Network Processor In-Line Packet Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network processors face inefficiencies and latency due to the need for repeated communication between processors and encryption/decryption circuits for IPsec operations, which slows down packet transmission and reception.
Innovation Solution
A network services processor with integrated cryptographic engines and network interface controllers enables in-line encryption and decryption of packets, reducing the workload on the processor cores and minimizing communication between components by generating and processing encrypted/decrypted packets within the processor modules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network processors use separate encryption/decryption circuits for IPsec operations, then security functionality is provided, but communication latency increases due to repeated processor-circuit communication
Solution Approach 1:
The patent combines the cryptographic engine directly into the network interface controller, merging previously separate functions (network interface control and cryptographic operations) into a single integrated component. This eliminates the need for repeated communication between separate processor and encryption/decryption circuits, as the cryptographic operations are now performed inline within the network interface controller itself, thereby reducing latency while maintaining security functionality.
2Reliability
If network processors perform packet encryption and decryption operations, then security is achieved, but processor workload increases and efficiency decreases
Solution Approach 1:
The patent extracts the cryptographic processing workload from the main processor cores and relocates it to a dedicated cryptographic engine within the network interface controller. This extraction allows the processor cores to focus on higher-level networking and protocol processing tasks, while the cryptographic engine handles encryption and decryption operations independently, thereby maintaining security while improving overall processor efficiency.
Solution Approach 2:
The network interface controller with integrated cryptographic engine performs encryption and decryption operations autonomously without requiring continuous processor intervention. The cryptographic engine self-manages the cryptographic operations for packets passing through the network interface, reducing the burden on processor cores and improving system-wide productivity.
3Reliability
If network processors communicate repeatedly with encryption/decryption circuits for each packet, then cryptographic operations are performed, but inter-component communication overhead increases
Solution Approach 1:
By merging the cryptographic engine into the network interface controller, the patent eliminates the need for repeated inter-component communication between separate processor and encryption/decryption circuits. The integrated design allows cryptographic operations to be performed inline within the same component that handles network packet I/O, significantly reducing communication overhead and simplifying the system architecture while maintaining cryptographic operation accuracy.
Data Source
AI summary
A network processor provides for in-line encryption and decryption of received and transmitted packets. For packet transmittal, a processor core generates packet data for encryption and forwards an encryption instruction to a cryptographic unit. The cryptographic unit generates an encrypted packet, and enqueues a send descriptor to a network interface controller, which, in turn, constructs and transmits an outgoing packet. For received encrypted packets, the network interface controller communicates with the cryptographic unit to decrypt the packet prior to enqueuing work to the processor core, thereby providing the processor core with a decrypted packet.