Overhead reduction for link protection

A receiver, comprising:

• a plurality of receive queues to receive and queue encrypted data blocks of data packets of variable sizes for a plurality of trusted execution sessions of a computing device having the receiver, communicating over a communication link;
• a plurality of buffers to correspondingly buffer a plurality of decryption pads for the plurality of trusted sessions;
• and
• decryption circuitry coupled to the plurality of receive queues and the plurality of buffers to decrypt the encrypted data blocks of the data packets of variable sizes of the plurality of trusted execution sessions into plaintext data blocks, with the decryption pads for the corresponding trust execution sessions in the plurality of buffers, consuming variable number of the decryption pads for each of the data packets corresponding to the variable size of the data packet.

A method for encrypting one or more plaintext data blocks of a data packet to be transmitted over a communication link, comprising:

• retrieving, by a transmitter associated with the communication link, one or more encryption pads from an encryption pad storage buffer based at least in part on a size of the data packet;
• encrypting, by the transmitter, the one or more plaintext data blocks of the data packet in accordance with advanced encryption standard (AES) Galois counter mode (GCM) encryption, using the one or more encryption pads retrieved, to generate one or more corresponding ciphertext data blocks;
• generating in parallel, while encrypting, by the transmitter, one or more encryption pads for the encryption pad storage buffer to replenish the one or more encryption pad used, using one or more monotonically increased counter values as one or more initialization vectors in the generation of the one or more replenishment encryption pads;
• and
• transmitting, by the transmitter, the one or more corresponding ciphertext data blocks over the communication link, on their generations.

A method for decrypting and authenticating encrypted data blocks of a data packet received over a communication link, comprising:

• receiving successively, by a receiver associated with the communication link, through the communication link, a plurality of encrypted data chunks of a data packet, each encrypted data chunk having one or more encrypted data blocks;
• receiving, by the receiver, through the communication link, a reference message authentication code (MAC) associated with the data packet;
• decrypting, by the receiver, the one or more encrypted data blocks of each encrypted data chunk successively received, to generate a plurality of decrypted data chunks, each decrypted data chunk having one or more decrypted data blocks corresponding to the one or encrypted data blocks of the corresponding encrypted data chunk;
• generating successively, by the receiver, a message authentication code (MAC) for each decrypted data chunk, on their generations;
• accumulating, by the receiver, the successively generated MACs with a function to generate an accumulated MAC for the data packet;
• and
• comparing, by the receiver, the generated accumulated MAC with the reference MAC to authenticate the decrypted data packet.