One-touch inline cryptographic data processing

Patent metadata

Field	Value
Publication number	US-11943207-B2
Application number	US-202017032391-A
Country	US
Kind code	B2
Filing date	Sep 25, 2020
Priority date	Sep 25, 2020
Publication date	Mar 26, 2024
Grant date	Mar 26, 2024

Abstract

Methods, systems, and use cases for one-touch inline cryptographic data security are discussed, including an edge computing device with a network communications circuitry (NCC), an enhanced DMA engine coupled to a memory device and including a cryptographic engine, and processing circuitry configured to perform a secure exchange with a second edge computing device to negotiate a shared symmetric encryption key, based on a request for data. An inline encryption command for communication to the enhanced DMA engine is generated. The inline encryption command includes a first address associated with a storage location storing the data, a second address associated with a memory location in the memory device, and the shared symmetric encryption key. The data is retrieved from the storage location using the first address, the data is encrypted using the shared symmetric encryption key, and the encrypted data is stored in the memory location using the second address.

First claim

What is claimed is:

1. An edge computing device operable in an edge computing system, the edge computing device comprising:
network communications circuitry (NCC);
an enhanced direct memory access (DMA) engine coupled to a memory device, the enhanced DMA engine comprising a cryptographic engine; and
processing circuitry coupled to the NCC and the enhanced DMA engine, the processing circuitry configured to:
perform a secure exchange with a second edge computing device to negotiate a shared symmetric encryption key, based on a request for data received via the NCC from the second edge computing device; and
generate an inline encryption command for communication to the enhanced DMA engine, the inline encryption command including: a first address associated with a storage location storing the data, a second address associated with a memory location in the memory device, and the shared symmetric encryption key;
wherein the enhanced DMA engine is configured to retrieve the data from the storage location using the first address, encrypt the data using the cryptographic engine and based on the shared symmetric encryption key, and store the encrypted data in the memory location using the second address.

2. The edge computing device of claim 1 , wherein the processing circuitry is configured to:
generate the inline encryption command to further specify an encryption algorithm for encrypting the data by the cryptographic engine.

3. The edge computing device of claim 1 , wherein the secure exchange with the second edge computing device is based on a Transport Layer Security (TLS) protocol exchange.

4. The edge computing device of claim 1 , wherein the processing circuitry is configured to:
generate a Transport Layer Security (TLS) record template (RT) based on the request for the data received from the second edge computing device; and
communicate the TLS RT and the second address associated with the memory location to the NCC.

5. The edge computing device of claim 4 , wherein the NCC is configured to:
retrieve the encrypted data from the memory location using the second address; and
generate a header based on the TLS RT.

6. The edge computing device of claim 5 , wherein the NCC is further configured to:
communicate the header with a payload comprising the encrypted data to the second edge computing device using a destination IP address specified in the TLS RT.

7. The edge computing device of claim 1 , wherein the enhanced DMA engine is further configured to:
detect a configuration that the data retrieved from the storage location is encrypted.

8. The edge computing device of claim 1 , wherein the enhanced DMA engine is further configured to:
perform data transcription to encrypt the data using the cryptographic engine and based on the shared symmetric encryption key.

9. The edge computing device of claim 8 , wherein to perform the data transcription the enhanced DMA engine is further configured to:
retrieve a decryption key from the processing circuitry.

10. The edge computing device of claim 9 , wherein to perform the data transcription the enhanced DMA engine is further configured to:
decode, using the cryptographic engine, the encrypted data based on the retrieved decryption key to obtain decoded data.

11. The edge computing device of claim 10 , wherein to perform the data transcription the enhanced DMA engine is further configured to:
encode, using the cryptographic engine, the decoded data based on the shared symmetric encryption key.

12. A secure data management system comprising:
a plurality of hardware components, including a processing circuitry, a direct memory access (DMA) engine, and a cryptographic engine; and
at least one memory device including instructions embodied thereon, wherein the instructions, which when executed by the processing circuitry, configure the hardware components to perform operations to:
perform a secure exchange with an edge computing device to negotiate a shared symmetric encryption key, based on a request for data received from the edge computing device;
generate an inline encryption command based on completion of the secure exchange, the inline encryption command including a first address associated with a storage location storing the data, a second address associated with a memory location in the at least one memory device, and the shared symmetric encryption key;
retrieve the data from the storage location using the first address of the inline encryption command;
encrypt the data using the cryptographic engine within the plurality of hardware components and based on the shared symmetric encryption key; and
store the encrypted data in the memory location using the second address.

13. The secure data management system of claim 12 , wherein the instructions further configure the hardware components to perform operations to:
generate a Transport Layer Security (TLS) record template (RT) based on the request for the data received from the edge computing device;
retrieve the encrypted data from the memory location using the second address; and
generate a header based on the TLS RT.

14. The secure data management system of claim 13 , wherein the instructions further configure the hardware components to perform operations to:
communicate the header with a payload comprising the encrypted data to the edge computing device using a destination IP address specified in the TLS RT.

15. The secure data management system of claim 12 , wherein the instructions further configure the hardware components to perform operations to:
generate the inline encryption command to further specify an encryption algorithm for encrypting the data by the cryptographic engine.

16. The secure data management system of claim 12 , wherein the instructions further configure the hardware components to perform operations to:
detect the data retrieved from the storage location is encrypted; and
perform data transcription to encrypt the data using the cryptographic engine and based on the shared symmetric encryption key.

17. The secure data management system of claim 16 , wherein to perform the data transcription, the instructions further configure the hardware components to perform operations to:
retrieve a decryption key; and
decode, using the cryptographic engine, the encrypted data based on the retrieved decryption key to obtain decoded data.

18. The secure data management system of claim 17 , wherein to perform the data transcription, the instructions further configure the hardware components to perform operations to:
encode, using the cryptographic engine, the decoded data based on the shared symmetric encryption key to obtain the encrypted data.

19. At least one non-transitory machine-readable storage device comprising instructions stored thereupon, which when executed by processing circuitry of an edge computing system, cause the processing circuitry to perform operations comprising:
performing a secure exchange with an edge computing device to negotiate a shared symmetric encryption key, based on a request for data received from the edge computing device;
generating an inline encryption command based on completion of the secure exchange, the inline encryption command including a first address associated with a storage location storing the data, a second address associated with a memory location in at least one memory device, and the shared symmetric encryption key;
retrieving the data from the storage location using the first address of the inline encryption command;
encrypting

Assignees

• Intel Corp

Inventors

• Doshi Kshitij Arun
• Qureshi Uzair
• Mosur Lokpraveen
• Fleming Patrick
• Doyle Stephen
• Keating Brian Andrew
• Smith Ned M

Classifications

• H04L63/0435 Primary

  wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06) · CPC title

• G06F13/28 Primary

  using burst mode transfer, e.g. direct memory access {DMA}, cycle steal (G06F13/32 takes precedence) · CPC title

• G06F21/602

  Providing cryptographic facilities or services · CPC title

• H04L63/166

  at the transport layer · CPC title

• G06F21/72

  in cryptographic circuits · CPC title