Remote direct memory access authentication of a device
An approach is provided in which a server receives a first request from a client over a command port connection. The server, in turn, sends a first phase authentication token to the client over the command port and receives a second request from the client over a management port connection. In response, the server sends a second phase authentication token to the client over the management port connection, which the server receives back from the client over the command port connection. In turn, the server authenticates the client to utilize the command port connection accordingly.
1. An information handling system comprising:
one or more processors;
a memory coupled to at least one of the processors;
a set of computer program instructions stored in the memory and executed by at least one of the processors in order to perform actions of:
receiving, at a server, a first request from a client over a command port connection;
sending a first phase authentication token to the client over the command port connection in response to receiving the first request;
receiving, at the server, a second request over a management port connection from the client;
sending a second phase authentication token to the client over the management port connection in response to receiving the second request;
receiving, at the server, the second phase authentication token from the client over the command port connection; and
authenticating the client to utilize the command port connection in response to receiving the second phase authentication token.
2. The information handling system of claim 1 wherein the second request includes the first phase authentication token, the processors performing additional actions comprising:
extracting the first phase authentication token from the second request;
validating the extracted first phase authentication token; and
storing, in response to validating the extracted first phase authentication token, a first phase indicator in an authentication table entry that indicates the client completing a first phase authentication over the command port connection.
3. The information handling system of claim 1 wherein the processors perform additional actions comprising:
matching the received second phase authentication token to the authentication table entry; and
identifying that the authentication table entry includes the first phase indicator.
4. The information handling system of claim 1 further comprising:
wherein the command port connection is a Remote DMA (RDMA) connection; and
wherein the management port connection is a TCPIP (Transmission Control Protocol/Internet Protocol) connection.
5. The information handling system of claim 4 wherein the RDMA connection utilizes a Direct Access Provider Library (DAPL).
6. The information handling system of claim 1 wherein the processors perform additional actions comprising:
receiving, at the server, a different first request from a different client over a different command port connection;
sending a different first phase authentication token to the different client over the different command port in response to receiving the first request;
receiving, at the server, a different second request over the management port connection from the different client;
sending a different second phase authentication token to the different client over the management port connection in response to receiving the different second request;
receiving, at the server, the different second phase authentication token over the different command port connection from the different client; and
authenticating the different client to utilize the different command port connection in response to receiving the different second phase authentication token.
7. The information handling system of claim 1 wherein the processors perform additional actions comprising:
receiving, at the server, a different first request from the client over a different command port connection;
sending a different first phase authentication token to the client over the different command port in response to receiving the first request;
receiving, at the server, a different second request over the management port connection from the client;
sending a different second phase authentication token to the client over the management port connection in response to receiving the different second request;
receiving, at the server, the different second phase authentication token over the different command port connection from the client; and
authenticating the client to utilize the different command port connection in response to receiving the different second phase authentication token.
8. The information handling system of claim 7 wherein the client executes a first application and a second application, the first application utilizing the command port connection to send data to the server and the second application utilizing the different command port to send different data to the server.
9. A computer program product stored in a non-transitory computer readable storage medium, comprising computer program code that, when executed by an information handling system, causes the information handling system to perform actions comprising:
receiving, at a server, a first request from a client over a command port connection;
sending a first phase authentication token to the client over the command port connection in response to receiving the first request;
receiving, at the server, a second request over a management port connection from the client;
sending a second phase authentication token to the client over the management port connection in response to receiving the second request;
receiving, at the server, the second phase authentication token from the client over the command port connection; and
authenticating the client to utilize the command port connection in response to receiving the second phase authentication token.
10. The computer program product of claim 9 wherein the second request includes the first phase authentication token, the information handling system performing further actions comprising:
extracting the first phase authentication token from the second request;
validating the extracted first phase authentication token; and
storing, in response to validating the extracted first phase authentication token, a first phase indicator in an authentication table entry that indicates the client completing a first phase authentication over the command port connection.
11. The computer program product of claim 9 wherein the information handling system performs further actions comprising:
matching the received second phase authentication token to the authentication table entry; and
identifying that the authentication table entry includes the first phase indicator.
12. The computer program product of claim 9 further comprising:
wherein the command port connection is a Remote DMA (RDMA) connection; and
wherein the management port connection is a TCPIP (Transmission Control Protocol/Internet Protocol) connection.
13. The computer program product of claim 12 wherein the RDMA connection utilizes a Direct Access Provider Library (DAPL).
14. The computer program product of claim 9 wherein the information handling system performs further actions comprising:
receiving, at the server, a different first request from a different client over a different command port connection;
sending a different first phase authentication token to the different client over the different command port in response to receiving the first request;
receiving, at the server, a different second request over the management port connection from the different client;
sending a different second phase authentication token to the different client over the management port connection in response to receiving the different second request;
receiving, at the server, the different second phase authentication token over the different command port connection from the different client; and
authenticating the different client to utilize the different command port connection in response to receiving the different second phase authentication token.
15. The computer program product of claim 9 wherein the information handling system performs further actions comprising:
receiving, at the server, a different first request from the client over a different command port connection;
sending a different first phase authentication token to the client over the different command port in response to receiving the first request;
receiving, at the server, a different second request over the management port connection from the client;
sending a different second phase authentication token to the client over the management port connection in response to receiving the different second request;
receiving, at the server, the different second phase authentication token over the different command port connection from the client; and
authenticating the client to utilize the different command port connection in response to receiving the different second phase authentication token.
16. The computer program product of claim 15 wherein the client executes a first application and a second application, the first application utilizing the command port connection to send data to the server and the second application utilizing the different command port to send different data to the server.