Network Adapter Offloads Session Key Encryption from Hypervisor
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud computing environments, the management and virtualization functional abstraction layers face resource constraints and security risks due to the need to generate and store private session keys for data encryption, which can be exploited by unauthorized access.
Innovation Solution
Generating a private session key in user space and storing it on a network communication device, such as a network adapter or switch, to perform encryption and decryption operations, thereby offloading these tasks from the host hypervisor stack and virtual machine operating system, reducing resource usage and mitigating security risks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If private session keys are generated and stored in the host hypervisor stack or virtual machine operating system for data encryption, then security is provided, but resource constraints and security risks increase due to unauthorized access potential
Solution Approach 1:
The patent extracts the private session key storage and encryption operations from the host hypervisor stack and virtual machine operating system, placing them instead in the network communication device (network adapter). This extraction eliminates the security risk of key exposure in the hypervisor/OS layers while reducing the resource burden on these critical system components.
Solution Approach 2:
The network adapter serves as an intermediary component between the virtual machine and the external network. It handles the cryptographic operations using stored private session keys, acting as a mediator that protects both the VM resources and the security keys from direct exposure to potential attack vectors in the hypervisor or external networks.
2Reliability
If private session keys are stored in the host hypervisor stack or virtual machine operating system, then encryption functionality is provided, but the risk of unauthorized access increases
Solution Approach 1:
The private session keys are extracted from the hypervisor/OS storage locations and placed in the network adapter's secure memory. This extraction reduces the attack surface for unauthorized access while the network adapter maintains the keys in a protected environment, balancing security enhancement with operational simplicity.
3Reliability
If encryption and decryption operations are performed by the host hypervisor stack or virtual machine operating system, then data security is ensured, but processor and memory resources are consumed
Solution Approach 1:
The encryption and decryption operations are extracted from the host hypervisor stack and virtual machine operating system and transferred to the network adapter. This extraction offloads computationally intensive cryptographic processing from the main system resources, improving overall productivity while maintaining data security through the network adapter's dedicated encryption capabilities.
Solution Approach 2:
The network adapter performs self-service by autonomously handling encryption and decryption of network traffic using private session keys stored in its own memory. This self-service capability eliminates the need for the hypervisor or OS to consume processor and memory resources for these operations, thereby improving system-wide resource efficiency.
Data Source
AI summary
A secure communication tunnel between user space software and a client device can be established. A private session key can be communicated from the user space software to a network communication device in at least one User Datagram Protocol datagram. Outbound session backets can be communicated from the user space software to the network communication device. The network communication device can generate encrypted outbound session packets by encrypting the outbound session packets using the private session key; communicate, to the client device via the secured communication tunnel, the encrypted outbound session packets; receive, by the network communication device from the client device, via the secured communication tunnel, inbound session packets; generate, by the network communication device, decrypted inbound session packets by decrypting the inbound session packets using the private session key; and communicate, from the network communication device to the user space software, the decrypted inbound session packets.