Virtualized security gateway system applicable to RDMA (Remote Direct Memory Access) network

Abstract

The invention relates to the field of networks, in particular to a virtualization security gateway system suitable for an RDMA (Remote Direct Memory Access) network, which comprises a virtualization rear end used for providing the use condition of a virtual machine for the RDMA network for a kernel security module by calling a global sign function and being responsible for guaranteeing a specific security mechanism, the kernel security module and the user layer security process collaboratively complete the formulation of a security policy; the kernel security module is used for collecting historical data, summarizing the historical data, and sending the historical data to a user layer security process through netlink at a preset moment to analyze and predict the historical data so as to predict and judge whether security threats exist or not; and after the prediction data is received, a security policy is formulated, and a virtualization rear end is notified to take measures to guarantee a security mechanism through a kernel notification chain. The technical problem that an existing virtualization technology is low in safety performance is at least solved.

Description

technical field [0001] The invention relates to the network field, in particular to a virtualized security gateway system suitable for RDMA networks. Background technique [0002] Different from the traditional TCP / IP network, Remote Direct Memory Access (RDMA) transfers the processing of data packets from the kernel network protocol stack to dedicated network card hardware, so that the kernel can be bypassed during data transmission. Instead, it is processed directly on the network card. Therefore, the occupation of the processor can be reduced, and the data copying from the user application space to the kernel space can be reduced. In addition, using the remote secret key verification provided by the RDMA protocol, when the connection between the sender and the receiver is established, the sender can directly transfer the data to the memory address specified by the receiver, thereby bypassing the processing of the receiver. device, further reducing the delay of data tran...

AI Technical Summary

Problems solved by technology

[0005] The embodiment of the present invention provides a virtualized security gateway system suitable for RDMA networks, so as to at least solve the technical problem of low security performance of the existing virtualization technology

Images