Inline Crypto Pipeline for Line-Rate Network Packet Protection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing network devices face performance degradation due to excessive reliance on software for cryptographic operations, which consume CPU resources and reduce system efficiency, especially as network speeds increase.

Innovation Solution

Offload cryptographic processing to a block cipher circuit coupled inline within a hardware pipeline, utilizing hardware engines such as ASICs or FPGAs to perform cryptographic operations directly on network packets, reducing software interaction.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If cryptographic operations are performed using software on CPU, then data protection and authentication are achieved, but system performance and efficiency deteriorate due to excessive CPU resource consumption

Engineering Contradiction:

Improvedata protectionVSAvoidsystem performance

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent replaces software-based cryptographic operations with hardware-based cryptographic operations. Specifically, it introduces a hardware pipeline with block cipher circuits that can perform encryption and decryption operations in hardware, substituting the software/CPU-based approach. This hardware implementation maintains data protection functionality while dramatically improving system performance by offloading cryptographic processing from the CPU to dedicated hardware circuits operating at line rate

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The patent introduces a hardware pipeline as an intermediary component between the network interface and the CPU. This hardware pipeline includes block cipher circuits that handle cryptographic operations independently, acting as a mediator that processes encrypted/decrypted data without requiring CPU intervention. The hardware pipeline serves as an intermediate processing layer that protects data while freeing CPU resources for other tasks

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If cryptographic operations are performed using software, then data security is maintained, but network packet processing speed decreases due to software overhead

Engineering Contradiction:

Improvedata securityVSAvoidnetwork packet processing speed

Core Design Contradiction:

ReliabilityVSSpeed

Solution Approach 1:

The patent substitutes software-based cryptographic processing with hardware-based processing. The hardware pipeline includes block cipher circuits that perform encryption and decryption operations directly in hardware, replacing the software execution model. This substitution enables cryptographic operations to be performed at line rate, matching network packet processing speed without the overhead of software interpretation and CPU context switching

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The patent segments the network packet processing function into distinct hardware components. The hardware pipeline is divided into multiple stages, including separate block cipher circuits for encryption and decryption operations. This segmentation allows cryptographic operations to be performed in parallel with other packet processing tasks, improving overall network packet processing speed while maintaining data security through dedicated security processing modules

Inventive Principle:

Principle #1Segmentation

3Reliability

If cryptographic operations are performed repeatedly, then data protection is maintained, but CPU resources are exhausted reducing overall system efficiency

Engineering Contradiction:

Improvedata protectionVSAvoidCPU resource consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent introduces a hardware pipeline as an intermediary that handles all cryptographic operations independently of the CPU. This hardware pipeline includes block cipher circuits that perform encryption and decryption without CPU involvement. By making the CPU unnecessary for cryptographic operations, the system maintains data protection through repeated cryptographic operations while eliminating CPU resource consumption entirely for these tasks

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent enables the cryptographic processing function to serve itself through self-contained hardware circuits. The block cipher circuits in the hardware pipeline are autonomous and do not require CPU intervention or software control for each cryptographic operation. This self-service capability allows repeated cryptographic operations to be performed efficiently without draining CPU resources, as the hardware circuits handle all processing independently

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS20260006010A1Flexible cryptographic architecture in a network device

Publication Date: 2026.01.01 MELLANOX TECHNOLOGIES LTD(IL)

AI summary

A network device includes a hardware pipeline to process a network packet to be encrypted for transmission, the hardware pipeline includes a steering engine to retrieve, from the network packet, information including a packet header, a parsed header structure, or steering metadata associated with processing the network packet. The steering engine generates, based on the information, steering action(s) to be taken using a match-action pipeline of the hardware pipeline. The steering engine generates command(s) based on the steering action(s). A set of hardware engines, of the hardware pipeline, are to be triggered, by the one the command(s), to parse and execute the command(s) to determine a set of inputs and facilitate performance of a cryptographic operation on a payload data of the network packet based on the set of inputs.