Virtualized Cryptographic Resources via Memory Keystreams
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic systems face performance bottlenecks during high-bandwidth operations due to processor saturation, especially in end-to-end encryption and decryption processes, which are often limited by the computational bandwidth of personal or larger computers.
Innovation Solution
The virtualization of cryptographic resources, where cryptographic functions are decoupled from processor limitations by utilizing memory resources to create a memory-based cryptographic construct that supports both encryption and decryption, leveraging precomputed keystreams and cryptographic caches to enhance throughput.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If cryptographic computation is performed using traditional processor-based methods, then security and encryption/decryption functionality are achieved, but processor bandwidth is exhausted and performance bottlenecks occur during high-bandwidth operations
Solution Approach 1:
The patent introduces memory as an intermediary resource between the processor and cryptographic operations. By pre-computing and storing keystreams in memory, the system offloads computational burden from the processor while maintaining security functionality. The memory system acts as a mediator that handles the computationally intensive keystream generation, allowing the processor to focus on other tasks while cryptographic operations proceed at high speed through memory bandwidth.
Solution Approach 2:
The system performs preliminary action by pre-computing keystreams before they are needed for actual encryption or decryption operations. These pre-computed keystreams are stored in memory and can be rapidly retrieved and XORed with data during cryptographic operations. This advance preparation eliminates the need for real-time processor computation during critical encryption/decryption events, thereby increasing throughput and reducing processor load.
2Speed
If hardware cryptographic instructions are added to processors to support end-to-end protocols, then encryption/decryption speed is improved, but processors become saturated when handling multiple high-bandwidth links
Solution Approach 1:
The patent segments the cryptographic computation task into two distinct parts: keystream generation (computationally intensive) and data encryption/decryption (XOR operation). The keystream generation is performed in advance and stored in memory, while the actual cryptographic operation uses simple XOR with pre-computed keystreams. This segmentation allows multiple high-bandwidth links to operate simultaneously without saturating the processor, as each link can independently access pre-computed keystreams from memory at high speed.
3Productivity
If memory resources are used to time-shift cryptographic computation, then processor bandwidth is preserved and throughput is increased, but additional memory resources are consumed
Solution Approach 1:
The patent changes the parameter of cryptographic computation from real-time processor-based calculation to pre-computed memory-stored keystreams. By transforming the computational parameter (when and how keystreams are generated) into a storage parameter (pre-computed and stored in memory), the system achieves higher throughput by leveraging memory bandwidth rather than processor computational bandwidth. This parameter change allows the system to trade memory resources for processing capacity, optimizing overall system performance for high-bandwidth cryptographic operations.
Data Source
AI summary
A method and apparatus is provided for the virtualization of cryptographic resources which enables memory speed encryption and decryption that is not bound by the speed at which processor resources can compute the result of a symmetric-key algorithm. This is achieved through a time-memory tradeoff via empty space at provisioning time. When implementing the apparatus, un-initialized memory is filled with the output of a symmetric-key algorithm uniquely keyed for the specific set of data that is going to be written to the provisioned area. Since the provisioning operation stores cryptographically structured data, rather than redundant data, plaintext that is xor'ed into memory is automatically encrypted and ciphertext that xor'ed into memory is automatically decrypted without the need for additional cryptographic computation. This reduced computation requirement enables cryptographic function to be implemented at the ends of communication, rather than the middle, and treated as a virtualized resource.