Networking InfiniBand Cluster Bring-up Procedure
Networking InfiniBand Cluster Bring-up Procedure
Breadcrumbs

Infiniband Keys and Security

This chapter describes the security configuration in UFM using cloud profile.

Cloud Profile Mode

The configuration model introduces the cloud_profile parameter with the following possible values:

  • Mode 0 (Disabled): Default state with no additional security controls.

  • Mode 1 (Bare Metal Profile): Perform extra validations on Pkey members, such as ensuring that all HCAs are assigned to the same Pkey.

  • Mode 2 (Secured Bare Metal Profile): Enforces comprehensive security validation, auto-configuration, and advanced control mechanisms. 

Cloud Profile

By setting the cloud_profile to 1, it will configure UFM to assign default management network memberships as limited. It also activates additional validations for PKey members, including checks to ensure all HCAs are associated with the same PKey and that there are no duplicate PKey assignments using index 0.

Secured Cloud Profile

By setting cloud_profile to 2, UFM not only applies all the additional validations included in the Bare Metal Profile but also enables rigorous security controls tailored for bare-metal cloud environments. These include:

  • Enforcing a restrictive PKEY posture, with the default management PKEY tightly limited.

  • Enabling all SM MAD keys with a periodically randomized seed, including:
    MKEY, VSKEY, CCKEY, Class C key (N2N), SHARP job keys, SMKEY, and SAKEY.

  • Activating the Service Key mechanism for SHARP Aggregation Manager (AM) and future services.

  • Enabling the enhanced SA trust model, introducing registration limits to mitigate security risks.

  • Applying SA registration limitations with default values.

  • Activating the MAD Limiter using default configurations to improve security.

  • Enforcing MFT with M_Key as mandatory.

  • Validating allowed SM GUIDs to restrict which ports can operate as Subnet Managers (SMs).

  • Restoring original parameter values when the feature is disabled after being enabled.

 

To configure UFM running in Cloud Profile mode, perform the following:

  1. Set the following parameter in the gv.cfg file to one of the supported values: 

# Allow setting of cloud profile. Supported values:# 0 - Disabled. (default)# 1 - Bare metal profile (Perform extra validations on Pkey members, such as ensuring that all HCAs are assigned to the same Pkey.).# 2 - Secured bare metal profile (UFM enforces a hardened InfiniBand (IB) security posture suitable for bare-metal cloud environments.).cloud_profile = 2

  1. Restart UFM.  

  2. If cloud_profile is set to 2, ensure that the allowed_sm_guids parameter is configured in the opensm.conf file.
    The allowed_sm_guids key is mandatory when the secured bare-metal profile is enabled; otherwise, UFM will fail to start.

For more implementing on security capabilities over an InfiniBand network, please refer to NVIDIA InfiniBand - Security Overview and Guidelines.

Last updated: