Bump-in-the-Wire Accelerator for Offloading Cryptographic Operations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Bump-in-the-wire computational accelerators are limited in their usefulness and scalability when dealing with connection-oriented transport-layer traffic, leading to cryptographic operations being performed in software on the host CPU rather than being offloaded to hardware accelerators, especially for protocols like TCP.
Innovation Solution
A bump-in-the-wire accelerator device that performs opportunistic decryption of packets using a flow state table with cryptographic context information, allowing offloading of cryptographic operations from the host processor while maintaining transport logic on the host processor, and resumes hardware processing after packet rearrangement.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If cryptographic operations are performed in software on the host CPU, then the host processor can handle transport-layer protocols like TCP, but cryptographic operations cannot be offloaded to hardware accelerators
Solution Approach 1:
The system segments the processing responsibilities between the host CPU and the hardware accelerator. The host CPU handles transport-layer protocol processing (TCP/IP stack), while the hardware accelerator handles cryptographic operations. This segmentation is achieved through a co-processor architecture where the accelerator appears as a network interface to the host, allowing simultaneous handling of protocol logic and cryptographic computations without interference.
Solution Approach 2:
A network interface controller (NIC) or bridge device acts as an intermediary between the host CPU and the hardware accelerator. This intermediary manages the interface between the software-based transport layer and the hardware-based cryptographic engine, enabling the host to send cryptographic operations to the accelerator while maintaining protocol handling responsibilities. The intermediary translates and coordinates data flows between the two processing domains.
2Productivity
If cryptographic operations are offloaded to a hardware accelerator, then cryptographic throughput increases, but the accelerator cannot handle connection-oriented transport-layer traffic
Solution Approach 1:
The transport-layer protocol handling functionality is extracted from the hardware accelerator and placed in the host CPU's software stack. This extraction allows the accelerator to focus exclusively on cryptographic operations without the complexity of maintaining connection state, sequence numbers, or retransmission logic. The host CPU retains full control over TCP/IP protocol processing while the accelerator provides dedicated cryptographic acceleration.
Solution Approach 2:
Instead of having the hardware accelerator handle both transport protocols and cryptography (as in traditional approaches), the system inverts the architecture: the host CPU handles transport protocols in software while the accelerator handles only cryptography in hardware. This inversion resolves the contradiction by assigning each component to its strength - software flexibility for protocol handling and hardware speed for cryptographic computations.
3Productivity
If a bump-in-the-wire accelerator is deployed, then cryptographic operations can be intercepted and accelerated, but the accelerator requires implementation of transport layer logic and data buffering
Solution Approach 1:
The host CPU's network stack is designed to be universal, handling both standard network traffic and cryptographic operations through a unified interface. The NIC or bridge device provides multi-functionality by supporting both regular packet forwarding and cryptographic acceleration modes. This universality eliminates the need for the accelerator to implement specialized transport layer logic, as the host's existing network stack already provides this functionality.
Solution Approach 2:
The host CPU's existing network stack and memory resources are utilized to provide transport layer services and data buffering, rather than requiring the accelerator to implement these functions. The accelerator leverages the host's self-service capabilities for protocol handling and buffer management, focusing its resources on cryptographic computations. This approach reduces the accelerator's complexity by having it rely on the host's established infrastructure.
Data Source
AI summary
Data processing apparatus includes a host processor and a network interface controller (NIC), which is configured to couple the host processor to a packet data network. A memory holds a flow state table containing context information with respect to computational operations to be performed on multiple packet flows conveyed between the host processor and the network. Acceleration logic is coupled to perform the computational operations on payloads of packets in the multiple packet flows using the context information in the flow state table.