US 12,113,859 B2 · Zero-trust authentication for secure remote direct memory access

Abstract

Various example embodiments for supporting zero-trust policy enforcement in a communication system are presented herein. Various example embodiments for supporting zero-trust policy enforcement in a communication system may be configured to support zero-trust policy enforcement, including zero-trust authentication, for Remote Direct Memory Access (RDMA) communications. Various example embodiments for supporting zero-trust policy enforcement for RDMA communications may be configured to support transparent zero-trust policy enforcement for RDMA communications by leveraging programmable Smart Network Interface Cards (SmartNICs). Various example embodiments for supporting zero-trust policy enforcement for RDMA communications based on leveraging of programmable SmartNICs may be configured to support zero-trust policy enforcement for RDMA communications by applying zero-trust policies on a connection-by-connection basis within SmartNICs for RDMA connections between RDMA applications hosted on end hosts served by the SmartNICs.

Claims20

Dependent claims

An apparatus, comprising:

at least one processor;
and
at least one memory including instructions which, when executed by the at least one processor, cause the apparatus at least to perform:
receiving, by a device associated with a destination application, a packet associated with a remote direct memory access connection between a source application and the destination application, wherein the packet is an initial remote direct memory access data packet sent on the remote direct memory access connection after establishment of the remote direct memory access connection using an out-of-band communication channel;
determining, based on a tag associated with the packet, a set of application-level attributes associated with the source application;
determining, based on the packet, a set of application-level attributes associated with the destination application;
identifying, based on the set of application-level attributes associated with the source application and the set of application-level attributes associated with the destination application, a policy;
and
performing, based on the policy, a policy enforcement action.

6 more elements

An apparatus, comprising:

at least one processor;
and
at least one memory including instructions which, when executed by the at least one processor, cause the apparatus at least to perform:
receiving, by a device associated with a destination application, a packet associated with a remote direct memory access connection between a source application and the destination application, wherein the packet is a remote direct memory access connection message associated with establishment of the remote direct memory access connection, wherein the remote direct memory access connection message is a connection request message;
determining, based on a tag associated with the packet, a set of application-level attributes associated with the source application;
determining, based on the packet, a set of application-level attributes associated with the destination application, wherein determining the set of application-level attributes associated with the destination application includes:
obtaining, from a destination port field of the connection request message, a destination port, wherein the destination port was previously allocated by the destination application to bind a service for supporting discovery of the service;
determining, based on the destination port, a process identifier of the destination application;
and
retrieving, from an identity table based on the process identifier of the destination application, the set of application-level attributes of the destination application;
identifying, based on the set of application-level attributes associated with the source application and the set of application-level attributes associated with the destination application, a policy;
and
performing, based on the policy, a policy enforcement action.

10 more elements

An apparatus, comprising:

at least one processor;
and
at least one memory including instructions which, when executed by the at least one processor, cause the apparatus at least to perform:
receiving, by a device associated with a destination application, a packet associated with a remote direct memory access connection between a source application and the destination application, wherein the packet is a remote direct memory access connection message associated with establishment of the remote direct memory access connection, wherein the remote direct memory access connection message is a connection reply message;
determining, based on a tag associated with the packet, a set of application-level attributes associated with the source application;
determining, based on the packet, a set of application-level attributes associated with the destination application, wherein determining the set of application-level attributes associated with the destination application includes:
maintaining a mapping of a local communication identifier of an outgoing connection message to a set of application-level attributes;
obtaining, from a remote communication identifier field of the connection reply message, a remote communication identifier;
and
using, based on a matching of the remote communication identifier to the local communication identifier, the set of application-level attributes as the set of application-level attributes of the destination application;
identifying, based on the set of application-level attributes associated with the source application and the set of application-level attributes associated with the destination application, a policy;
and
performing, based on the policy, a policy enforcement action.

10 more elements

Dependencies are inferred from the claim text.

Zero-trust authentication for secure remote direct memory access

Life of this patent

Zero-trust authentication for secure remote direct memory access

Life of this patent

Abstract

Claims20