System and method for providing restrictions on the location of peer subnet manager (SM) instances in an infiniband (IB) network

A system for providing subnet manager (SM) restriction in an InfiniBand (IB) network, comprising:

• one or more microprocessors;
• a local SM in a subnet that runs on the one or more microprocessors, wherein the local SM operates to
• detect, via a local SM, a remote port that is associated with a remote SM, wherein the local SM is associated with a local management key and the remote SM is associated with a remote management key;
• determine whether the remote SM associated with a remote port is trustworthy based on at least one of
• known secret management key values in an incoming SM-SM request received from the remote SM before the local SM discovers type, location and trustfulness of an port that the remote SM operates from, and
• a public/private key based authentication procedure initiated by either the remote SM or the local SM before the local SM discovers type, location and trustfulness of a port that the remote SM operates from;
• allow the local SM to send at least one of a request and a response that contains a secret management key to the remote SM, if the local SM determines that the remote SM is trustworthy, and prevent the local SM from initiating a communication with the remote SM using a secret management key, if otherwise.

A non-transitory machine readable storage medium having instructions stored thereon that when executed cause a system to perform the steps of:

• detecting, via a local SM in an InfiniBand (IB) network, a remote port that is associated with a remote SM in the IB network, wherein the local SM is associated with a local management key and the remote SM is associated with a remote management key;
• determining, via the local SM, whether the remote SM associated with the remote port is trustworthy based on at least one of
• known secret management key values in an incoming SM-SM request received from the remote SM before the local SM discovers type, location and trustfulness of an port that the remote SM operates from, and
• a public/private key based authentication procedure initiated by either the remote SM or the local SM before the local SM discovers type, location and trustfulness of an port that the remote SM operates from;
• and
• allowing the local SM to send at least one of a request and a response that contains a secret management key to the remote SM, if the local SM determines that the remote SM is trustworthy, and preventing the local SM from initiating a communication with the remote SM using a secret management key, if otherwise.