Remote Direct Memory Access (RDMA) is a key enabler of high-performance systems, offering low latency, high throughput, and reduced CPU overhead by allowing direct memory-to-memory transfers between machines. However, its design bypasses traditional CPU-mediated security mechanisms, introducing critical vulnerabilities in untrusted environments. This work explores the integration of RDMA and AES-128 encryption to secure data transfers without compromising performance. We implement encryption directly within the data plane of a programmable Tofino switch using the P4 programming language. By offloading encryption from the CPU to the switch, our design preserves RDMA's performance benefits while addressing its security shortcomings. Experimental results show that the system achieves throughput of 0.37 Gbps for 16-byte packets, 0.76 Gbps for 32-byte packets, 1.83 Gbps for 64-byte packets, and 1.9 Gbps for 128-byte packets. These findings demonstrate the feasibility of secure, high-throughput RDMA communication using programmable network hardware.

翻译：远程直接内存访问（RDMA）是实现高性能系统的关键技术，它通过允许计算机之间进行直接的内存到内存传输，提供了低延迟、高吞吐量和较低的CPU开销。然而，其设计绕过了传统的基于CPU的安全机制，在不可信环境中引入了关键性的安全漏洞。本研究探讨了集成RDMA与AES-128加密的方法，以在不牺牲性能的前提下保护数据传输。我们使用P4编程语言在可编程Tofino交换机的数据平面内直接实现了加密。通过将加密任务从CPU卸载到交换机上，我们的设计在解决RDMA安全缺陷的同时，保持了其性能优势。实验结果表明，对于16字节数据包，系统吞吐量达到0.37 Gbps；32字节数据包为0.76 Gbps；64字节数据包为1.83 Gbps；128字节数据包为1.9 Gbps。这些发现证明了利用可编程网络硬件实现安全、高吞吐量RDMA通信的可行性。