VIRTUALIZED NETWORK INTERFACE FOR REMOTE DIRECT MEMORY ACCESS OVER CONVERGED ETHERNET

• US 20150172055A1
• Filed: 12/15/2013
• Published: 06/18/2015
• Est. Priority Date: 12/15/2013
• Status: Active Grant

• Current Assignee: Marvell Asia Pte Limited (Marvell Technology Group Limited)
• Original Assignee: Cavium, LLC (Marvell Technology Group Limited)
• Inventors: Snyder, Wilson Parkhurst II
• Granted Patent: US 9,313,029 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions

Abstract

A method and a system embodying the method for generating an opaque data comprising a stream identifier, comprising encrypting at least part of a stream identifier with a first secret random data to provide an encrypted stream identifier; generating a digest by applying a cryptographic hash to at least the at least the part of the stream identifier; and combining the encrypted stream identifier with the digest, is disclosed Additionally, a method and a system embodying the method for reconstructing a stream identifier from the opaque data indicating permission to access a region of a storage at an entity that generated the opaque data is disclosed.

Claims

1. A method for generating an opaque data comprising a stream identifier, comprising:

encrypting at least part of a stream identifier with a first secret random data to provide an encrypted stream identifier;

generating a digest by applying a cryptographic hash to at least the at least the part of the stream identifier; and

combining the encrypted stream identifier with the digest.

2. The method as claimed in claim 1, wherein the opaque data comprises a remote key (R-Key) in accordance with the Infiniband specification.

3. The method as claimed in claim 1, wherein the encrypting at least a part of a stream identifier with a first secret random data to provide an encrypted stream identifier comprises:

encrypting the entire stream identifier with the first secret random data to provide the encrypted stream identifier.

4. The method as claimed in claim 1, wherein the generating a digest by applying a cryptographic hash to at least the at least part of a stream identifier comprises:

generating the digest by applying the cryptographic hash to the at least the part of the stream identifier and a second secret random data.

5. The method as claimed in claim 1, wherein the generating a digest by applying a cryptographic hash to at least the at least part of a stream identifier comprises:

generating the digest by applying the cryptographic hash to the at least the part of the stream identifier, a second secret random data, and a third data.

6. The method as claimed in claim 5, wherein the third data do not need to be secret.

7. An apparatus for generating an opaque data comprising a stream identifier, comprising:

an entity configured

to encrypt at least part of a stream identifier with a first secret random data to provide an encrypted stream identifier,

to generate a digest by applying a cryptographic hash to at least the at least part the stream identifier, and

to combine the encrypted stream identifier with the digest.

8. The apparatus as claimed in claim 7, wherein the opaque data comprises a remote key (R-Key) in accordance with specification implementing the Infiniband specification.

11. The apparatus as claimed in claim 7, wherein the entity is configured to:

encrypt the entire stream identifier with the first secret random data to provide the encrypted stream identifier.

12. The apparatus as claimed in claim 7, wherein the entity is configured to

generate the digest by applying the cryptographic hash to the at least part of the stream identifier and a second secret random data.

13. The apparatus as claimed in claim 7, wherein the entity is configured to

generate the digest by applying the cryptographic hash to the at least part of the stream identifier, second secret random data, and a third data.

14. The apparatus as claimed in claim 13, wherein the third data do not need to be secret.

15. The apparatus as claimed in claim 7, wherein the entity comprises one of:

a hypervisor;

a virtual machine; and

a virtual network interface card.

16. A method for reconstructing a stream identifier, comprising:

receiving an opaque data at an entity that generated the opaque data;

separating the opaque data into an encrypted stream identifier and a first digest;

decrypting the encrypted stream identifier with a first secret random data to provide a decrypted stream identifier; and

verifying the decrypted stream identifier using the first digest.

17. The method as claimed in claim 16, wherein an opaque comprises a remote key (R-Key) in accordance with Infiniband specification.

18. The method as claimed in claim 16, further comprising:

combining the decrypted stream identifier with a static part of an identifier when the decrypted stream identifier comprises a programmable part of the stream identifier.

19. The method as claimed in claim 16, wherein the verifying the decrypted stream identifier comprises:

generating a second digest by applying a cryptographic hash to at least the decrypted stream identifier;

declaring the decrypted stream identifier verified when the first digest and the second digest are identical.

20. The method as claimed in claim 19, wherein the generating a second digest by applying a cryptographic hash to at least the stream identifier comprises:

generating the second digest by applying the cryptographic hash to the stream identifier and a second secret random data.

21. The method as claimed in claim 19, wherein the generating a second digest by applying a cryptographic hash to at least the stream identifier comprises:

generating the digest by applying the cryptographic hash to the stream identifier, a second secret random data, and a third data.

22. The method as claimed in claim 21, wherein the third data do not need to be secret.

23. An apparatus for reconstructing a stream identifier, comprising:

a virtual interface network card configured

to receive an opaque data at an entity that generated the opaque data,

to separate the opaque data into an encrypted stream identifier and a first digest;

decrypt the encrypted stream identifier with a first secret random data to provide a decrypted stream identifier; and

verify that the decrypted stream identifier using the first digest.

24. The apparatus as claimed in claim 23, wherein the opaque data comprises a remote key (R-Key) in accordance with Infiniband specification.

25. The apparatus as claimed in claim 23, wherein the virtual interface network card is configured to:

combine the decrypted stream identifier with a static part of an identifier when the decrypted stream identifier comprises a programmable part of the stream identifier.

26. The apparatus as claimed in claim 23, wherein the virtual interface network card is configured to:

generate a second digest by applying a cryptographic hash to at least the decrypted stream identifier;

declare the decrypted stream identifier verified when the first digest and the second digest are identical.

27. The apparatus as claimed in claim 26, wherein the virtual interface network card is configured to:

generate the second digest by applying a cryptographic hash to the stream identifier and a second secret random data.

28. The apparatus as claimed in claim 26, wherein the virtual interface network card is configured to:

generate the second digest by applying the cryptographic hash to the stream identifier, a second secret random data, and a third data.

29. The apparatus as claimed in claim 28, wherein the third data do not need to be secret.