Inline Cryptographic Engine for Direct Accelerator Storage Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In computing systems with host processors and accelerators, the overhead and latency of storage access are increased due to the need for CPU involvement in decrypting and decompressing encrypted and compressed data, especially for large files, and existing technologies struggle to enable direct storage access between accelerators and storage.
Innovation Solution
Implementing an inline cryptographic and/or compression circuit on the path between storage and accelerator, allowing encryption/decryption and/or compression/decompression to be performed directly without intermediate memory hops, and using user-level instruction set architecture instructions to configure policies and algorithms for authorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If CPU is involved in decrypting and decompressing data before accelerator access, then data security and integrity are maintained, but latency and processing overhead increase
Solution Approach 1:
The patent introduces an inline encryption engine as an intermediary component positioned between the storage device and the accelerator. This engine handles decryption and decompression operations directly at the storage interface, eliminating the need for CPU involvement in these operations while maintaining security. The intermediary engine processes data before it reaches the accelerator, resolving the contradiction by providing secure data access without CPU latency.
Solution Approach 2:
The patent extracts the decryption and decompression functions from the CPU and relocates them to a dedicated inline encryption engine at the storage interface. This extraction allows the CPU to focus on higher-level processing while the specialized engine handles the time-consuming cryptographic operations, thereby reducing overall system latency while maintaining data security through dedicated hardware processing.
2Ease of operation
If CPU reads storage content and brings it into memory before accelerator access, then data can be processed, but additional overhead and complexity are introduced
Solution Approach 1:
The patent extracts the data processing functions (decryption and decompression) from the CPU-based software layer and implements them in a dedicated inline encryption engine at the storage interface. This extraction eliminates the need for CPU to read data into memory before processing, thereby reducing processing overhead and system complexity while maintaining the ability to process encrypted and compressed data efficiently.
3Loss of time
If direct storage access between accelerator and storage is enabled, then latency is reduced, but security control and authorization become more difficult to implement
Solution Approach 1:
The patent positions an inline encryption engine as an intermediary between the storage device and the accelerator, enabling direct storage access while maintaining security control. This intermediary engine implements access control mechanisms by validating authorization requests and managing encryption keys, allowing the accelerator to access storage directly without compromising security through CPU-mediated processing.
Data Source
Figure 1~2
Figure 3
Figure 4A~4B
AI summary
In one embodiment, an apparatus includes: an access control circuit to receive a memory transaction directed to a storage, the memory transaction having a requester ID and a key ID; a first memory to store an access control table, the access control table having a plurality of entries each to store a requester ID and at least one key ID; and a cryptographic circuit coupled to the access control circuit, the cryptographic circuit to perform a cryptographic operation on data associated with the memory transaction based at least in part on the key ID. The apparatus may be implemented as an inline engine coupled between the storage and an accelerator, the inline engine to provide decrypted data to the accelerator, the storage to store encrypted data. Other embodiments are described and claimed.