Distribution of private session key to a network communication device for secured RDMA communications
A network communication device can receive a private session key from a data processing system. A first work queue element can be received in a send queue of the network communication device. The first work queue element can indicate outbound session data to be communicated to a client device. Responsive to receiving the first work queue element, the network communication device can generate encrypted outbound session data by encrypting the outbound session data using the private session key. The network communication device can communicate, via remote directory memory access (RDMA) over a secured communication tunnel, the encrypted outbound session data to the client device.
1 . A method, comprising:
receiving, by a network communication device from a data processing system, a private session key;
receiving in a send queue of the network communication device, from the data processing system, a first work queue element, the first work queue element indicating outbound session data to be communicated to a client device;
responsive to receiving the first work queue element, generating, by the network communication device, encrypted outbound session data by encrypting the outbound session data using the private session key; and
communicating, by the network communication device, via remote directory memory access (RDMA) over a secured communication tunnel, the encrypted outbound session data to the client device.
2 . The method of claim 1 , further comprising:
receiving, by the network communication device from the client device, via the RDMA over the secured communication tunnel, inbound encrypted session data;
generating, by the network communication device, inbound session data by decrypting the inbound encrypted session data using the private session key;
storing, by the network communication device, the inbound session data to a memory buffer of the data processing system;
indicating, by the network communication device, where the inbound session data is stored in the memory buffer by updating a memory translation and protection table; and
generating a queue element of a receive queue or a queue element of a shared receive queue indicating data in the memory translation and protection table generated for the inbound session data.
3 . The method of claim 1 , further comprising:
communicating, by the network communication device via the RDMA, a public key to the client device; and
receiving, by the network communication device via the RDMA, a pre-master key from the client device,
wherein the private session key is determined based on the pre-master key.
4 . The method of claim 1 , further comprising:
performing, by the network communication device, a private session key exchange, the private session key exchange establishing a secure tunnel for RDMA communications between the network communication device and the client device using the private session key.
5 . The method of claim 1 , further comprising:
receiving, by the network communication device, in a session key control queue of the network communication device, from the data processing system, a second work queue element, the second work queue element indicating the private session key is to be used to encrypt the outbound session data; and
responsive to receiving the second work queue element, adding the private session key for use by the network communication device to encrypt the outbound session data.
6 . The method of claim 1 , further comprising:
receiving, by the network communication device, in a session key control queue of the network communication device, from the data processing system, a second work queue element, the second work queue element indicating the private session key is to be deleted or destroyed; and
responsive to receiving the second work queue element, deleting or destroying, by the network communication device, the private session key.
7 . The method of claim 6 , further comprising:
responsive to the network communication device deleting or destroying the private session key, generating, by the network communication device, a completion queue element in a completion queue, the completion queue element indicating the private session key has been deleted or destroyed.
8 . The method of claim 1 , wherein the communicating, by the network communication device, via the RDMA over the secured communication tunnel, the encrypted outbound session data to the client device comprises:
communicating the outbound session data to another network communication device used by the client device.
9 . A network communication device, comprising:
a processor programmed to initiate executable operations comprising:
receiving, from a data processing system, a private session key;
receiving in a send queue of the network communication device, from the data processing system, a first work queue element, the first work queue element indicating outbound session data to be communicated to a client device;
responsive to receiving the first work queue element, generating encrypted outbound session data by encrypting the outbound session data using the private session key; and
communicating, via remote directory memory access (RDMA) over a secured communication tunnel, the encrypted outbound session data to the client device.
10 . The network communication device of claim 9 , the executable operations further comprising:
receiving, by the network communication device from the client device, via the RDMA over the secured communication tunnel, inbound encrypted session data;
generating, by the network communication device, inbound session data by decrypting the inbound encrypted session data using the private session key;
storing, by the network communication device, the inbound session data to a memory buffer of the data processing system;
indicating, by the network communication device, where the inbound session data is stored in the memory buffer by updating a memory translation and protection table; and
generating a queue element of a receive queue or a queue element of a shared receive queue indicating data in the memory translation and protection table generated for the inbound session data.
11 . The network communication device of claim 9 , the executable operations further comprising:
communicating, by the network communication device via the RDMA, a public key to the client device; and
receiving, by the network communication device via the RDMA, a pre-master key from the client device,
wherein the private session key is determined based on the pre-master key.
12 . The network communication device of claim 9 , the executable operations further comprising:
performing, by the network communication device, a private session key exchange, the private session key exchange establishing a secure tunnel for RDMA communications between the network communication device and the client device using the private session key.
13 . The network communication device of claim 9 , the executable operations further comprising:
receiving, by the network communication device, in a session key control queue of the network communication device, from the data processing system, a second work queue element, the second work queue element indicating the private session key is to be used to encrypt the outbound session data; and
responsive to receiving the second work queue element, adding the private session key for use by the network communication device to encrypt the outbound session data.
14 . The network communication device of claim 9 , the executable operations further comprising:
receiving, by the network communication device, in a session key control queue of the network communication device, from the data processing system, a second work queue element, the second work queue element indicating the private session key is to be deleted or destroyed; and
responsive to receiving the second work queue element, deleting or destroying, by the network communication device, the private session key.
15 . The network communication device of claim 14 , the executable operations further comprising:
responsive to the network communication device deleting or destroying the private session key, generating, by the network communication device, a completion queue element in a completion queue, the completion queue element indicating the private session key has been deleted or destroyed.
16 . The network communication device of claim 9 , wherein the communicating, by the network communication device, via the RDMA over the secured communication tunnel, the encrypted outbound session data to the client device comprises:
communicating the outbound session data to another network communication device used by the client device.
17 . A computer program product, comprising:
one or more computer readable storage mediums having program code stored thereon, the program code stored on the one or more computer readable storage mediums collectively executable by a network communication device to initiate operations including:
receiving, from a data processing system, a private session key;
receiving in a send queue of the network communication device, from the data processing system, a first work queue element, the first work queue element indicating outbound session data to be communicated to a client device;
responsive to receiving the first work queue element, generating encrypted outbound session data by encrypting the outbound session data using the private session key; and
communicating, via remote directory memory access (RDMA) over a secured communication tunnel, the encrypted outbound session data to the client device.
18 . The computer program product of claim 17 , wherein the program code is executable by the network communication device to initiate the operations further comprising:
receiving, by the network communication device from the client device, via the RDMA over the secured communication tunnel, inbound encrypted session data;
generating, by the network communication device, inbound session data by decrypting the inbound encrypted session data using the private session key;
storing, by the network communication device, the inbound session data to a memory buffer of the data processing system;
indicating, by the network communication device, where the inbound session data is stored in the memory buffer by updating a memory translation and protection table; and
generating a queue element of a receive queue or a queue element of a shared receive queue indicating data in the memory translation and protection table generated for the inbound session data.
19 . The computer program product of claim 17 , wherein the program code is executable by the network communication device to initiate the operations further comprising:
communicating, by the network communication device via the RDMA, a public key to the client device; and
receiving, by the network communication device via the RDMA, a pre-master key from the client device,
wherein the private session key is determined based on the pre-master key.
20 . The computer program product of claim 17 , wherein the program code is executable by the network communication device to initiate the operations further comprising:
performing, by the network communication device, a private session key exchange, the private session key exchange establishing a secure tunnel for RDMA communications between the network communication device and the client device using the private session key.