RDMAP/DDP Security Draft draft-pinkerton-rddp-security-00.txt Jim Pinkerton, Ellen Deleganes, Allyn Romanow, Bernard Aboba

Approach Focus on wire visible issues Do not constrain the security analysis to any one implementation – examine the scope of implementations The draft is new – much of the thought has not been presented/reviewed before

Security Model Privileged Resource Manager Privileged Application Non-Privileged Application RNIC Engine firmware Admin Privileged Control Interface Privileged Data Interface Non-Privileged Data Interface Application Control Interface Request Proxy Interface RNIC Interface (RI) Internet

Resources RDMAP/DDP Resources –Connection context memory –Data Buffers –Page translation tables –STag namespace –Completion Queues RDMAP Specific Resources –RDMA Read Request Queue

Dimensions of Trust Local Resource Sharing – are local resources shared between streams? Local Trust – are local applications trusted to not try to circumvent the protocol (either accidentally or on purpose) Remote Trust – are remote applications trusted to try to not circumvent the protocol

Combinations of Trust Local Resource Sharing Local Trust? Remote Trust? NameExample Application NNNNS- NT RDDP/DDP client/server Networking NNYNS- RT Authenticated Remote Peer NYNKernel client NYYSimilar to S-T YNNS-NTTypical Networking YNY?? YYNS-LTStorage target YYYS-TMPI

Tools for Counter Measures Protection Domain Limiting STag scope –Number of connections, amount of buffer advertised, time the buffer is advertised, randomly use the namespace Buffer access rights –Write-only, Read-only, Write/Read Limiting Completion Queue Scope –One or more connections Limiting the scope of an error

Questions Is using “Dimensions of Trust” the right way to characterize the security models? Are the 4 security models the sufficient? Are there other countermeasures?

Outstanding Issues In the document –IPsec section –Summary table at the end From David’s –Change definition of “Trust” to “Partial Trust” –Least common denominator for trust model –Trust model for multiple clients to a single server?

Outstanding Issues Other s –Clarify that an application may choose to use multiple Protections Domains –Possibly explicitly limit STag scope to just PD or just Stream? –Other Resources Asynch Event Queue? –Errors –Shared data buffers Protection Domain as a resource? –Non-privileged Application being able to disable/enable an STag mapping without using the Privileged Resource Manager