Hardware Accelerator for AES-GCM Cipher Offloading
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Processing cipher operations, such as encryption and decryption, often bottleneck computer systems due to the high computational demands, particularly in high-bandwidth encrypted environments like in-memory databases, where the Central Processing Unit (CPU) is overwhelmed, leading to performance degradation.
Innovation Solution
Incorporating a dedicated accelerator within the system that performs specialized encryption and decryption operations, such as an encryption/decryption unit, along with optional compress/decompress and filter units, to offload these tasks from the CPU, utilizing a Galois/Counter Mode (GCM) of operation and the Advanced Encryption Standard (AES) cipher, and employing an accelerator with interfaces for efficient data handling and configuration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If CPU performs cipher operations, then encryption and decryption can be completed, but system performance degrades due to high computational demands
Solution Approach 1:
The patent extracts the cipher operation functionality from the general-purpose CPU and implements it in a dedicated hardware accelerator. This separation allows the CPU to focus on other tasks while the accelerator handles encryption/decryption operations in parallel, eliminating the performance bottleneck without sacrificing security functionality.
Solution Approach 2:
The patent introduces a hardware accelerator as an intermediary component between the CPU and memory system. This accelerator includes dedicated encryption/decryption units that interface with the memory controller, allowing cipher operations to be performed on data in transit without burdening the CPU, thus improving overall system throughput.
2Productivity
If dedicated accelerator is used for cipher operations, then processing speed increases, but device complexity increases
Solution Approach 1:
The hardware accelerator is designed with multiple functional units including encryption, decryption, compression, and filtering capabilities. These units can be selectively activated based on the specific operation required, allowing a single complex component to handle diverse data processing tasks and justify its added complexity through versatility.
Solution Approach 2:
The accelerator is divided into distinct functional units (encryption unit, decryption unit, compression unit, filter unit) that can operate independently or in combination. This modular segmentation allows the system to activate only the necessary units for each operation, managing complexity through functional decomposition while maintaining high processing speeds.
Data Source
AI summary
Disclosed embodiments relate to encrypting or decrypting confidential data with additional authentication data by an accelerator and a processor. In one example, a processor includes processor circuitry to compute a first hash of a first block of data stored in a memory, store the first hash in the memory, and generate an authentication tag based in part on a second hash. The processor further includes accelerator circuitry to obtain the first hash from the memory, decrypt a second block of data using the first hash, and compute the second hash based in part on the first hash and the second block of data.