Transport and cryptography offload to a network interface device

Patent metadata

Field	Value
Publication number	US-12483516-B2
Application number	US-202117544699-A
Country	US
Kind code	B2
Filing date	Dec 7, 2021
Priority date	Dec 8, 2020
Publication date	Nov 25, 2025
Grant date	Nov 25, 2025

Abstract

Examples described herein relate to a network interface device that includes circuitry, configured to perform encryption of data, generate one or more packets from the encrypted data, cause transmission of the one or more packets with the encrypted data, manage reliability of transport of the transmitted one or more packets with the encrypted data, and share protocol state information between a host system and the network interface device using connectivity based on user space accessible queues.

First claim

The invention claimed is:

1 . An apparatus comprising:
a network interface device comprising: a host interface; a direct memory access (DMA) circuitry; a network interface;
circuitry to perform offloaded operations from a host system of encryption of data,
circuitry to generate one or more packets from the encrypted data,
circuitry to cause transmission of the one or more packets with the encrypted data,
circuitry to perform offloaded operations from the host system to manage reliability of transport of the transmitted one or more packets with the encrypted data, wherein the circuitry to manage reliability of transport of the transmitted one or more packets is to manage packet receipt and packet retransmission of packets identified as not received, and
circuitry to share protocol state information between a host system and the network interface device using user space accessible queues, wherein the user space accessible queues are consistent with Address Family of the eXpress Data Path (AF_XDP) and wherein an application is to access the AF_XDP queues to cause transmission of data in a packet of the transmitted one or more packets or access data of a received packet.

2 . The apparatus of claim 1 , wherein the network interface device comprises circuitry to receive protocol state information from a host system and to share protocol state information with the host system.

3 . The apparatus of claim 1 , wherein the protocol state information comprises information related to two or more of: state for packetization, reliable transport, congestion management, packet encryption, packet decryption, and security association.

4 . The apparatus of claim 1 , wherein the circuitry to share protocol state information between a host system and the network interface device using connectivity based on user space accessible queues is to provide connectivity based on one or more of: Infrastructure Programmer's Development Kit (IPDK) or NVIDIA DOCA.

5 . The apparatus of claim 1 , wherein the circuitry to perform encryption of data is to receive a reference to a key from the host system and the circuitry to perform encryption of data is to access the key based on the reference and encrypt the data based on the key.

6 . The apparatus of claim 1 , wherein the encryption of data comprises Transport Layer Security (TLS) encryption of at least one record.

7 . The apparatus of claim 1 , wherein the circuitry to cause transmission of the one or more packets with the encrypted data is to look-up a target Hypertext Transfer Protocol (HTTP) Uniform Resource Locator (URL) to which to send the one or more packets and stream encrypted data the target HTTP URL.

8 . The apparatus of claim 1 , wherein the network interface device comprises one or more of: a network interface controller (NIC), a remote direct memory access (RDMA)-enabled NIC, SmartNIC, router, switch, forwarding element, infrastructure processing unit (IPU), data processing unit (DPU), or network-attached appliance.

9 . The apparatus of claim 1 , comprising:
the host system coupled to the network interface device, wherein the host system is to configure the network interface device to perform offloaded operations from the host system of: encryption of data, generate one or more packets from the encrypted data, cause transmission of the one or more packets with the encrypted data, manage reliability of transport of the transmitted one or more packets with the encrypted data, and share protocol state information between the host system and the network interface device based on user space accessible queues.

10 . The apparatus of claim 1 , wherein the host system is to initiate and manage a Hypertext Transfer Protocol (HTTP) connection with a target device.

11 . The apparatus of claim 9 , comprising:
a datacenter comprising a second server to receive the encrypted data in the one or more packets from the network interface device.

12 . At least one non-transitory computer-readable medium comprising instructions stored thereon, that if executed by one or more processors, cause the one or more processors to:
configure a network interface device to perform operations offloaded by a server to the network interface device, wherein the offloaded operations comprise: perform cryptography operations on data, transmit encrypted data in one or more packets, look-up of a target device to which to send the one or more packets and stream encrypted data to the target device, and manage reliability of transport of the transmitted one or more packets to manage packet receipt and packet retransmission of packets identified as not received, wherein the network interface device is to share protocol state information with the server using user space accessible queues, wherein the user space accessible queues are consistent with Address Family of the eXpress Data Path (AF_XDP), wherein the protocol state information comprises information related to four or more of: reliable transport, congestion management, packet encryption, packet decryption, and security association, and wherein an application is to access the AF_XDP queues to cause transmission of data in a packet of the one or more packets or access data of a received packet.

13 . The computer-readable medium of claim 12 , wherein the network interface device is to share protocol state information with the server using connectivity based on user space accessible queues is to provide connectivity based on one or more of: Infrastructure Programmer's Development Kit (IPDK) or NVIDIA DOCA.

14 . The computer-readable medium of claim 12 , wherein the network interface device is to perform cryptography operations on data based on a reference to a key from the server and the network interface device is to access the key based on the reference and encrypt the data based on the key.

15 . The computer-readable medium of claim 14 , wherein the encrypt the data comprises perform Transport Layer Security (TLS) encryption of at least one record.

16 . The computer-readable medium of claim 12 , wherein the transmit encrypted data in one or more packets is to transmit packets to a target Hypertext Transfer Protocol (HTTP) Uniform Resource Locator (URL) associated with the target device.

17 . The computer-readable medium of claim 12 , wherein the network interface device comprises one or more of: a network interface controller (NIC), a remote direct memory access (RDMA)-enabled NIC, SmartNIC, router, switch, forwarding element, infrastructure processing unit (IPU), data processing unit (DPU), or network-attached appliance.

18 . The apparatus of claim 1 , wherein the host system is to receive events associated with packet arrival via the user space accessible queues and the host system is to provide a descriptor to identify a packet payload to transmit via the user space accessible queues.

Assignees

• Intel Corp

Inventors

• Daly Daniel
• Jain Anjali Singhai
• Li Yadong
• Doyle Stephen
• Sundar Naru Dames
• Chang Chih-Jen
• Bissessur Sailesh
• Cunningham Andrew
• Verplanke Edwin
• Fleming Patrick

Classifications

• H04L63/166

  at the transport layer · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L47/803

  Application aware · CPC title

• H04L47/2425

  for supporting services specification, e.g. SLA · CPC title

• H04L63/101 Primary

  Access control lists [ACL] · CPC title