PCIe Link Encryption via Channel Engine

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current storage encryption solutions using Host Bus Adapter (HBA) hardware leave PCIe links vulnerable to snooping and add cost and complexity, as they rely on vendor-provided encryption functionality.

Innovation Solution

Adapting the Security Key Exchange (SKE) protocol to enable encryption mechanisms on PCIe links without relying on HBA services, allowing for secure data encryption by selecting and directing I/O operations through a channel engine that supports encryption mechanisms like ENCR_AES_GCM, either during login or rekey operations.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If HBA hardware is used to perform storage encryption, then encryption functionality is provided, but PCIe links remain vulnerable to snooping and system complexity increases

Engineering Contradiction:

Improveencryption securityVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The encryption functionality is extracted from the HBA hardware and relocated to the channel engine. The channel engine now performs encryption operations independently, removing the dependency on HBA encryption services and eliminating the vulnerability of PCIe links to snooping while reducing system complexity

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The channel engine acts as an intermediary between the storage system and PCIe links. By implementing encryption within the channel engine, it serves as a security mediator that protects data without requiring external HBA encryption services, thereby securing PCIe communications

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If HBA encryption services are used, then storage encryption is achieved, but additional cost is incurred

Engineering Contradiction:

Improveencryption securityVSAvoidsystem cost

Core Design Contradiction:

ReliabilityVSEase of manufacture

Solution Approach 1:

The channel engine performs encryption operations autonomously without requiring external HBA encryption services. By making the channel engine self-sufficient in handling encryption, the system eliminates additional hardware costs associated with HBA encryption capabilities while maintaining security

Inventive Principle:

Principle #25Self-service

3Adaptability or versatility

If HBA hardware performs encryption, then encryption functionality is available, but PCIe links are exposed to security risks

Engineering Contradiction:

Improveencryption capabilityVSAvoidsnooping vulnerability

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The encryption function is segmented from the HBA hardware and assigned to a separate component - the channel engine. This segmentation allows encryption to be performed at a different architectural level, protecting PCIe links from snooping while preserving encryption versatility

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The encryption operation is moved from the HBA hardware dimension to the channel engine dimension within the storage system architecture. This dimensional shift in where encryption occurs protects the PCIe communication dimension from exposure while maintaining encryption capability

Inventive Principle:

Principle #17Another dimension (Dimensionality change)

Data Source

PatentUS12135831B2Extending encryption to PCIe links

Publication Date: 2024.11.05 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

An approach for extending encryption to input/output (I/O) on Peripheral Component Interconnect express (PCIe) links. The approach receives a proposal list of available encryption mechanisms. The approach selects an encryption mechanism from the proposal list, the encryption mechanism performs the encryption without encryption services from an associated Host Bus Adapter (HBA). The approach directs the I/O to the encryption mechanism.