Embedded NIC Offloading IPSec Processing for Virtual Machines
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current IPSec and IKE implementations in software consume significant CPU processing power due to network-level peer authentication, data integrity, and encryption/decryption operations, making it desirable to offload these operations to an external hardware accelerator.
Innovation Solution
Offloading IPSec/IKE processing from virtual machines (VMs) to an embedded network interface card (NIC) acting as a hardware accelerator, which performs IPSec operations on data packets before transmission, reducing CPU and memory burden on the host and enabling secure communication without software changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IPSec and IKE are implemented in software on the host, then network-level peer authentication, data integrity, and encryption/decryption operations can be performed, but CPU processing power is consumed tremendously
Solution Approach 1:
The patent extracts the IPSec processing functions from the host CPU and relocates them to a dedicated network interface card (NIC). The NIC is configured to perform IPSec operations including encryption, decryption, authentication, and integrity checking independently from the host processor, thereby removing the computational burden from the CPU while maintaining security functions.
Solution Approach 2:
The patent introduces a virtual machine (VM) as an intermediary layer between the host and the network. The VM acts as a bridge that can offload IPSec processing to the NIC while maintaining the security architecture. This intermediary enables the host to benefit from hardware acceleration without requiring direct modification of the host's core processing architecture.
2Reliability
If IPSec operations are performed in software, then secure communication can be established, but memory consumption on the host increases
Solution Approach 1:
The patent extracts memory-intensive IPSec processing operations from the host's memory space and relocates them to the NIC's dedicated memory resources. By moving encryption/decryption buffers, security association data, and processing state to the NIC, the host's memory consumption is reduced while data confidentiality is maintained through hardware-enforced security operations.
3Use of energy by moving object
If an external hardware accelerator is used for IPSec, then CPU processing power is reduced, but device complexity increases
Solution Approach 1:
The patent implements a multi-functional NIC that can operate in multiple modes: standard networking mode for regular traffic and IPSec offloading mode for secure communication. The NIC includes configurable hardware engines that can be enabled or disabled based on the communication requirements, allowing the system to maintain simplicity for standard operations while providing advanced capabilities when needed.
Solution Approach 2:
The patent uses virtualization to create a virtual copy of the network interface that can be assigned to specific VMs. This virtual NIC (vNIC) copies the essential networking functions to the virtualized environment, allowing IPSec offloading to be implemented in virtualized systems without requiring physical hardware modifications to each individual system.
Data Source
AI summary
A new approach is proposed that contemplates systems and methods to support a mechanism to offload IPSec/IKE processing of virtual machines (VMs) running on a host to an embedded networking device, which serves as a hardware accelerator for the VMs that need to have secured communication with a remote device/server over a network. By utilizing a plurality of its software and hardware features, the embedded networking device is configured to perform all offloaded IPSec operations on data packets transferred between the host and the remote device over the network as required for the secured communication before the data packets can be transmitted over the network. The embedded networking device, in effect, acts as a proxy on behalf of the VMs running on the host to perform the offloaded IPSec operations as well as serving as the network interface for the secured communication between the VMs and the remote device.