Protected data accesses using remote copy operations

Patent metadata

Field	Value
Publication number	US-12333025-B2
Application number	US-202318370137-A
Country	US
Kind code	B2
Filing date	Sep 19, 2023
Priority date	Apr 11, 2019
Publication date	Jun 17, 2025
Grant date	Jun 17, 2025

Abstract

Examples herein relate to an interface selectively providing access to a memory region for a work request from an entity by providing selective access to a physical address of the memory region and selective access to a cryptographic key for use by a memory controller to access the memory region. In some examples, providing selective access to a physical address conversion is based on one or more of: validation of a certificate received with the work request and an identifier of the entity being associated with a process with access to the memory region. Access to the memory region can be specified to be one or more of: create, read, update, delete, write, or notify. A memory region can be a page or sub-page sized region. Different access rights can be associated with different sub-portions of the memory region, wherein the access rights comprise one or more of: create, read, update, delete, write, or notify.

First claim

What is claimed is:

1. A cloud service provider system configurable to be used in association with multiple tenants, the cloud service provider system to be used in providing at least one service associated with at least one of the multiple tenants, the cloud service provider being configurable for use in association with at least one public cloud and/or at least one private cloud, the cloud service provider system comprising:
server hardware for use in executing at least one workload associated with the providing of the at least one service; and
multiple memory regions configurable to be associated with the multiple tenants, at least one of the multiple memory regions also to be associated with the at least one workload, the multiple tenants to be assigned access privileges with respect to the multiple memory regions;
wherein:
the server hardware is configurable for use in association with circuitry for use in processing at least one remote direct memory access (RDMA) request associated with the at least one of the multiple memory regions;
the at least one RDMA request is configurable to request at least one RDMA write access to and/or at least one RDMA read access from the at least one of the multiple memory regions;
the at least one RDMA write access is configurable to comprise data encryption for use in subsequent RDMA transmission to the at least one of the multiple memory regions;
the at least one RDMA read access is configurable to comprise RDMA reception of encrypted data from the at least one of the multiple memory regions for subsequent decryption;
the access privileges that are to be assigned to the multiple tenants with respect to the multiple memory regions are to be mutually different from each other, at least in part;
the at least one RDMA request is associated with at least one requesting tenant of the multiple tenants;
the processing comprises determining, based upon which of the access privileges is to be assigned to the at least one requesting tenant, whether to permit the at least one RDMA request;
the cloud service provider system comprises physical server resources;
the physical server resources:
comprise the server hardware; and
are configurable to comprise accelerator circuits that comprise graphics processing units (GPUs);

the cloud service provider system is configurable to dynamically allocate, based upon resource utilization trend data, resource utilization performance modeling data, and future resource utilization prediction data associated with the at least one workload, one or more portions of the physical server resources for use in association with the executing of the at least one workload;
the GPUs are configurable to implement one or more artificial intelligence models associated with machine learning and/or neural networks; and
the cloud service provider system is to execute virtual machines and/or containers that are configurable to be associated with the multiple tenants, multiple memory regions, and the at least one workload.

2. The cloud service provider system of claim 1 , wherein:
the at least one requesting tenant comprises the at least one of the multiple tenants; and
the at least one of the multiple tenants is to be assigned at least one of the access privileges that is to result in the circuitry permitting the at least one RDMA request.

3. The cloud service provider system of claim 1 , wherein:
the at least one requesting tenant comprises at least one other of the multiple tenants; and
the at least one other of the multiple tenants is to be assigned at least one of the access privileges that is to result in the circuitry denying the at least one RDMA request.

4. The cloud service provider system of claim 1 , wherein:
the server hardware and/or the physical server resources are configurable to be comprised in the at least one public cloud and the at least one private cloud.

5. The cloud service provider system of claim 4 , wherein:
the server hardware and/or the physical server resources are configurable to be comprised in both at least one on-premises data center and at least one off-premises data center.

6. The cloud service provider system of claim 5 , wherein:
the at least one public cloud, the at least one private cloud, the at least one on-premises data center, and/or the at least one off-premises data center are configured for use in association with mobile edge compute; and
the access privileges are to be determined based upon one or more certificate-associated credentials.

7. At least one non-transitory machine-readable storage medium storing instructions for being executed by at least one machine that is to be associated with a cloud service provider system, the cloud service provider system being configurable to be used in association with multiple tenants, the cloud service provider system to be used in providing at least one service associated with at least one of the multiple tenants, the cloud service provider being configurable for use in association with at least one public cloud and/or at least one private cloud, the cloud service provider system comprising server hardware and multiple memory regions, the instructions, when executed by the at least one machine, resulting in the cloud service provider system being configured to enable performance of operations comprising:
executing, by the server hardware, at least one workload associated with the providing of the at least one service; and
configuring multiple memory regions to be associated with the multiple tenants, at least one of the multiple memory regions also to be associated with the at least one workload, the multiple tenants to be assigned access privileges with respect to the multiple memory regions;
wherein:
the server hardware is configurable for use in association with circuitry for use in processing at least one remote direct memory access (RDMA) request associated with the at least one of the multiple memory regions;
the at least one RDMA request is configurable to request at least one RDMA write access to and/or at least one RDMA read access from the at least one of the multiple memory regions;
the at least one RDMA write access is configurable to comprise data encryption for use in subsequent RDMA transmission to the at least one of the multiple memory regions;
the at least one RDMA read access is configurable to comprise RDMA reception of encrypted data from the at least one of the multiple memory regions for subsequent decryption;
the access privileges that are to be assigned to the multiple tenants with respect to the multiple memory regions are to be mutually different from each other, at least in part;
the at least one RDMA request is associated with at least one requesting tenant of the multiple tenants;
the processing comprises determining, based upon which of the access privileges is to be assigned to the at least one requesting tenant, whether to permit the at least one RDMA request;
the cloud service provider system comprises physical server resources;
the physical server resources:
comprise the server hardware; and
are configurable to comprise accelerator circuits that comprise graphics processing units (GPUs);

the cloud service provider system is configurable to dynamically allocate, based upon resource utilization trend data, resource utilization performance modeling data, and future resource utilization prediction data associated with the at least one workload, one or more portions of the physical server resources for use in association with the executing of the at least one workload;
the GPUs are configurable to implement one or more artificial intelligence models associated with machine learning and/or neural networks; and
the cloud service provider system is to execute virtual

Assignees

• Intel Corp

Inventors

• Smith Ned
• Doshi Kshitij A
• Guim Bernat Francesc
• Sood Kapil
• Viswanathan Tarun

Classifications

• G06F15/17331

  Distributed shared memory [DSM], e.g. remote direct memory access [RDMA] · CPC title

• H04L9/3268

  using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL] · CPC title

• G06F21/335

  for accessing specific resources, e.g. using Kerberos tickets · CPC title

• G06F21/602 Primary

  Providing cryptographic facilities or services · CPC title

• G06F15/161

  Computing infrastructure, e.g. computer clusters, blade chassis or hardware partitioning (casings, cabinets, racks or drawers for data centers H05K5/00) · CPC title