RDMA Security Risks and Protections for Intelligent Computing Centers

Remote Direct Memory Access (RDMA) is a primary inter-node fabric for large intelligent computing clusters, but built-in CRC, rKey, and protection-domain checks omit cryptographic authentication, payload integrity, and encryption. China Mobile Research Institute researchers describe four risk classes and three hardening methods: authenticated encryption, memory-protection key derivation, and DPU o

RDMA in large clusters

As intelligent computing centers grow from single hosts into large clusters, Remote Direct Memory Access (RDMA) is a main inter-node communications technology. A host NIC can read or write another host's memory without the operating system in the data path. The design offers low latency, high bandwidth, kernel bypass, and zero-copy transfers. RDMA includes packet checks, memory access control, and resource isolation, but those controls do not provide cryptographic identity authentication, cryptographic integrity, transport encryption, or fine-grained authorization.

Zhang Yiran, Yan Junzhi, and Du Haitao of the China Mobile Research Institute Security Technology Research Institute (China Mobile Artificial Intelligence Security Governance Research Center), reviewed by Du Chenhui, analyze built-in RDMA security, four typical risk classes, and three protection techniques for cluster interconnects.

Operation and built-in controls

RDMA lets one host's NIC access another host's memory without kernel involvement in the transfer. Figure 1 shows the flow for an RDMA WRITE.

Built-in controls cover packet format and field checks, memory regions (MR) with access keys, and protection domains (PD).

On receive, the NIC checks cyclic redundancy check (CRC), queue pair number (QPN), packet sequence number (PSN), remote key (rKey), and virtual address. Failed checks cause the NIC to reject the request or raise an error so unauthorized access does not continue.

Applications must register memory with the NIC. The NIC records address, length, and permissions and issues rKey and lKey. rKey authorizes remote access. lKey authorizes local device access. A remote read or write completes only with a matching rKey and an address range inside the registered MR. Figure 2 shows the role of rKey.

A protection domain isolates RDMA resources among applications or processes. Queue pairs (QP), memory regions, and completion queues (CQ) belong to a PD. Only resources in the same PD can be associated. Figure 3 shows node A's QP0 communicating with node B's QP0 and accessing MR0, not MR1.

Four risk classes

In a trusted network those checks provide baseline protection. RDMA does not authenticate peers with cryptography, does not authenticate headers or payloads, does not encrypt the transport, and does not offer fine-grained authorization. The paper groups the resulting risks into four classes.

Unauthenticated identity. Legitimacy is judged from protocol fields such as QPN, PSN, and rKey. Communicator identity is not bound with cryptography. Injected RDMA requests can interrupt legitimate connections and stop model training or parameter synchronization.

No cryptographic integrity. CRC detects random bit errors. It does not authenticate malicious changes to headers or payloads. Modified payloads can overwrite model parameters, training data, or database records, producing bad inference results or corrupted business data.

Plaintext payloads. Native RDMA does not encrypt end to end. Model parameters, training data, and intermediate results travel in the clear and can be exposed if link traffic is captured.

Token-style access keys. MR and rKey gate remote memory access. rKey is an access token, not a dynamic identity credential. If an rKey is disclosed, guessed, or obtained without authorization, registered memory can be read or written outside application-layer authorization.

Hardening techniques

The authors propose three enhancements that aim to keep low latency and high bandwidth while adding confidentiality, integrity, and tighter access control.

Authenticated encryption modes. Three modes match different security and performance needs. Header authentication covers fields such as QPN, PSN, and addresses so identity spoofing and control-field tampering are harder; it does not protect the payload. Packet authentication adds integrity over the plaintext payload so forgery and tampering are harder; it does not encrypt the link. Authenticated encryption encrypts the payload and jointly authenticates the header and ciphertext, covering spoofing, tampering, and eavesdropping. All three modes still need memory-protection key derivation so permissions bind to address ranges.

Memory-protection key derivation. Token-style rKey authorization is replaced with cryptographic verification from derived keys. A protection-domain root key derives a memory-region key, which then derives subkeys bound to memory subregions. Finer subregions can be derived from the parent subkey. Subregion keys take part in packet authentication. If an access address is altered or falls outside the authorized range, the receiver cannot complete authentication with a matching key, which reduces unauthorized access after rKey disclosure.

DPU and smart-NIC offload. Cryptographic work is moved from the host to DPU or smart-NIC hardware so security processing does not consume host CPU. Figure 4 shows the deployment.

A security DPU or smart NIC at the compute-node edge performs RDMA packet authentication, encryption and decryption, key management, and access checks. The NIC applies send-side protection before traffic reaches the leaf switch and verifies and decrypts on receive, providing end-to-end processing. The design keeps the existing spine-leaf topology, cuts host CPU cost for security, and scales with compute nodes.

Outlook

RDMA remains a mainstay of high-performance inter-node communication in intelligent computing centers, with residual risks of identity spoofing, data tampering, link eavesdropping, and unauthorized memory access. Authenticated encryption, memory-protection key derivation, and DPU or smart-NIC offload are proposed to raise confidentiality, integrity, and access control without discarding RDMA performance. The authors recommend further work on protocol-stack and NIC co-design, key management, performance testing, security evaluation methods, and standardization for large-scale use.