Storage inline encryption circuit
A processing system includes one or more storage encryption circuits (SIECs) interconnected with one or more input/output (I/O) devices and a system memory. Each SIEC is configured to encrypt and decrypt data as the data passes between the I/O devices and the system memory. To this end, an SIEC includes slots each associated with respective memory addresses of the system memory. Each slot provides an aperture to the associated memory addresses such that the I/O devices use these apertures to indirectly target the associated memory addresses. As the data targeting the memory addresses associated with an aperture passes through an SIEC, the SIEC encrypts or decrypts the data using cryptographic keys stored on the SIEC.
1 . A processing system comprising:
a memory;
a storage inline encryption circuit (SIEC) connected to the memory, the SIEC including a plurality of slots each associated with a corresponding memory address of the memory and the SIEC configured to:
provide a direct memory access (DMA) request received at a first slot of the plurality of slots to the memory based on the corresponding memory address associated with the first slot; and
in response to receiving a completion packet from the memory at the first slot, encrypting data associated with the completion packet based on the first slot.
2 . The processing system of claim 1 , wherein each slot of the plurality of slots is associated with a corresponding cryptographic key and wherein the SIEC is configured to encrypt the data associated with the completion packet based on the cryptographic key associated with the first slot.
3 . The processing system of claim 2 , wherein the SIEC includes a key table including a plurality of cryptographic keys.
4 . The processing system of claim 1 , wherein the memory includes a command queue storing a command descriptor.
5 . The processing system of claim 4 , further comprising a processor configured to configure the first slot of the SIEC based on the command descriptor.
6 . The processing system of claim 5 , wherein the processor is configured to reconfigure the first slot of the SIEC based on a second command descriptor in the command queue in response to a completion indicator being received by the memory.
7 . The processing system of claim 1 , wherein the SIEC is configured to encrypt the data associated with the completion packet based on an offset associated with the first slot.
8 . The processing system of claim 1 , wherein the SIEC is configured to provide the encrypted data associated with the completion packet to an I/O device associated with the DMA request.
9 . A method comprising:
in response to receiving a memory request at a first slot of a plurality of slots of a storage inline encryption circuit (SIEC), providing the memory request to a memory based on the first slot, wherein each slot of the plurality of slots is associated with a corresponding memory address of the memory; and
in response to receiving a completion packet from the memory at the first slot of the SIEC, encrypting data associated with the completion packet based on the first slot.
10 . The method of claim 9 , wherein each slot of the plurality of slots is associated with a corresponding cryptographic key and wherein encrypting the data associated with the completion packet is further based on the cryptographic key associated with the first slot.
11 . The method of claim 9 , wherein the memory request is received from an attached storage device.
12 . The method of claim 9 , wherein the memory request is received from a non-volatile memory express (NVMe) device.
13 . The method of claim 9 , further comprising configuring the first slot of the SIEC based on a command queue of a memory such that the first slot is associated with the memory address of the memory.
14 . The method of claim 13 , further comprising reconfiguring the first slot of the SIEC based on the command queue in response to a completion indicator being received by the memory.
15 . The method of claim 9 , further comprising encrypting the data associated with the completion packet further based on an offset associated with the first slot.
16 . A processor comprising:
a storage inline encryption circuit (SIEC) connected to a memory and an I/O device, the SIEC including a plurality of slots each associated with a corresponding memory address of a memory and the SIEC configured to:
in response to receiving a direct memory access (DMA) request from the I/O device at a first slot of the plurality of slots, decrypt data associated with the DMA request based on the first slot; and
providing the decrypted data associated with the DMA request to the memory based on the first slot.
17 . The processor of claim 16 , wherein each slot of the plurality of slots is associated with a corresponding cryptographic key and wherein the SIEC is configured to decrypt the data associated with the DMA request based on the cryptographic key associated with the first slot.
18 . The processor of claim 16 , wherein the SIEC includes a key table including a plurality of cryptographic keys.
19 . The processor of claim 16 , wherein the memory includes a command queue storing a command descriptor.
20 . The processor of claim 19 , wherein the processor is configured to configure the first slot of the SIEC based on the command descriptor.