Combined integrity protection, encryption and authentication
Network protocols generally implement integrity protection, encryption and authentication as separate validation steps. Since each validation step contributes encoding and processing overhead associated with individual packet transfers over the network, such network protocols can make inefficient use of limited packet space. Systems and methods according to the present disclosure combine integrity protection, encryption and authentication into a single validation step thereby making efficient use of limited packet space.
1. A method comprising:
receiving a remote memory access (RMA) read request message at a network interface that can access one of a plurality of registered memory regions of each of a plurality of host computers connected to the network interface, wherein:
each of the plurality of registered memory regions is within a physical memory of one of the plurality of host computers electrically connected to the network interface, each of the plurality of registered memory regions corresponds to a memory region allocated to one of a plurality of applications executing on a corresponding one of the host computers connected to the target network interface, a first plurality of registered memory region access keys are stored on the network interface, each registered memory region access key corresponding to one of the plurality of registered memory regions, each registered memory region access key is independent of any of the plurality of host computers connected to the network interface, and
the RMA read request message includes a RMA operation, an identifier of one the registered memory regions, an identifier of a memory location within the identified registered memory region and host memory access request information;
evaluating the authority of the source of the RMA read request message to access the identified registered memory region using the host memory access request information included in the RMA read request message and the registered memory region access key corresponding to the identified registered memory region stored by the network interface;
determining whether the source of the RMA read request message is authorized to access the identified registered memory region;
in response to determining that the source of the RMA read request message is authorized to access the identified registered memory region, generating at least one RMA response communication including data retrieved from the identified memory location within the identified registered memory region; and
in response to determining the source of the RMA read request message is not authorized to access the registered memory region, halting further processing of the RMA read request message.
2. The method of claim 1 , wherein each of the plurality of hosts connected to the network interface is electrically connected to the network interface by a serial computer expansion bus.
3. The method of claim 1 , wherein one or more portions of the received RMA read request message are encrypted, the RMA read request message includes authentication data, and the method further comprises:
evaluating the one or more encrypted portions of the RMA read request message using a cryptographic key formed using at least the host memory access request information;
comparing a result of the evaluation to the authentication data included in the RMA read request message;
in response to the comparison validating the authentication data, successfully decrypting the encrypted portion of the RMA read request message; and
in response to the comparison not validating the authentication data, discarding the RMA read request message.
4. The method of claim 3 , wherein the authentication data included in the RMA read request message is a message authentication code (MAC).
5. The method of claim 1 , wherein the generated at least one RMA response communication includes a response data offset relative to the identified memory location within the identified registered memory region.
6. The method of claim 1 further comprising:
encrypting the generated at least one RMA response communication including the retrieved data into one or more encrypted data; and
transmitting, by the network interface, the one or more encrypted data.
7. The method of claim 6 , wherein:
the encryption uses a cryptographic key formed using at least the region key of the identified registered memory region and the response data offset.
8. The method of claim 1 , wherein the plurality of registered memory region access keys stored on the network interface correspond to a subset of the registered memory regions of the one or more hosts connected to the network interface.
9. The method of claim 1 , wherein:
a second plurality of registered memory region access keys are stored on the network interface, and
each of the second plurality of registered memory region access keys correspond to one of a second plurality of registered memory regions allocated to one of a plurality of applications that are each executing on one of a second plurality of host computers that are not electrically connected to the network interface.
10. The method of claim 9 , wherein the plurality of host computers that are not electrically connected to the network interface are electrically connected to a second network interface that is different from the network interface.
11. A system comprising:
network interface configured to:
access one of a plurality of registered memory regions of each of a plurality of host computers connected to the network interface, wherein:
each of the plurality of registered memory regions is within a physical memory of one of the plurality of host computers electrically connected to the network interface, each of the plurality of registered memory regions corresponds to a memory region allocated to one of a plurality of applications executing on a corresponding one of the host computers connected to the target network interface, and
a first plurality of registered memory region access keys are stored on the network interface, each registered memory region access key corresponding to one of the plurality of registered memory regions;
each registered memory region access key is independent of any of the plurality of host computers connected to the network interface, and
receive a remote memory access (RMA) read request message includes a RMA operation, an identifier of one the registered memory regions, an identifier of a memory location within the identified registered memory region and a host memory access request information; and
evaluate the authority of the source of the RMA read request message to access the identified registered memory region using the host memory access request information included in the RMA read request message and the registered memory region access key corresponding to the identified registered memory region stored by the network interface;
determine whether the source of the RMA read request message is authorized to access the identified registered memory region;
in response to determining that the source of the RMA read request message is authorized to access the identified registered memory region, generate at least one RMA response communication including data retrieved from the identified memory location within the identified registered memory region; and
in response to determining the source of the RMA read request message is not authorized to access the registered memory region, halt further processing of the RMA read request message.
12. The system of claim 11 , wherein each of the plurality of hosts connected to the network interface is electrically connected to the network interface by a serial computer expansion bus.
13. The system of claim 11 , wherein one or more portions of the received RMA read request message are encrypted, the RMA read request message includes authentication data and the one or more processors are further configured to:
evaluate the one or more encrypted portions of the RMA read request message using a cryptographic key formed using at least the host memory access request information;
compare a result of the evaluation to the authentication data included in the RMA read request message;
in response to the comparison validating the authentication data, decrypt the encrypted portion of the RMA read request message; and
in response to the comparison not validating the authentication data, discard the RMA read request message.
14. The system of claim 13 , wherein the authentication data included in the RMA read request message is a message authentication code (MAC).
15. The system of claim 11 , wherein the generated at least one RMA response communication includes a response data offset relative to the identified memory location within the identified registered memory region that indicates a memory location of the retrieved data included in the RMA response communication.
16. The system of claim 11 , wherein the one or more processors are further configured to:
encrypt the generated at least one RMA response communication including the retrieved data into one or more encrypted data; and
transmit, by the network interface, the one or more encrypted data.
17. The system of claim 16 , wherein the encryption uses a cryptographic key formed using at least the region key of the identified registered memory region and the response data offset.
18. The system of claim 11 , wherein the plurality of registered memory region access keys stored on the network interface correspond to a subset of the registered memory regions of the one or more hosts connected to the network interface.
19. The system of claim 11 , wherein:
a second plurality of registered memory region access keys are stored on the network interface, and
each of the second plurality of registered memory region access keys correspond to one of a second plurality of registered memory regions allocated to one of a plurality of applications that are each executing on one of a second plurality of host computers that are not electrically connected to the network interface.
20. The system of claim 19 , wherein the plurality of host computers that are not electrically connected to the network interface are electrically connected to a second network interface that is different from the network interface.
21. A non-transitory computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to:
receive a remote memory access (RMA) read request message at a network interface that can access one of a plurality of registered memory regions of each of a plurality of host computers connected to the network interface, wherein:
each of the plurality of registered memory regions is within a physical memory of one of the plurality of host computers electrically connected to the network interface,
each of the plurality of registered memory regions corresponds to the a memory region allocated to one of a plurality of applications executing on a corresponding one of the host computers connected to the target network interface, a first plurality of registered memory region access keys are stored on the network interface, each registered memory region access key corresponding to one of the plurality of registered memory regions, and
each registered memory region access key is independent of any of the plurality of host computers connected to the network interface, and
the RMA read request message includes a RMA operation, an identifier of one the registered memory regions, an identifier of a memory location within the identified registered memory region and a host memory access request information;
evaluate the authority of the source of the RMA read request message to access the identified registered memory region using the host memory access request information included in the RMA read request message and the registered memory region access key corresponding to the identified registered memory region stored by the network interface;
determine whether the source of the RMA read request message is authorized to access the identified registered memory region;
in response to determining that the source of the RMA read request message is authorized to access the identified registered memory region, generate at least one RMA response communication including data retrieved from the identified memory location within the identified registered memory region; and
in response to determining the source of the RMA read request message is not authorized to access the registered memory region, halting further processing of the RMA read request message.
22. The non-transitory computer-readable medium of claim 21 , wherein each of the plurality of hosts connected to the network interface is electrically connected to the network interface by a serial computer expansion bus.
23. The non-transitory computer-readable medium of claim 21 , wherein one or more portions of the received RMA read request message are encrypted, the RMA read request message includes authentication data and the instructions cause the one or more processors to:
evaluate the one or more encrypted portions of the RMA read request message using a cryptographic key formed using at least the host memory access request information;
compare a result of the evaluation to the authentication data included in the RMA read request message;
in response to the comparison validating the authentication data, successfully decrypt the encrypted portion of the RMA read request message; and
in response to the comparison not validating the authentication data, discarding the RMA read request message.
24. The non-transitory computer-readable medium of claim 23 , wherein the authentication data included in the RMA read request message is a message authentication code (MAC).
25. The non-transitory computer-readable medium of claim 21 , wherein the generated at least one RMA response communication includes a response data offset relative to the identified memory location within the identified registered memory region that indicates a memory location of the retrieved data included in the RMA response communication.
26. The non-transitory computer-readable medium of claim 21 , wherein the instructions further cause the one or more processors to:
encrypt the generated at least one RMA response communication including the retrieved data into one or more encrypted data; and
transmit, by the network interface, the one or more encrypted data.
27. The non-transitory computer-readable medium of claim 26 , wherein:
the encryption uses a cryptographic key formed using at least the region key of the identified registered memory region and the response data offset.
28. The non-transitory computer-readable medium of claim 21 , wherein the plurality of registered memory region access keys stored on the network interface correspond to a subset of the registered memory regions of the one or more hosts connected to the network interface.
29. The non-transitory computer-readable medium of claim 21 , wherein:
a second plurality of registered memory region access keys are stored on the network interface, and
each of the second plurality of registered memory region access keys correspond to one of a second plurality of registered memory regions allocated to one of a plurality of applications that are each executing on one of a second plurality of host computers that are not electrically connected to the network interface.
30. The non-transitory computer-readable medium of claim 21 , wherein the plurality of host computers that are not electrically connected to the network interface are electrically connected to a second network interface that is different from the network interface.