System and method for supporting subnet manager (SM) level robust handling of unkown management key in an infiniband (IB) network

Patent metadata

Field	Value
Publication number	US-9935848-B2
Application number	US-201213488192-A
Country	US
Kind code	B2
Filing date	Jun 4, 2012
Priority date	Jun 3, 2011
Publication date	Apr 3, 2018
Grant date	Apr 3, 2018

Abstract

A system and method can support subnet manager (SM) level robust handling of an incoming unknown management key in an InfiniBand (IB) network. A local SM in a fabric is adaptive to receive an incoming subnet management packet (SMP) from a remote SM, wherein the SMP contains a first management key. Furthermore, the local SM operates to check whether the first management key is consistent with a configuration associated with the local SM, and can silently drop the incoming SMP if the first management key is not consistent with the local SM configuration.

First claim

What is claimed is:

1. A method for handling an unknown remote subnet manager (SM) and an incoming unknown management key from the remote subnet manager in an InfiniBand (IB) network fabric operating on one or more microprocessors, comprising:
detecting, by a local SM of a first IB network fabric, a connection of a remote port of a second IB network fabric to the first IB network fabric, wherein the local SM is associated with a first M_Key, wherein the remote port is associated with a subnet management agent (SMA) and is managed by a remote SM of the second IB network fabric, wherein the remote SM of the second IB fabric is associated with a second M_Key different from the first M_Key, wherein the remote SM of the second IB network fabric is positioned behind the remote port in the second IB network fabric, and wherein the connection of the remote port of the second IB network fabric is a physical link to a local port of the first IB network fabric that is managed by the local SM of the first IB network fabric;
receiving, by the local SM of the first IB network fabric, an incoming subnet management packet (SMP) from the remote SM of the second IB network fabric, the incoming SMP including the second M_Key associated with the second SM of the second I B network fabric;
determining, by the local SM of the first IB network fabric, that the second M_Key included in the received SMP from the remote subnet is inconsistent with a configuration of the local SM of the first IB network fabric by comparing the second M_Key with a list of M_Keys in a configuration file of the local SM;
dropping the received SMP based on the determined inconsistency of the second M_Key with the configuration of the local SM of the first IB network fabric;
preventing the initiation of subnet management packet (SMP) communication from the local SM of the first IB network fabric to the remote port of the second IB network fabric based on the determined inconsistency of the second M_Key with the configuration of the local SM of the first IB network fabric;
preventing subnet-discovery operation attempts by the local SM of the first IB network fabric over the link to the remote port of the second IB network fabric based on the determined inconsistency of the second M_Key with the configuration of the local SM of the first IB network fabric;
subsequent to determining the inconsistency of the second M_Key, periodically performing, by the local subnet manager of the first IB network fabric and without dependency on receipt of state-change traps from the SMA associated with the remote port, integrity checks on the SMA associated with the remote port;
determining that the integrity checks have failed; and
configuring, by the local SM of the first IB network fabric, and in response to the determined failure of the integrity checks, the local port to treat the physical link connecting the local port to the remote port as logically down, wherein, while the local port is treated as logically down, the local SM does not receive or evaluate any subnet-level communications sent from the remote port.

2. The method according to claim 1 , further comprising:
determining, via the local SM, whether the remote SM is authorized to communicate with the local SM.

3. The method according to claim 2 , further comprising:
using subnet SMP based authentication protocols to verify an identity of the remote SM.

4. The method according to claim 1 , further comprising:
determining that the link is operational when the link is up and the subnet management agent (SMA) associated with a remote port is responding correctly to said periodic integrity checks.

5. The method according to claim 1 , wherein the remote SM can initiate communication with the local SM.

6. A non-transitory machine readable storage medium comprising instructions for handling an unknown remote subnet manager (SM) and an incoming unknown management key from the remote subnet manager in InfiniBand (IB) network fabrics, said instructions, when executed by one or more microprocessors, causing the one or more microprocessors to perform the steps comprising:
detecting, by a local SM of a first IB network fabric, a connection of a remote port of a second IB network fabric to the first IB network fabric, wherein the local SM is associated with a first M_Key, wherein the remote port is associated with a subnet management agent (SMA) and is managed by a remote SM of the second IB network fabric, wherein the remote SM of the second IB fabric is associated with a second M_Key different from the first M_Key, wherein the remote SM of the second IB network fabric is positioned behind the remote port in the second IB network fabric, and wherein the connection of the remote port of the second IB network fabric is a physical link to a local port of the first IB network fabric that is managed by the local SM of the first IB network fabric;
receiving, by the local SM of the first IB network fabric, an incoming subnet management packet (SMP) from the remote SM of the second IB network fabric, the incoming SMP including the second M_Key associated with the second SM of the second IB network fabric;
determining, by the local SM of the first IB network fabric, that the second M_Key included in the received SMP from the remote subnet is inconsistent with a configuration of the local SM of the first IB network fabric by comparing the second M_Key with a list of M_Keys in a configuration file of the local SM;
dropping the received SMP based on the determined inconsistency of the second M_Key with the configuration of the local SM of the first IB network fabric;
preventing the initiation of subnet management packet (SMP) communication from the local SM of the first IB network fabric to the remote port of the second IB network fabric based on the determined inconsistency of the second M_Key with the configuration of the local SM of the first IB network fabric;
preventing subnet-discovery operation attempts by the local SM of the first IB network fabric over the link to the remote port of the second IB network fabric based on the determined inconsistency of the second M_Key with the configuration of the local SM of the first IB network fabric;
subsequent to determining the inconsistency of the second M_Key, periodically performing, by the local subnet manager of the first IB network fabric and without dependency on receipt of state-change traps from the SMA associated with the remote port, integrity checks on the SMA associated with the remote port;
determining that the integrity checks have failed; and
configuring, by the local SM of the first IB network fabric, and in response to the determined failure of the integrity checks, the local port to treat the physical link connecting the local port to the remote port as logically down, wherein, while the local port is treated as logically down, the local SM does not receive or evaluate any subnet-level communications sent from the remote port.

7. The non-transitory machine readable storage medium according to claim 6 , further comprising:
determining, via the local SM, whether the remote SM is authorized to communicate with the local SM.

8. The non-transitory machine readable storage medium according to claim 7 , further comprising:
using subnet SMP based authentication protocols to verify an identity of the remote SM.

9. The non-transitory machine readable storage medium according to claim 6 , further comprising:
determining that the link is operational when the link is up and the subnet management agent (SMA) associated with a remote port is responding correctly to said periodic integrity checks.

10. The non-transitory machine readable storage medium according to claim 6

Assignees

• Johnsen Bjorn Dag
• Holen Line
• Moxnes Dag Georg
• Oracle Int Corp

Inventors

• Johnsen Bjorn-Dag
• Holen Line
• Moxnes Dag Georg

Classifications

• H04L41/32

  Specific management aspects for broadband networks · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L41/28 Primary

  Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration · CPC title