NIC Encryption Offload While Keeping RDMA Keys Inside the VM

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In cloud server environments, transferring encryption keys to the cloud service provider for hardware offloading compromises data privacy, as the cloud provider gains access to unencrypted data, leading to slow encryption processes in software within the virtual machine to maintain security.

Innovation Solution

Offload encryption tasks to a network interface controller (NIC) while maintaining encryption keys within the virtual machine, using a secure architecture that encrypts data transfers between the VM memory and the NIC, ensuring the cloud service provider cannot access the encryption keys.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If encryption keys are transferred to the cloud service provider for hardware offloading, then encryption speed is improved, but data privacy is compromised

Engineering Contradiction:

Improveencryption speedVSAvoiddata privacy compromise

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The system segments the encryption architecture into distinct components: the virtual machine maintains encryption keys in isolated memory, while the NIC performs hardware encryption operations. This segmentation allows the keys to remain segregated from the cloud provider's access while enabling hardware-accelerated encryption through the NIC's dedicated encryption engine.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The NIC acts as an intermediary between the virtual machine and the network. It receives encrypted data from the VM, performs hardware encryption/decryption operations using keys that never leave the VM's memory space, and transmits the processed data. This intermediary role enables fast hardware encryption while maintaining key secrecy within the VM.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Object-affected harmful factors

If encryption keys are maintained in the virtual machine, then data privacy is preserved, but encryption processing speed deteriorates

Engineering Contradiction:

Improvedata privacyVSAvoidencryption processing speed

Core Design Contradiction:

Object-affected harmful factorsVSProductivity

Solution Approach 1:

The NIC serves as a hardware intermediary that performs encryption operations without requiring the encryption keys to leave the virtual machine's memory space. The NIC's encryption engine can process data using keys stored in the VM while providing hardware-accelerated performance, thus maintaining both privacy and speed.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system replaces software-based encryption processing in the virtual machine with hardware-based encryption in the NIC. This substitution provides significant performance improvement while maintaining the same security model where keys remain within the VM's memory space and are never exposed to the cloud provider.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Object-affected harmful factors

If encryption is performed in software within the virtual machine, then data secrecy is maintained, but processing speed becomes slow

Engineering Contradiction:

Improvedata secrecyVSAvoidencryption processing speed

Core Design Contradiction:

Object-affected harmful factorsVSSpeed

Solution Approach 1:

The invention replaces software-based encryption processing with hardware-based encryption in the NIC. The NIC contains dedicated encryption engines that perform cryptographic operations at hardware speeds while the virtual machine maintains control over the encryption keys, achieving both high speed and data secrecy.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The NIC acts as a hardware intermediary that handles the computationally intensive encryption operations. It receives data from the VM, performs fast hardware encryption/decryption, and returns the processed data, thereby offloading the processing burden from the VM's software while maintaining security through key isolation.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS20260074886A1Computer and Network Interface Controller Securely Offloading Encryption Keys and RDMA Encryption Processing to the Network Interface Controller

Publication Date: 2026.03.12 DREAMBIG SEMICON INC

AI summary

Encryption operations are securely offloaded to a network interface controller (NIC). Encryption keys are securely transferred from a virtual machine (VM) to the NIC and data is securely transferred from encrypted VM memory to secure buffers in the NIC. The NIC handles the encryption and decryption operations in hardware, greatly increasing encryption performance while not reducing security. This is especially useful in cloud server environments, so the cloud service provider does not have access to the encryption keys or the unencrypted data. The offloaded operations are performed with numerous different communication protocols, including RDMA, QUIC, IPsec underlay and WireGuard.