NIC Encryption Offload Using Derived Keys and Secure VM Data Paths

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In cloud computing environments, maintaining data privacy and security while performing high-speed encryption is challenging due to the need for cloud service providers to have access to encryption keys, which compromises user privacy when hardware offloading is employed.

Innovation Solution

Offloading encryption tasks to a smart network interface controller (NIC) while maintaining encryption keys within the virtual machine, using a secure data path from VM memory to the NIC, ensuring that only the VM can decrypt data, thus preventing the cloud service provider from accessing unencrypted data.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If encryption keys are transferred to the cloud service provider for hardware offloading, then encryption speed is improved, but data privacy is compromised

Engineering Contradiction:

Improveencryption speedVSAvoiddata privacy compromise

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The system segments the encryption architecture into distinct components: a secure key management unit within the virtual machine that retains control of encryption keys, and a separate encryption processing unit in the network interface controller that performs hardware acceleration. This segmentation allows the keys to remain isolated in the VM while enabling fast hardware-based encryption operations, thus resolving the contradiction between speed and privacy.

Inventive Principle:

Principle #1Segmentation

2Object-affected harmful factors

If encryption is performed in software within the virtual machine, then data privacy is maintained, but encryption performance is slow

Engineering Contradiction:

Improvedata privacy protectionVSAvoidencryption performance

Core Design Contradiction:

Object-affected harmful factorsVSProductivity

Solution Approach 1:

The patent introduces an intermediary secure data path and key management mechanism that bridges the virtual machine and the network interface controller. This intermediary structure allows the VM to maintain key secrecy while enabling the NIC's hardware encryption capabilities to be utilized, thus achieving both privacy protection and high performance encryption.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS12483388B2Computer and network interface controller offloading encryption processing to the network interface controller and using derived encryption keys

Publication Date: 2025.11.25 DREAMBIG SEMICON INC

AI summary

Encryption operations are securely offloaded to a network interface controller (NIC). Encryption keys are securely transferred from a virtual machine (VM) to the NIC and data is securely transferred from encrypted VM memory to secure buffers in the NIC. The NIC handles the encryption and decryption operations in hardware, greatly increasing encryption performance while not reducing security. This is especially useful in cloud server environments, so the cloud service provider does not have access to the encryption keys or the unencrypted data. The offloaded operations are performed with numerous different communication protocols, including RDMA, QUIC, IPsec underlay and WireGuard.