Zeta: Transparent Zero-Trust Security Add-on for RDMA

While the fast adoption of RDMA in data centers has been primarily driven by its performance benefits, more and more attention is being paid to its security implication, especially with mounting security risks associated with lateral communication within data centers. However, since RDMA is implemented as NIC’s fixed function, it is challenging to incorporate any new security feature in RDMA. In this paper, we propose Zeta, a zero-trust security addon for RoCEv2, which enables network-independent, fine-grained zero-trust security control for RDMA. It does not require any change in RDMA’s ASIC implementation or application-level interfaces. To this end, Zeta leverages modern SmartNIC’s versatility to perform zero-trust policy control on RDMA packets within a SmartNIC in a cryptographically secure fashion. From its prototype implementation and evaluation based on real-word applications, we show that, while cryptographic verification of Zeta introduces 1.5 ms session startup latency, the overhead of end-to-end application performance is marginal (e.g., less than 1% throughput and 5% latency penalty).