|
Network systems have seen a significant transformation with the growing acceptance of RDMA for low-latency communications in data centers. Unfortunately, studies have shown that RDMA one-sided operations are subject to security risks such as packet eavesdropping, packet injection, and packet tampering; therefore, we are seeing new RDMA designs taking secure features into account, while most of which still neglecting efficiency in some ways. We propose SEC-RDMA, a scheme being compatible with the original RoCEv2 protocol and enhancing confidentiality and authentication for one-sided operations during RDMA transmissions, mainly focusing on the efficiency of two critical aspects: hard-wired key management and message-based packet authentication. We implement such a scheme on an FPGA-based RDMA network interface card to prove its viability. In testing with this implementation, message-based packet authentication takes roughly 84.6% less time than packet-based one, while hard-wired key management takes approximately 85.5% less time than the typical key exchange strategy at the QP level. This SEC-RDMA implementation adds 45K LUTs and 29K registers to the FPGA-based RDMA network interface card.
|
