Secure communication acceleration using a System-on-Chip (SoC) architecture

1. A System-on-Chip (SoC) for performing secure communication operations, the SoC comprising:

a peripheral interface configured to communicate with a host system;

a network interface configured to receive network packets in a secure communication session;

a processor configured to execute an Operating System (OS) software and a secure communication software stack to process at least one received network packet in the secure communication session;

a secure communication engine configured to perform cryptographic operations and generate at least one decrypted packet in the secure communication session, wherein the at least one decrypted packet is provided to the host system via the peripheral interface; and

a network operation offloading engine configured to:

identify at least one secure communication packet from the network packets received by the network interface by decapsulating a record header associated with an application layer payload of the network packets to determine whether the network packets have a legitimate secure communication protocol record header, and

forward the identified at least one secure communication packet to the processor for processing a decryption operation on the identified at least one secure communication packet in response to a determination that the identified at least one secure communication packet has a legitimate secure communication protocol record header,

wherein the secure communication engine is configured to decrypt the identified at least one secure communication packet in response to a determination by the processor that the decryption operation is to be performed on the identified at least one secure communication packet.

2. The SoC of claim 1 , wherein the OS software includes a network software stack and the processor is configured to execute the network software stack to process the at least one received network packet in the secure communication session.

3. The SoC of claim 2 , wherein the network software stack includes a Transmission Control Protocol/Internet Protocol (TCP/IP) software stack, and the processor is configured to execute the TCP/IP software stack to process the at least one received network packet and deliver the processed at least one network packet to the secure communication software stack.

4. The SoC of claim 1 , wherein the network operation offloading engine is further configured to identify the at least one secure communication packet by inspecting a destination port of each network packet received by the network interface.

5. The SoC of claim 2 , wherein the processor is configured to execute the network software stack to process handshaking packets during a handshaking process in the secure communication session.

6. The SoC of claim 1 , wherein the secure communication software stack includes an Open Secure Sockets Layer (OpenSSL) software stack.

7. The SoC of claim 1 , wherein the peripheral interface includes a Peripheral Component Interconnect Express (PCIe) interface.

8. The SoC of claim 1 , wherein the secure communication engine includes at least one of an RSA cipher, an Elliptic Curve (EC) cipher, or an Advanced Encryption Standard (AES) cipher.

9. A hardware computer peripheral card for performing secure communication operations, the hardware computer peripheral card comprising:

a hardware connector configured to be coupled with a host system; and

a System-on-Chip (SoC), comprising:

a peripheral interface configured to communicate with the host system through the hardware connector;

a network interface configured to receive network packets from a client device in a secure communication session;

a processor configured to execute an Operating System (OS) software and a secure communication software stack to process at least one received network packet in the secure communication session;

a secure communication engine configured to perform cryptographic operations and generate at least one decrypted packet in the secure communication session, wherein the at least one decrypted packet is provided to the host system via the peripheral interface; and

a network operation offloading engine configured to:

identify at least one secure communication packet from the network packets received by the network interface by decapsulating a record header associated with an application layer payload of the network packets to determine whether the network packets have a legitimate secure communication protocol record header, and

forward the identified at least one secure communication packet to the processor for processing a decryption operation on the identified at least one secure communication packet in response to a determination that the identified at least one secure communication packet has a legitimate secure communication protocol record header,

wherein the secure communication engine is configured to decrypt the identified at least one secure communication packet in response to a determination by the processor that the decryption operation is to be performed on the identified at least one secure communication packet.

10. The hardware computer peripheral card of claim 9 , wherein the peripheral interface includes a Peripheral Component Interconnect Express (PCIe) interface and the hardware connector includes a PCIe connector.

11. A method, conducted by a System-on-Chip (SoC) coupled to a host system, of performing secure communication operations, the method comprising:

receiving, by a network interface of the SoC, a network packet from a client device;

determining whether the received network packet is a secure communication packet by decapsulating a record header associated with an application layer payload of the received network packet to determine whether the received network packet has a legitimate secure communication protocol record header;

in response to the determination that the network packet is a secure communication packet and that the network packet has a legitimate secure communication protocol record header, sending the secure communication packet to a secure communication software stack executed on the SoC;

decrypting the network packet by the secure communication software stack executed on the SOC; and

establishing, by the secure communication software stack executed on the SoC, a secure communication session between the client device and the host system based on the secure communication packet through a handshaking process.

12. The method of claim 11 , comprising:

determining whether the network packet is a secure communication packet based on a destination port of the received network packet.

13. The method of claim 11 , comprising:

decrypting, by the secure communication engine, encrypted network packets received from the client device in the established secure communication session; and

sending the decrypted network packets to the host system.

14. The method of claim 13 , comprising:

sending the decrypted network packets to the host system through a Peripheral Component Interconnect Express (PCIe) interface.

15. The method of claim 11 , wherein performing the cryptographic operations using the secure communication engine comprises:

performing the cryptographic operations according to at least one of an RSA algorithm, an Elliptic Curve (EC) algorithm, or an Advanced Encryption Standard (AES) algorithm.

16. A method, conducted by a System-on-Chip (SoC) coupled to a host system, of performing secure communication operations, the method comprising:

receiving, by a network interface of the SoC, a network packet from a client device;

determining whether the received network packet is a secure communication packet by decapsulating a record header associated with an application layer payload of the received network packet to determine whether the received network packet has a legitimate secure communication protocol record header;

in response to the determination that the received network packet is a secure communication packet and that the network packet has a legitimate secure communication protocol record header, sending the secure communication packet to a secure communication software stack executed on the SoC;

forwarding, by the secure communication software stack, one or more parameters associated with the secure communication packet to a secure communication engine of the SoC;

decrypting, by the secure communication engine, the secure communication packet according to one or more crypto algorithms to generate a decrypted network packet; and

sending the decrypted network packet to the host computer via a peripheral interface.