP / IP scenarios into RDMA clouds, it is theoretically possible to achieve similar management effects as TCP / IP clouds. For example, administrators can formulate corresponding RDMA defense strategies based on the tenant information of the current RDMA cloud, thereby isolating RDMA network communication within and between tenants and preventing the sending and receiving of malicious RDMA requests.

[0025] However, in existing TCP / IP scenarios, ACL-based access control typically uses a five-tuple format (source / destination IP, source / destination port, protocol number) designed for traditional TCP / IP networks to express access control rules. However, the basic transmission unit in an RDMA cloud network is a QP (Queries Per Instance), and the communication process is clearly divided into a control path and a data path. Before RDMA communication, both parties need to exchange basic QP information, such as the QP number, on the control path. After the exchange, both parties execute the corresponding remote memory operations for that QP on the data path, such as read / write operations and more complex atomic operations. Therefore, directly applying the five-tuple ACL expression to an RDMA cloud network scenario will affect the accuracy of tenant access control because the ACL rules lack a complete representation of fine-grained QP information for different paths.

[0026] Based on the above research, this application provides an access control method, system, device, computer equipment, and computer program product. It defines the logical conditions of access control policies by using QP transmission semantics based on RDMA. By defining and distinguishing key semantic fields (such as QP number, virtual address, etc.) of RDMA messages on the control path and data path, it generates fine-grained access control policies that can adapt to both types of paths. By converting the access control policies into specific access control rules and distributing them to the host, fine-grained and precise access control can be achieved on the host side for the complete RDMA communication behavior from QP connection establishment to specific memory operations between the communicating parties. This effectively solves the problems of insufficient control precision and incomplete coverage caused by the lack of semantic expression in traditional methods, significantly improving the accuracy of access control for tenant RDMA communication behavior.

[0027] The shortcomings of the above solutions are the result of the inventor's practical experience and careful research. Therefore, the discovery process of the above problems and the solutions proposed in this application below should be considered as the inventor's contributions to this application.

[0028] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0029] It is understood that before using the technical solutions disclosed in the various embodiments of this application, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this application in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0030] It should be noted that the specific terms mentioned in the embodiments of this application include: RoCEv2 is an Ethernet-based RDMA protocol designed to achieve high-performance, low-latency data transmission over Ethernet. InfiniBand is a computer network communication standard for high-performance computing. It features extremely high throughput and extremely low latency and is used for data interconnection between computers.

[0031] To facilitate understanding of this embodiment, a detailed description of the access control method disclosed in this application embodiment will be provided first. The execution subject of the access control method provided in this application embodiment is generally a terminal device or other processing device with certain computing capabilities. The terminal device can be a user equipment (UE), mobile device, terminal, personal digital assistant device (PDA), handheld device, computer device, cloud host, controller, server, etc. In some possible implementations, the access control method can be implemented by the processor calling computer-readable instructions stored in the memory.

[0032] The access control method provided in this application embodiment is illustrated below, taking the controller in the RDMA cluster as the execution subject as an example.

[0033] like Figure 1 The flowchart shown is an example of an access control method for a controller in a Remote Direct Memory Access (RDMA) cluster, provided by an embodiment of this application. The method may include the following steps: S101: Receive an application request for a set of access control policies for a tenant; the set of access control policies includes various access control policies for RDMA communication behavior; the access control policies carry logical conditions and control actions indicating access permissions; the logical conditions are set according to the queue QP transmission semantics under RDMA communication behavior.

[0034] Here, an independent centralized controller can be deployed in the RDMA cluster. This controller is physically or logically independent of the hosts running RDMA services and serves as the sole access control policy management center for the entire RDMA cluster. RDMA cloud vendor administrators can use this controller to edit, combine, and uniformly distribute access control policies, thereby achieving centralized management and isolation of RDMA communication behavior among multiple tenants.

[0035] QP transport semantics is used to describe the behavioral characteristics of RDM communication. QP transport semantics provides specific, matchable RDMA message-specific characteristic information (such as the identification characteristics of the two parties in the RDMA communication, QP behavioral semantics, etc.) for constructing logical conditions.

[0036] Logical conditions are a set of matching rules based on QP transport semantics used to filter and identify specific RDMA communication behaviors. Their function is to serve as a criterion for determining whether to perform corresponding control actions on received RDMA messages. Logical conditions specifically include matching requirements for one or more fields in the RDMA message header, including precise matching of specific values ​​for a field (e.g., `match(sIP == "10.0.X.1X1")`, membership checks (e.g., `(sIP ∈ 10.0.X.1X1 / 24)`), or numerical range matching (e.g., `match(VA in [0x10X0, 0x20X0]))`). By combining these fields, logical conditions can precisely characterize a specific, manageable RDMA operation scenario. Specifically, logical conditions can be implemented and expressed using the predicate syntax element.

[0037] A control action (denoted as Action) refers to a specific access control operation specified in the access control policy and executed when logical conditions are met. It is used to directly implement specific access control behavior on RDMA messages that match the matching rules. Specifically, control actions include, but are not limited to, allowing (defined as allow) and denying (defined as deny).

[0038] Understandably, the logical conditions and control actions in an access control policy together constitute the complete rules indicating access permissions. Logical conditions precisely identify a specific communication behavior or request category by matching specific fields in the RDMA message (such as the source node, destination QP number, etc.). Subsequently, the control action (allow or deny) bound to this condition directly determines what action to take in response to that RDMA communication behavior, thus explicitly granting or revoking access permissions.

[0039] Access control policies primarily consist of logical conditions used to filter messages, and the control actions that must be performed once these conditions are met. An access control policy defines a clear control rule for specific RDMA communication behavior, specifying "what characteristics of RDMA communication" should be subject to "what control action." Access control policies are the basic units that constitute access control rules; the conversion process between access control policies and access control rules will be described in detail later. An access control policy can have a unique policy ID; for example, P1 represents the first access control policy.

[0040] An access control policy set can be a collection of at least one access control policy combined to achieve a comprehensive security management goal (such as isolating a tenant). The specific number of policies included in an access control policy set is entirely determined by the complexity and granularity of the required management scenario.

[0041] An application request is initiated by the administrator to instruct the formal activation and execution of a set of access control policies. Through an application request, a predefined set of access control policies can be transformed from a static configuration state to a dynamic execution state. This triggering instruction can be specifically represented as an application instruction (Apply). For example, if a set of access control policies contains three policies {P1, P2, P3}, then the application request for this set of access control policies can be represented as Apply{P1, P2, P3}.

[0042] In practice, the centralized controller in the RDMA cluster receives application requests initiated by the administrator for a set of access control policies targeting a specific tenant. This request carries at least one access control policy designed to manage the tenant's RDMA communication behavior. Each access control policy consists of two parts: first, logical conditions for precisely matching message characteristics to identify specific communication behaviors; and second, the control action that must be executed once a match is found. The construction of the logical conditions is entirely based on the QP transport semantics of RDMA, meaning its matching rules are set for multiple specific message header fields that characterize RDMA communication. The logical conditions define a complete operational scenario to be managed by combining rules for precise matching, range matching, or set relationship matching of these fields.

[0043] In one possible implementation, considering that traditional TCP / IP ACL representations typically employ a five-tuple format designed for TCP / IP networks, the limited expressive power of five-tuples makes it difficult to support comprehensive and fine-grained control over RDMA traffic. The fundamental reason lies in RDMA's unique QP semantics. Unlike TCP / IP, which uses five-tuples to describe a connection, the basic transmission unit of RDMA is a QP, which represents "how the source QP at the sending end operates on the remote memory region of the target QP at the receiving end." For example, RDMA packets on the data path are determined by the read and write operations of the sending end's QP on the receiving end's QP memory region; while RDMA packets on the control path correspond to a pair of QP initialization and state management processes between the sending and receiving ends. Therefore, an RDMA connection is not only represented by the initiator and responder of the QP request, but also by the specific QP behavior to represent the QP semantics of RDMA. However, due to the lack of expressive capabilities for QPs, ACL expressions based on TCP / IP 5-tuples cannot accurately describe the fine-grained strategies for diverse QP behaviors in RDMA, thus failing to implement effective access control for a complete RDMA connection. Based on this, this application proposes an ACL expression method for QP transmission semantics, which includes entity fields for identifying the communication nodes corresponding to both parties of the communication tenant, and behavioral semantic fields for identifying the RDMA message type; the logical conditions include matching rules for the entity fields and behavioral semantic fields.

[0044] Here, the entity field is used to uniquely identify and distinguish the network node address information of the communication nodes corresponding to the two tenants (communication initiator and responder) participating in RDMA communication. This field provides the most basic basis for access control to determine "who communicates with whom" by clearly defining the source and destination of the communication. The communication node can be a virtual machine or container in the host.

[0045] Specifically, the entity fields differ depending on the network protocol used by RDMA. For example, in the Ethernet-based RoCEv2 protocol, the entity fields are represented by IP addresses and ports, specifically source IP address (Sip), destination IP address (Dip), source port (Sport), and destination port (Dport). In InfiniBand networks, the entity fields are represented by Global Identifier (GID) and Local Identifier (LID), specifically source Local Identifier (sLID), destination Local Identifier (dLID), source Global Identifier (sGID), and destination Global Identifier (dGID). For example, in a RoCEv2 network, the entity field of an RDMA communication can be specifically: sip=192.168.X.1X0, dip=192.168.X.10X, Sport=any, Dport=4971. This set of information uniquely identifies the node in this communication.

[0046] Understandably, the specific values ​​of these entity fields are derived from the tenant network information that the administrator needs to know before formulating access control policies. After the administrator has a clear understanding of the address information of these communication nodes and the specific access control intent, the administrator can accurately set the matching rules for entity fields in the logical conditions of the access control policy, thereby ensuring that the access control rules can be correctly bound to the specific network endpoints.

[0047] Behavioral semantic fields are a type of key information used to describe and define the specific operation type and behavioral characteristics represented by an RDMA message. Their core function is to accurately characterize the operational intent and target of each RDMA communication request from the QP semantic level of the RDMA protocol itself. The specific composition of behavioral semantic fields will be explained in detail below.

[0048] An RDMA message is a basic data unit transmitted in an RDMA network to complete a remote direct memory access operation. Its core function is to carry and convey complete information about a specific RDMA operation request or response. Based on their different functions in the entire RDMA communication process, RDMA messages are mainly divided into two types: control path messages and data path messages. Control path messages are specifically responsible for the lifecycle management of the QP connection, including but not limited to QP initialization and state management processes, such as connection requests and responses. Data path messages are responsible for performing substantive business data interactions.

[0049] The logical conditions include matching rules for message information in RDMA messages that match the entity field and the behavioral semantic field. The matching rules determine the target RDMA message and the specific method of controlling the RDMA message by simultaneously constraining the identity of the communication endpoint (entity field) and the specific operation behavior (behavioral semantic field).

[0050] In one possible implementation, different behavioral semantic fields can correspond to different paths in the RDMA communication process. Specifically, the behavioral semantic fields under the data path include at least a destination queue pair number (dQPN) field, an opcode field, and a virtual address (VA) field; the destination queue pair number field is used to indicate the queue pair in the communication node corresponding to the communication receiver; the virtual address field is used to identify the target memory address of the required operation; and the opcode field is used to identify the operation type for the target memory address.

[0051] Under the control path, the behavioral semantic field includes at least the queue pair (QP) field and the request type field corresponding to each of the two communicating tenants; the request type field is used to indicate the link request type of the two communicating tenants. Specifically, the queue pair field may include the destination queue pair number (dQPN) field and the local queue pair number (lQPN) field.

[0052] Here, in RDMA communication, the communication process, with its different functions, is divided into two independent logical paths: the control path and the data path. The control path is specifically responsible for managing the connection state of the QPs. Its role is to complete the "handshake" and negotiation before communication, such as establishing a usable data transmission channel (QP connection) or tearing it down after it has completed its task. The data path is responsible for executing the actual upper-layer business data transmission. Its role is to describe how the source QP at the sending end performs operations on the memory area of ​​the target QP at the receiving end, thereby enabling direct operations such as reading and writing to the remote memory on the established channel.

[0053] Because the control path and data path perform different functions in RDMA communication, the core intent and key information carried in the messages they transmit are also completely different. Therefore, it is necessary to define different sets of behavioral semantic fields to describe them.

[0054] Specifically, in the data path of RDMA communication, the behavioral semantic field is a set of key message information used to precisely define the essence of each data operation, and to fully describe "which operation is performed on which target memory by which QP". Therefore, the behavioral semantic field in the data path can include the destination queue pair number field (dQPN), the opcode field, and the Virtual Address (VA) field. dQPN is used to indicate the specific queue pair in the receiving node that is the target of the operation; opcode is used to declare the specific type of memory operation requested to be performed, such as read, write, or atomic operation; VA is used to identify the address range of the target memory region targeted by the operation. For example, the behavioral semantic field in a data path message can specifically be: dQPN=300, Opcode=RITE, VA in [0xA00X, 0xA10X], this set of information fully characterizes the specific behavior of "performing a write operation to the memory address 0xA00X~0xA10X associated with queue pair 300 of the target node".

[0055] In the data path, the definition of behavioral semantic fields aims to precisely define the identity and operational intent of an RDMA connection. However, other message fields such as Remote Key (RKey), Direct Memory Access (DMA) size, Packet Sequence Number (PSN), and checksum primarily function to ensure the security, orderliness, and data integrity of a single memory access, belonging to application-layer or transport-layer auxiliary mechanisms to ensure the reliable execution of RDMA operations. These fields do not participate in defining the core RDMA connection identity—"who initiated the operation, who it was against, and what action was performed." Therefore, in order to construct a minimal yet complete set of rule matching for access control and to avoid including volatile parameters related to application-layer reliability in static security policies, the behavioral semantic fields in this application selectively exclude the aforementioned auxiliary fields, thereby ensuring that access control rules can clearly, stably, and efficiently match and adjudicate based on connection identity.

[0056] In the control path of RDMA communication, the behavioral semantic field is a set of key message information used to precisely define the nature of each connection management operation, fully describing "which (or which) QPs are subject to which connection control operation". This set of information includes the request type field (type) and the queue pair number (QPN) field. The type field declares the specific type of connection management operation, specifically including the following types used in the connection management protocol (CM protocol) for establishing and terminating connections for QPs: connection request (ConnectRequest), connection reply (ConnectReply), disconnect request ((Dis)connectRequest), disconnect reply ((Dis)ConnectRequest), and registration memory address (ibv_reg_mr), etc. The QPN is used to identify the local queue pair (lQPN) and / or the target queue pair (dQPN) involved in this operation. For example, the behavioral semantic field in a control path message might be: request type is ConnectRequest, local queue pair number is 100, and target queue pair number is 200. This set of information fully represents a specific management action of "requesting to establish a connection between local queue pair 100 and remote queue pair 200".

[0057] In the RDMA control path, the entity fields and behavioral semantic fields corresponding to the control path together constitute the RDMA connection identity. Besides the core fields defining the connection identity, the control path message also contains auxiliary fields such as the Shared Receive Queue (SRQ) identifier or the Initial Packet Sequence Number (PSN). These fields primarily serve specific functional requirements of the RDMA application layer (such as resource sharing or transmission reliability), and their specific values ​​are closely related to the application implementation, rather than being used to express or distinguish the basic identity information of the connection relationship between the communicating parties. Therefore, in this application, such application layer metadata is explicitly excluded from the matching field set of access control rules. This design principle ensures that the control rules can focus on stable and clear connection identity identifiers, avoiding the policy complexity and uncertainty introduced by application layer variable parameters. Its design approach is consistent with the traditional TCP / IP network concept of access control based on five-tuples rather than application layer information.

[0058] It should be understood that, in this application, a minimal and complete set of message fields is proposed to precisely define the identity of an RDMA connection for fine-grained access control. Based on the different characteristics of RDMA communication on the control and data paths, this set divides the required fields into two categories: request entity fields and semantic fields. These two types of fields together constitute all the information necessary to uniquely identify an RDMA connection. Table 1 below illustrates a request entity field and semantic field provided in an embodiment of this application: (Table 1) Table 1 above exemplifies the entity fields and QP behavior semantic fields when using the RoCEv2 protocol and InfiniBand network. Analysis through elimination reveals that each field in the set of various request entity fields and semantic fields is an indispensable element. For example, the absence of the dQPN field, used to identify the target QP, makes it impossible to locate the specific operation object in the rules, resulting in missing QP semantics. In the InfiniBand scenario, the absence of the GID field, which identifies the communication entity, makes it impossible to distinguish between the sender and receiver of the request. Therefore, the defined field set achieves the most simplification while accurately describing the RDMA connection identity, thus laying the foundation for generating efficient and accurate access control rules.

[0059] In this way, by expressing ACLs based on QP transport semantics in RDMA, it is possible to comprehensively cover RDMA traffic with QP as the basic transport unit, enabling administrators to formulate more granular control rules for QP. Furthermore, when customizing access control policies based on QP transport semantics, this application provides a policy language for writing access control policies based on entity fields and behavioral semantic fields under different paths, allowing administrators to write complex QP-oriented ACL policies using only a few statements.

[0060] S102: In response to an application request, generate access control rules corresponding to RDMA communication behavior according to various access control policies; the access control rules include control path rules corresponding to the control path, and / or data path rules corresponding to the data path; the control path and data path are used to transmit different types of RDMA messages.

[0061] Here, access control rules are ACL rules compiled by the controller according to the access control policy. The controller can issue access control rules to the host, enabling the host to perform access control operations according to the access control rules upon receiving an RDMA message.

[0062] By converting access control policies into access control rules, the policy intent reflected by the access control policies defined by the administrator based on the preset policy language proposed in this application can be transformed into precise inspection instructions for specific fields in the packet header that network devices can understand and execute at high speed. The preset policy language is the syntax mentioned above for defining policies and initiating application requests through logical conditions and control actions.

[0063] For access control rules and access control policies, each access control policy will be translated by the controller into one or more specific access control rules.

[0064] Control path rules and data path rules are targeted access control rules compiled separately based on the two different types of messages in RDMA communication: control messages and data messages. Control path rules are specifically used to manage the lifecycle operations of an RDMA connection, such as granting or denying requests to establish or terminate a QP connection. Data path rules are specifically used to manage specific data access operations, such as controlling access to remote memory read / write or atomic operations performed through an established QP.

[0065] Understandably, a set of access control policies, consisting of multiple access control policies, often corresponds to a specific access control intent. A complete access control intent may require managing both the control path and data path phases simultaneously to achieve end-to-end security, or it may only need to manage one phase. Therefore, to accurately match the administrator's policy intent, the controller performs intelligent discrimination during policy compilation: if the policy's logical conditions are based on control path semantic fields (such as connection type), corresponding control path rules are generated; if based on data path semantic fields (such as opcodes, memory addresses), corresponding data path rules are generated; if the policy set contains independent policies targeting both paths, the controller will generate two types of rules respectively, forming a complete rule set. For example, for a tenant using the RoCEv2 protocol, an administrator's access control intent for that tenant may include the following four access control policies: #for RDMA control path Policy p1{ Predicate=match(sip=10.0.1.1x1)&match(dip=10.0.1.1x5)&match(Sport=any)&(Dport=4x71)&match(type in {ConnectRequest, ConnectReply})&match(lQPN=any)&match(dQPN in {200, 500}) action=allow} Policy p2{ Predicate=match(sip=10.0.1.0 / 24)&match(dip=10.0.1.1x5)&match(Sport=any)&(Dport=4971)&match(type in {ConnectRequest, ConnectReply})&match(lQPN=any)&match(dQPN=any) action=deny} #for RDMA data path (for data path) Policy p3{ Predicate=match(sip = 10.0.1.1x1)&match(dip = 10.0.1.1x5)&match(Sport= any)&(Dport = 4971)&match(dQPN in {200,500})&match(opcode in {READ} )&match(VA in[0x00001000,0x00002000]) action=deny} Policy p4{ Predicate=match(sip = 10.0.1.0 / 24)&match(dip = 10.0.1.1x5)&match(Sport = any)&(Dport = 4971)&match(dQPN=any)&match(opcode =any)&match(VA in[0,inf]) action=deny} #Activate four ACL policies(激活四条访问控制策略) apply(p1,p2,p3,p4) Assuming node 10.0.1.1x1 is allowed to access the RDMA service on node 10.0.1.1x5, the above four policies constitute an access control intent of the administrator targeting the source communication node 10.0.1.1x1 and the destination communication node 10.0.1.1x5 corresponding to the tenant. Specifically, the four policies represent: ① At the control path level: Policy p1 allows connection requests (ConnectRequests) and disconnect requests (ConnectReplies) from 10.0.1.1x1 to 10.0.1.1x5 with QP indices 200 and 500; simultaneously, policy p2 denies QP creation requests from other hosts within the 10.0.1.0 / 24 network segment to node 10.0.1.1x5. ② At the data path level: Combining policies p3 and p4, policy p3 indicates that only two specific QPs (200 and 500) on 10.0.1.1x1 are allowed to read the restricted memory address range on 10.0.1.1x5 (i.e., the memory address range outside [0x00001000, 0x00002000]); while policy p4 rejects other memory operation type requests sent from 10.0.1.1x1 to node 10.0.1.1x5, as well as all requests sent from the 10.0.1.0 / 24 network segment to node 10.0.1.1x5. ③ Final stage: The above four policies are applied together, converted into corresponding access control rules by the controller, and sent to the host corresponding to node 10.0.1.1x1 and the host corresponding to node 10.0.1.1x5. This completes the high-level ACL control of the tenant's communication on the host side.

[0066] Control path rules and data path rules work together to achieve precise control over the entire process of a complete RDMA communication, from connection establishment to data operation.

[0067] In practice, the controller responds to application requests for a set of access control policies for a tenant, parses each access control policy carried in the application request, and extracts the specific entity fields and specific action semantic fields included in its logical conditions. Based on these fields, it determines the type of RDMA message the policy intends to manage: if the logical conditions mainly include fields such as type and QPN, it is determined to be a control path policy; if it mainly includes fields such as opcode and VA, it is determined to be a data path policy. For the classified policies, the controller compiles them separately: for access control policies under control paths, the controller compiles its logical conditions into specific rule entries that match fields that at least include source / destination entity information (such as IP address) and control path QP semantic information (such as type, lQPN, dQPN), and associates them with the control actions (allow / deny) specified in the policy, thereby generating control path rules; for access control policies under data paths, the controller compiles its logical conditions into specific rule entries that match fields that at least include source / destination entity field information and data path QP semantic information (such as dQPN, opcode, VA), and associates them with the corresponding control actions, thereby generating data path rules.

[0068] Understandably, for any tenant, the administrator can write corresponding access control policies in real time on the controller based on the tenant's real-time access control intent. Then, after writing, the administrator can initiate an application request. The controller can respond to the application request, generate access control rules for RDMA communication behavior under the control path and / or data path according to the various access control policies carried in the application request, and send them to the host in real time, thereby realizing the real-time update of access control rules.

[0069] S103: Send the access control rules to the host where the communication node associated with the access control rules is located; the host is used to perform access control on the RDMA messages from the communication node according to the access control rules.

[0070] Here, a communication node refers to a network endpoint entity in an RDMA cloud network that can initiate or receive RDMA communication requests. Specifically, it manifests as a physical server, virtual machine, or container equipped with RDMA capabilities. Communication nodes related to access control rules specifically refer to nodes explicitly designated as the source or destination node within the control logic defined by a particular access control rule, such as the communication nodes corresponding to sIP and dIP, or Sport and Dport. These communication nodes are the specific objects on which access control rules take effect and execute control measures. Distributing rules to the hosts where these nodes reside is crucial to ensuring that control policies are accurately executed at the source or destination of communication.

[0071] In an RDMA cluster, the controller and hosts form a centralized management and distributed execution relationship. Specifically, the entire RDMA cluster deploys one controller and at least one host. The controller uniformly issues policies, and the hosts execute them in a distributed manner, working together to achieve fine-grained and consistent management of RDMA communication traffic across the entire network.

[0072] In practice, the controller can accurately distribute the control path rules and data path rules generated in step S102 to the physical hosts where the communication nodes managed by the rules reside. Specifically, the controller determines the target host with the corresponding node based on the source node information and destination node information (such as SIP and DIP addresses) implicit in the matching fields of each access control rule. Subsequently, the controller sends the generated access control rules to the corresponding host through a pre-defined management channel (e.g., a communication link based on the Remote Procedure Call (RPC) protocol) established between the deployed smart agent and the target host. This process ensures that each host only receives and loads control rules related to its own message transmission and reception, achieving precise policy delivery.

[0073] Based on the same inventive concept, embodiments of this application also provide an access control method for a host corresponding to the access control method applied to a controller, which realizes the complete access control process from access policy specification, forwarding and execution through the interaction between the controller and the host.

[0074] The following description uses the host as the execution subject to illustrate the access control method provided in this application embodiment: like Figure 2 The flowchart shown is a method for access control of a host in a Remote Direct Memory Access (RDMA) cluster, provided by an embodiment of this application. It may include the following steps: S201: Receive access control rules sent by the controller in the RDMA cluster; the access control rules are generated by the controller based on each access control policy in the set of access control policies carried in the received application request; the access control policy carries logical conditions and control actions indicating access permissions; the logical conditions are set according to the queue QP transmission semantics under RDMA communication behavior.

[0075] In this application, the RDMA cluster is configured with distributed business hosts. Each host acts as an independent policy enforcement endpoint, receiving access control rules uniformly issued by the controller and performing real-time matching and management of RDMA packets arriving at the host. A host may include one or more communication nodes purchased and deployed by a tenant according to their needs. A communication node can be a virtual machine or a container. A tenant may purchase communication nodes on one or more hosts, and a host may include one or more communication nodes purchased by the tenant.

[0076] In practice, any distributed host in the RDMA cluster can receive access control rules issued by the controller through a pre-established management channel (e.g., an RPC-based communication link) established with the central controller. These access control rules are compiled by the controller from a set of access control policies written based on QP transport semantics, according to application requests submitted by the administrator. For example, a host might receive an access control rule whose matching condition requires identifying all RDMA packets under the control path with "sIP 10.2.0.1X, Sport port 'any', dIP 10.2.0.2X, Dport port 479X, and the message is for target QP 40X with an operation type of 'ConnectRequest'"; the associated control action is 'deny'. This rule corresponds to an access control policy designed to block connection requests from any port of node 10.2.0.1X to the specific service corresponding to the Dport port in 10.2.0.2X. After receiving such rules, the host stores them locally, preparing for real-time access control of incoming network packets.

[0077] S202: In response to receiving an RDMA message from the communication node corresponding to any tenant, perform access control on the RDMA message according to the access control rules.

[0078] In practice, when a host receives any arriving RDMA message, it can perform an ACL check based on access control rules to implement access control. For example, upon receiving any RDMA message, the host can parse the header fields to determine the values ​​of the entity fields under each entity field and the values ​​of the specific semantic fields under each behavioral semantic field. Based on the values ​​of each semantic field, it can be determined whether the message is a control path message or a data path message. For example, if the semantic field values ​​include type, lQPN, and dQPN, the message can be determined to be a control path message, and access control rules under the control path can then be used to perform access control on the message. For instance, a control path rule might be defined as: if the message type is ConnectRequest, lQPN is any value, and dQPN is 8x8, then a deny action is performed. When the host receives a ConnectRequest message requesting to establish a connection with QP number 8x8, this rule will be successfully matched, and the request will be rejected.

[0079] When the semantic field values ​​include dQPN, opcode, and VA, the packet can be identified as a data path packet. Therefore, access control rules under the data path can be used to control access to the packet. For example, a data path rule might specify that a READ operation is only allowed for a destination QPN of 7X0 within the virtual address range [0x500X, 0x600X]. When a host receives a WRITE operation packet for dQPN 7X0 and address 0x550X, the packet will not be allowed by this rule because the opcode does not match; if no rule matches, it will be rejected by the default policy.

[0080] In one possible implementation, S201 described above can be carried out according to the following steps: The central processing unit (CPU) in the data processing unit receives access control rules and stores them in the data path accelerator within the data processing unit.

[0081] Here, the Data Processing Unit (DPU) is a dedicated piece of hardware deployed in each host. In this application, the DPU in the host can be dedicated to high-speed execution of network strategies such as receiving, parsing, matching, and performing specific operations on RDMA messages.

[0082] The central processing unit (CPU) can be hardware integrated within the DPU, such as a CPU based on an Advanced Reduced Instruction Set Machine (ARM) architecture. In this application, the CPU can act as the control plane, communicating with the controller in the RDMA cluster. It is responsible for receiving, parsing, and managing access control rules issued by the controller, and ensuring that these rules are correctly configured into the hardware unit (i.e., the Data Path Accelerator (DPA)) within the DPU responsible for high-speed packet processing.

[0083] The Data Access Panel (DPA) is a hardware component within the Data Processing Unit (DPU). It serves as the data plane within the DPU, specifically responsible for handling each incoming and outgoing RDMA packet. Specifically, it performs line-rate matching, judgment, and execution of corresponding access control actions (allow / deny) based on the acquired access control rules. Independent of the DPU's control plane (ARM_CPU), it is the final physical execution unit for implementing fine-grained, high-performance access control of RDMA packets.

[0084] In practice, the DPU deployed within the host communicates with the controller in the RDMA cluster via the ARM_CPU, which acts as the control plane. Specifically, the controller utilizes a deployed intelligent agent to communicate with the ARM_CPU within the host DPU through a pre-defined RPC management channel, distributing access control rules to the ARM_CPU. Upon receiving the access control rules, the ARM_CPU performs necessary parsing, format conversion, and preprocessing (such as merging and checking), transforming them from a network transmission format into an instruction format recognizable by the DPU's internal data plane. After format conversion, the ARM_CPU distributes these executable access control rules via the internal bus and loads them into the rule storage area of ​​the DPA within the DPU. The DPA receives and persists these rules, preparing for subsequent line-rate execution of RDMA message checks and control. This completes the storage and activation process of access control rules on the host.

[0085] Furthermore, regarding the above S202, the following steps can be taken: In response to receiving an RDMA message, the data path accelerator is used to perform access control on the RDMA message according to access control rules and message information related to QP transmission semantics in the RDMA message.

[0086] In practice, when an RDMA message arrives at the host via the RDMA network and enters the DPU, the message can be scheduled to the DPA (Data Plane). The DPA then performs a rapid parsing of the RDMA message, precisely extracting entity fields related to access control rules (such as sIP / dIP addresses, sport / dport) and QP semantic fields (such as type and QPN fields in the control path, or dQPN, opcode, and VA fields in the data path) from its header. These fields constitute the message information related to QP transmission semantics within the RDMA message. Subsequently, threads within the DPA match the extracted message information against all access control rules pre-loaded in its internal rule store. If the message information completely matches all conditions (such as logical conditions) of an access control rule, the DPA immediately executes the control action (allow or deny) bound to that rule. When performing the allow action, DPA will allow the RDMA message to continue forwarding to the host's upper-layer protocol stack or the target application's memory; when performing the deny action, DPA will directly discard the RDMA message and terminate all subsequent processing.

[0087] For example, suppose the DPA stores an access control rule with the following matching conditions: (Source IP=10.10.1.10X, dport=479X, dQPN=80X, opcode=WRITE, VA=0x900X), and the action is deny. When an RDMA data packet originating from 10.10.1.10X, with dport 479X, and carrying the information "perform a write operation to address 0x900X of QP number 80X", arrives, the fields extracted by the DPA will completely match the rule, and a discard action will be triggered immediately. This malicious or unauthorized write request will be blocked immediately before entering the host system memory.

[0088] Those skilled in the art will understand that, in the above-described method of the specific implementation, the order in which each step is written does not imply a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of each step should be determined by its function and possible internal logic.

[0089] To facilitate understanding of the embodiments of this application, this application also provides a schematic diagram of an access control architecture, such as... Figure 3The diagram illustrates an access control architecture provided in an embodiment of this application. This architecture primarily includes a centralized controller located in an RDMA cloud network, multiple hosts (Host1~n) deployed with Data Processing Units (DPUs), and multiple tenants (Tenant1~Tenantn) who lease resources from these hosts. Specifically, in this architecture, each host (also referred to as a server) can be shared by different tenants. Each tenant can lease server resources and deploy containers or virtual machines as needed, thus acting as the corresponding communication node. All communication nodes share the underlying RDMA network.

[0090] Administrators, through the controller, use the logical conditions and control actions defined by QP transport semantics in this application to edit access control policies using the policy language provided in this application, and combine them into policy sets to initiate application requests. The controller, as the core management node, can respond to application requests by converting user-defined policies into ACL rules that can be directly executed on the host and are applicable to both control and data paths. Subsequently, the controller communicates with the host-side DPU through the deployed agent, distributing access control rules to the hosts involved in the relevant tenant communication behavior. The DPU equipped on each host is the key hardware for executing access control. Internally, the DPU contains a central processing unit (such as an ARM_CPU) as the control plane and a data path accelerator (DPA) as the data plane. The ARM_CPU is responsible for receiving the access control rules issued by the controller and loading them into the DPA, which acts as the data plane. The DPA then utilizes its hardware acceleration capabilities to perform line-speed parsing of all RDMA packets entering and leaving the host, and performs real-time matching and adjudication (allow or deny) of RDMA packets according to the loaded access control rules, thereby achieving fine-grained access control. Figure 3 In this context, plane interaction can include the interaction between the control plane and the data plane within the same host (such as when an ARM CPU adds access control to the DPA).

[0091] As can be seen from the above embodiments, this application involves the interaction between the controller and the host when implementing the access control process for RDMA messages. Therefore, this application also provides an access control system.

[0092] like Figure 4 The diagram shown is a schematic representation of an access control system provided in an embodiment of this application. The access control system includes a centralized controller 401 and multiple hosts 402, wherein: The controller 401 is configured to receive an application request for a set of access control policies for a tenant; the set of access control policies includes various access control policies for RDMA communication behavior; each access control policy carries logical conditions and control actions indicating access permissions; the logical conditions are set according to the queued QP transmission semantics under the RDMA communication behavior; in response to the application request, the controller generates access control rules corresponding to the RDMA communication behavior according to each access control policy; the access control rules include control path rules corresponding to the control path and / or data path rules corresponding to the data path; the control path and data path are used to transmit different types of RDMA messages; and the controller sends the access control rules to the host where the communication node associated with the access control rules is located. The host 402 is configured to receive access control rules sent by the controller 401 in the RDMA cluster; and in response to receiving an RDMA message from a communication node corresponding to any tenant, to perform access control on the RDMA message according to the access control rules.

[0093] For a detailed description of the access control system provided in the embodiments of this application, please refer to the foregoing description of the specific implementation of the access control method, which will not be repeated here. That is, for the functions, interaction relationships and workflows of the components of the access control system, such as the centralized controller and various hosts, please refer to the previous description, which will not be repeated here.

[0094] Based on the same inventive concept, this application also provides an access control device corresponding to the access control method applied to the controller in an RDMA cluster. Since the principle of the device in this application is similar to the access control method described above in this application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.

[0095] like Figure 5 The diagram shown is a schematic of an access control device applied to a controller in an RDMA cluster, according to an embodiment of this application, including: The first receiving module 501 is used to receive an application request for a set of access control policies for a tenant; the set of access control policies includes various access control policies for RDMA communication behavior; the access control policy carries logical conditions and control actions indicating access permissions; the logical conditions are set according to the queued QP transmission semantics under RDMA communication behavior. The generation module 502 is configured to, in response to the application request, generate access control rules corresponding to RDMA communication behaviors according to each of the access control policies; the access control rules include control path rules corresponding to the control path, and / or data path rules corresponding to the data path; the control path and data path are used to transmit different types of RDMA messages; The sending module 503 is used to send the access control rule to the host where the communication node associated with the access control rule is located; the host is used to perform access control on the RDMA message from the communication node according to the access control rule.

[0096] In one possible implementation, the QP transport semantics includes an entity field for identifying the communication nodes corresponding to both parties of the communication tenant, and a behavioral semantic field for identifying the RDMA message type. The logical conditions include matching rules for the entity fields and the behavioral semantic fields.

[0097] In one possible implementation, the behavioral semantic field under the data path includes at least a destination queue pair number field, an opcode field, and a virtual address field; the destination queue pair number field is used to indicate the queue pair in the communication node corresponding to the communication receiver; the virtual address field is used to identify the target memory address of the required operation; and the opcode field is used to identify the operation type for the target memory address. The behavioral semantic field under the control path includes at least a queue pair field and a request type field corresponding to both communication tenants respectively; the request type field is used to indicate the link request type of both communication tenants.

[0098] The specific implementation process of the functions and roles of each unit in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0099] Based on the same inventive concept, this application also provides an access control device corresponding to the access control method applied to hosts in an RDMA cluster. Since the principle of the device in this application is similar to the access control method described above in this application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.

[0100] like Figure 6 The diagram shown is a schematic of an access control device for hosts in an RDMA cluster, provided in an embodiment of this application, including: The second receiving module 601 is used to receive access control rules sent by the controller in the RDMA cluster; the access control rules are generated by the controller based on each access control policy in the set of access control policies carried in the received application request; the access control policy carries logical conditions and control actions indicating access permissions; the logical conditions are set according to the queue QP transmission semantics under RDMA communication behavior; The control module 602 is configured to, in response to receiving an RDMA message from a communication node corresponding to any tenant, perform access control on the RDMA message according to the access control rules.

[0101] In one possible implementation, the second receiving module 601, when receiving the access control rules sent by the controller in the RDMA cluster, is used to: The access control rules are received using the central processing unit (CPU) in the data processing unit, and the access control rules are stored in the data path accelerator in the data processing unit. The control module 602, when responding to receiving an RDMA message from a communication node corresponding to any tenant and performing access control on the RDMA message according to the access control rules, is configured to: In response to receiving the RDMA message, the data path accelerator is used to perform access control on the RDMA message according to the access control rules and the message information in the RDMA message that is related to the QP transmission semantics.

[0102] The specific implementation process of the functions and roles of each unit in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0103] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this application according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0104] Based on the same technical concept, embodiments of this application also provide a computer device. (Refer to...) Figure 7 The diagram shown is a structural schematic of a computer device provided in an embodiment of this application, comprising: The system comprises a processor 701, a memory 702, and a bus 703. The memory 702 stores machine-readable instructions executable by the processor 701. The processor 701 executes these machine-readable instructions, and when executed, performs the following steps: S101: Receiving an application request for a set of access control policies for a tenant; the set of access control policies includes various access control policies for RDMA communication behavior; each access control policy carries logical conditions and control actions indicating access permissions; the logical conditions are set according to the queued QP transmission semantics under the RDMA communication behavior; S102: In response to the application request, generating access control rules corresponding to the RDMA communication behavior based on each access control policy; the access control rules include control path rules corresponding to the control path and / or data path rules corresponding to the data path; the control path and data path are used for transmission... RDMA messages of the same type; S103: Send the access control rules to the host where the communication node associated with the access control rules is located; The host is used to perform access control on the RDMA messages from the communication node according to the access control rules; or, when the machine-readable instructions are executed by the processor 701, the processor 701 performs the following steps: S201: Receive the access control rules sent by the controller in the RDMA cluster; The access control rules are generated by the controller according to each access control policy in the access control policy set carried in the received application request; The access control policy carries logical conditions and control actions indicating access permissions; The logical conditions are set according to the queue QP transmission semantics under RDMA communication behavior; S202: In response to receiving an RDMA message from the communication node corresponding to any tenant, perform access control on the RDMA message according to the access control rules.

[0105] The aforementioned memory 702 includes a main memory 7021 and an external memory 7022. The main memory 7021, also known as internal memory, is used to temporarily store the computational data in the processor 701, as well as the data exchanged with external memory such as a hard disk 7022. The processor 701 exchanges data with the external memory 7022 through the main memory 7021. When the computer device is running, the processor 701 and the memory 702 communicate through the bus 703, so that the processor 701 executes the execution instructions mentioned in the above method embodiments.

[0106] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the access control method in the above-described method embodiments. The storage medium can be either volatile or non-volatile computer-readable storage.

[0107] This application also provides a computer program product, which carries program code. The instructions included in the program code can be used to execute the steps of the access control method in the above method embodiments. For details, please refer to the above method embodiments, which will not be repeated here.

[0108] The computer program product can be implemented specifically through hardware, software, or a combination thereof. In one alternative embodiment, the computer program product is specifically embodied in a computer storage medium; in another alternative embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0109] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems and devices described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. In the several embodiments provided in this application, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Another point is that the displayed or discussed mutual coupling or direct coupling or communication connection may be through some communication interfaces; the indirect coupling or communication connection of devices or units may be electrical, mechanical, or other forms.

[0110] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0111] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0112] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to existing technology, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0113] If the technical solution of this application involves personal information, the product using this technical solution has clearly informed the user of the personal information processing rules and obtained the user's voluntary consent before processing the personal information. If the technical solution of this application involves sensitive personal information, the product using this technical solution has obtained the user's separate consent before processing the sensitive personal information, and also meets the requirement of "express consent". For example, at personal information collection devices such as cameras, clear and prominent signs are set up to inform users that they have entered the scope of personal information collection and that personal information will be collected. If an individual voluntarily enters the collection scope, it is deemed that they have agreed to the collection of their personal information; or on the personal information processing device, with clear signs / information informing users of the personal information processing rules, authorization is obtained from the user through pop-up information or by asking the user to upload their personal information; wherein, the personal information processing rules may include information such as the personal information processor, the purpose of personal information processing, the processing method, and the types of personal information processed.

[0114] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. An access control method, characterized in that, A method for use with a controller in a Remote Direct Memory Access (RDMA) cluster includes: Receive an application request for a set of access control policies for a tenant; the set of access control policies includes various access control policies for RDMA communication behavior; the access control policies carry logical conditions and control actions indicating access permissions; the logical conditions are set according to the queued QP transmission semantics under RDMA communication behavior. In response to the application request, access control rules corresponding to RDMA communication behaviors are generated according to each of the access control policies; the access control rules include control path rules corresponding to the control path, and / or data path rules corresponding to the data path; the control path and data path are used to transmit different types of RDMA messages; The access control rules are sent to the host where the communication node associated with the access control rules is located; the host is used to perform access control on the RDMA messages from the communication node according to the access control rules.

2. The method according to claim 1, characterized in that, The QP transmission semantics include an entity field for identifying the communication nodes corresponding to both parties of the communication tenant, and a behavioral semantic field for identifying the RDMA message type. The logical conditions include matching rules for the entity fields and the behavioral semantic fields.

3. The method according to claim 2, characterized in that, The behavioral semantic field under the data path includes at least a destination queue pair number field, an opcode field, and a virtual address field; the destination queue pair number field is used to indicate the queue pair in the communication node corresponding to the communication receiver; the virtual address field is used to identify the target memory address of the required operation; the opcode field is used to identify the operation type for the target memory address; The behavioral semantic field under the control path includes at least a queue pair field and a request type field corresponding to both communication tenants respectively; the request type field is used to indicate the link request type of both communication tenants.

4. An access control method, characterized in that, The method, applied to a host in a Remote Direct Memory Access (RDMA) cluster, includes: The system receives access control rules sent by the controller in the RDMA cluster. The access control rules are generated by the controller based on each access control policy in the set of access control policies carried in the received application request. The access control policy carries logical conditions and control actions that indicate access permissions. The logical conditions are set according to the queued QP transmission semantics under RDMA communication behavior. In response to receiving an RDMA message from a communication node corresponding to any tenant, access control is performed on the RDMA message according to the access control rules.

5. The method according to claim 4, characterized in that, The method of receiving access control rules sent by the controller in the RDMA cluster includes: The access control rules are received using the central processing unit (CPU) in the data processing unit, and the access control rules are stored in the data path accelerator in the data processing unit. The step of responding to receiving an RDMA message from a communication node corresponding to any tenant, and performing access control on the RDMA message according to the access control rules, includes: In response to receiving the RDMA message, the data path accelerator is used to perform access control on the RDMA message according to the access control rules and the message information in the RDMA message that is related to the QP transmission semantics.

6. An access control system, characterized in that, The system includes a controller and multiple hosts, wherein: The controller is configured to receive an application request for a set of access control policies for a tenant; the set of access control policies includes various access control policies for RDMA communication behavior; each access control policy carries logical conditions and control actions indicating access permissions; the logical conditions are set according to the queued QP transmission semantics under the RDMA communication behavior; in response to the application request, the controller generates access control rules corresponding to the RDMA communication behavior according to each access control policy; the access control rules include control path rules corresponding to the control path and / or data path rules corresponding to the data path; the control path and data path are used to transmit different types of RDMA messages; and the controller sends the access control rules to the host where the communication node associated with the access control rules is located. The host is configured to receive access control rules sent by the controller in the RDMA cluster; and in response to receiving an RDMA message from a communication node corresponding to any tenant, to perform access control on the RDMA message according to the access control rules.

7. An access control device, characterized in that, A controller for use in a Remote Direct Memory Access (RDMA) cluster, the device comprising: The first receiving module is used to receive an application request for a set of access control policies for a tenant; the set of access control policies includes various access control policies for RDMA communication behavior; the access control policies carry logical conditions and control actions indicating access permissions; the logical conditions are set according to the queued QP transmission semantics under RDMA communication behavior. A generation module is used to respond to the application request and generate access control rules corresponding to RDMA communication behaviors according to each access control policy; the access control rules include control path rules corresponding to the control path and / or data path rules corresponding to the data path; the control path and data path are used to transmit different types of RDMA messages; The sending module is used to send the access control rules to the host where the communication node associated with the access control rules is located; the host is used to perform access control on the RDMA messages from the communication node according to the access control rules.

8. An access control device, characterized in that, An apparatus for use in a Remote Direct Memory Access (RDMA) cluster for hosts, the apparatus comprising: The second receiving module is used to receive access control rules sent by the controller in the RDMA cluster; the access control rules are generated by the controller based on each access control policy in the set of access control policies carried in the received application request; the access control policy carries logical conditions and control actions indicating access permissions; the logical conditions are set according to the queued QP transmission semantics under RDMA communication behavior; The control module is configured to, in response to receiving an RDMA message from a communication node corresponding to any tenant, perform access control on the RDMA message according to the access control rules.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by a processor, it implements the steps of the method as described in any one of claims 1 to 5.

10. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method as described in any one of claims 1 to 5.

Images