RDMA Network Card Tunnel Encapsulation for Tenant Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In a public cloud environment, data security is compromised as tenants cannot be isolated from each other, leading to potential data detection by other tenants, despite the benefits of RDMA technology for high bandwidth and low latency.
Innovation Solution
Implementing a method that uses tunnel encapsulation and decapsulation through RDMA network adapters to isolate tenant data by adding tenant identifiers to data packets, ensuring secure data transmission within a virtual private cloud (VPC) without altering the operating system of the remote system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If RDMA technology is implemented in a public cloud environment, then high bandwidth and low latency are achieved, but data security is compromised due to lack of tenant isolation
Solution Approach 1:
A tunnel encapsulation mechanism is introduced as an intermediary between RDMA data packets and the public cloud network. The tunnel encapsulation adds outer network layer headers containing tenant identification information, enabling tenant isolation while maintaining RDMA's high-speed transmission capabilities. This intermediary layer allows the system to simultaneously achieve fast data transfer and secure tenant separation.
Solution Approach 2:
The data transmission system is segmented into multiple isolated tenant channels, each identified by unique tenant identifiers embedded in the tunnel encapsulation headers. This segmentation divides the shared public cloud network into separate virtual channels for different tenants, ensuring that data from one tenant cannot be accessed by another while maintaining the underlying RDMA performance.
2Reliability
If tenant isolation is implemented in public cloud, then data security is improved, but device complexity increases due to additional tunnel encapsulation
Solution Approach 1:
The RDMA network adapter is enhanced with self-service capabilities to automatically perform tunnel encapsulation and decapsulation operations. The adapter autonomously adds and removes tunnel headers based on tenant identification information without requiring external intervention or complex configuration, thereby improving data security while minimizing the increase in device complexity.
Solution Approach 2:
The RDMA network adapter is designed with multi-functionality to handle both traditional RDMA data transmission and tunnel encapsulation for tenant isolation. By integrating these functions into a single device, the system achieves tenant isolation without proportionally increasing device complexity, as the same hardware resources serve multiple purposes.
3Reliability
If traditional network isolation methods are used, then tenant data security is improved, but bandwidth and latency performance deteriorate
Solution Approach 1:
The tunnel encapsulation serves as a lightweight intermediary that adds minimal overhead to RDMA data packets. Unlike traditional network isolation methods that require full protocol stacks and CPU intervention, this intermediary approach maintains direct memory access paths while adding only essential tenant identification information, thus preserving high bandwidth and low latency performance.
Solution Approach 2:
The patent replaces traditional mechanical network isolation mechanisms (such as physical network segmentation or software-based virtualization requiring CPU involvement) with a more efficient tunnel encapsulation approach. This substitution eliminates the need for CPU intervention in data path operations, maintaining RDMA's performance advantages while achieving tenant isolation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Embodiments of the present application relate to the technical field of communications, and disclosed thereby are a data transmission method and apparatus, a network card, and a storage medium. The method comprises: acquiring an original data packet, a first address and a tenant identifier, performing tunnel encapsulation for the original data packet according to the first address and the tenant identifier to determine a tunnel data packet, and sending the tunnel data packet to a receiver network card corresponding to the first address; the receiver network card, in response to the receipt of the tunnel data packet, decapsulates the tunnel data packet to determine the original data packet and the tenant identifier; transmitting the original data packet and the tenant identifier to a receiver server; and the receiver server is used to distribute the original data packet to a tenant corresponding to the tenant identifier. Therefore, by distinguishing the tenants by using the tunnel encapsulation and according to the tenant identifier, data of each tenant in the public cloud can be isolated, and the data security is ensured.