Zero-copy data privacy and integrity
Implementations are provided herein for maintaining a set of cryptographic algorithms in the kernel. User space applications can call on the set of cryptographic logic algorithms in the kernel to perform computations on data payloads residing in kernel space memory without having to copy the data payloads out of kernel space memory into user space memory. The results of the cryptographic logic being applied to data payloads can be packaged together with message framing originating from user space and data payloads in the kernel space as a protocol message that can sent through the network stack to a socket. It can be appreciated that by retaining protocol logic in user space, just the cryptographic algorithms need be added to the kernel.
1. A computer implemented method, implemented using a hardware processor, for avoiding data copying between a kernel space and a user space of an operating system comprising:
maintaining a set of cryptographic algorithms in the kernel space of the operating system;
receiving by a first protocol head in the user space of the operating system a request to send a data payload over a data socket;
reading the data payload from at least one disk to a kernel space memory;
instructing the kernel by the protocol head to perform a subset of the set of cryptographic logic on the data payload in the kernel space memory;
performing by the kernel the subset of the set of cryptographic logic on the data payload, wherein the performing generates at least one of a cryptographic result and a transformed data payload;
in response to generating the cryptographic result, copying the cryptographic result to a user space memory of the operating system;
generating a message framing by the protocol head, wherein the message framing includes at least the cryptographic result, and wherein the message framing is stored in the user space memory;
instructing the kernel to send a protocol message based on a user space supplied vector wherein the user space supplied vector includes the message framing in the user space memory and one of the data payload in the kernel space memory or the transformed data payload in the kernel space memory;
assembling the protocol message in kernel memory space based on the user space supplied vector; and
sending, using the hardware processor, the protocol message over the data socket.
2. The method of claim 1 , further comprising:
generating a second cryptographic result in the kernel space memory based on the message framing and one of the data payload or the transformed data payload, wherein the instructing the kernel to generate the vectored output is further based on the second cryptographic result.
3. The method of claim 1 , wherein the data payload is not copied to a user space memory when the performing the subset of the set of cryptographic logic and generating the message framing.
4. The method of claim 1 , wherein the set of cryptographic logic algorithms include at least one of AES-128-CCM, AES-128-CMAC, AES-128-GCM, SHA-256-HMAC, and MD5.
5. The method of claim 1 , wherein generating the vectored output in kernel space includes copying the message framing in the user space memory to the kernel space memory.
6. The method of claim 1 , further comprising:
receiving by a second protocol head in the user space of the operating system a second request to send a second data payload over a second data socket;
reading the second data payload from the at least one disk to the kernel space memory;
instructing the kernel by the second protocol head to perform a second subset of the set of cryptographic logic on the second data payload;
performing the second subset of the set of cryptographic logic on the second data payload, wherein the performing generates at least one of a second cryptographic result and a second transformed data payload;
in response to generating the second cryptographic result, copying the second cryptographic result to the user space memory of the operating system;
generating a second message framing by the second protocol head, wherein the second message framing includes at least the second cryptographic result, and wherein the second message framing is stored in the user space memory;
instructing the kernel to send a second protocol message based on a second user space supplied vector wherein the second user space supplied vector includes the second message framing in the user space memory and one of the second data payload in the kernel space memory or the second transformed data payload in the kernel space memory;
assembling the second protocol message in kernel memory space based on the second user space supplied vector; and
sending the second protocol message over the second data socket.
7. The method of claim 6 , wherein the subset and the second subset are different.
8. A system for avoiding data copying between a kernel space and a user space of an operating system comprising at least one storage device and at least one hardware processor configured to:
maintain a set of cryptographic algorithms in the kernel space of the operating system;
receive by a first protocol head in the user space of the operating system a request to send a data payload over a data socket;
read the data payload from at least one disk to a kernel space memory;
instruct the kernel by the protocol head to perform a subset of the set of cryptographic logic on the data payload in the kernel space memory;
perform by the kernel the subset of the set of cryptographic logic on the data payload, wherein the performing generates at least one of a cryptographic result and a transformed data payload;
in response to generating the cryptographic result, copy the cryptographic result to a user space memory of the operating system;
generate a message framing by the protocol head, wherein the message framing includes at least the cryptographic result, and wherein the message framing is stored in the user space memory;
instruct the kernel to send a protocol message based on a user space supplied vector wherein the user space supplied vector includes the message framing in the user space memory and one of the data payload in the kernel space memory or the transformed data payload in the kernel space memory;
assemble the protocol message in kernel memory space based on the user space supplied vector; and
send the protocol message over the data socket.
9. The system of claim 8 further configured to:
generate a second cryptographic result in the kernel space memory based on the message framing and one of the data payload or the transformed data payload, wherein the instructing the kernel to generate the vectored output is further based on the second cryptographic result.
10. The system of claim 8 , wherein the data payload is not copied to a user space memory when the performing the subset of the set of cryptographic logic and generating the message framing.
11. The system of claim 8 , wherein the set of cryptographic logic algorithms include at least one of AES-128-CCM, AES-128-CMAC, AES-128-GCM, SHA-256-HMAC, and MD5.
12. The system of claim 8 , wherein generating the vectored output in kernel space includes copying the message framing in the user space memory to the kernel space memory.
13. The system of claim 8 further configured to:
receive by a second protocol head in the user space of the operating system a second request to send a second data payload over a second data socket;
read the second data payload from the at least one disk to the kernel space memory;
instruct the kernel by the second protocol head to perform a second subset of the set of cryptographic logic on the second data payload;
perform the second subset of the set of cryptographic logic on the second data payload, wherein the performing generates at least one of a second cryptographic result and a second transformed data payload;
in response to generating the second cryptographic result, copy the second cryptographic result to the user space memory of the operating system;
generate a second message framing by the second protocol head, wherein the second message framing includes at least the second cryptographic result, and wherein the second message framing is stored in the user space memory;
instruct the kernel to send a second protocol message based on a second user space supplied vector wherein the second user space supplied vector includes the second message framing in the user space memory and one of the second data payload in the kernel space memory or the second transformed data payload in the kernel space memory;
assemble the second protocol message in kernel memory space based on the second user space supplied vector; and
send the second protocol message over the second data socket.
14. The system of claim 13 , wherein the subset and the second subset are different.
15. A non-transitory computer readable medium with program instructions stored thereon executed by a hardware processor to perform the following acts:
maintaining a set of cryptographic algorithms in the kernel space of the operating system;
receiving by a first protocol head in the user space of the operating system a request to send a data payload over a data socket;
reading the data payload from at least one disk to a kernel space memory;
instructing the kernel by the protocol head to perform a subset of the set of cryptographic logic on the data payload in the kernel space memory;
performing by the kernel the subset of the set of cryptographic logic on the data payload, wherein the performing generates at least one of a cryptographic result and a transformed data payload;
in response to generating the cryptographic result, copying the cryptographic result to a user space memory of the operating system;
generating a message framing by the protocol head, wherein the message framing includes at least the cryptographic result, and wherein the message framing is stored in the user space memory;
instructing the kernel to send a protocol message based on a user space supplied vector wherein the user space supplied vector includes the message framing in the user space memory and one of the data payload in the kernel space memory or the transformed data payload in the kernel space memory;
assembling the protocol message in kernel memory space based on the user space supplied vector; and
sending the protocol message over the data socket.
16. The non-transitory computer readable medium of claim 15 , with program instructions stored thereon to further perform the following acts:
generating a second cryptographic result in the kernel space memory based on the message framing and one of the data payload or the transformed data payload, wherein the instructing the kernel to generate the vectored output is further based on the second cryptographic result.
17. The non-transitory computer readable medium of claim 15 , wherein the data payload is not copied to a user space memory when the performing the subset of the set of cryptographic logic and generating the message framing.
18. The non-transitory computer readable medium of claim 15 , wherein the set of cryptographic logic algorithms include at least one of AES-128-CCM, AES-128-CMAC, AES-128-GCM, SHA-256-HMAC, and MD5.
19. The non-transitory computer readable medium of claim 15 , wherein generating the vectored output in kernel space includes copying the message framing in the user space memory to the kernel space memory.
20. The non-transitory computer readable medium of claim 15 , with program instructions stored thereon to further perform the following acts:
receiving by a second protocol head in the user space of the operating system a second request to send a second data payload over a second data socket;
reading the second data payload from the at least one disk to the kernel space memory;
instructing the kernel by the second protocol head to perform a second subset of the set of cryptographic logic on the second data payload;
performing the second subset of the set of cryptographic logic on the second data payload, wherein the performing generates at least one of a second cryptographic result and a second transformed data payload;
in response to generating the second cryptographic result, copying the second cryptographic result to the user space memory of the operating system;
generating a second message framing by the second protocol head, wherein the second message framing includes at least the second cryptographic result, and wherein the second message framing is stored in the user space memory;
instructing the kernel to send a second protocol message based on a second user space supplied vector wherein the second user space supplied vector includes the second message framing in the user space memory and one of the second data payload in the kernel space memory or the second transformed data payload in the kernel space memory;
assembling the second protocol message in kernel memory space based on the second user space supplied vector; and
sending the second protocol message over the second data socket.