Virtio-crypto

ethXuserland

kernel

Virtio-net Driver

Network stack

IPSec

Crypto framework

CryptoAPI “lib”/dev/crypto

Virtio-cryptoDriver

vtiX:1

VNFC in a VM

Virtual Networking

Virtio-net-backend Driver

Virtio-crypto-backend Driver

HW1Driver

HW2Driver

Crypto framework

Hypervisor domain

OpenSSL “lib”

Web Server

App

VNFC in a VM

DPDK/ODP

DPDKVirtio-net

DPDK/ODP Crypto Framework

Virtio-cryptoDriver

Virtio-crypto-backend Driver

HW1Driver

HW2Driver

Crypto frameworkVirtual Networking

Virtio-net-backend Driver

Hypervisor domain

Web ServerApp

TCP/IP IPSec

CryptoAPI “lib”SSL “lib”

Virtio-compression

userland

kernel

Virtio-block Driver

File Systems

VFS, e3comprCompression framework

zlib, libarchive/dev/compression

Virtio-compressionDriver

Application in a VM

Virtio-block-backend Driver Virtio-compression-backend Drivers

HW1Driver

HW2Driver

Hypervisor domain

Backup ArchiverApp

Adapt existing libraries to use system calls and compression devices

Define new virtio classes

HWDriver

Ensure kernel uses compression framework

File system read/write

Layers of APIs and entities

• (Open)SSL• Presents a value-added API to applications• Leverages crypto lib• Can be asynchronous&stateless (today’s typical), or some combination

• Internal adaptation layer between sync/async and stateful/stateless

• Crypto LIB• Presents a basic crypto API to applications and other libraries• Leverages kernel crypto API (Netlink/AF_ALG), may also use crypto support in ISA• Can be asynchronous&stateless (today’s typical), or some combination

• Internal adaptation layer between sync/async and stateful/stateless

• Kernel crypto framework• Implements kernel crypto functionality• Provides service to internal (e.g. networking stack/IPSec) and external (through crypto API) clients

• Virtio-crypto guest driver• Presents a driver to the kernel crypto framework• Normally asynchronous and stateful/stateless• Talks Virtqueues (and likely vrings) to the hypervisor

• Virtio-crypto hypervisor driver• HW-specific driver presents an abstract (implementation independent) interface to guests• Normally asynchronous and stateful/stateless