Computer and Network Interface Controller Securely Offloading Encryption Keys and WireGuard Encryption Processing to the Network Interface Controller

A network interface controller (NIC) for connection to a computer, the computer including:

• a computer processor;
• a memory controller coupled to the computer processor;
• computer memory coupled to the computer processor, the memory controller and the computer peripheral device interface;
• a computer peripheral device interface coupled to the computer processor and to the computer memory;
• a computer encryption engine coupled to the computer memory and the memory controller;
• and
• computer non-transitory storage for programs to execute from computer memory on the computer processor,
• wherein the computer processor and the memory controller are configured to provide secure memory areas within the computer memory, encrypted memory areas within the secure memory areas, and session encryption key secure storage for encryption keys used for WireGuard communications between a local program and a remote program over a network within the secure memory areas;
• wherein the computer processor is configured to execute programs from secure memory areas;
• wherein the computer non-transitory storage includes a local program to be executed from a secure memory area, wherein the local program is configured to operate with data stored in an encrypted memory area within the secure memory area, wherein the local program is configured for communicating data contained in the encrypted memory area to a remote computer over a network according to a WireGuard protocol, the NIC comprising:
• a NIC peripheral device interface for connection to the computer;
• a network interface for connection to the network;
• a NIC processor coupled to the NIC peripheral device interface and the network interface;
• NIC memory coupled to the NIC processor, the NIC peripheral device interface and the network interface, the NIC memory including:
• session encryption key secure storage for encryption keys used for the communications between the local program and the remote program over the network;
• and
• secure buffer storage of holding communication data in transit;
• NIC non-transitory storage for programs to execute from the NIC memory on the NIC processor, the NIC non-transitory storage including a NIC WireGuard program configured for use with the communications between the local program and the remote program;
• and
• a NIC encryption engine coupled to the NIC peripheral device interface, the network interface, the session encryption key secure storage, and the secure buffer storage to encrypt and decrypt communication packets over the network interface using keys stored in the session encryption key secure storage, wherein the NIC encryption engine is configured to encrypt data packets leaving the NIC through the network interface and decrypt data packets entering the NIC through the network interface;
• wherein the computer peripheral device interface and the NIC peripheral device interface are configured to provide a secure peripheral device communication path between the local program and the NIC;
• wherein the local program and the NIC WireGuard program are configured to securely exchange session encryption keys over the secure peripheral device communication path,
• wherein the local program is configured to provide a local session encryption key to the NIC WireGuard program,
• wherein at least one of the NIC WireGuard program and the local program is configured to develop an index value and a derived session encryption key using the local session primary encryption key and at least one field contained in the packets being exchanged,
• wherein the one of the NIC WireGuard program and the local program configured to develop an index is configured to provide the index value and the derived session encryption key to the other of the local program and the NIC WireGuard program,
• wherein the local program is configured to interact with the remote program to exchange index values and derived session encryption keys with the remote program,
• wherein the local program and the NIC WireGuard program are configured for the local program to provide the received remote program derived session encryption key and the remote index value to the NIC WireGuard program and the NIC WireGuard program is configured to provide a local index referencing the received remote program derived session encryption key to the local program,
• wherein the local program and the NIC WireGuard program are configured for the local program to provide the local index to the NIC WireGuard program,
• wherein the NIC WireGuard program is configured to use the received local index to select the received remote derived session encryption key and to provide the received remote derived session encryption key to the NIC encryption engine to allow the NIC encryption engine to encrypt packets being transmitted to the remote program with the received remote derived session encryption key,
• wherein the NIC WireGuard program is configured to provide the local session encryption key to the NIC encryption engine to allow the NIC encryption engine to decrypt packets being received from the remote program,
• wherein the NIC encryption engine and the network interface develop an ingress derived session encryption key based on the local session primary encryption key and at least one field contained in packets received from the remote program, and
• wherein the NIC encryption engine uses the ingress derived session encryption key to decrypt packets received from the remote program.

A computer non-transitory machine readable storage medium for use in a computer cooperating with a network interface controller (NIC), the computer including:

• a computer processor;
• a memory controller coupled to the computer processor;
• computer memory coupled to the computer processor and the memory controller;
• a computer peripheral device interface coupled to the computer processor and to the computer memory;
• a computer encryption engine coupled to the computer memory, the memory controller and the computer peripheral device interface;
• and
• the computer non-transitory machine readable storage medium for programs to execute from computer memory on the computer processor,
• wherein the computer processor and the memory controller are configured to provide secure memory areas within the computer memory, encrypted memory areas within the secure memory areas, and session encryption key secure storage for encryption keys used for WireGuard communications between the computer and a remote program over a network within the secure memory areas;
• wherein the computer processor is configured to execute programs from secure memory areas;
• and
• the NIC including:
• a NIC peripheral device interface for connection to the computer;
• a network interface for connection to the network;
• a NIC processor coupled to the NIC peripheral device interface and the network interface;
• NIC memory coupled to the NIC processor, the NIC peripheral device interface and the network interface, the NIC memory including:
• session encryption key secure storage for encryption keys used for the communications between computer and the remote program over the network;
• and
• secure buffer storage of holding communication data in transit;
• NIC non-transitory storage for programs to execute from the NIC memory on the NIC processor, the NIC non-transitory storage including a NIC WireGuard program for use with the communications between the computer and the remote program;
• and
• a NIC encryption engine coupled to the NIC peripheral device interface, the network interface, the session encryption key secure storage, and the secure buffer storage to encrypt and decrypt communications over the network interface using keys stored in the session encryption key secure storage, wherein the NIC encryption engine is configured to encrypt data leaving the NIC through the network interface and decrypt data entering the NIC through the network interface;
• wherein the computer peripheral device interface and the NIC peripheral device interface are configured to provide a secure peripheral device communication path between a secure memory area and the NIC,
• the computer non-transitory machine readable storage medium having stored thereon instructions, which when executed by the computer from a secure memory area, causes the computer to perform operations comprising:
• operating with data stored in an encrypted memory area within the secure memory area and communicating data contained in the encrypted memory area to a remote computer over a network using WireGuard protocol;
• securely providing the local session encryption key to the NIC WireGuard program;
• at least one of securely receiving an index value and a derived session encryption key using the local session primary encryption key and at least one field contained in the packets being exchanged from the NIC WireGuard program over the secure peripheral device communication path and developing an index value and a derived session encryption key using the local session primary encryption key and at least one field contained in the packets being exchanged and securely providing the index value and derived session encryption key to the NIC WireGuard program;
• interacting with the remote program to exchange index values and derived session encryption keys with the remote program;
• and
• securely providing the received remote derived session encryption key to the NIC WireGuard program over the secure peripheral device communication path;
• and
• securely providing a local index referencing the received remote derived session encryption key to the NIC WireGuard program over the secure peripheral device communication path,
• wherein, when the local program instructions include receiving the index value and the derived session encryption key from the NIC WireGuard program, the NIC WireGuard program is configured to develop an index value and a derived session encryption key using the local session primary encryption key and at least one field contained in the packets being exchanged;
• wherein, when the local program instructions include developing the index value and the derived session encryption key, the NIC WireGuard program is configured to receive the index value and the derived session encryption key from the local program;
• wherein the NIC WireGuard program is configured use the received local index to select the received remote derived session encryption key and to provide the received remote derived session encryption key to the NIC encryption engine to allow the NIC encryption engine to encrypt packets being transmitted to the remote program with the received remote derived session encryption key,
• wherein the NIC WireGuard program is configured to provide the local program session encryption key to the NIC encryption engine to allow the NIC encryption engine to decrypt packets being received from the remote program,
• wherein the NIC encryption engine and the network interface develop an ingress derived session encryption key based on the local session primary encryption key and at least one field contained in packets received from the remote program, and
• wherein the NIC encryption engine uses the ingress derived session encryption key to decrypt packets received from the remote program.