InfiniBand Port Validation Module for Multi-Address Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
InfiniBand (IB) networks face security breaches due to the lack of validation for multiple addresses assigned to a physical port, which can result in unauthorized access despite validated partition keys.
Innovation Solution
A method and network device with a validation module that compares a partition key with stored values and verifies source or destination addresses to ensure authorized communication, even when a physical port has multiple addresses assigned.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If partition key validation is implemented in IB networks, then communication security between devices is improved, but security breaches can still occur when a physical port has multiple addresses assigned due to lack of address validation
Solution Approach 1:
The patent merges partition key validation with address validation into a unified security check. The validation module combines the partition key from the packet header with the source address to form a composite validation key, which is then compared against the partition key database. This merging ensures that both partition-level and address-level security requirements are simultaneously enforced, preventing unauthorized access even when multiple addresses are assigned to a single physical port.
Solution Approach 2:
The patent introduces a validation module as an intermediary component between the packet reception and processing stages. This module acts as a mediator that intercepts incoming packets, performs dual validation of partition keys and addresses, and determines whether to allow or block packet transmission. The validation module serves as a security gatekeeper that enforces both partition key policies and address assignment rules before packets are processed by the network switch.
2Adaptability or versatility
If multiple addresses are assigned to a single physical port for virtualization operations, then network versatility is improved, but security control becomes more difficult
Solution Approach 1:
The validation module is designed with universal functionality to handle multiple validation scenarios. It can validate packets based on partition keys alone, or combine partition keys with source addresses, or compare against multiple address entries in the database. This multi-functional design allows the same module to support both simple single-address ports and complex multi-address virtualized ports, providing versatility without requiring separate validation mechanisms for different configurations.
Solution Approach 2:
The patent adds an additional validation dimension by incorporating address verification alongside traditional partition key validation. Instead of validating only the partition key (single dimension), the system now validates the combination of partition key and source address (two dimensions). This dimensional expansion creates a more granular security model that can distinguish between multiple addresses assigned to the same physical port, enabling virtualization support while maintaining security control.
Data Source
AI summary
Method for and system validating a network packet is provided. The method includes receiving a network packet at a port of a network device, the packet including a first indicia value and a second indicia value; comparing the first indicia value of the packet with at least a first value stored at the network device; comparing the second indicia value of the packet with at least a second value stored at the network device; and processing the packet if the first indicia value matches with the first value and the second indicia value matches with the second value; wherein the first indicia value is a partition key that restricts communication between a packet source and at least one destination; and the second indicia value is one or more of a source address and a destination address, where a same physical port of a source is assigned more than one source address.