Parallelizing Cryptographic Operations for Line-Speed BGPSEC
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current edge router hardware lacks the processing power to handle the cryptographic-intensive computations required by BGPSEC, particularly due to the large size of the BGP Routing Table and the need for real-time line-speed cryptographic operations, which poses a challenge in maintaining network security and stability against cyber threats.
Innovation Solution
A secure signature and verification operations parallelizing manager is implemented, utilizing a rule-based configuration and multiple execution agents with asynchronous worker routines to distribute and prioritize tasks, enabling simultaneous and efficient digital signing and verification of messages using ECDSA and other public key algorithms at network line-speed, even without prior knowledge of request quantities or types.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If cryptographic operations are performed sequentially on existing edge router hardware, then security validation is maintained, but processing speed and throughput are insufficient for line-speed operations
Solution Approach 1:
The patent segments cryptographic operations into independent parallel tasks that can be executed simultaneously by multiple execution agents. Each signing or verification operation is divided into discrete tasks that can be distributed across available processing resources, enabling line-speed cryptographic operations without sacrificing security validation.
Solution Approach 2:
The patent transitions from sequential single-threaded cryptographic processing to multi-dimensional parallel processing by introducing multiple execution agents that operate simultaneously. This dimensional expansion from one-dimensional sequential execution to multi-dimensional concurrent execution enables the system to achieve both high speed and high throughput by utilizing multiple processing cores and threads.
2Productivity
If multiple cryptographic operations are performed in parallel, then processing throughput increases, but system complexity and resource management become more difficult
Solution Approach 1:
The patent introduces a manager component that acts as an intermediary between incoming cryptographic requests and multiple execution agents. This manager receives signing and verification requests, decomposes them into tasks, and distributes them to appropriate execution agents. This intermediary layer abstracts the complexity of parallel task management, allowing the system to achieve high throughput while maintaining manageable system complexity through centralized task coordination.
3Speed
If cryptographic operations are accelerated using hardware resources, then processing speed improves, but power consumption increases
Solution Approach 1:
The patent implements dynamic resource allocation where execution agents are activated and deactivated based on incoming cryptographic workload demands. Rather than maintaining dedicated hardware resources for cryptographic operations at all times, the system dynamically scales its processing capacity to match actual needs, achieving high processing speeds when required while minimizing power consumption during low-utilization periods.
Data Source
AI summary
A networking device continuously and simultaneously receives multiple sign and verify requests, without a priori knowledge of their quantity, type, sequence, length, input data or frequency. The networking device performs the corresponding signature operations and verification operations according to a rule based configuration. Each received sign and verify request is broken into multiple tasks, which are placed into a task pool with priorities, and disassociated from their originating requests and from other tasks. Multiple execution agents (each one a separate general purpose compute unit with its own memory space) repeatedly and simultaneously processes next available tasks from the pool based on priority. Asynchronous worker routines in the agents can pre-calculate certain values for higher level task processing. The output from completed tasks is placed into a repository, and the results in the repository are processed to fulfill the multiple received requests at network line speed.