Methods and apparatus for offloading encryption

1. A method comprising:

receiving, at an encryption offload engine, using a first connection in an interconnect fabric, data from a host;

encrypting the data from the host at the encryption offload engine to generate encrypted data; and

transferring the encrypted data from the encryption offload engine to a storage device using a peer-to-peer connection in the interconnect fabric;

wherein the interconnect fabric comprises a switch connected between the encryption offload engine and the storage device; and

wherein the peer-to-peer connection uses the switch.

2. The method of claim 1 , further comprising:

transferring the encrypted data from the storage device to the encryption offload engine using a peer-to-peer connection in the interconnect fabric;

decrypting the encrypted data from the storage device at the encryption offload engine; and

transferring the decrypted data to the host using the interconnect fabric.

3. The method of claim 1 , further comprising:

transferring the encrypted data from the storage device to the host; and

verifying the encryption of the encrypted data at the host.

4. The method of claim 1 , wherein:

the data from the host comprises a source address; and

the method further comprises mapping the source address to the encryption offload engine.

5. The method of claim 4 , wherein:

the storage device initiates a peer-to-peer transfer from the encryption offload engine to the storage device in response to a write command from the host; and

the encryption offload engine fetches the data from the host using a mapping table.

6. The method of claim 2 , wherein:

the data to be sent to the host has a destination address; and

the method further comprises mapping the destination address to the encryption offload engine.

7. The method of claim 6 , wherein:

the storage device initiates a peer-to-peer transfer from the encryption offload engine to the storage device in response to a read command from the host; and

the encryption offload engine transfers the decrypted data to the host using a mapping table.

8. A system comprising:

a host;

an encryption offload engine; and

an interconnect fabric arranged to interconnect the host, the encryption offload engine, and one or more storage devices, wherein the interconnect fabric comprises a switch connected between the encryption offload engine and at least one of the one or more storage devices;

wherein the encryption offload engine is configured to:

receive data from the host using a first connection;

encrypt the data received from the host to generate encrypted data; and

send the encrypted data to the at least one of the storage devices using a peer-to-peer connection in the interconnect fabric, wherein the peer-to-peer connection uses the switch.

9. The system of claim 8 , wherein the host is configured to:

read the encrypted data from the at least one storage device; and

verify the encryption of the encrypted data.

10. The system of claim 9 , wherein the host is configured to read the encrypted data from the at least one storage device by bypassing a mapping table in the encryption offload engine.

11. The system of claim 8 , wherein:

the system further comprises a submission queue configured to hold a write command from the host; and

the write command includes a source address for data to be written to the at least one storage device.

12. The system of claim 11 , wherein the host is configured to map the source address to the encryption offload engine.

13. The system of claim 8 , wherein the encryption offload engine is configured to maintain a mapping table to map data for a peer-to-peer transfer with the at least one storage device to an address in the host.

14. The system of claim 13 , wherein the peer-to-peer transfer is associated with a write command from the host.

15. The system of claim 14 , wherein:

the at least one storage device is configured to initiate a peer-to-peer transfer from the encryption offload engine in response to the write command from the host; and

the encryption offload engine is configured to receive the data from the host, encrypt the data received from the host, and send the encrypted data to at the at least one storage device in response to the at least one storage device initiating the peer-to-peer transfer.

16. The system of claim 8 , wherein the encryption offload engine is further configured to:

receive encrypted data from at least one of the storage devices using the peer-to-peer connection in the interconnect fabric;

decrypt the encrypted data received from the at least one storage device; and

send the decrypted data to the host.

17. The system of claim 16 , wherein:

the system further comprises a submission queue configured to hold a read command from the host; and

the read command includes a destination address for the decrypted data from the at least one storage device.

18. The system of claim 17 , wherein the host is configured to map the destination address to the encryption offload engine.

19. An encryption device comprising:

an interface configured to couple the encryption device to an interconnect fabric having peer-to-peer capabilities, wherein the interconnect fabric comprises a switch connected between the encryption device and a storage device; and

a controller coupled to the interface and configured to:

receive, using a first connection to a host, data from a host using the interface;

encrypt the data received from the host to generate encrypted data; and

send, using a peer-to-peer connection, the encrypted data to a storage device using the interface, wherein the peer-to-peer connection uses the switch.

20. The encryption device of claim 19 , wherein the controller is further configured to:

receive encrypted data from the storage device using the interface;

decrypt the encrypted data received from the storage device to generate decrypted data; and

send the decrypted data to the host using the interface.