RDMA Authorization Key Ring for Scalable Client Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face scalability limitations in connectionless network environments where a single server needs to communicate with multiple clients using unique authorization keys, leading to inefficiencies in RDMA traffic isolation and resource access management.
Innovation Solution
Implementing a single endpoint with an authorization key ring that supports multiple authorization keys, utilizing a network API extension (e.g., LibFabric) and modifying hardware data structures to manage and validate authorization keys, ensuring secure and scalable communication and resource access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single server uses a unique endpoint with its own authorization key to communicate with each client endpoint, then secure communication and traffic isolation between clients are achieved, but scalability deteriorates when the server needs to support a large number of authorization keys for multiple clients
Solution Approach 1:
The patent segments the authorization key management by introducing a separate authorization key ring data structure that is independent from the endpoint structure. This allows authorization keys to be managed separately and reused across multiple endpoints, resolving the contradiction between security isolation and scalability.
Solution Approach 2:
The patent makes the authorization key ring universal by allowing a single endpoint to use multiple authorization keys from the key ring. This multi-functional approach enables one endpoint to serve multiple clients securely without requiring unique endpoints for each client, thus improving scalability while maintaining security.
2Adaptability or versatility
If multiple authorization keys are supported in a single endpoint, then scalability is improved, but device complexity increases due to additional hardware modifications and software extensions
Solution Approach 1:
The patent introduces an intermediary authorization key ring data structure that mediates between the endpoint and the authorization keys. This key ring acts as a buffer and manager, allowing multiple keys to be stored and accessed without directly complicating the endpoint structure or requiring extensive hardware modifications.
Solution Approach 2:
The patent changes the parameter of authorization key management from a fixed one-key-per-endpoint model to a flexible multi-key model using the authorization key ring. This parameter change enables scalability while managing complexity through structured data organization rather than fundamental architectural overhauls.
Data Source
AI summary
A system allows a first endpoint to communicate with a plurality of endpoints in a connectionless network environment by enabling, by the first endpoint, a plurality of authorization keys, a respective endpoint of the plurality of endpoints being associated with a respective authorization key. The first endpoint receives, from a second endpoint of the plurality of endpoints, a first request comprising an action, a remote procedure call, and a first authorization key associated with the second endpoint. The system validates the first authorization key by matching the first authorization key to an enabled authorization key. The system performs the action indicated and, responsive to performing the action, returns the first authorization key to a completion event queue. The system obtains the first authorization key from the completion event queue and transmits, to the second endpoint based on the obtained first authorization key, data associated with the first request.