Method and apparatus for securing and segregating host to host messaging on pcie fabric

Abstract

A PCIe fabric includes at least one PCIe switch. The fabric may be used to connect multiple hosts. The PCIe switch implements security and segregation measures for host-to-host message communication. A management entity defines a Virtual PCIe Fabric ID (VPFID). The VPFID is used to enforce security and segregation. The fabric ID may be extended to be used in switch fabrics with other point-to-point protocols.

What is claimed is: 
     
         1 . A PCI express switch in combination with a management system in a switch fabric having a point-to-point network protocol, comprising:
 means for receiving an input from a switch fabric administrator defining subnets;   means for generating a virtual fabric ID (VFID) for at least one defined subnet, tag packets of outgoing messages from at least one host with the virtual fabric ID, and means for determining if an incoming message to at least one host has a tag matching the virtual fabric ID;   wherein receive processing for incoming messages is supported if the tag of the incoming message matches an approved virtual fabric ID and the message is dropped within the PCI express switch if the tag does not match the approved virtual fabric ID.   
     
     
         2 . A PCI express switch in connection with a management system, wherein a memory in the management system stores a table of virtual fabric IDs (VFIDs) to enforce security and segregation of host-to-host message flows for hosts coupled to the PCI express switch;
 wherein the switch is configured to receive an input from a switch fabric administrator defining subnets, generate a virtual fabric ID for at least one defined subnet, tag packets of outgoing messages from at least one host with the virtual fabric ID, and determine if an incoming message to at least one host has a tag matching the virtual fabric ID; and   wherein receive processing for incoming messages is supported if the tag of the incoming message matches an approved virtual fabric ID, and the message is dropped within the PCI express switch if the tag does not match the approved virtual fabric ID.   
     
     
         3 . The switch of  claim 2 , wherein a point-to-point protocol utilized by the switch is PCI Express. 
     
     
         4 . The switch of  claim 2 , wherein tagging in the switch is performed via vendor defined messaging. 
     
     
         5 . The switch of  claim 2 , wherein the switch returns an error code to a sender if the virtual fabric ID does not match. 
     
     
         6 . The switch of  claim 2 , wherein the switch checks every host-to-host packet coming out of a port and drops the packet unless it has been tagged with a valid virtual fabric ID. 
     
     
         7 . The switch of  claim 6 , wherein the switch checks at each receiving port for a valid virtual fabric ID and drops packets having invalid virtual fabric IDs. 
     
     
         8 . The switch of  claim 2 , wherein the switch fabric includes virtual Direct Memory Access (DMA) engine functions for each port, wherein the switch receives from a fabric administrator one or more settings defining a relationship between VFIDs and DMA functions. 
     
     
         9 . The switch of  claim 8 , wherein the settings include:
 a single VFID/DMA function;   a multiple VFID mode on a per DMA function basis; and   a default setting having a single VFID and all DMA functions are set to this setting.   
     
     
         10 . The switch of  claim 2 , wherein the switch translates an Ethernet Virtual Local Area Network (VLAN) to a corresponding VFID to permit Ethernet VLAN to be run over the fabric switch. 
     
     
         11 . The switch of  claim 2 , wherein the switch generates at least one error message based at least in part on the tag not matching an approved VFID. 
     
     
         12 . The switch of  claim 11 , wherein the at least one error message comprises a security violation notification. 
     
     
         13 . A PCI express switch in combination with a management system forming a switch fabric having a point-to-point network protocol, comprising:
 means for generating a table defining a virtual fabric ID (VFID) for at least one defined subnet;   means for tagging packets of outgoing messages from at least one host with the virtual fabric ID; and   means for determining if an incoming message to at least one host has a tag matching the virtual fabric ID;   wherein receive processing for incoming messages is supported if the tag matches the virtual fabric ID and the message is dropped within the switch if the tag does not match the virtual fabric ID.   
     
     
         14 . A PCI express switch in connection with a management system in a switch fabric, wherein a memory in the management system stores a table of virtual fabric IDs to enforce security and segregation of host-to-host message flows for hosts coupled to the PCI express switch; and
 wherein the switch is configured to:
 generate the table defining the virtual fabric IDs for at least one defined subnet; 
 tag packets of outgoing messages from at least one host with the virtual fabric ID; and 
 determine if an incoming message to at least one host has a tag matching the virtual fabric ID, and receive processing for incoming messages is supported if the tag matches the virtual fabric ID and the message is dropped within the switch if the tag does not match the virtual fabric ID. 
   
     
     
         15 . The switch of  claim 14 , wherein a point-to-point protocol utilized by the PCI express switch is PCI Express. 
     
     
         16 . The switch of  claim 14 , wherein tagging is performed via vendor defined messaging. 
     
     
         17 . The switch of  claim 14 , wherein an error code is returned to a sender if the virtual fabric ID does not match. 
     
     
         18 . The switch of  claim 14 , wherein the switch checks every host-to-host packet coming out of a port and drops the packet unless it has been tagged with a valid VFID. 
     
     
         19 . The switch of  claim 18 , where the switch checks at each receiving port for a valid virtual fabric ID and dropping packets having invalid tags. 
     
     
         20 . The switch of  claim 14 , wherein the switch fabric includes virtual Direct Memory Access (DMA) engine functions for each port and the switch receives from a fabric administrator one or more settings, including setting a relationship between VFIDs and DMA functions. 
     
     
         21 . The switch of  claim 20 , wherein the settings include:
 a single VFID/DMA function;   a multiple VFID mode on a per DMA function basis; and   a default setting having a single VFID and all DMA functions are set to this setting.   
     
     
         22 . The switch of  claim 14 , wherein the switch translates an Ethernet Virtual Local Area Network (VLAN) to a corresponding VFID to permit Ethernet VLAN to be run over the fabric switch. 
     
     
         23 . The switch of  claim 14 , wherein the switch generates at least one error message based at least in part on the tag not matching an approved VFID. 
     
     
         24 . The switch of  claim 23 , wherein the at least one error message comprises a security violation notification.