Network Interface Controller Encryption Offload with VM-Resident Keys

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In cloud computing environments, transferring encryption keys to the cloud service provider for hardware offloading compromises data privacy, as the cloud service provider gains access to unencrypted data, leading to slow encryption processes in software.

Innovation Solution

Implementing a system where encryption and decryption are performed in hardware by a network interface controller (NIC) while maintaining encryption keys within the virtual machine, ensuring data remains encrypted throughout transmission by using enhanced memory controllers and secure memory paths.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If encryption keys are transferred to the cloud service provider for hardware offloading, then encryption speed is improved, but data privacy is compromised

Engineering Contradiction:

Improveencryption speedVSAvoiddata privacy compromise

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The system segments the encryption architecture into distinct components: the virtual machine maintains encryption keys in isolated memory, while the NIC performs hardware acceleration. This segmentation allows the cloud service provider to benefit from hardware offloading without accessing the encryption keys, thus resolving the contradiction between speed improvement and privacy protection.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces an intermediary mechanism where the NIC acts as a mediator between the virtual machine and the network. The NIC performs encryption operations using keys that remain resident in the virtual machine's memory, allowing hardware acceleration without key exposure to the cloud service provider.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Object-affected harmful factors

If encryption is performed in software within the virtual machine, then data privacy is maintained, but encryption speed deteriorates

Engineering Contradiction:

Improvedata privacyVSAvoidencryption speed

Core Design Contradiction:

Object-affected harmful factorsVSProductivity

Solution Approach 1:

The patent replaces the mechanical software-based encryption system with a hardware-based encryption system in the NIC. This substitution maintains data privacy by keeping keys in the virtual machine while achieving high-speed encryption through hardware acceleration, thus resolving the speed-privacy contradiction.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Loss of information

If encryption keys are maintained in the virtual machine, then data secrecy is preserved, but hardware offloading cannot occur

Engineering Contradiction:

Improvedata secrecyVSAvoidencryption capability

Core Design Contradiction:

Loss of informationVSProductivity

Solution Approach 1:

The patent adds a new dimension to the encryption architecture by introducing dedicated encryption hardware in the NIC. This dimensional addition allows the system to simultaneously maintain keys in the virtual machine (preserving secrecy) and perform hardware acceleration (improving capability), resolving the contradiction between secrecy and performance.

Inventive Principle:

Principle #17Another dimension (Dimensionality change)

Data Source

PatentUS20250310083A1Computer and Network Interface Controller Securely Offloading Encryption Keys and Underlay IPsec Encryption Processing to the Network Interface Controller

Publication Date: 2025.10.02 DREAMBIG SEMICON INC

AI summary

Encryption operations are securely offloaded to a network interface controller (NIC). Encryption keys are securely transferred from a virtual machine (VM) to the NIC and data is securely transferred from encrypted VM memory to secure buffers in the NIC. The NIC handles the encryption and decryption operations in hardware, greatly increasing encryption performance while not reducing security. This is especially useful in cloud server environments, so the cloud service provider does not have access to the encryption keys or the unencrypted data. The offloaded operations are performed with numerous different communication protocols, including RDMA, QUIC, IPsec underlay and WireGuard.