Batch Cryptography Hardware Security Module Throughput
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Hardware security modules (HSMs) face inefficiencies in processing small plaintext cryptographic operations due to high per-operation overhead, limiting their throughput, especially when handling numerous requests for encryption and decryption of small data elements.
Innovation Solution
Implementing a set of batch application programming interfaces (APIs) that allow HSMs to process multiple requests simultaneously, utilizing a general-purpose processor for pre-processing and validation, and a cryptoprocessor for cryptographic operations, thereby reducing overhead and increasing processing capacity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If HSM processes cryptographic operations one request at a time through a single interface, then security and key protection are maintained, but throughput is limited to thousands of requests per second
Solution Approach 1:
The patent segments the cryptographic processing workflow into distinct phases: a setup phase that occurs once per batch to establish cryptographic context, and individual operation phases that can be executed in parallel for each data element in the batch. This segmentation eliminates repeated overhead by performing expensive operations only once per batch rather than once per element.
Solution Approach 2:
The patent merges multiple individual cryptographic operation requests into a single batch request that is processed together. By combining multiple operations into one unified processing call, the system reduces the total number of interface transactions and amortizes the overhead cost across all operations in the batch, achieving millions of requests per second throughput.
2Reliability
If HSM uses specialized cryptoprocessors for cryptographic operations, then cryptographic security is enhanced, but the single interface bottleneck limits full utilization of processing capability
Solution Approach 1:
The patent performs preliminary actions in a setup phase before the actual cryptographic operations begin. This includes initializing cryptographic contexts, loading keys, and configuring processing parameters once per batch. By completing these preparatory steps beforehand, the specialized cryptoprocessors can then focus exclusively on executing cryptographic operations in parallel without repeated setup overhead, maximizing their utilization.
Solution Approach 2:
The patent transitions from a single-dimensional sequential processing model to a multi-dimensional batch processing model. By organizing operations into batches with hierarchical structure (batch-level setup + element-level operations), the system adds temporal and organizational dimensions that enable parallel execution on cryptoprocessors while maintaining security, thereby fully utilizing processing capability.
3Reliability
If HSM processes small plaintexts individually, then each operation can be completed with full validation and security checks, but the constant overhead dominates and reduces efficiency
Solution Approach 1:
The patent applies partial validation and security checks at the batch level rather than fully validating each individual small plaintext. The setup phase performs necessary cryptographic initialization and key verification once per batch, while individual elements within the batch undergo streamlined processing. This partial action approach maintains essential security and validation while eliminating redundant overhead operations.
Solution Approach 2:
The patent changes the processing parameters by grouping multiple small operations into a batch with a unified structure. By altering the operational mode from individual processing to batch processing, the system changes the effective parameters such as overhead allocation, validation depth, and execution timing, enabling efficient handling of small plaintexts while maintaining security requirements.
Data Source
AI summary
Methods, systems, and apparatuses, including computer storage media and hardware security modules, for performing batch cryptography on hardware security modules. A hardware security module can receive a request to perform one or more cryptographic operations. The request can include a batch data structure storing a plurality of data elements. The hardware security module can unbatch the plurality of data elements, perform one or more cryptographic operations on the plurality of data elements to generate a plurality of outputs, generate an output batch data structure storing the plurality of outputs, and transmit the output batch data structure in response to the request. The request and the batch data structure can be formed in accordance with a batch hardware security module application program interface (API) implemented by the hardware security module.