Techniques to provide client-side security for storage of data in a network environment
Various embodiments are generally directed to an apparatus, method and other techniques to determine a secure memory region for a transaction, the secure memory region associated with a security association context to perform one or more of an encryption/decryption operation and an authentication operation for the transaction, perform one or more of the encryption/decryption operation and the authentication operation for the transaction based on the security association context, and cause communication of the transaction.
1. An apparatus, comprising:
network interface circuitry to execute one or more instructions, the one or more instructions, that when executed, cause the circuitry to:
receive, from an operating system or an application, a request to comprise a remote direct memory access (RDMA) transaction and an index value;
determine the RDMA transaction is a write transaction to put data in a remote storage via a network interconnect;
determine a key based on the index value;
generate authentication information based on the data and the key; and
cause communication of the data and the authentication information to the remote storage in one or more RDMA messages via the network interconnect.
2. The apparatus of claim 1 , the circuitry to:
encrypt the data using an encryption key to generate encrypted data, wherein the encrypted data is to be communicated with the authentication information in the one or more RDMA messages.
3. The apparatus of claim 2 , wherein the key and the encryption key are to be associated with a secure memory region for the RDMA transaction.
4. The apparatus of claim 3 , the circuitry to:
determine a nonce associated with the secure memory region; and
perform the encryption based at least in part on the nonce.
5. The apparatus of claim 1 , the authentication information to comprise one or more of a message authentication code (MAC), a signature, or a hash value.
6. The apparatus of claim 1 , the circuitry to:
receive requested data from the remote storage via the network interconnect;
generate a second authentication information based on the requested data and the key;
compare the second authentication information with a third authentication information received from the remote storage;
authenticate the requested data if the second authentication information matches the third authentication information; and
invalidate the requested data if the second authentication information does not match the third authentication information.
7. The apparatus of claim 1 , the circuitry to:
encrypt the data using the key to generate encrypted data, wherein the encrypted data is to be communicated with the authentication information in the one or more RDMA messages.
8. A non-transitory computer-readable storage medium comprising instructions, that when executed, enable processing circuitry to:
receive, from an operating system or an application, a request to comprise a remote direct memory access (RDMA) transaction and an index value;
determine the RDMA transaction is a write transaction to put data in a remote storage via a network interconnect;
determine a key based on the index value;
generate authentication information based on the data and the key; and
cause communication of the data and the authentication information to the remote storage in one or more RDMA messages via the network interconnect.
9. The medium of claim 8 , comprising instructions that when executed cause the processing circuitry to:
encrypt the data using an encryption key to generate encrypted data, wherein the encrypted data is to be communicated with the authentication information in the one or more RDMA messages.
10. The medium of claim 9 , wherein the key and the encryption key are to be associated with a secure memory region for the RDMA transaction.
11. The medium of claim 10 , comprising instructions that when executed cause the processing circuitry to:
determine a nonce associated with the secure memory region; and
perform the encryption based at least in part on the nonce.
12. The medium of claim 8 , the authentication information to comprise one or more of a message authentication code (MAC), a signature, or a hash value.
13. The medium of claim 8 , comprising instructions that when executed cause the processing circuitry to:
receive requested data from the remote storage via the network interconnect;
generate a second authentication information based on the requested data and the key;
compare the second authentication information with a third authentication information received from the remote storage;
authenticate the requested data if the second authentication information matches the third authentication information; and
invalidate the requested data if the second authentication information does not match the third authentication information.
14. The medium of claim 8 , comprising instructions that when executed cause the processing circuitry to:
encrypt the data using the key to generate encrypted data, wherein the encrypted data is to be communicated with the authentication information in the one or more RDMA messages.
15. A computer-implemented method, comprising:
receiving, from an operating system or an application, a request to comprise a remote direct memory access (RDMA) transaction and an index value;
determining the RDMA transaction is a write transaction to put data in a remote storage via a network interconnect;
determining a key based on the index value;
generating authentication information based on the data and the key; and
causing communication of the data and the authentication information to the remote storage in one or more RDMA messages via the network interconnect.
16. The method of claim 15 , further comprising:
encrypting the data using an encryption key to generate encrypted data, wherein the encrypted data is to be communicated with the authentication information in the one or more RDMA messages.
17. The method of claim 16 , wherein the key and the encryption key are to be associated with a secure memory region for the RDMA transaction.
18. The method of claim 17 , further comprising:
determining a nonce associated with the secure memory region; and
performing the encryption based at least in part on the nonce.
19. The method of claim 15 , the authentication information to comprise one or more of a message authentication code (MAC), a signature, or a hash value.
20. The method of claim 15 , further comprising:
encrypting the data using the key to generate encrypted data, wherein the encrypted data is to be communicated with the authentication information in the one or more RDMA messages.