Network Adapter Offloads RDMA Encryption from Host CPU
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud computing environments, the management and virtualization layers face resource constraints and security risks due to the need to store and manage private session keys for data encryption, which can lead to inefficient use of processor and memory resources and potential unauthorized access.
Innovation Solution
Storing private session keys on network communication devices like network adapters or switches, allowing these devices to perform encryption and decryption via Remote Direct Memory Access (RDMA) over a secured communication tunnel, thereby freeing up host system resources and reducing the risk of key exposure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If private session keys are stored and managed by the management and virtualization layers, then data encryption can be performed, but processor and memory resources are inefficiently used and security risks increase
Solution Approach 1:
The patent extracts the private session key storage and encryption function from the management and virtualization layers and relocates it to network communication devices (network adapters or switches). This extraction eliminates the resource waste and security risks associated with storing keys in the host system while maintaining the encryption capability.
Solution Approach 2:
The patent introduces network communication devices as intermediary components that handle encryption and decryption operations. These devices act as mediators between the data processing system and the network, performing cryptographic operations without requiring host system resources or exposing keys to unauthorized access.
2Ease of operation
If private session keys are stored in the management and virtualization layers, then encryption functionality is available, but the risk of unauthorized access increases
Solution Approach 1:
The patent removes the vulnerable storage location of private session keys from the host system's management and virtualization layers and places it in dedicated network communication devices. This extraction isolates the keys from potential unauthorized access vectors in the host system while preserving encryption functionality.
Solution Approach 2:
The network communication devices autonomously manage their own private session keys and perform encryption/decryption operations independently. This self-service capability eliminates the need for host system involvement in key management, reducing the attack surface for unauthorized access while maintaining operational functionality.
3Reliability
If encryption operations are performed by the host data processing system, then data security is maintained, but processor and memory resources are consumed
Solution Approach 1:
The patent extracts encryption and decryption operations from the host data processing system and relocates them to network communication devices. This extraction eliminates the resource consumption on host processors and memory while maintaining data security through dedicated cryptographic hardware in the network devices.
Solution Approach 2:
The patent replaces the software-based encryption implementation running on host processors with hardware-based encryption capabilities in network communication devices. This substitution moves computational work from general-purpose CPU cycles to dedicated cryptographic hardware, eliminating host resource consumption while preserving security functionality.
Data Source
AI summary
A network communication device can receive a private session key from a data processing system. A first work queue element can be received in a send queue of the network communication device. The first work queue element can indicate outbound session data to be communicated to a client device. Responsive to receiving the first work queue element, the network communication device can generate encrypted outbound session data by encrypting the outbound session data using the private session key. The network communication device can communicate, via remote directory memory access (RDMA) over a secured communication tunnel, the encrypted outbound session data to the client device.