NIC QUIC Encryption Offload With VM Key Isolation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In cloud computing environments, transferring encryption keys to a cloud service provider for hardware offloading compromises data privacy, as the provider gains access to unencrypted data, leading to slow encryption processes in software within virtual machines.

Innovation Solution

Implementing a system where encryption and decryption are performed in hardware by a network interface controller (NIC) while maintaining encryption keys within the virtual machine, ensuring data remains encrypted throughout transmission by using enhanced memory controllers and secure communication protocols.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If encryption keys are transferred to the cloud service provider for hardware offloading, then encryption speed is improved, but data privacy is compromised

Engineering Contradiction:

Improveencryption speedVSAvoiddata privacy compromise

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces a trusted execution environment (TEE) as an intermediary between the virtual machine and the cloud service provider's hardware. The TEE creates a secure enclave that allows hardware offloading of encryption operations while maintaining key confidentiality. The encryption keys never leave the TEE-bound NIC, yet the hardware acceleration benefits are utilized through controlled interfaces between the TEE and the external hardware components.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Object-affected harmful factors

If encryption is performed in software within the virtual machine, then data privacy is maintained, but encryption process becomes slow

Engineering Contradiction:

Improvedata privacy protectionVSAvoidencryption processing speed

Core Design Contradiction:

Object-affected harmful factorsVSProductivity

Solution Approach 1:

The patent replaces software-based encryption with hardware-based encryption through a specialized NIC containing encryption engines. This substitution moves the encryption function from the software domain (CPU processing) to the hardware domain (dedicated cryptographic accelerators in the NIC), providing both speed improvement and security through hardware-enforced key protection mechanisms.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Ease of operation

If encryption keys are maintained in the virtual machine, then key control is preserved, but hardware offloading cannot occur

Engineering Contradiction:

Improvekey controlVSAvoidhardware offloading capability

Core Design Contradiction:

Ease of operationVSProductivity

Solution Approach 1:

The patent segments the system into distinct security domains: the virtual machine maintains key control through the TEE interface, while the bound NIC handles hardware encryption operations. The TEE creates a segmented boundary that allows the VM to manage keys logically while the physical hardware operates in a separate, secure domain that cannot be accessed by the cloud provider without TEE authorization.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS12483390B2Computer and network interface controller securely offloading encryption keys and QUIC encryption processing to the network interface controller

Publication Date: 2025.11.25 DREAMBIG SEMICON INC

AI summary

Encryption operations are securely offloaded to a network interface controller (NIC). Encryption keys are securely transferred from a virtual machine (VM) to the NIC and data is securely transferred from encrypted VM memory to secure buffers in the NIC. The NIC handles the encryption and decryption operations in hardware, greatly increasing encryption performance while not reducing security. This is especially useful in cloud server environments, so the cloud service provider does not have access to the encryption keys or the unencrypted data. The offloaded operations are performed with numerous different communication protocols, including RDMA, QUIC, IPsec underlay and WireGuard.