RDMA协议应用及安全防护技术综述

刘雨蒙; 唐正梁; 路松峰; 朱建新; 刘运渠

doi:10.11959/j.issn.2096-109x.2024022

您当前的位置：

首页 >

文章列表页 >

RDMA协议应用及安全防护技术综述

综述 | 更新时间：2024-08-14

- RDMA协议应用及安全防护技术综述
- Survey on RDMA protocol applications and security protection technologies
- 网络与信息安全学报 2024年10卷第2期页码：22-46
- 作者机构：
  
  1.华中科技大学网络空间安全学院工业互联网安全实验室，湖北武汉 430074
  2.深圳华中科技大学研究院，广东深圳 518057
  3.江苏为是科技有限公司，江苏苏州 215000
- 作者简介：
  
  [ "刘雨蒙（1998- ），男，湖北武汉人，华中科技大学硕士生，主要研究方向为工业互联网安全。" ]
  [ "唐正梁（1998- ），男，贵州遵义人，华中科技大学硕士生，主要研究方向为工业互联网安全。" ]
  [ "路松峰（1968- ），男，河南巩义人，华中科技大学教授、博士生导师，主要研究方向为密码学、区块链及其应用、工业互联网及其安全。" ]
  [ "朱建新（1966- ），男，浙江临海人，华中科技大学副教授、硕士生导师，主要研究方向为工业互联网安全。" ]
  [ "刘运渠（1972- ），男，贵州遵义人，江苏为是科技有限公司首席架构师，主要研究方向为先进网络计算、网络数据安全、非对称光网络、广播与一致性和网络智能计算。" ]
- 基金信息：
  
  2023年湖北省重大攻关项目(2023BAA027);湖北省重点研发计划项目(2021BAA038);深圳市科技计划基础研究项目(JCYJ20210324120002006);深圳市科技计划技术攻关项目(JSGG20210802153009028)
- DOI：10.11959/j.issn.2096-109x.2024022
  中图分类号： TP393
- 收稿：2023-08-09，
  
  修回：2024-03-03，
  
  纸质出版：2024-04-15
- 稿件说明：
移动端阅览
刘雨蒙, 唐正梁, 路松峰, 等. RDMA协议应用及安全防护技术综述[J]. 网络与信息安全学报, 2024, 10(02): 22-46.

Format: LIU Y M, TANG Z L, LU S F, et al. Survey on RDMA protocol applications and security protection technologies[J]. Chinese Journal of Network and Information Security, 2024, 10(02): 22-46.
刘雨蒙, 唐正梁, 路松峰, 等. RDMA协议应用及安全防护技术综述[J]. 网络与信息安全学报, 2024, 10(02): 22-46. DOI： 10.11959/j.issn.2096-109x.2024022.

Format: LIU Y M, TANG Z L, LU S F, et al. Survey on RDMA protocol applications and security protection technologies[J]. Chinese Journal of Network and Information Security, 2024, 10(02): 22-46. DOI： 10.11959/j.issn.2096-109x.2024022.

摘要

远程直接内容读写技术是一种有效提升数据传输速率、降低CPU占用率的通信方式，在跨区域数据中心之间的转存、高性能计算、快速数据读写等领域起着重要的作用。然而，作为新兴技术，RDMA缺少得到业界广泛认同的安全方案，目前，随着大量RDMA应用逐渐从专用网络环境向一般以太网拓展，关注其安全风险、为其设置一套在不影响传输效率的前提下保障安全性的防护措施是很有必要的；此外，由于采用了特殊的底层实现和协议设计，RDMA技术不仅无法兼容现有的成熟安全方案，还面临其他特殊安全风险的挑战。为梳理RDMA攻防技术的发展，向即将到来的RDMA技术的大规模应用提供安全保障：以无线带宽协议和基于以太网的RDMA协议第2版为例介绍了RDMA技术及其实现原理，调查了在相关场景下RDMA应用面临的安全风险，总结了近年来RDMA安全领域的攻防研究进展，汇总了能够应对这些安全风险的有效安全方案；在证明其有效防御能力的基础上，结合理论分析和实验数据，对比了这些方案的优劣；提出了RDMA攻防领域后续的改进方案和技术优化前景。

Abstract

The remote direct memory access (RDMA) technology

which has been effectively utilized to enhance data transfer rates and reduce CPU utilization

has played a significant role in various domains such as cross-regional data center transfers

high-performance computing

and rapid data read/write operations. However

despite its emerging status

RDMA has been lacking in widely recognized security solutions. With the expansion of RDMA applications from dedicated network environments to general Ethernet networks

the need to address the security risks faced by these applications has become imperative. A set of protective measures were established to ensure security without compromising transmission efficiency. Furthermore

the unique underlying implementation and protocol design of RDMA technology have resulted in incompatibility with existing mature security solutions and have led to the confrontation with specific security risks. The development of RDMA attack and defense technologies and the provision of security guarantees for the forthcoming widespread application of RDMA technology were elucidated The principles of RDMA technology and its implementation were proposed

with examples drawn from the InfiniBand (IB) and the RDMA over converged Ethernet (RoCE) second edition protocols. The security risks faced by RDMA applications in relevant scenarios were investigated

and a summary of the research progress in the RDMA security field over recent years was provided. Effective security solutions addressing these risks were compiled and

after their defensive capabilities were proven

a comparison of their advantages and disadvantages was conducted through theoretical analysis and experimental data. Finally

improvement plans and prospects for technological optimization in the RDMA attack and defense field were proposed.

关键词

Keywords

references

AGUILERA M K , AMIT N , CALCIU I , et al . A abstraction for remote memory [C ] // Proceedings of the USENIX Conference , Usenix Annual Technical Conference . Boston : USENIX Association , 2018 : 775 - 787 .

夏亮 . 基于RoCE协议的网络传输技术研究与实现 [D ] . 北京 : 北京邮电大学 , 2023 .

XIA L . Research and implementation of network transmission technology based on RoCE protocol [D ] . Beijing : Beijing University of Posts and Telecommunications , 2023 .

SIMPSON A K , SZEKERES A , NELSON J , et al . Securing RDMA for high-performance datacenter storage systems [J ] . HotCloud , 2020 : 1 - 8 .

ROTHENBERGER B , TARANOV K , PERRIG A , et al . ReDMArk: bypassing RDMA security mechanisms [J ] . USENIX Security Symposium , 2021 : 4277 - 4292 .

TSAI S Y . Building fast, scalable, low-cost, and safe RDMA systems in datacenters [D ] . West Lafayette : Purdue University , 2019 .

刘建伟 , 王育民 . 网络安全: 技术与实践 [M ] . 第3版 . 北京 : 清华大学出版社 , 2017 .

LIU J W , WANG Y M . Network security: technology and practice [M ] . 3rd Edition . Beijing : Tsinghua University Press , 2017 .

GLĂVAN D . Sniffing attacks on computer networks [J ] . Scientific Bulletin of Naval Academy , 2020 , XXIII( 1 ): 202 - 207 .

JOSHI M , HADI T H . A review of network traffic analysis and prediction techniques [EB ] . arXiv preprint , arXiv: 1507. 05722 . 2015 .

HENINGER N , DURUMERIC Z , WUSTROW E , et al . Mining your Ps and Qs: detection of widespread weak keys in network devices [C ] // Proceedings of the 21st USENIX conference on Security symposium . New York : ACM Press , 2012 : 35 .

赵景 , 王浉锟 . 基于Internet的TCP会话劫持欺骗攻击与防御策略 [J ] . 现代电子技术 , 2020 , 43 ( 16 ): 122 - 125 .

ZHAO J , WANG S K . TCP session hijacking spoofing attack and defense strategy based on Internet [J ] . Modern Electronics Technique , 2020 , 43 ( 16 ): 122 - 125 .

DIETRICH S , LONG N , DITTRICH D . Analyzing distributed denial of service tools: the shaft case [C ] // Proceedings of the 14th USENIX conference on System administration . New York : ACM press , 2000 : 329 - 340 .

LEE M , KIM E J , LEE C W . A source identification scheme against DDoS attacks in cluster interconnects [C ] // Proceedings of the Proceedings of the 2004 International Conference on Parallel Processing Workshops . New York : ACM press , 2004 : 354 - 361 .

MESSADI I , NEUMANN S , ALMSTEDT L , et al . A fast and secure key-value service using hardware enclaves [C ] // Proceedings of the 20th International Middleware Conference Demos and Posters . New York : ACM Press , 2019 : 1 - 2 .

MIHIR B , PHILLIP R . Optimal asymmetric encryption [C ] // Proceedings of the Advances in Cryptology—EUROCRYPT'94: Workshop on the Theory and Application of Cryptographic Techniques . Perugia : Springer Berlin Heidelberg , 1994 : 92 - 111 .

MARK L , SEAN S . Improving DES Coprocessor Throughput for Short Operations [C ] // Proceedings of the 10th USENIX Security Symposium (USENIX Security 01) . Berkeley : USENIX Association , 2001 : 67 - 84 .

WANG X Z , WANG S , LI D . sRDMA: a general and low-overhead scheduler for RDMA [C ] // Proceedings of the 7th Asia-Pacific Workshop on Networking . Hong Kong : Association for Computing Machinery Press , 2023 : 21 - 27 .

MANSOUR W , JANVIER N , FAJARDO P . FPGA implementation of RDMA-based data acquisition system over 100-Gb Ethernet [J ] . IEEE Transactions on Nuclear Science , 2019 , 66 ( 7 ): 1138 - 1143 .

RASHTI M J , SABIN G , KETTIMUTHU R . Long-haul secure data transfer using hardware-assisted GridFTP [J ] . Future Generation Computer Systems , 2016 , 56 : 265 - 276 .

KIM D , LEE S , PARK K . A case for SmartNIC-accelerated private communication [C ] // Proceedings of the 4th Asia-Pacific Workshop on Networking . New York : ACM press , 2020 .

廖湘科 , 肖侬 . 新型高性能计算系统与技术 [J ] . 中国科学: 信息科学 , 2016 , 46 ( 9 ): 1175 - 1210 .

LIAO X K , XIAO N . Emerging high-performance computing systems and technology [J ] . Scientia Sinica (Informationis) , 2016 , 46 ( 9 ): 1175 - 1210 .

梁戈 . 基于RDMA的分布式数据库内存存储系统 [D ] . 成都 : 电子科技大学 , 2020 .

LIANG G . RDMA-based distributed database memory storage system [D ] . Chengdu : University of Electronic Science and Technology of China , 2020 .

KALIA A , KAMINSKY M , ANDERSEN D G . Design guidelines for high performance RDMA systems [C ] // Proceeding of 2016 USENIX Annual Technical Conference (USENIX ATC 16) . Denver : USENIX Association , 2016 : 437 - 450 .

GUO C X , WU H T , DENG Z , et al . RDMA over commodity Ethernet at scale [C ] // Proceedings of the 2016 ACM SIGCOMM Conference . New York : ACM press . 2016 : 202 - 215 .

MACARYHUR P , Russell R D . A performance study to guide RDMA programming decisions [C ] // Proceedings of the 2012 IEEE 14th International Conference on High Performance Computing and Communication & 2012 IEEE 9th International Conference on Embedded Software and Systems . Liverpool : IEEE Press , 2012 : 778 - 785 .

YAN D Y , LIU Y P , ZHANG S , et al . A survey of RoCEv2 congestion control [C ] // International Conference on Information Science, Communication and Computing . Singapore : Springer , 2024 : 42 - 56 .

GRANT R E , RASHTI M J , AFSAHI A , et al . RDMA capable iWARP over datagrams [C ] // Proceedings of the 2011 IEEE International Parallel & Distributed Processing Symposium . Piscataway : IEEE Press , 2011 : 628 - 639 .

MA S , MA T , CHEN K , et al . A survey of storage systems in the RDMA Era [J ] . IEEE Transactions on Parallel and Distributed Systems , 2022 , 33 ( 12 ): 4395 - 4409 .

STEVENS W R , FENNER B . UNIX网络编程 [M ] . 北京 : 机械工业出版社 , 2004 .

STEVENS W R , FENNER B . UNIX network programmin [M ] . Beijing : China Machine Press , 2004 .

MAMBRETTI A , SANDULESCU A , SORNIOTTI A , et al . Bypassing memory safety mechanisms through speculative control flow hijacks [C ] // Proceedings of the 2021 IEEE European Symposium on Security and Privacy (EuroS&P) . Piscataway : IEEE Press , 2021 : 633 - 649 .

MIAO R , ZHU L J , MA S , et al . From luna to solar: the evolutions of the compute-to-storage networks in Alibaba cloud [C ] // Proceedings of the ACM SIGCOMM 2022 Conference . New York : ACM press , 2022 : 753 - 766 .

LU X Y , SHANKAR D , SHI H Y , et al . Spark-uDAPL: cost-saving big data analytics on microsoft azure cloud with RDMA networks [C ] // Proceedings of the 2018 IEEE International Conference on Big Data . Piscataway : IEEE Press , 2018 : 321 - 326 .

POPA R A , LORCH J R , MOLNAR D , et al . Enabling security in cloud storage SLAs with CloudProof [C ] // Proceedings of the 2011 USENIXConference on USENIX Annual Technical Conference . New York : ACM press , 2011 : 31 .

TSAI S Y , PAYER M , ZHANG Y . Pythia: remote oracles for the masses [C ] // Proceedings of the 28th USENIX Security Symposium (USENIX Security 19) . Santa Clara : USENIX Association , 2019 : 693 - 710 .

DRAGOJEVIĆ A , NARAYANAN D , HODSON O , et al . FaRM: fast remote memory [C ] // Proceedings of the 11th USENIX Conference on Networked Systems Design and Implementation . New York : ACM press , 2014 : 401 - 414 .

TSAI S Y , ZHANG Y Y . LITE kernel RDMA support for datacenter applications [C ] // Proceedings of the 26th Symposium on Operating Systems Principles . New York : ACM Press , 2017 : 306 - 324 .

KALIA A , KAMINSKY M , ANDERSEN D G . Using RDMA efficiently for key-value services [J ] . ACM SIGCOMM Computer Communication Review , 2015 , 44 ( 4 ): 295 - 306 .

LU Y Y , SHU J , CHEN Y M , et al . Octopus: an RDMA-enabled distributed persistent memory file system [J ] . ACM Trans Storage , 2017 , 17 ( 19 ): 1 - 19 .

TSAI S Y , ZHANG Y . A double-edged sword: security threats and opportunities in one-sided network communication [C ] // Proceedings of the 11th USENIX Workshop on Hot Topics in Cloud Computing (HotCloud 19) . Renton : USENIX Association , 2019 .

TSAI S Y , ZHANG Y Y . A double-edged sword: security threats and opportunities in one-sided network communication [EB ] . arXiv preprint , arXiv: 1903.09355.2019 .

GRUSS D , MAURICE C , MANGARD S . Rowhammer.js: a remote software-induced fault attack in JavaScript [C ] // Proceedings of the International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment . Cham : Springer , 2016 : 300 - 321 .

VANO-GARCIA F , MARCO-GISBERT H . KASLR-MT: kernel address space layout randomization for multi-tenant cloud systems [J ] . Journal of Parallel and Distributed Computing , 2020 , 137 : 77 - 90 .

IYER V , KANITKAR A , DASGUPTA P , et al . Preventing overflow attacks by memory randomization [C ] // Proceedings of the 2010 IEEE 21st International Symposium on Software Reliability Engineering . Piscataway : IEEE Press , 2010 : 339 - 347 .

ROMANOW A , TALPEY T , BAILEY S . Remote direct memory access (RDMA) over IP problem statement: RFC4297 [S ] . 2005 : 2 - 14 .

JOY PERSIAL G , PRABHU M , SHANMUGALAKSHMI R . Side channel attack-survey [J ] . International Journal of Advanced Scientific Research Review , 2011 , 1 ( 4 ): 54 - 57 .

KHAN M , SWAROOP G . Analysis of row hammer attack on sttram [C ] // Proceedings of the IEEE 36th International Conference on Computer Design (ICCD) . Orlando : IEEE Press , 2018 : 75 - 82 .

李永康 . 基于RDMA的虚拟化安全网关系统设计与实现 [D ] . 深圳 : 中国科学院大学 , 2022 .

LI Y K . Design and implementation of an RDMA-based virtualized security gateway system [D ] . Shenzhen : Chinese Academy of Sciences , 2022 .

NAGANAND D , ‎DAN H . IPSec: the new security standard for the Internet, intranets, and virtual private networks [M ] . Englewood Cliffs : Prentice Hall Professional , 2003 .

LEE M , KIM E.J. , YOUSIF M . Security enhancement in InfiniBand architecture [C ] // Proceedings of the 19th IEEE International Parallel and Distributed Processing Symposium . Denver : IEEE Press , 2005 : 10 .

PINKERTON J , DELEGANES E . Direct data placement protocol (DDP)/remote direct memory access protocol (RDMAP) security: RFC5042 [S ] . 2007 : 4 - 49 .

LEE M , KIM E J . A comprehensive framework for enhancing security in InfiniBand architecture [J ] . IEEE Transactions on Parallel and Distributed Systems , 2007 , 18 ( 10 ): 1393 - 1406 .

NORONHA R , CHAI L , TALPEY T , et al . Designing NFS with RDMA for security, performance and scalability [C ] // Proceedings of the 2007 International Conference on Parallel Processing (ICPP 2007) . Piscataway : IEEE Press , 2007 : 49 .

TARANOV K , ROTHENBERGER B , PERRIG A , et al . sRDMA: efficient NIC-based authentication and encryption for remote direct memory access [C ] // Proceedings of the 2020 USENIX Conference on Usenix Annual Technical Conference . New York : ACM press , 2020 : 691 - 704 .

POKE M , HOEFLER T . DARE: high-performance state machine replication on RDMA networks [C ] // Proceedings of the 24th International Symposium on High-Performance Parallel and Distributed Computing . New York : ACM Press , 2015 : 107 - 118 .

STUEDI P , TRIVEDI A , PFEFFERLE J , STOICA R , et al . Crail: a high-performance I/O architecture for distributed data processing [J ] . IEEE Data Eng Bull , 2017 , 40 : 38 - 49 .

DIAMOND N B . Securing infiniband networks with end-point encryption [D ] . Dayton : Air Force Institute of Technology , 2022 .

TARANOV K , ROTHENBERGER B , DE SENSI D , et al . NeVerMore: exploiting RDMA mistakes in NVMe-oF storage applications [C ] // Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM press , 2022 .

朱佳平 , 李琼 , 宋振龙 , 等 . NVMeoF网络存储协议及硬件卸载技术研究 [C ] // 第22届计算机工程与工艺年会暨第8届微处理器技术论坛论文集 . 长沙 : 中南大学出版社 , 2018 : 24 - 33 .

ZHU J P , LI Q , SONG Z L , et al . Research on NVMeoF network storage protocol and hardware offloading techniques [C ] // Proceedings of the 22nd Annual Conference on Computer Engineering and Technology and the 8th Microprocessor Technology Forum . Changsha : Central South University Press , 2018 : 24 - 33 .

QIAN Z Y , MAO Z M , XIE Y . Collaborative TCP sequence number inference attack: how to crack sequence number under a second [C ] // Proceedings of the 2012 ACM conference on Computer and communications security . Raleigh : ACM Press , 2012 : 593 - 604 .

ALSHAMSI A , SAITO T . A technical comparison of IPSec and SSL [C ] // Proceedings of the 19th International Conference on Advanced Information Networking and Applications (AINA'05) Volume 1 (AINA papers) . Piscataway : IEEE Press , 2005 : 395 - 398 .

CHEN S , JERO S , JAGIELSKI M , et al . Secure communication channel establishment: TLS 1.3 (over TCP fast open) versus QUIC [J ] . Journal of Cryptology . 2021 , 34 ( 3 ): 26 .

MENACHEM A , LISS L , PISMENNY B . Offloading communication security operations to a network interface controller [P ] . US 10958627 , 2021 .

阚闯 , 栾新 , 戚玮玮 . 基于Linux的XFRM框架下IPSec VPN 的研究 [J ] . 计算机工程 , 2008 , 34 ( 20 ): 109 - 111 .

KAN C , LUAN X , QI W W . Research on IPSec VPN under XFRM framework based on Linux [J ] . Computer Engineering , 2008 , 34 ( 20 ): 109 - 111 .

HARKINS D , DAVE C . The internet key exchange (IKE): RFC2409 [S ] . 1998 : 2 - 41 .

AGRAWAL H , DUTTA Y , MALIK S . Performance analysis of offloading IPsec processing to hardware based accelerators [C ] // Proceedings of the 2012 International Symposium on Electronic System Design (ISED) . Piscataway : IEEE Press , 2012 : 291 - 294 .

KONG X , CHEN J , BAI W , et al . Understanding RDMA microarchitecture resources for performance isolation [C ] // Proceedings of the 20th USENIX Symposium on Networked Systems Design and Implementation (NSDI 23) . Boston : USENIX Association , 2023 : 31 - 48 .

黄沛昱 , 宋佳波 , 贾洋凡 . 基于FPGA的高速国密SM4光纤通信系统方案 [J ] . 网络与信息安全学报 , 2023 , 9 ( 6 ): 46 - 55 .

HUANG P Y , SONG J B , JIA Y F . High speed national secret SM4 optical fiber communication system scheme based on FPGA [J ] . Chinese Journal of Network and Information Security , 2023 , 9 ( 6 ): 46 - 55 .

浏览量

140

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

暂无数据