Smart NIC Key Offload for Secure RDMA Encryption

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In cloud computing environments, the challenge lies in performing high-speed encryption while maintaining control of encryption keys with the user and ensuring data privacy, as transferring keys to the cloud service provider compromises secrecy.

Innovation Solution

Offloading encryption tasks to a smart network interface controller (NIC) while keeping encryption keys secure within the user's virtual machine, using a crypto engine and secure memory pathways to ensure data remains encrypted throughout transmission.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If encryption keys are transferred to the cloud service provider for hardware offloading, then encryption speed is improved, but data privacy and secrecy are compromised

Engineering Contradiction:

Improveencryption speedVSAvoiddata privacy

Core Design Contradiction:

ProductivityVSLoss of information

Solution Approach 1:

The system segments the encryption architecture into distinct components: a crypto engine within the NIC for hardware acceleration, secure memory regions isolated from the cloud provider, and a key management system that separates key storage from processing. This segmentation allows the cloud provider to benefit from hardware offloading while the user maintains exclusive control of encryption keys in isolated memory spaces.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces an intermediary key management system and secure memory interface that acts as a mediator between the user's virtual machine and the cloud service provider's infrastructure. This intermediary layer enables the NIC to perform hardware encryption while preventing the cloud provider from accessing encryption keys, thus resolving the contradiction between speed improvement and privacy protection.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Loss of information

If encryption is performed in software within the virtual machine, then data privacy is maintained, but encryption performance is slow

Engineering Contradiction:

Improvedata privacyVSAvoidencryption performance

Core Design Contradiction:

Loss of informationVSProductivity

Solution Approach 1:

The patent replaces software-based encryption mechanisms with hardware-based encryption in the NIC's crypto engine. This substitution maintains data privacy by keeping keys in secure memory while achieving significant performance improvement through dedicated hardware acceleration, eliminating the slow software processing bottleneck.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Ease of operation

If encryption keys are kept in the virtual machine, then user control is maintained, but hardware offloading cannot occur

Engineering Contradiction:

Improveuser controlVSAvoidhardware offloading capability

Core Design Contradiction:

Ease of operationVSProductivity

Solution Approach 1:

The patent adds a new dimension to key management by implementing secure memory regions with isolated access paths. Encryption keys remain in the virtual machine's address space but are placed in protected memory regions that can be accessed by the NIC's crypto engine through controlled interfaces. This dimensional separation allows both user control and hardware offloading to coexist.

Inventive Principle:

Principle #17Another dimension (Dimensionality change)

Data Source

PatentUS12483389B2Computer and network interface controller securely offloading encryption keys and RDMA encryption processing to the network interface controller

Publication Date: 2025.11.25 DREAMBIG SEMICON INC

AI summary

Encryption operations are securely offloaded to a network interface controller (NIC). Encryption keys are securely transferred from a virtual machine (VM) to the NIC and data is securely transferred from encrypted VM memory to secure buffers in the NIC. The NIC handles the encryption and decryption operations in hardware, greatly increasing encryption performance while not reducing security. This is especially useful in cloud server environments, so the cloud service provider does not have access to the encryption keys or the unencrypted data. The offloaded operations are performed with numerous different communication protocols, including RDMA, QUIC, IPsec underlay and WireGuard.