NIC WireGuard Offload Without Exposing VM Encryption Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud server environments, transferring encryption keys to the cloud service provider for hardware offloading compromises data privacy, and performing encryption in software is slow.
Innovation Solution
Offload encryption tasks to a network interface controller (NIC) while maintaining encryption keys in the virtual machine, using a secure architecture that encrypts data transfers within the VM memory to the NIC using identity-based derived keys, ensuring data remains encrypted throughout the process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If encryption keys are transferred to the cloud service provider for hardware offloading, then encryption speed is improved, but data privacy is compromised
Solution Approach 1:
The patent introduces a trusted execution environment (TEE) as an intermediary between the VM and the NIC. The TEE securely stores encryption keys and performs encryption operations without exposing keys to the cloud service provider or NIC firmware. This mediator enables hardware-accelerated encryption while maintaining key secrecy through isolated secure memory regions and protected communication channels.
2Object-affected harmful factors
If encryption is performed in software within the virtual machine, then data privacy is maintained, but encryption speed deteriorates
Solution Approach 1:
The patent replaces software-based encryption with hardware-based encryption performed by the NIC. The NIC contains dedicated encryption engines that perform cryptographic operations in hardware, providing acceleration while the TEE ensures keys remain protected. This substitution moves encryption from the software domain to the hardware domain without compromising security.
3Loss of information
If encryption keys are kept in the virtual machine, then key secrecy is maintained, but hardware offloading cannot occur
Solution Approach 1:
The patent segments the system into distinct security domains: the VM maintains key secrecy, the TEE provides secure key storage and management, and the NIC performs encryption operations. This segmentation allows each component to operate in its optimal security zone while enabling hardware offloading through the TEE-NIC interface that doesn't require key exposure.
4Object-affected harmful factors
If a secure architecture is implemented to maintain keys in the VM during hardware offloading, then data privacy is preserved, but system complexity increases
Solution Approach 1:
The TEE operates autonomously to manage encryption keys and secure communication between the VM and NIC. It automatically handles key generation, storage, and distribution without requiring complex external key management infrastructure. This self-service capability reduces overall system complexity despite the added security layer.
Data Source
AI summary
Encryption operations are securely offloaded to a network interface controller (NIC). Encryption keys are securely transferred from a virtual machine (VM) to the NIC and data is securely transferred from encrypted VM memory to secure buffers in the NIC. The NIC handles the encryption and decryption operations in hardware, greatly increasing encryption performance while not reducing security. This is especially useful in cloud server environments, so the cloud service provider does not have access to the encryption keys or the unencrypted data. The offloaded operations are performed with numerous different communication protocols, including RDMA, QUIC, IPsec underlay and WireGuard.