Inline NVMe Encryption Using PCIe Header LBA Indexing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Non-Volatile Memory express (NVMe) devices face challenges in inline encryption due to the lack of metadata for encrypting/decrypting packets, as the host does not receive Logical Block Addresses (LBAs) in the direct memory access (DMA) path, and existing solutions using SRAM are not scalable.
Innovation Solution
Implementing a memory-assisted encryption/decryption system within the System on Chip (SOC) that uses a PCIe header to send an index for lookup tables, allowing the crypto controller to determine LBAs and perform encryption/decryption at inline DMA speed without relying on SRAM.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If SRAM is used to store metadata for encryption, then encryption can be performed at inline DMA speed, but the solution is not scalable and has high implementation costs
Solution Approach 1:
The patent creates an index copy of the LBA mapping relationship stored in DRAM, placing only the necessary index information in the PCIe header rather than storing complete metadata. This allows the system to scale without requiring proportional increases in SRAM capacity while maintaining inline encryption speed.
Solution Approach 2:
The patent extracts only the essential metadata (LBA index) from the complete encryption information and places it in the PCIe header, separating the critical path data from the full metadata set. This extraction enables scalable implementation by minimizing the data that must be rapidly accessed during inline encryption operations.
2Speed
If SRAM is used to store metadata for encryption, then encryption can be performed at inline DMA speed, but implementation costs increase
Solution Approach 1:
The patent uses inexpensive PCIe header structures to carry encryption metadata instead of expensive SRAM resources. The PCIe header is a transient, reusable structure that costs significantly less to implement than dedicated SRAM memory, making inline encryption cost-effective while maintaining performance.
Solution Approach 2:
The patent repurposes the PCIe header, which is already part of the NVMe interface infrastructure, to carry encryption metadata. This multi-functional use of existing infrastructure eliminates the need for separate expensive metadata storage resources while maintaining inline encryption capability.
3Productivity
If the host does not receive LBAs in the DMA path, then NVMe protocol efficiency is maintained, but metadata for encryption is unavailable
Solution Approach 1:
The patent prepares the LBA index information in advance by storing it in the PCIe header before the DMA transfer occurs. This preliminary action ensures that the crypto controller has the necessary metadata available when needed for encryption, without requiring changes to the NVMe protocol or interrupting the efficient DMA data path.
Solution Approach 2:
The patent introduces the PCIe header as an intermediary carrier that bridges the gap between the NVMe protocol efficiency requirements and the encryption metadata needs. The header acts as a mediator that delivers necessary information without disrupting the high-speed DMA data path or requiring protocol changes.
Data Source
AI summary
Techniques for memory assisted inline encryption/decryption are described. An example includes an encryption data structure engine to provide a key, data, and a tweak to the encryption/decryption engine, wherein the encryption data structure engine is to: read an index value from an encryption data structure lookup data structure entry using an address, the entry to include the index value and a guest page physical address (GPPA), retrieve, based on the index value, an entry from the encryption data structure, the entry to include a logical block address (LBA) base, a key identifier, and at least one GPPA in a sequence of GPPAs, generate a LBA using a position of the GPPA from the encryption data structure lookup data structure entry in the sequence of GPPAs, and retrieve a key based on the key identifier, wherein the encryption engine to encrypt data using the retrieved key, and the generated LBA.