Techniques to provide client-side security for storage of data in a network environment

Patent metadata

Field	Value
Publication number	US-11042657-B2
Application number	US-201715721769-A
Country	US
Kind code	B2
Filing date	Sep 30, 2017
Priority date	Sep 30, 2017
Publication date	Jun 22, 2021
Grant date	Jun 22, 2021

Abstract

Various embodiments are generally directed to an apparatus, method and other techniques to de determine a secure memory region for a transaction, the secure memory region associated with a security association context to perform one or more of an encryption/decryption operation and an authentication operation for the transaction, perform one or more of the encryption/decryption operation and the authentication operation for the transaction based on the security association context, and cause communication of the transaction.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
determining a transaction is a write transaction to put data in a remote storage coupled via a network interconnect;
determining a secure memory region for the write transaction, the secure memory region associated with a security association context to perform one or more of an encryption operation and an authentication operation for the write transaction;
performing the encryption operation using information from the security association context to encrypt the data generating encrypted data;
performing the authentication operation using information from the security association context to generate a message authentication code (MAC) based on the data; and
causing communication of the encrypted data and the MAC to the remote storage via the network interconnect.

2. The computer-implemented method of claim 1 , comprising:
determining a second transaction is a read transaction to get a second encrypted data from the remote storage;
receiving the second encrypted data via the network interconnect;
performing a decryption operation using information from the security association context to decrypt the second encrypted data generating plaintext data; and
providing the plaintext data to a local memory.

3. The computer-implemented method of claim 2 , comprising:
generating a second MAC based on the plaintext data;
comparing the second MAC with a third MAC received from the remote storage;
authenticating the plaintext data if the second MAC matches the third MAC; and
invalidating the plaintext data if the second MAC does not match the third MAC.

4. The computer-implemented method of claim 1 , comprising receiving a transaction request and a memory region index value from an operating system to perform the write transaction, the memory region index value associated with an entry in an memory region table associated with the secure memory region, the entry comprising a security association context index to determine an entry in a security association context table specifying the security association context.

5. The computer-implemented method of claim 4 , the entry in the memory region table comprising a starting nonce.

6. The computer-implemented method of claim 1 , the security association context comprising cryptographic protocol information, and secure key information.

7. The method of claim 1 , wherein the write transaction is a remote direct memory access (RDMA) transaction.

8. An apparatus, comprising:
interface circuitry to execute one or more instructions, the one or more instructions, that when executed, cause the interface circuitry to:
determine a transaction is a write transaction to put data in a remote storage coupled via a network interconnect;
determine a secure memory region for the write transaction, the secure memory region associated with a security association context to perform one or more of an encryption operation and an authentication operation for the write transaction;
perform the encryption operation using information from the security association context to encrypt the data to generate encrypted data;
perform the authentication operation using information from the security association context to generate a message authentication code (MAC) based on the data; and
cause communication of the encrypted data and the MAC to the remote storage via the network interconnect.

9. The apparatus of claim 8 , the interface circuitry to:
determine a second transaction is a read transaction to get a second encrypted data from the remote storage;
receive the second encrypted data via the network interconnect;
perform a decryption operation using information from the security association context to decrypt the second encrypted data to generate plaintext data; and
provide the plaintext data to a local memory.

10. The apparatus of claim 9 , the interface circuitry to:
generate a second MAC based on the plaintext data;
compare the second MAC with a third MAC received from the remote storage;
authenticate the plaintext data if the second MAC matches the third MAC; and
invalidate the plaintext data if the second MAC does not match the third MAC.

11. The apparatus of claim 8 , the interface circuitry to receive a transaction request and a memory region index value from an operating system to perform the write transaction, the memory region index value associated with an entry in a memory region table associated with the secure memory region, the entry comprising a security association context index value to determine an entry in a security association context table specifying the security association context.

12. The apparatus of claim 11 , the entry in the memory region table comprising a starting nonce, and the interface circuitry to perform the encryption operation utilizing the starting nonce.

13. The apparatus of claim 8 , the security association context comprising cryptographic protocol information, and secure key information, and the interface circuitry to perform the encryption operation utilizing the cryptographic protocol information and the secure key information.

14. The apparatus of claim 8 , comprising:
a memory to store the one or more instructions; and
a network interface component including the interface circuitry, the network interface component coupled with the remote storage via the network interconnect.

15. The apparatus of claim 8 , the write transaction to comprise a remote direct memory access (RDMA) transaction.

16. A non-transitory computer-readable storage medium, comprising a plurality of instructions, that when executed, enable processing circuitry to:
determine a transaction is a write transaction to put data in a remote storage coupled via a network interconnect;
determine a secure memory region for the write transaction, the secure memory region associated with a security association context to perform one or more of an encryption operation and an authentication operation for the write transaction;
perform the encryption operation using information from the security association context to encrypt the data to generate encrypted data;
perform the authentication operation using information from the security association context to generate a message authentication code (MAC) based on the data; and
cause communication of the encrypted data and the MAC to the remote storage via the network interconnect.

17. The computer-readable storage medium of claim 16 , comprising a plurality of instructions, that when executed, enable processing circuitry to:
determine a second transaction is a read transaction to get a second encrypted data from the remote storage;
receive the second encrypted data via the network interconnect;
perform a decryption operation using information from the security association context to decrypt the second encrypted data to generate plaintext data; and
provide the plaintext data to a local memory.

18. The computer-readable storage medium of claim 17 , comprising a plurality of instructions, that when executed, enable processing circuitry to:
generate a second MAC based on the plaintext data;
compare the second MAC with a third MAC received from the remote storage;
authenticate the plaintext data if the second MAC matches the third MAC; and
invalidate the plaintext data if the second MAC does not match the third MAC.

19. The computer-readable storage medium of claim 16 , comprising a plurality of instructions, that when executed, enable processing circuitry to receive

Assignees

• Intel Corp

Inventors

• Hausauer Brian S
• Mosur Lokpraveen B
• Hurson Tony
• Fleming Patrick
• Pearson Adrian R

Classifications

• G06F2221/2107

  File encryption · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L9/3242

  involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC · CPC title

• H04L9/0891

  Revocation or update of secret information, e.g. encryption key update or rekeying · CPC title

• H04L9/0894

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title