Systems and methods for NVME PDU data digest optimization
The throughput of a network appliance can be increased by a circuit that produces an encrypted block and a digest value while requiring only a single read of a data block. Data blocks, including a first data block, are stored in a memory that can be accessed by an ASIC that includes an encryption offload circuit. The ASIC can read the first data block from the memory and the encryption offload circuit can produce a first encrypted block and a first digest value from the first data block. The ASIC can produce a network packet that includes the first encrypted block and a data digest value. The first digest value is used to produce the data digest value, and a single read of the first data block from the memory is performed for producing the first encrypted block and also for calculating the first digest value.
1 . A network appliance comprising:
a memory that stores a plurality of data blocks that includes a first data block; and
an encryption offload circuit configured to produce encrypted blocks and digest values of the encrypted blocks,
wherein an encryption circuit in the encryption offload circuit is configured to produce encrypted data in response to receiving the first data block,
wherein a digest calculation circuit is configured to produce a first digest value in response to receiving the encrypted data directly from the encryption circuit,
wherein the encryption offload circuit stores a first encrypted block by writing the encrypted data to the memory,
wherein the network appliance is configured to produce a network packet that includes the first encrypted block and a data digest value produced using
the first digest value.
2 . The network appliance of claim 1 , further including:
a semiconductor chip that includes a memory interface and an on-chip communications fabric;
wherein the memory is outside of the semiconductor chip;
wherein the memory interface is configured to read from and write to the memory;
wherein the on-chip communications fabric communicatively connects the memory interface with the encryption offload circuit;
wherein the semiconductor chip receives the first data block from the memory via the memory interface; and
wherein the encryption offload circuit receives the first data block via the on-chip communications fabric.
3 . The network appliance of claim 1 , wherein:
a network interface card (NIC) includes the encryption offload circuit and the memory;
the NIC is installed in a host computer that includes a host memory; and
the NIC uses a peripheral component interface express (PCIe) bus to transfer the first data block from the host memory to the memory.
4 . The network appliance of claim 1 , further including:
a packet processing pipeline circuit that commands the encryption offload circuit to encrypt the first data block.
5 . The network appliance of claim 1 wherein:
the network packet includes a Non-Volatile Memory Express (NVMe) protocol data unit (PDU);
a PDU data field of the NVMe PDU includes the first encrypted block; and
a data digest field of the NVMe PDU includes the data digest value.
6 . The network appliance of claim 5 wherein:
the network packet is an internet protocol (IP) packet that encapsulates a transmission control protocol (TCP) packet; and
the NVMe PDU is a NVMe/TCP PDU that is included in a TCP payload of the TCP packet.
7 . The network appliance of claim 1 wherein:
the network packet is an IP packet that encapsulates a TCP packet that includes a TCP payload;
the TCP payload includes a NVMe/TCP PDU that has a PDU data field and a data digest field;
the PDU data field includes the first encrypted block; and
the data digest field includes the data digest value.
8 . The network appliance of claim 1 wherein:
the network packet is an IP packet that includes an IP payload;
the IP payload includes a NVMe/TCP PDU that has a PDU data field and a data digest field;
the PDU data field includes the first encrypted block; and
the data digest field includes the data digest value.
9 . The network appliance of claim 1 , wherein:
the plurality of data blocks includes a second data block;
a second encrypted block and a second digest value are produced by the encryption offload circuit;
the network packet includes the second encrypted block; and
the first digest value and the second digest value are used to produce the data digest value.
10 . The network appliance of claim 9 wherein:
the first digest value is a first cyclic redundancy check (CRC) value;
the second digest value is a second CRC value; and
an exclusive or (XOR) circuit uses the first CRC value and the second CRC value to produce the data digest value.
11 . The network appliance of claim 9 wherein:
the first digest value is a first cyclic redundancy check (CRC) value;
the second digest value is a second CRC value; and
a checksum circuit uses the first CRC value and the second CRC value to produce the data digest value.
12 . The network appliance of claim 9 wherein:
the first digest value is a first cyclic redundancy check (CRC) value;
the second digest value is a second CRC value; and
a summation circuit uses the first CRC value and the second CRC value to produce the data digest value.
13 . The network appliance of claim 9 wherein:
the first digest value is a first cyclic redundancy check (CRC) value;
the second digest value is a second CRC value; and
an Adler-32 circuit uses the first CRC value and the second CRC value to produce the data digest value.
14 . The network appliance of claim 9 wherein:
the first digest value is a first cyclic redundancy check (CRC) value;
the second digest value is a second CRC value; and
a CRC circuit produces the data digest value by using the first CRC value and the second CRC value as inputs.
15 . The network appliance of claim 14 , further including:
a semiconductor chip that includes the encryption offload circuit, a memory interface, a packet processing pipeline circuit, and an on-chip communications fabric,
wherein
the memory is outside of the semiconductor chip,
the memory interface is configured to read from and write to the memory,
the on-chip communications fabric communicatively connects the memory interface with the encryption offload circuit,
the semiconductor chip receives the first data block from the memory via the memory interface,
the encryption offload circuit receives the first data block via the on-chip communications fabric,
a NIC includes the semiconductor chip and the memory,
the NIC is installed in a host computer that includes a host memory,
the NIC uses a PCIe bus to transfer the first data block from the host memory to the memory,
the packet processing pipeline circuit commands the encryption offload circuit to encrypt the first data block,
the network packet includes a NVMe PDU,
a PDU data field of the NVMe PDU includes the first encrypted block,
a data digest field of the NVMe PDU includes the data digest value,
the network packet is an IP packet that encapsulates a TCP packet that includes a TCP payload, and
the NVMe PDU is a NVMe/TCP PDU that is included in the TCP payload.
16 . A method comprising:
storing a plurality of data blocks that includes a first data block in a memory;
producing a first encrypted block and a first digest value in response to receiving the first data block; and
producing a network packet that includes the first encrypted block and a data digest value produced using the first digest value,
wherein an encryption circuit is configured to produce encrypted data in response to receiving the first data block,
wherein the first digest value is produced in response to receiving the encrypted data directly from the encryption circuit, and
wherein the first encrypted block is stored by writing the encrypted data to the memory.
17 . The method of claim 16 , wherein:
the network packet includes a NVMe PDU;
a PDU data field of the NVMe PDU includes the first encrypted block; and
a data digest field of the NVMe PDU includes the data digest value.
18 . The method of claim 16 , further including:
producing a second encrypted block and a second digest value in response to receiving a second data block,
wherein:
the network packet includes the second encrypted block; and
the first digest value and the second digest value are used to produce the data digest value.
19 . A system comprising:
a memory means for storing a plurality of data blocks that includes a first data block;
an encryption means for producing encrypted data in response to receiving the data blocks;
a digest means for producing a plurality of digest values in response to receiving the encrypted data directly from the encryption means;
a means for storing encrypted blocks by storing the encrypted data in the memory means;
a means for using the digest values to produce a data digest value; and
a means for producing a network packet that includes at least one of the encrypted blocks and the data digest value.
20 . The system of claim 19 , wherein:
the network packet includes a NVMe PDU;
a PDU data field of the NVMe PDU includes the encrypted blocks; and
a data digest field of the NVMe PDU includes the data digest value.