NIC TLS Offload With Reliable Transport State Sharing

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In data centers with high packet traffic, CPU resources are often used for network-related computations such as packet processing, encryption/decryption, and network policy enforcement, leaving less capacity for other workloads, and existing solutions for offloading data encryption introduce unacceptable tail latencies due to communication overhead between network interface devices and the host system's protocol stack.

Innovation Solution

Offload TLS encryption and decryption to a network interface device, which updates the host system's operating system with state information for reliable transport management, reducing CPU utilization and minimizing latency by performing these tasks directly on the network interface device.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If CPU resources are used to perform packet processing, encryption/decryption, and network policy enforcement, then network-related computations can be completed, but CPU resources available for other workloads are reduced

Engineering Contradiction:

Improvenetwork-related computation capacityVSAvoidCPU resource availability for other workloads

Core Design Contradiction:

ProductivityVSAdaptability or versatility

Solution Approach 1:

The patent extracts network-related computation tasks (packet processing, encryption/decryption, network policy enforcement) from the CPU and relocates them to a dedicated network interface device. This separation allows the CPU to focus on application workloads while the network interface device handles network functions, resolving the contradiction between network computation capacity and CPU availability for other tasks.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The network interface device serves as an intermediary between the network and the CPU. It receives network packets, performs necessary processing and encryption/decryption operations, and then communicates with the CPU only when needed for state information updates. This intermediary role enables network functions to be performed independently of CPU resources.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Productivity

If existing solutions offload data encryption to network interface devices, then CPU utilization is reduced, but unacceptable tail latencies are introduced due to communication overhead between network interface devices and host system protocol stack

Engineering Contradiction:

ImproveCPU utilizationVSAvoidtail latency

Core Design Contradiction:

ProductivityVSLoss of time

Solution Approach 1:

The network interface device performs encryption and decryption operations locally on incoming packets before they reach the host system protocol stack. By completing these time-consuming cryptographic operations in advance at the network interface device, the patent eliminates the need for subsequent CPU intervention in these operations, thereby reducing tail latency while maintaining CPU utilization benefits.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The network interface device is designed to perform network functions autonomously, including packet processing, encryption/decryption, and policy enforcement, without requiring continuous CPU involvement. It maintains its own state information and can independently manage network tasks, significantly reducing the communication overhead and latency associated with CPU-offloaded encryption solutions.

Inventive Principle:

Principle #25Self-service

3Reliability

If network interface devices communicate with host system protocol stack for reliable transport management, then state information can be updated, but communication overhead increases latency

Engineering Contradiction:

Improvestate information synchronizationVSAvoidcommunication overhead

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

Instead of continuously synchronizing all state information between the network interface device and host system, the patent implements selective updates where the network interface device maintains its own state locally and only communicates necessary state information to the host system when changes occur. This partial synchronization approach maintains reliability while significantly reducing communication overhead and associated latency.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS12483516B2Transport and cryptography offload to a network interface device

Publication Date: 2025.11.25 INTEL CORP

AI summary

Examples described herein relate to a network interface device that includes circuitry, configured to perform encryption of data, generate one or more packets from the encrypted data, cause transmission of the one or more packets with the encrypted data, manage reliability of transport of the transmitted one or more packets with the encrypted data, and share protocol state information between a host system and the network interface device using connectivity based on user space accessible queues.