NIC Encryption Offload Using VM-Derived Keys for Cloud Privacy

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In cloud computing environments, transferring encryption keys to a cloud service provider for hardware offloading compromises data privacy, as the provider gains access to unencrypted data, leading to slow encryption processes in software within virtual machines.

Innovation Solution

Implementing a system where encryption and decryption are performed in hardware by a network interface controller (NIC) while maintaining encryption keys within the virtual machine, ensuring data remains encrypted throughout transmission by using enhanced memory controllers and secure communication protocols.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If encryption keys are transferred to the cloud service provider for hardware offloading, then encryption speed is improved, but data privacy is compromised

Engineering Contradiction:

Improveencryption speedVSAvoiddata privacy compromise

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces a trusted execution environment (TEE) as an intermediary layer between the virtual machine and the cloud service provider's hardware. This TEE acts as a secure mediator that enables hardware-accelerated encryption while keeping the actual encryption keys isolated and inaccessible to the cloud provider, thus resolving the contradiction between speed improvement and privacy protection

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system segments the encryption process into multiple components: key generation and management within the TEE, hardware acceleration through dedicated encryption engines, and data processing in the virtual machine. This segmentation allows each component to operate in its optimal security and performance zone without compromising overall system privacy or speed

Inventive Principle:

Principle #1Segmentation

2Object-affected harmful factors

If encryption is performed in software within the virtual machine, then data privacy is maintained, but encryption speed deteriorates

Engineering Contradiction:

Improvedata privacyVSAvoidencryption speed

Core Design Contradiction:

Object-affected harmful factorsVSProductivity

Solution Approach 1:

The patent replaces the software-based encryption mechanism with a hardware-based encryption engine that operates within a trusted execution environment. This substitution maintains data privacy through hardware-level security protections while achieving significant speed improvements through dedicated cryptographic processing units and parallel processing capabilities

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS20260074885A1Computer and Network Interface Controller Offloading Encryption Processing to the Network Interface Controller and Using Derived Encryption Keys

Publication Date: 2026.03.12 DREAMBIG SEMICON INC

AI summary

Encryption operations are securely offloaded to a network interface controller (NIC). Encryption keys are securely transferred from a virtual machine (VM) to the NIC and data is securely transferred from encrypted VM memory to secure buffers in the NIC. The NIC handles the encryption and decryption operations in hardware, greatly increasing encryption performance while not reducing security. This is especially useful in cloud server environments, so the cloud service provider does not have access to the encryption keys or the unencrypted data. The offloaded operations are performed with numerous different communication protocols, including RDMA, QUIC, IPsec underlay and WireGuard.