Persistent Memory Cache RDMA Security via Segmented Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems face performance overhead and security challenges in managing access permissions for data cached in persistent memory, as they rely on CPU-intensive security measures for each data block, impacting storage server performance.
Innovation Solution
Implementing a secure RDMA table that maps remote access keys to cache addresses and persistent storage addresses, with access credentials determining permission access, allowing only authorized clients to access specific cache lines within the PMEM cache, thereby reducing CPU overhead and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security measures are implemented for each data block in the persistent cache, then security is improved, but CPU overhead increases and performance deteriorates
Solution Approach 1:
The patent segments the cache into multiple cache lines with unique identifiers, and segments the security mechanism by implementing security checks at the cache line level rather than data block level. The RDMA table is segmented into multiple tables (first RDMA table and second RDMA table) that can be independently accessed based on security credentials, reducing the overhead of checking every data block while maintaining security at the appropriate granularity.
Solution Approach 2:
The patent introduces an intermediary mechanism - the RDMA table with cache line identifiers and security credentials - that mediates between the security requirement and performance constraint. This intermediary structure allows the system to verify security permissions without requiring CPU intervention for every data block access, as the RDMA table can be consulted efficiently to determine authorized cache line accesses.
2Reliability
If CPU-intensive security measures are used for each data block, then access control is improved, but storage server performance deteriorates
Solution Approach 1:
The patent extracts the security verification function from the CPU-intensive data block processing path and places it in a separate RDMA table lookup mechanism. By taking out the security credentials and cache line identifiers into a dedicated RDMA table structure, the system can perform access control checks without burdening the CPU with per-data-block security processing, thereby improving storage server performance while maintaining access control.
Solution Approach 2:
The patent implements preliminary action by pre-establishing the RDMA table with cache line identifiers and security credentials before data access operations. This preliminary structure allows security verification to be performed through efficient table lookups rather than intensive per-block processing during actual data operations, reducing the performance impact on the storage server.
3Productivity
If RDMA is used for data transfer, then data throughput increases and latency decreases, but security management complexity increases
Solution Approach 1:
The patent applies local quality by implementing security management specifically tailored for RDMA operations through dedicated RDMA tables with cache line identifiers. Instead of applying generic security measures to all data transfers, the system creates localized security structures (first and second RDMA tables) that are optimized for RDMA's direct memory access characteristics, thereby managing security complexity efficiently while maintaining high data throughput.
Data Source
AI summary
Techniques are described for providing one or more clients with direct access to cached data blocks within a persistent memory cache on a storage server. In an embodiment, a storage server maintains a persistent memory cache comprising a plurality of cache lines, each of which represent an allocation unit of block-based storage. The storage server maintains an RDMA table that include a plurality of table entries, each of which maps a respective client to one or more cache lines and a remote access key. An RDMA access request to access a particular cache line is received from a storage server client. The storage server identifies access credentials for the client and determines whether the client has permission to perform the RDMA access on the particular cache line. Upon determining that the client has permissions, the cache line is accessed from the persistent memory cache and sent to the storage server client.