SmartNIC Key Isolation for End-to-End Virtual Cloud Encryption

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing virtual cloud network (VCN) encryption systems rely on host-managed encryption, which can compromise customer data security due to potential breaches or excessive access by the host.

Innovation Solution

Implementing customer-managed encryption keys using SmartNICs with Network Encryption Virtual Functions (NEVFs) and a key management service to securely manage and distribute encryption keys, ensuring the host does not have access to the encryption keys.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If host-managed encryption is used, then the encryption system is simpler to implement, but data security is compromised due to potential host breaches or excessive access

Engineering Contradiction:

Improvedata securityVSAvoidencryption system complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The encryption system is segmented into customer-managed key components and host-managed components. The customer's encryption keys are stored and managed separately in their virtual cloud network, while the host infrastructure provides the encryption/decryption functionality. This segmentation ensures that even if the host is compromised, the customer's data remains secure because the host cannot access the customer's encryption keys.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

A key management service acts as an intermediary between the customer and the host infrastructure. The service facilitates secure key storage, key rotation, and key management operations without requiring the host to have direct access to the encryption keys. This intermediary layer protects customer data while enabling the host to provide encryption services.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If customer-managed encryption keys are implemented, then data security is improved by preventing host access, but system complexity increases due to key management requirements

Engineering Contradiction:

Improvedata securityVSAvoidkey management operation

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The key management service enables customers to autonomously manage their own encryption keys through self-service operations. Customers can perform key rotation, key recovery, and key management tasks directly without requiring host intervention or complex coordination. This self-service model simplifies operations while maintaining strong security controls.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The system implements feedback mechanisms that provide customers with visibility into their encryption key status, usage, and security posture. The key management service monitors and reports on key operations, allowing customers to make informed decisions about their encryption strategies without needing to understand the underlying complexity of the host infrastructure.

Inventive Principle:

Principle #23Feedback

3Ease of operation

If encryption keys are stored in the host infrastructure, then access and management is easier, but security is compromised when host security is breached

Engineering Contradiction:

Improvekey accessVSAvoidhost security breach impact

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The customer's encryption keys are extracted from the host infrastructure and stored exclusively within the customer's virtual cloud network environment. The host infrastructure provides encryption and decryption capabilities but does not store or have access to the customer's encryption keys. This extraction ensures that host security breaches cannot compromise customer data encryption keys.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The system preemptively prevents host access to encryption keys by designing the architecture so that keys never reside in the host infrastructure. This preliminary anti-action eliminates the possibility of host-based attacks or breaches compromising the encryption keys, as the keys are fundamentally isolated from the host environment through dedicated hardware security modules and encrypted storage within the customer's network.

Inventive Principle:

Principle #9Preliminary anti-action

Data Source

PatentUS12549526B2End-to-end network encryption from customer on-premise network to customer virtual cloud network using customer-managed keys

Publication Date: 2026.02.10 ORACLE INT CORP

AI summary

For end-to-end encryption of a virtual cloud network, a VPN tunnel from a customer device is terminated at a host network headend device using encryption keys secured in hardware and managed by the customer. The network headend device can be a card in a bare-metal server with one or more network virtualization devices. The network headend device is configured to receive a first key provisioned by a customer; receive a first data packet sent from a device of the customer; and decrypt the first data packet using the first key to obtain information. A network virtualization device is configured to receive the information from the network headend device; ascertain that the information is to be sent to a virtual machine in a virtual cloud network; ascertain that data in the virtual cloud network is configured to be encrypted; and encrypt the information with a second key to generate a second data packet before routing the second data packet to the virtual machine.