Load balancing for a system of cryptographic processors

• US 7,870,395 B2
• Filed: 10/20/2006
• Issued: 01/11/2011
• Est. Priority Date: 10/20/2006
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Sutter, Siegfried K. H., Fayad, Camil, Dewkett, Thomas J., Li, John K., Yeh, Phil C.
• Primary Examiner(s): Simitoski; Michael J
• Application Number:
  US11/551,432
• Publication Number:
  US 20080098233A1
• Time in Patent Office: 1,544 Days
• Field of Search: 713189-190, 713192-193, 709/215, 712/10, 712/13, 712/17, 712/27
• US Class Current: 713/189
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 9/5083 Techniques for rebalancing the load in a distributed system

Abstract

In an array of groups of cryptographic processors, the processors in each group operate together but are securely connected through an external shared memory. The processors in each group include cryptographic engines capable of operating in a pipelined fashion. Instructions in the form of request blocks are supplied to the array in a balanced fashion to assure that the processors are occupied processing instructions.

Claims

1. A method for controlling cryptographic operations in a cryptographic processing system, the method comprising:

providing a plurality of instruction streams from a system memory;

supplying, via a controller, the plurality of instruction streams to a plurality of cryptographic processors of the cryptographic processing system, the supplying of the plurality of instruction streams to-the plurality of cryptographic processors initially based on addresses of the instructions within the system memory;

subsequent to beginning the supplying, dynamically partitioning by the controller at least a portion of the system memory into different dynamically partitioned regions to facilitate pipeline processing of cryptographic operations by the plurality of cryptographic processors based on the dynamically partitioned regions, the dynamically partitioned regions being various-sized regions of system memory, and being sized at least in part according to one or more attributes of the cryptographic operations being processed; and

supplying, via the controller, subsequent instruction streams to the plurality of cryptographic processors of the cryptographic processing system based on the dynamically partitioned regions in the system memory assigned.

2. The method of claim 1, wherein the supplying, via the controller, the plurality of instruction streams comprises supplying a balanced set of instruction streams from the system memory to the plurality of cryptographic processors, wherein the plurality of cryptographic processors are operating securely and in a coordinated fashion.

3. The method of claim 1, wherein the plurality of cryptographic processors comprise an array of groups of cryptographic processors, with the processors in each group operating securely and in a coordinated fashion.

4. The method of claim 3, in which at least one of said plurality of cryptographic processors includes a cryptographic engine capable of processing requests in a pipelined fashion.

5. The method of claim 3, in which each cryptographic processor of said plurality of cryptographic processors is a separate cryptographic processor chip comprising a cryptographic engine, a microprocessor for controlling said engine, an interface for supplying instructions to said cryptographic processor chip and a switch for controlling the flow of information amongst said engine, said microprocessor and said interface.

6. The method of claim 1, wherein the dynamically partitioning comprises dynamically partitioning by the controller the at least a portion of system memory into different dynamically partitioned regions of various sizes at least in part according to priority attributes of the cryptographic operations being processed by the plurality of cryptographic processors.

7. The method of claim 1, wherein the dynamically partitioning comprises dynamically partitioning by the controller the at least a portion of system memory into different dynamically partitioned regions of various sizes at least in part according to size attributes of the cryptographic operations being processed by the plurality of cryptographic processors.

8. A cryptographic processing system for carrying out cryptographic operations, said system comprising:

a system memory; and

a plurality of cryptographic processors in communications with the system memory via a controller, wherein the cryptographic processing system is configured to perform a method, the method comprising;

providing a plurality of instruction streams from the system memory;

supplying, via the controller. the plurality of instruction streams to the plurality of cryptographic processors of the cryptographic processing system, the supplying of the plurality of instruction streams to the plurality of cryptographic processors initially based on addresses of the instructions within the system memory;

subsequent to beginning the supplying, dynamically partitioning by the controller at least a portion of the system memory into different dynamically partitioned regions to facilitate pipelined processing of cryptographic operations by the plurality of cryptographic processors based on the dynamically partitioned regions, the dynamically partitioned regions being various-sized regions of system memory, and being sized at least in part according to one or more attributes of the cryptographic operations being processed; and

supplying, via the controller, subsequent instruction streams to the plurality of cryptographic processors of the cryptographic processing system based on the dynamically partitioned regions in system memory assigned.

9. The system of claim 8, wherein the dynamically partitioning comprises dynamically partitioning by the controller the at least a portion of system memory into different dynamically partitioned regions of various sizes at least in part according to priority attributes of the cryptographic operations being processed by the plurality of cryptographic processors.

10. The system of claim 8, wherein the dynamically partitioning comprises dynamically partitioning by the controller the at least a portion of system memory into different dynamically partitioned regions of various sizes at least in part according to size attributes of the cryptographic operations being processed by the plurality of cryptographic processors.

11. The system of claim 8 in which all of said cryptographic processors include a cryptographic engine capable of processing requests in a pipelined fashion.