Computer and Network Interface Controller Offloading Encryption Processing to the Network Interface Controller and Using Derived Encryption Keys

A network interface controller (NIC) for connection to a computer and a network, the computer including:

• a computer processor;
• a memory controller coupled to the computer processor;
• computer memory coupled to the computer processor and the memory controller, the computer memory including session encryption key storage for encryption keys used for communications between a local program and a remote program according to a protocol;
• a computer peripheral device interface coupled to the computer processor and to the computer memory;
• and
• computer non-transitory storage for programs to execute from computer memory on the computer processor,
• wherein the computer non-transitory storage includes the local program to exchange encryption keys with the remote program to be used in egress encryption operations of data being transmitted in packets to the other program, the packets conforming to the protocol,
• the NIC comprising:
• a NIC peripheral device interface for connection to the computer;
• and
• a network interface for connection to a network,
• wherein the NIC is configured to encrypt data leaving the NIC through the network interface and decrypt data entering the NIC through the network interface;
• wherein the computer peripheral device interface and the NIC peripheral device interface are configured to provide a peripheral device communication path between the local program and the NIC and a data transfer path between the computer and the NIC;
• wherein the NIC is configured to utilize a local program primary encryption key in conjunction with at least one field contained in packets being exchanged to develop an ingress derived encryption key and to provide the ingress derived encryption key to the local program for exchange with the remote program, the ingress derived encryption key to be used to encrypt packets sent to the local program;
• wherein the local program and the NIC are configured for the local program to provide a received remote program encryption key to the NIC,
• wherein the NIC is configured to use the received remote program encryption key to encrypt packets being transmitted to the remote program with the received remote program encryption key, and
• wherein the NIC is configured to use the ingress derived encryption key to decrypt packets received from the remote program.

A computer non-transitory machine readable storage medium for use in a computer cooperating with a network interface controller (NIC), the computer including:

• a computer processor;
• a memory controller coupled to the computer processor;
• computer memory coupled to the computer processor and the memory controller, the computer memory including session encryption key storage for encryption keys used for communications between the computer and a remote program according to a protocol;
• a computer peripheral device interface coupled to the computer processor and to the computer memory;
• and
• the computer non-transitory storage for programs to execute from computer memory on the computer processor;
• and
• the NIC including:
• a NIC peripheral device interface for connection to the computer;
• and
• a network interface for connection to a network,
• wherein the NIC is configured to encrypt data leaving the NIC through the network interface and decrypt data entering the NIC through the network interface;
• wherein the computer peripheral device interface and the NIC peripheral device interface are configured to provide a peripheral device communication path between the computer and the NIC and a data transfer path between the computer and the NIC;
• wherein the NIC is configured to utilize a local primary encryption key in conjunction with at least one field contained in packets being exchanged to develop an ingress derived encryption key and to provide the ingress derived encryption key to the computer for exchange with the remote program, the ingress derived encryption key to be used to encrypt packets sent to the computer;
• wherein the NIC is configured to use a received remote program encryption key to encrypt packets being transmitted to the remote program with the received remote program encryption key, and
• wherein the NIC is configured to use the ingress derived encryption key to decrypt packets received from the remote program,
• the computer non-transitory machine readable storage medium having stored thereon instructions to perform operations comprising:
• exchanging encryption keys with the remote program to be used in egress encryption operations of data being transmitted in packets to the other program, the packets conforming to a protocol;
• and
• providing the received remote program encryption key to the NIC.