NIC Offloading Inline SSL Processing to Reduce CPU Load
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing SSL solutions consume significant CPU processing power on servers due to software-based security operations, and existing hardware offloading mechanisms only address cryptography operations, requiring multiple trips across the PCI bus, which does not fully utilize CPU savings.
Innovation Solution
Offloading all aspects of inline SSL processing to a Network Interface Card (NIC) acting as a hardware accelerator, which processes SSL operations as packets are transferred between the host and client, avoiding multiple PCI bus traversals and enabling TCP/IP connection termination on the hardware accelerator.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL operations are performed in software on the server, then security operations can be completed, but CPU processing power is consumed tremendously
Solution Approach 1:
The patent replaces software-based SSL processing with hardware-based SSL processing using a Network Interface Card (NIC) that performs SSL operations in hardware. This substitution moves SSL processing from the CPU (software/mechanical system) to the NIC (hardware system), thereby reducing CPU processing power consumption while maintaining security operations.
2Use of energy by moving object
If cryptography operations are offloaded to an external hardware accelerator, then CPU savings can be achieved, but multiple trips between user space and accelerator across PCI bus are required
Solution Approach 1:
The patent merges SSL processing functionality directly into the NIC, combining what were previously separate components (cryptography accelerator and network interface) into a single integrated device. This eliminates the need for multiple PCI bus traversals between separate user space software and external hardware accelerator, as SSL processing now occurs inline within the NIC itself.
3Use of energy by moving object
If SSL processing is offloaded to external hardware, then CPU load is reduced, but device complexity increases due to multiple components
Solution Approach 1:
The patent makes the NIC a multi-functional device that handles both standard network I/O operations and SSL processing operations. By giving the NIC universal functionality to handle multiple types of traffic (encrypted and non-encrypted) through a single interface, the system reduces overall device complexity compared to having separate dedicated hardware accelerators for cryptography and separate network interfaces.
Data Source
AI summary
A new approach is proposed that contemplates systems and methods to support a mechanism to offload all aspects of inline SSL processing of an application running on a server/host to an embedded networking device such as a Network Interface Card (NIC), which serves as a hardware accelerator for all applications running on the server that need to have a secure connection with a remote client device over a network. By utilizing a plurality of its software and hardware features, the embedded networking device is configured to process all SSL operations of the secure connection inline, i.e., the SSL operations are performed as packets are transferred between the host and the client over the network, rather than having the SSL operations offloaded to the NIC, which then returns the packets to the host (or the remote client device) before they can be transmitted to the remote client device (or to the host).