TNIC Secure Protocol Handshake Offload
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer systems face processing burdens during secure data exchanges due to compute-intensive cryptographic operations in the TCP/IP layers, leading to overhead and inefficiencies, especially during secure protocol handshakes.
Innovation Solution
Offloading secure protocol handshakes to a Network Interface Card (NIC), specifically using a TNIC that processes cryptographic operations, allowing the host to determine if the handshake is offloaded and sending cryptographic key values for the NIC to perform operations, thereby reducing host CPU load and maintaining access to secure protocol data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic operations are performed on the host CPU during secure protocol handshakes, then security can be maintained, but system processing burden and overhead increase significantly
Solution Approach 1:
The patent extracts cryptographic operations from the host CPU and relocates them to a dedicated Network Interface Card (NIC). The host CPU sends cryptographic parameters and data to the NIC, which performs the actual cryptographic processing independently, then returns results to the host. This separation reduces the processing burden on the host while maintaining security through dedicated hardware acceleration.
Solution Approach 2:
The NIC acts as an intermediary between the host CPU and the cryptographic processing requirements. It receives cryptographic data from the host, performs the computationally intensive operations using its own cryptographic engine, and returns results without requiring continuous host CPU involvement. This mediator approach maintains security while improving processing efficiency.
2Loss of information
If secure protocol data is processed through the host software, then access to secure protocol data is maintained, but frequent IO bus crossings increase overhead
Solution Approach 1:
The patent extracts secure protocol data processing from the host software path and relocates it to the NIC. The NIC maintains its own copy of cryptographic parameters and performs processing locally, eliminating the need for frequent data transfers between host memory and network interface. This reduces IO bus crossings while maintaining full access to secure protocol data through the NIC's local storage and processing capabilities.
3Productivity
If cryptographic hardware accelerators are implemented as proxy cards, then cryptographic operations are accelerated, but the original SSL/TLS data becomes unavailable to host software
Solution Approach 1:
The patent segments the cryptographic processing function from the data path. The NIC handles cryptographic operations independently while the host software maintains access to the original SSL/TLS data stream. This segmentation allows cryptographic acceleration without interfering with data availability, as the NIC processes cryptographic parameters while the host retains the original encrypted data for inspection, debugging, or protocol compliance verification.
Data Source
AI summary
A method for offloading a secure protocol handshake. The method includes establishing a connection between a host system and a remote peer, and determining whether the secure protocol handshake is offloaded to a network interface card (NIC). When the secure protocol handshake is offloaded to the NIC, an offload request is sent to offload the secure protocol handshake, where the offload request includes a value of at least one cryptographic key. The method further includes performing cryptographic operations associated with the secure protocol handshake using the value of at least one cryptographic key to obtain at least one secret key, and returning a status of the secure protocol handshake to the host system.