RDMA Stream Identifier Generation via Deterministic Key Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualized environments, existing implementations of Remote Direct Memory Access (RDMA) over Converged Ethernet (RoCE) face challenges such as potential forgery attacks and inefficiencies due to the use of random stream identifiers, leading to increased hardware requirements and power consumption, especially when processing only TCP-style packets.
Innovation Solution
A deterministic method for generating and verifying a stream identifier using a remote key (R_Key) and partition key (P_Key), which eliminates the need for a look-up table by using cryptographic hashes and modular arithmetic to ensure secure and efficient address translation and corruption protection without adding overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a look-up table is implemented in the NIC for R_Key and P_Key translation, then address translation and corruption protection are achieved, but hardware area and power consumption increase
Solution Approach 1:
The patent extracts the look-up table functionality from the NIC hardware and relocates it to the host system memory. The NIC no longer needs to store large translation tables, instead receiving R_Key and P_Key values and computing stream identifiers through software-based address translation mechanisms in the host system, thereby reducing NIC hardware area while maintaining translation capability
Solution Approach 2:
The patent introduces an intermediary translation mechanism where the host system acts as a mediator between the NIC and memory. Instead of direct hardware-based translation in the NIC, the host system processes the R_Key and P_Key values and provides translation services, reducing the burden on NIC hardware while maintaining security and corruption protection
2Reliability
If a look-up table is implemented in the NIC for R_Key and P_Key translation, then address translation and corruption protection are achieved, but power consumption increases
Solution Approach 1:
The patent extracts the power-intensive look-up table operations from the NIC and relocates them to the host system. By moving the translation table storage and computation to the host, the NIC's power consumption is reduced while the host system handles the translation operations that require substantial computational resources
Solution Approach 2:
The patent changes the operational parameters of the translation system by moving from hardware-based real-time translation in the NIC to software-based translation in the host system. This parameter change allows the system to trade NIC power consumption for host system processing, optimizing overall power distribution and reducing NIC energy usage
3Reliability
If random stream identifiers are used, then corruption protection is provided, but security vulnerabilities to forgery attacks exist
Solution Approach 1:
The patent applies preliminary action by pre-establishing secure key pairs (R_Key and P_Key) through cryptographic key exchange protocols before data transmission. These keys are used to generate deterministic stream identifiers that inherently provide both corruption detection and forgery resistance, eliminating the need for random identifiers and their associated security vulnerabilities
Solution Approach 2:
The patent converts the potential harm of using simple random identifiers into benefit by implementing a cryptographic key-based system. The deterministic nature of key-derived identifiers, which might seem to reduce randomness, actually provides the benefit of verifiable authenticity and resistance to forgery attacks while maintaining corruption protection through the cryptographic strength of the key pairs
4Reliability
If deterministic stream identifier generation is implemented, then security and efficiency are improved, but complexity in key management increases
Solution Approach 1:
The patent applies universality by designing the R_Key and P_Key key pair system to serve multiple functions simultaneously: authentication, stream identifier generation, and corruption protection. This multi-functional approach consolidates what would otherwise require separate mechanisms into a unified cryptographic system, reducing overall system complexity despite the deterministic nature of identifier generation
Data Source
AI summary
A method and a system embodying the method for receiving a remote direct memory access packet comprising an opaque data, a virtual address, and a payload at a virtual network interface card that generated the opaque data; reconstructing a stream identifier by separating the opaque data into an encrypted stream identifier and a first digest; decrypting the encrypted stream identifier; verifying the decrypted stream identifier using the first digest; providing the verified stream identifier to a system memory management unit; and mapping the virtual address and the provided stream identifier by the system memory management unit to a physical address, is disclosed.