Ebpf-based rdma data injection attack detection method and system

Abstract

The application discloses an eBPF-based RDMA data injection attack detection method and system, the method comprises the following steps: a sending terminal monitors the RDMA use behavior of a user state program through an eBPF-based monitoring program, and writes the monitored RDMA operation data into a data buffer; a super process reads the RDMA operation data in the data buffer, calculates a hash value of the RDMA operation data, and sends the hash value as additional data to a receiving terminal; the super process on the receiving terminal calculates a hash value of the received RDMA operation data, and compares the calculated hash value with the hash value carried in the additional data to realize data verification on the RDMA operation data. The application aims to realize accurate detection of RDMA data injection attacks under the premise of compatibility with general RDMA network cards, improve the real-time performance of software protection, and reduce resource consumption.

Description

Technical Field

[0001] This invention relates to the field of computer security protection technology, specifically to a method and system for detecting RDMA data injection attacks based on eBPF. Background Technology

[0002] With the gradual maturation of intelligent computing technologies (such as distributed machine learning, deep neural networks, and large-scale models), more and more fields are introducing intelligent computing technologies to build efficient intelligent sensing / control systems. However, as application areas deepen, intelligent computing technologies increasingly rely on large amounts of data for model training and real-time optimization. This requires intelligent computing platforms to provide efficient network transmission capabilities and reduce data transmission latency. Traditional TCP / IP network interface cards (NICs) are only responsible for data transmission. When data arrives at the end-side server, the server's own CPU resources are needed to handle the data transfer. However, the end-side server uses CPU resources in a time-sharing manner, making it difficult to allocate all CPU resources to the NIC for transmitting large amounts of data, and also making it difficult to continuously support data transmission. Data transmission within the end-side server's protocol stack significantly increases data transmission jitter and latency, failing to effectively support the low latency and high throughput requirements of intelligent computing technologies. To address the aforementioned issues, Remote Memory Direct Access (RDMA) technology, with the assistance of the network interface card (NIC) and Direct Memory Access (DMA), enables data transmission bypassing the CPU. This solves the transmission bottleneck of traditional TCP / IP networks, which prevents NICs from supporting efficient intelligent computing technologies. RDMA is currently widely deployed and applied in major cloud computing platforms and enterprise computing environments. However, because RDMA directly accesses memory by bypassing the CPU, it suffers from serious security flaws. If an attacker can breach the security protections of the NIC hardware logic and exploit vulnerabilities in the RDMA mechanism, it can cause serious data leakage / forgery issues between communicating parties. Numerous studies have proposed corresponding attack models to address RDMA security issues, such as RDMA data injection attacks.

[0003] RDMA data injection attacks exploit the weaknesses in RDMA security to hijack the transmission network or forge the identity of the communication terminal, maliciously altering or falsifying transmitted data. With the increasing use of RDMA in intelligent computing technologies and the growing reliance on the accuracy of the data itself (such as model parameters, training data, and input data), the destructive power of RDMA data injection attacks is receiving increasing attention. These attacks are crucial for the reliability control of intelligent applications across various fields; therefore, implementing defenses against RDMA data injection attacks is essential. Some researchers have proposed relevant defense strategies, such as adding security authentication or data encryption transmission functions to the hardware logic of RDMA network cards. However, this defense strategy requires modifying the hardware logic, i.e., re-customizing the RDMA network card, which greatly increases the economic cost. On the other hand, RDMA is usually used to transmit large amounts of data, and encrypting large amounts of data itself also requires a lot of computing resources, which is difficult to match the actual situation of low resource consumption of RDMA network cards. In addition, some researchers have proposed using eBPF (extended Berkeley Packet Filter) technology and programmable network technology to achieve RDMA network attack denial through network traffic collection and terminal behavior perception. Although this method can effectively reduce data injection attacks, on the one hand, because it is based on behavior analysis, it will have the problem of inaccurate judgment and detection; on the other hand, as more communication terminals join the network, this scheme will cause a lot of network resource consumption and detection time delay. In summary, existing defense technologies against RDMA data injection attacks have the following problems: (1) They require hardware customization and are difficult to interconnect with existing general RDMA equipment; (2) They have high resource consumption and are prone to complex network management problems under large-scale traffic; (3) They have weak detection capabilities and have problems such as low attack detection accuracy and extended detection time. Summary of the Invention

[0004] The technical problem to be solved by this invention is to provide an RDMA data injection attack detection method and system based on eBPF, which addresses the above-mentioned problems in the prior art. This invention aims to achieve accurate detection of RDMA data injection attacks while being compatible with general RDMA network cards, thereby improving the real-time performance of software protection and reducing resource overhead.

[0005] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows: A method for detecting RDMA data injection attacks based on eBPF includes the following steps: S101, the transmitting terminal monitors the RDMA usage behavior of the user-mode program through an eBPF-based monitoring program and writes the monitored RDMA operation data into the data buffer. S102, the transmitting terminal uses the super process to read the RDMA operation data in the data buffer, calculates the hash value of the RDMA operation data, and sends the hash value as additional data to the receiving terminal; S103 After receiving the RDMA operation data and additional data, the receiving terminal calculates the hash value of the received RDMA operation data through the super process on the receiving terminal, and compares the calculated hash value with the hash value carried in the additional data to realize the data verification of the RDMA operation data.

[0006] Optionally, in step S101, when the transmitting terminal monitors the RDMA usage behavior of the user-mode program through the eBPF-based monitoring program, the monitoring program is attached to the dynamic library corresponding to the user-mode driver of the RDMA network card to load and monitor the dynamic library functions.

[0007] Optionally, in step S101, when the transmitting terminal monitors the RDMA usage behavior of the user-space program through the eBPF-based monitoring program, it includes dynamic library functions for RDMA usage behavior, and accurately obtains the input parameters and return values ​​of the dynamic library functions by reverse querying the user-space functions corresponding to the dynamic library functions based on the libibverbs library.

[0008] Optionally, the data buffer includes a first buffer S and a second buffer D for buffering transmitted data information. The first buffer S is composed of a first-in-first-out (FIFO) queue pattern MAP. Each member of the first buffer S consists of three element attributes, which are used to record the global identifier of RDMA usage behavior, the queue number of the local process, and the function process number, respectively. The second buffer D is composed of a first-in-first-out (FIFO) queue pattern MAP. Each member of the second buffer D consists of seven element attributes, which are used to record the function process number of RDMA usage behavior, the queue number of the local process, the queue number of the communication peer process, the local data start address, the peer data start address, the message length of the current communication interaction between the two ends, and the transmission type of this communication.

[0009] Optionally, step S102 includes: the superprocess pre-constructing a global identifier-queue pair mapping table W, where each element in the global identifier-queue pair mapping table W... The structure is ,in The global identifier representing the k-th remote RDMA network card communicating with the local RDMA network card. This indicates the queue number occupied by the k-th RDMA network card superprocess in local RDMA network card communication. The global identifier-queue pair mapping table W is initially set to 0. The superprocess operates every [time interval]. Read the first buffer S and the second buffer D once. Reading the first buffer S once includes reading all the data in the first buffer S. For any data item in the first buffer S... Obtain the queue number of the communication peer process. Global identifier of the peer process in communication Query whether the global identifier-queue pair exists in the corresponding table W. If it does not exist, then Add the global identifier-queue pair to the corresponding table W; when reading the second buffer D, this includes reading the first non-empty data item in the second buffer D. ,in and for data items Perform the following processing: from data items Retrieve the queue number of the local process in the current RDMA usage behavior. Queue number of the communication peer process Local data start address Data length Starting address of remote data ;From the local memory, starting at the local data address Start reading length is Data ; Calculate data hash value Based on the global identifier of the peer process in the communication. Query the global identifier - queue to find the corresponding element in table W. This allows us to obtain the queue number of the communication peer process. Data is transmitted in UD mode using RMDA communication. hash value It is sent to the receiving terminal as additional data.

[0010] Optionally, the data buffer further includes a third buffer Z for buffering received data information. The third buffer Z is composed of a first-in-first-out queue pattern MAP. Each member of the third buffer Z consists of six element attributes, which are used to record the transmission type of the two-way communication of RDMA usage behavior, the starting address of the local label of the two-way communication, the data length of the two-way communication, the hash value, the queue number of the local process, and the queue number of the communication peer process.

[0011] Optionally, step S103 includes: the super process every time interval Read the third buffer Z once. If the third buffer Z is empty, then read the existing data in the buffer. For each data item, perform the following operations: S201, Set the value of parameter m to 1; S202, if parameter m is greater than Then terminate and exit; otherwise, proceed to step S203. S203, Read the k-th data entry from the third buffer Z. <type, , , >, among which The `type` parameter specifies the transmission type for two-way communication. This is the starting address marked on this side for two-way communication. For two-way communication, If the transmission type of the two-way communication is 1 or 2, then proceed to step S204; otherwise, proceed to step S205. S204, the super process reads the starting address as the starting address marked on this side of the two-way communication. The length is the data length for two-way communication. The memory data is processed, and a hash value is obtained by performing a hash operation on the memory data using a preset hash function. The calculated hash value The hash value read from the third buffer Z Compare the two; if they are equal, proceed to step S206; otherwise, proceed to step S207. S205, Superprocess queries the second buffer D, the starting address marked on this side based on two-way communication. Data length in two-way communication Obtain the starting address and data length The super process starts from the address The read length is the data length. The data is processed using a preset hash function to perform a hash operation on the memory data to obtain a hash value. The calculated hash value The hash value read from the third buffer Z Compare the two; if they are equal, proceed to step S206; otherwise, proceed to step S207. S206, increment parameter m by 1, then jump to step S202; S207, alarm error, increment parameter m by 1, jump to step S202.

[0012] Furthermore, the present invention also provides an eBPF-based RDMA data injection attack detection system, comprising an interconnected microprocessor and a memory, wherein the microprocessor is programmed or configured to execute the eBPF-based RDMA data injection attack detection method.

[0013] Furthermore, the present invention also provides a computer-readable storage medium storing a computer program or instructions that are programmed or configured to execute the eBPF-based RDMA data injection attack detection method by a processor.

[0014] Furthermore, the present invention also provides a computer program product, including a computer program or instructions, which are programmed or configured to execute the eBPF-based RDMA data injection attack detection method via a processor.

[0015] Compared with existing technologies, the present invention mainly achieves the following beneficial effects: The present invention includes a lightweight, non-intrusive end-to-end security detection based on the integration of eBPF and cryptographic technology. Specifically, it includes monitoring RDMA user-space programs in the kernel through eBPF to obtain the RDMA usage behavior of the RDMA user-space programs, and simultaneously using a super process to perform cryptographic hash calculation on the operation data of the RDMA usage behavior, and sending the hash value as additional data to the receiving terminal. After receiving the operation data of the RDMA usage behavior and the additional data, the receiving terminal verifies the received operation data of the RDMA usage behavior using the hash value in the additional data through the super process on the receiving terminal to achieve data verification. First, the implementation method of the present invention is entirely at the software level, requiring no modification to the RDMA network card, and can achieve compatibility with general RDMA network cards, achieving accurate detection of RDMA data injection attacks while being compatible with general RDMA network cards. Second, since the cryptographic hash calculation uses cryptographic technology, it can ensure accurate detection of each data tampering. Furthermore, the solution designed in this invention utilizes eBPF technology, which features lightweight real-time monitoring, effectively improving the real-time performance of software protection and reducing resource consumption. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of the basic process of the method in an embodiment of the present invention.

[0017] Figure 2 This is a schematic diagram of the topology of the sending terminal and the receiving terminal in an embodiment of the present invention. Detailed Implementation

[0018] To enable those skilled in the art to better understand the technical solutions of the present invention, the technical solutions of the present invention will be further described in detail below with reference to the accompanying drawings in the embodiments of the present invention.

[0019] like Figure 1 and Figure 2 As shown, the RDMA data injection attack detection method based on eBPF in this embodiment includes the following steps: S101, the transmitting terminal monitors the RDMA usage behavior of the user-mode program through an eBPF-based monitoring program and writes the monitored RDMA operation data into the data buffer. S102, the transmitting terminal uses the super process to read the RDMA operation data in the data buffer, calculates the hash value of the RDMA operation data, and sends the hash value as additional data to the receiving terminal; S103 After receiving the RDMA operation data and additional data, the receiving terminal calculates the hash value of the received RDMA operation data through the super process on the receiving terminal, and compares the calculated hash value with the hash value carried in the additional data to realize the data verification of the RDMA operation data.

[0020] The eBPF-based monitoring program is responsible for monitoring user usage of RDMA. This embodiment primarily focuses on monitoring RDMA Read, Write, and Send / Receive operations. The eBPF-based monitoring program uses eBPF technology and, through the operating system's support for user-space probes (uprobe), attaches itself to the dynamic library corresponding to the RDMA network card's user-space driver, and loads the corresponding functions in the dynamic library for monitoring. Specifically, in step S101, when the transmitting terminal monitors the RDMA usage behavior of the user-space program through the eBPF-based monitoring program, the monitoring program attaches itself to the dynamic library corresponding to the RDMA network card's user-space driver to load and monitor the dynamic library functions.

[0021] Considering the issue of inconsistent user-space drivers across different network cards leading to different monitored function names, this embodiment uses the libibverbs library to perform a reverse lookup of the corresponding user-space functions. In step S101 of this embodiment, when the transmitting terminal monitors the RDMA usage behavior of user-space programs through an eBPF-based monitoring program, including dynamic library functions related to RDMA usage behavior, the corresponding user-space functions of these dynamic library functions are accurately obtained by performing a reverse lookup of the libibverbs library. The eBPF-based monitoring program can obtain the input parameters and return values ​​of specified dynamic library functions. For example, monitorable dynamic library functions include the user-space functions called by functions such as post_send and post_receive. To facilitate differentiation in cases of different function names, the dynamic library functions corresponding to the aforementioned post_send and post_receive functions can be fixedly described as x_post_send and x_post_receive.

[0022] The data buffer is composed of a Map structure defined by eBPF, which supports data reading and writing by the monitoring program and the super process. In this embodiment, the data buffer includes a first buffer S and a second buffer D for buffering transmitted data. The first buffer S is composed of a first-in-first-out (FIFO) queue pattern MAP. Each member of the first buffer S consists of three element attributes, which are used to record the global identifier (Gid) of RDMA usage behavior, the queue pair number (QP number) of the local process, and the function process number. Its main function is to record the process currently using RDMA for communication, the queue pair number, and the corresponding information of the global identifier. Its structure is shown in Table 1. Among them, the queue pair number (QP number) is the basic unit of RDMA communication. It contains two queues: the send queue (SQ): used to store work requests (WRs) to be sent; and the receive queue (RQ): used to store work requests (WRs) to be received. Each queue pair has a unique queue pair number (QP number) to identify the queue pair.

[0023] Table 1. Structure of the first buffer S

[0024] Referring to Table 1, in this embodiment, each member of the first buffer S consists of three element attributes: attribute one (16 bytes), attribute two (8 bytes), and attribute three (8 bytes), totaling 100 members. The attribute content can be obtained by the dynamic library function x_post_send of the eBPF-based monitoring program, including the process currently using RDMA for communication, queue number, and global identifier. The global identifier corresponds to attribute one; the global identifiers of the 100 members in Table 1 include Gid 1 to Gid 100. The queue number corresponds to attribute two; the queue numbers of the 100 members in Table 1 include QP 1 to QP 100. The process number corresponds to attribute three; the process numbers of the 100 members in Table 1 include process 1 to process 100.

[0025] In this embodiment, the second buffer D is composed of a first-in-first-out queue pattern MAP. Each member in the second buffer D consists of seven element attributes, which are used to record the function process number of RDMA usage behavior, the queue number of the local process, the queue number of the communication peer process, the local data start address, the peer data start address, the message length of the current communication interaction between the two ends, and the transmission type of this communication. Its structure is shown in Table 2.

[0026] Table 2 Structure of the Second Buffer D

[0027] Referring to Table 2, in this embodiment, each member of the second buffer D consists of 7 element attributes, totaling 100 members. The attribute content can be obtained from the dynamic library functions x_post_send and x_post_receive of the eBPF-based monitoring program. Attribute 1 is the process ID (process 1 to process 100) using the x_post_send function; attribute 2 is the queue number currently used by this process (local QP1 to local QP100); attribute 3 is the queue number of the communicating peer process (peer QP1 to peer QP100); attribute 4 is the local data starting address (starting address a1 to starting address a100); attribute 5 is the peer data starting address (starting address a1 to starting address a100); and attribute 6 is the message length of the current communication interaction between the two ends (message length). ~Message length Attribute 7 indicates the transmission type of this communication (Transmission Type 1 to Transmission Type 100). When it is 1, it indicates that this communication is in WRITE mode. When it is 2, it indicates that this communication is in READ mode. When it is 3, it indicates that this communication is in SEND / RECEIVE mode. Other RDMA type communications are marked as 4.

[0028] The superprocess primarily has three functions: reading data from the data buffer to understand user behavior; verifying the correctness of read or written data; and generating a checksum and sending it to the peer RDMA network card via the RDMA network card. This embodiment mainly focuses on Write, Read, and Send / Receive operations in RDMA RC mode.

[0029] In this embodiment, step S102 includes: the superprocess pre-constructing a global identifier-queue pair (Gid-QP) correspondence table W, where each element in the Gid-QP correspondence table W... The structure is ,in The global identifier representing the k-th remote RDMA network card communicating with the local RDMA network card. This indicates the queue number occupied by the k-th RDMA network card superprocess in local RDMA network card communication. The initial value of the Gid-QP mapping table W is 0; the superprocess operates every time... Read the first buffer S and the second buffer D once. Reading the first buffer S once includes reading all the data in the first buffer S. For any data item in the first buffer S... Obtain the queue number of the communication peer process. Global identifier of the peer process in communication Query whether the corresponding table W for Gid-QP exists. If it does not exist, then Add to the Gid-QP mapping table W; when reading the second buffer D, this includes reading the first non-empty data item in the second buffer D. ,in and for data items Perform the following processing: from data items Retrieve the queue number of the local process in the current RDMA usage behavior. Queue number of the communication peer process Local data start address Data length Starting address of remote data ;From the local memory, starting at the local data address Start reading length is Data ; Calculate data hash value (Can be calculated using any secure hash function, symmetric or asymmetric method); based on the global identifier of the communicating peer process. Query the Gid-QP mapping table W to find the corresponding element. This allows us to obtain the queue number of the communication peer process. Data is transmitted in UD mode using RMDA communication. hash value This data is sent to the receiving terminal as additional data. The global identifier is a 128-bit identifier used to identify a port or multicast group. In an RDMA network, it functions similarly to an IP address, used for routing across subnets.

[0030] In this embodiment, the data buffer further includes a third buffer Z for buffering received data information. The third buffer Z is composed of a first-in-first-out queue pattern MAP. Each member of the third buffer Z consists of six element attributes, which are used to record the transmission type of the two-way communication of RDMA usage behavior, the starting address of the local side of the two-way communication, the data length of the two-way communication, the hash value, the queue number of the local process and the queue number of the communication peer process. Its structure is shown in Table 3.

[0031] Table 3. Structure of the Third Buffer Zone Z

[0032] Referring to Table 3, in this embodiment, each member of the third buffer Z consists of 6 element attributes (attribute 1 to attribute 5 and hash value), totaling 100 members (Type 1 to Type 100). The attribute content is written by the RDMA dual-end super process through RDMA communication. Attribute 1 indicates the transmission type of the associated dual-end communication (transmission type Type 1 to transmission type Type 100), attribute 2 indicates the starting address marked on this side of the dual-end communication (starting address a1 to starting address a100), and attribute 3 indicates the data length of the dual-end communication (data length...). ~Data length The hash value represents the check hash value (check hash value r1 to check hash value r100) associated with the memory data segment. Attributes four and five represent the queue numbers of the local process (local QP 1 to local QP 100) and the queue numbers of the communication peer process (peer QP 1 to peer QP100).

[0033] In this embodiment, step S103 includes: the super process at regular intervals. Read the third buffer Z once. If the third buffer Z is empty, then read the existing data in the buffer. For each data item, perform the following operations: S201, Set the value of parameter m to 1; S202, if parameter m is greater than Then terminate and exit; otherwise, proceed to step S203. S203, Read the k-th data entry from the third buffer Z. <type, , , >, among which The `type` parameter specifies the transmission type for two-way communication. This is the starting address marked on this side for two-way communication. For two-way communication, If the transmission type of the two-way communication is 1 or 2, then proceed to step S204; otherwise, proceed to step S205. S204, the super process reads the starting address as the starting address marked on this side of the two-way communication. The length is the data length for two-way communication. The memory data is processed, and a hash value is obtained by performing a hash operation on the memory data using a preset hash function. The calculated hash value The hash value read from the third buffer Z Compare the two; if they are equal, proceed to step S206; otherwise, proceed to step S207. S205, Superprocess queries the second buffer D, the starting address marked on this side based on two-way communication. Data length in two-way communication Obtain the starting address and data length The super process starts from the address The read length is the data length. The data is processed using a preset hash function to perform a hash operation on the memory data to obtain a hash value. The calculated hash value The hash value read from the third buffer Z Compare the two; if they are equal, proceed to step S206; otherwise, proceed to step S207. S206, increment parameter m by 1, then jump to step S202; S207, alarm error, increment parameter m by 1, jump to step S202.

[0034] It should be noted that the roles of the sending terminal and the receiving terminal are determined based on the transmission and reception of RDMA operation data. As an optional implementation, in this embodiment, the sending terminal and the receiving terminal are respectively the terminal host and the server, as shown below. Figure 2 As shown, three modules are deployed on each RDMA-supported terminal host / server: a super process, a data buffer, and an eBPF-based monitoring program. The eBPF-based monitoring program monitors the calls to the user-mode dynamic library of the RDMA driver to obtain the real-time usage of RDMA by user applications, and writes this call information to the data buffer in real time. The super process reads the data buffer, obtains RDMA behavior, verifies the contents of the RDMA read / write operation area, and then the sending terminal calculates a hash value and transmits the hash value to the receiving terminal using RDMA transmission technology. The receiving terminal performs verification to determine whether the verification is successful; for unqualified content, an anomaly warning is issued. This embodiment of the eBPF-based RDMA data injection attack detection method can achieve accurate detection of RDMA data injection attacks while being compatible with general RDMA network cards, improving the real-time performance of software protection and reducing resource overhead.

[0035] Furthermore, this embodiment also provides an eBPF-based RDMA data injection attack detection system, including a microprocessor and a memory interconnected, wherein the microprocessor is programmed or configured to execute the eBPF-based RDMA data injection attack detection method.

[0036] Furthermore, this embodiment also provides a computer-readable storage medium storing a computer program or instructions that are programmed or configured to execute the eBPF-based RDMA data injection attack detection method by a processor.

[0037] Furthermore, this embodiment also provides a computer program product, including a computer program or instructions, which are programmed or configured to execute the eBPF-based RDMA data injection attack detection method via a processor.

[0038] Those skilled in the art will understand that the technical solutions provided by this invention may take the form of a method, system, or computer program product. Therefore, this invention may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this invention may take the form of a computer program product embodied on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, produce an implementation of the flowchart... Figure 1 One or more processes and / or boxes Figure 1 The computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0039] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A method for detecting RDMA data injection attacks based on eBPF, characterized in that, Includes the following steps: S101, the transmitting terminal monitors the RDMA usage behavior of the user-mode program through an eBPF-based monitoring program and writes the monitored RDMA operation data into the data buffer. S102, the transmitting terminal uses the super process to read the RDMA operation data in the data buffer, calculates the hash value of the RDMA operation data, and sends the hash value as additional data to the receiving terminal; S103, after receiving the RDMA operation data and additional data, the receiving terminal calculates the hash value of the received RDMA operation data through the super process on the receiving terminal, and compares the calculated hash value with the hash value carried in the additional data to realize the data verification of the RDMA operation data. The data buffer includes a first buffer and a second buffer for buffering transmitted data. The first buffer is constructed using a first-in-first-out (FIFO) queue pattern (MAP). Each member in the first buffer consists of three element attributes, which are used to record the global identifier of RDMA usage behavior, the queue number of the local process, and the function process number, respectively. The second buffer is constructed using a FIFO queue pattern (MAP). Each member in the second buffer consists of seven element attributes, which are used to record the function process number of RDMA usage behavior, the queue number of the local process, the queue number of the communication peer process, the local data start address, the peer data start address, the message length of the current communication interaction between the two ends, and the transmission type of this communication. Step S102 includes: the superprocess pre-constructing a global identifier-queue pair mapping table, where each element in the global identifier-queue pair mapping table... The structure is ,in The global identifier representing the k-th remote RDMA network card communicating with the local RDMA network card. This indicates the queue number occupied by the k-th RDMA network card superprocess in local RDMA network card communication. The global identifier-queue pair mapping table is initially set to 0. The superprocess operates every [time interval]. Read the first buffer and the second buffer once. Reading the first buffer once includes reading all the data in the first buffer. For any data item in the first buffer... Obtain the queue number of the communication peer process. Global identifier of the peer process in communication Query whether the global identifier-queue pair exists in the corresponding table. If it does not exist, then Add to the global identifier-queue pair mapping table; when reading the second buffer, include reading the first non-empty data item in the second buffer. ,in and for data items Perform the following processing: from data items Retrieve the queue number of the local process in the current RDMA usage behavior. Queue number of the communication peer process Local data start address Data length Starting address of remote data ;From the local memory, starting at the local data address Start reading length is Data ; Calculate data hash value Based on the global identifier of the peer process in the communication. Query the global identifier - queue to find the corresponding element in the corresponding table This allows us to obtain the queue number of the communication peer process. Data is transmitted in UD mode using RMDA communication. hash value It is sent to the receiving terminal as additional data.

2. The method for detecting RDMA data injection attacks based on eBPF according to claim 1, characterized in that, In step S101, when the transmitting terminal monitors the RDMA usage behavior of the user-mode program through the eBPF-based monitoring program, the monitoring program is attached to the dynamic library corresponding to the user-mode driver of the RDMA network card to load and monitor the dynamic library functions.

3. The method for detecting RDMA data injection attacks based on eBPF according to claim 2, characterized in that, In step S101, when the transmitting terminal monitors the RDMA usage behavior of the user-mode program through the eBPF-based monitoring program, it includes dynamic library functions for RDMA usage behavior. It uses the libibverbs library to reverse query the user-mode function corresponding to the dynamic library function to accurately obtain the input parameters and return values ​​of the dynamic library function.

4. The method for detecting RDMA data injection attacks based on eBPF according to claim 1, characterized in that, The data buffer also includes a third buffer for buffering received data information. The third buffer is composed of a first-in-first-out queue pattern (MAP). Each member of the third buffer consists of six element attributes, which are used to record the transmission type of the two-way communication used by RDMA, the starting address of the local side of the two-way communication, the data length of the two-way communication, the hash value, the queue number of the local process, and the queue number of the communication peer process.

5. The method for detecting RDMA data injection attacks based on eBPF according to claim 4, characterized in that, Step S103 includes: the super process at regular intervals. Read the third buffer once. If the third buffer is not empty, then for the existing data in the third buffer... For each data item, perform the following operations: S201, Set the value of parameter m to 1; S202, if parameter m is greater than Then terminate and exit; otherwise, proceed to step S203. S203, Read the m-th data entry from the third buffer. <type, , , >, among which The `type` parameter specifies the transmission type for two-way communication. This is the starting address marked on this side for two-way communication. For two-way communication, If the transmission type of the two-way communication is 1 or 2, then proceed to step S204; otherwise, proceed to step S205. S204, the super process reads the starting address as the starting address marked on this side of the two-way communication. The length is the data length for two-way communication. The memory data is processed, and a hash value is obtained by performing a hash operation on the memory data using a preset hash function. The calculated hash value Hash value read from the third buffer Compare the two; if they are equal, proceed to step S206; otherwise, proceed to step S207. S205, Super Process queries the second buffer, based on the starting address marked on this side of the two-way communication. Data length in two-way communication Obtain the starting address and data length The super process starts from the address The read length is the data length. The data is processed using a preset hash function to perform a hash operation on the memory data to obtain a hash value. The calculated hash value Hash value read from the third buffer Compare the two; if they are equal, proceed to step S206; otherwise, proceed to step S207. S206, increment parameter m by 1, then jump to step S202; S207, alarm error, increment parameter m by 1, jump to step S202.

6. A detection system for RDMA data injection attacks based on eBPF, comprising a microprocessor and a memory interconnected, characterized in that, The microprocessor is programmed or configured to execute the eBPF-based RDMA data injection attack detection method according to any one of claims 1 to 5.

7. A computer-readable storage medium storing a computer program or instructions, characterized in that, The computer program or instructions are programmed or configured to execute, via a processor, the eBPF-based RDMA data injection attack detection method as described in any one of claims 1 to 5.

8. A computer program product, comprising a computer program or instructions, characterized in that, The computer program or instructions are programmed or configured to execute, via a processor, the eBPF-based RDMA data injection attack detection method as described in any one of claims 1 to 5.

Images