Intel Corporation

Patrick Fleming

Lokpraveen B Mosur

Stephen Doyle

Naveen Lakkakula

John Joseph Browne

Andrew Cunningham

Kshitij Arun Doshi

Stephen T Palermo

Niall D McDonnell

Tomasz Kantecki

Sailesh Bissessur

Brian A Keating

Ned M Smith

Kapil Sood

Chris MacNamara

Eliel Louzoun

Manasi Deval

Ilango S Ganga

Adrian R Pearson

Pierre Laurent

David K Cassetti

Bruce Richardson

Brian S Hausauer

Gregory J Bowers

Rajesh Gadiyar

Noam Elati

Chih-Jen Chang

Hari K Tadepalli

Tony Hurson

Atul Kwatra

Uzair Qureshi

Pradnyesh S Gudadhe

Smita Kumar

Brian Will

David M Durham

Patrick L Connor

Anatoli Aleksandrovich Bolotov

Mikhail I Grinchuk

Yadong Li

Anjali Singhai Jain

Patrick G Kutch

Edwin Verplanke

Andrey Chilikin

Kenneth G Keels

Namakkal N Venkatesan

Jose Niell

Doddaballapur N Jayasimha

Mark Debbage

Mark D Gray

Christopher MacNamara

Robert W Cone

Brendan Ryan

Alexander J Leckey

Brad Burres

Sean Harte

Naru Dames Sundar

Dan Biederman

Ciara Loftus

Chris Macnamara

Richard Guerin

Pat Wang

Venkidesh Krishna Iyer

Robert Cone

Charitra Sankar

Ralph Castro

John Barry

Examples described herein relate to a network interface device that includes circuitry, configured to perform encryption of data, generate one or more packets from the encrypted data, cause transmission of the one or more packets with the encrypted data, manage reliability of transport of the transmitted one or more packets with the encrypted data, and share protocol state information between a host system and the network interface device using connectivity based on user space accessible queues.

Transport and cryptography offload to a network interface device

A computing device includes a direct memory access (DMA) engine coupled to a memory, a network interface, and processing circuitry. The processing circuitry is to perform a secure exchange with a second computing device to negotiate a shared encryption key, based on a request for data received via the network interface from the second computing device. The DMA engine is to retrieve the data from a storage location based on an encryption command. The encryption command indicates the storage location. The DMA engine is to encrypt the data based on the shared encryption key to generate encrypted data, and store the encrypted data in the memory.

Cryptographic data processing using a DMA engine

In one embodiment, a system includes a device and a host. The device includes a device stream buffer. The host includes a processor to execute at least a first application and a second application, a host stream buffer, and a host scheduler. The first application is associated with a first transmit streaming channel to stream first data from the first application to the device stream buffer. The first transmit streaming channel has a first allocated amount of buffer space in the device stream buffer. The host scheduler schedules enqueue of the first data from the first application to the first transmit streaming channel based at least in part on availability of space in the first allocated amount of buffer space in the device stream buffer. Other embodiments are described and claimed.

System, apparatus, and method for streaming input/output data

Methods, apparatus, systems and articles of manufacture are disclosed to control execution of tasks in a computing system. The methods, apparatus, systems and articles of manufacture include at least one storage device and at least one processor to, execute instructions to at least obtain a request to perform an inverse operation on a data flow, the data flow previously transformed during a forward operation, determine a first processor core that executed the forward operation, the data flow including an identifier of the first processor core, and transmit the data flow to a second processor core to perform the inverse operation.

Methods and apparatus to control execution of tasks in a computing system

Examples described herein include a system comprising: a processing unit package comprising: at least one core and at least one offload processing device communicatively coupled inline between the at least one core and a network interface controller, the at least one offload processing device configurable to perform packet processing. In some examples, the at least one offload processing device is to allow mapping of packet processing pipeline stages of networking applications among software running on the at least one core and the at least one offload processing device to permit flexible entry, exit, and re-entry points among the at least one core and the at least one offload processing device.

Network and edge acceleration tile (NEXT) architecture

An apparatus, a method, and a computer program for generating data packets according to a transport protocol from an application buffer comprising a plurality of data streams is provided. The apparatus comprises an input circuit configured to receive metadata comprising at least one of information about data packet types supported by the transport protocol, information about an offset and a length of the supported data packet types, and information about possible stream header start positions, possible payload start positions and possible offsets in the data streams. Further, the apparatus comprises a parsing circuit configured to identify offsets in an application buffer as possible segmentation points based on the metadata, to segment the application buffer at the possible segmentation points into segments for data packets, and to generate data packets according to the transport protocol based on the segments. Furthermore, an apparatus, a method and a computer program for processing the application buffer is provided.

Concept for segmenting an application buffer into data packets

Methods, systems, and use cases for one-touch inline cryptographic data security are discussed, including an edge computing device with a network communications circuitry (NCC), an enhanced DMA engine coupled to a memory device and including a cryptographic engine, and processing circuitry configured to perform a secure exchange with a second edge computing device to negotiate a shared symmetric encryption key, based on a request for data. An inline encryption command for communication to the enhanced DMA engine is generated. The inline encryption command includes a first address associated with a storage location storing the data, a second address associated with a memory location in the memory device, and the shared symmetric encryption key. The data is retrieved from the storage location using the first address, the data is encrypted using the shared symmetric encryption key, and the encrypted data is stored in the memory location using the second address.

One-touch inline cryptographic data processing

A security accelerator device stores a first credential that is uniquely associated with the individual security accelerator device and represents a root of trust to a trusted entity. The device establishes a cryptographic trust relationship with a client entity that is based on the root of trust, the cryptographic trust relationship being represented by a second credential. The device receives and store a secret credential of the client entity, which is received via communication secured by the second credential. Further, the device executes a cryptographic computation using the secret client credential on behalf of the client entity to produce a computation result.

Key protection for computing platform

Technologies for an accelerator interface over Ethernet are disclosed. In the illustrative embodiment, a network interface controller of a compute device may receive a data packet. If the network interface controller determines that the data packet should be pre-processed (e.g., decrypted) with a remote accelerator device, the network interface controller may encapsulate the data packet in an encapsulating network packet and send the encapsulating network packet to a remote accelerator device on a remote compute device. The remote accelerator device may pre-process the data packet (e.g., decrypt the data packet) and send it back to the network interface controller. The network interface controller may then send the pre-processed packet to a processor of the compute device.

Technologies for accelerator interface

Various embodiments are generally directed to an apparatus, method and other techniques to determine a secure memory region for a transaction, the secure memory region associated with a security association context to perform one or more of an encryption/decryption operation and an authentication operation for the transaction, perform one or more of the encryption/decryption operation and the authentication operation for the transaction based on the security association context, and cause communication of the transaction.

Techniques to provide client-side security for storage of data in a network environment

A compression scheme can be selected for an input data stream based on characteristics of the input data stream. For example, when the input data stream is searched for pattern matches, input stream characteristics used to select a compression scheme can include one or more of: type and size of an input stream, a length of a pattern, a distance from a start of where the pattern is to be inserted to the beginning of where the pattern occurred previously, a gap between two pattern matches (including different or same patterns), standard deviation of a length of a pattern, standard deviation of a distance from a start of where the pattern is to be inserted to the beginning of where the pattern occurred previously, or standard deviation of a gap between two pattern matches. Criteria can be established whereby one or more characteristics are used to select a particular encoding scheme.

Selection of data compression technique based on input characteristics

An apparatus, a method and a computer program for generating data packets according to a transport protocol from an application buffer comprising a plurality of data streams is provided. The apparatus comprises an input circuit configured to receive metadata comprising at least one of information about data packet types supported by the transport protocol, information about an offset and a length of the supported data packet types, and information about possible stream header start positions, possible payload start positions and possible offsets in the data streams. Further, the apparatus comprises a parsing circuit configured to identify offsets in an application buffer as possible segmentation points based on the metadata, to segment the application buffer at the possible segmentation points into segments for data packets, and to generate data packets according to the transport protocol based on the segments. Furthermore, an apparatus, a method and a computer program for processing the application buffer is provided.

Systems, apparatus, and/or methods to provide memory data protection. In one example, authenticated encryption may be enhanced via a modification to an authentication code that is associated with encrypted data. The authentication code may be modified, for example, with a nonce value generated for a particular write to memory Decrypted data, generated from the encrypted data, may then be validated based on a modified authentication code. Moreover, data freshness control for data stored in the memory may be provided based on iterative authentication and re-encryption. In addition, a counter used to provide a nonce value may be managed to reduce a size of the counter and/or a growth of the counter.

Memory data protection based on authenticated encryption

A computing apparatus, including: a processor; a pointer to a counter memory location; and a lazy increment counter engine to: receive a stimulus to update the counter; and lazy increment the counter including issuing a weakly-ordered increment directive to the pointer.

Lazy increment for high frequency counters

Various embodiments are generally directed to an apparatus, method and other techniques to de determine a secure memory region for a transaction, the secure memory region associated with a security association context to perform one or more of an encryption/decryption operation and an authentication operation for the transaction, perform one or more of the encryption/decryption operation and the authentication operation for the transaction based on the security association context, and cause communication of the transaction.

Growing community of inventors

Slatt Wolfhill, Ireland

Patrick Fleming