NIC QUIC Encryption Offload Without Exposing VM Keys

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In cloud server environments, transferring encryption keys to the cloud service provider for hardware offloading compromises data privacy, as the cloud provider gains access to unencrypted data, leading to slow encryption processes in software within virtual machines.

Innovation Solution

Implementing a system where encryption and decryption are performed in hardware by the network interface controller (NIC) while maintaining encryption keys within the virtual machine, ensuring data remains encrypted throughout transmission by using enhanced memory controllers and secure PCIe links, isolating data paths from external access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If encryption keys are transferred to the cloud service provider for hardware offloading, then encryption speed is improved, but data privacy is compromised

Engineering Contradiction:

Improveencryption speedVSAvoiddata privacy compromise

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces a trusted execution environment (TEE) as an intermediary layer between the VM and the NIC. The TEE securely stores encryption keys and performs encryption operations without exposing keys to the cloud service provider or the VM. This mediator enables hardware offloading for high-speed encryption while maintaining key secrecy through isolated secure memory regions and protected communication channels.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Object-affected harmful factors

If encryption is performed in software within the virtual machine, then data privacy is maintained, but encryption process speed deteriorates

Engineering Contradiction:

Improvedata privacyVSAvoidencryption process speed

Core Design Contradiction:

Object-affected harmful factorsVSProductivity

Solution Approach 1:

The patent replaces software-based encryption with hardware-based encryption performed by the NIC. The VM communicates encryption requirements to the NIC through a driver interface, and the NIC's hardware encryption engine processes the data using keys stored in its TEE. This substitution transfers the encryption workload from the CPU to dedicated hardware, achieving high-speed encryption while maintaining privacy through the NIC's secure key management.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS20260074887A1Computer and Network Interface Controller Securely Offloading Encryption Keys and QUIC Encryption Processing to the Network Interface Controller

Publication Date: 2026.03.12 DREAMBIG SEMICON INC

AI summary

Encryption operations are securely offloaded to a network interface controller (NIC). Encryption keys are securely transferred from a virtual machine (VM) to the NIC and data is securely transferred from encrypted VM memory to secure buffers in the NIC. The NIC handles the encryption and decryption operations in hardware, greatly increasing encryption performance while not reducing security. This is especially useful in cloud server environments, so the cloud service provider does not have access to the encryption keys or the unencrypted data. The offloaded operations are performed with numerous different communication protocols, including RDMA, QUIC, IPsec underlay and WireGuard.