Secured I/O in the Cloud with NVMe-Over-TCP
summary
An implementation adds user-space TLS daemon that receives kernel sockets via netlink, performs TLS 1.3 handshakes, and pushes negotiated IVs into the kernel so NVMe-over-TCP connections use encryption; PSKs live in the Linux keyring and nvme-cli can provision them, with per-queue handshakes performed for each IO connection. It works end-to-end today, hits a practical CPU-bound ceiling (~40–50 Gbit/s) without crypto offload, and aims to add key rotation, X.509 identities and offload support once spec updates land.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:06NVMe-over-TCP encryption necessity
- 2:34NVMe-over-TCP basics
- 6:52Encrypting NVMe-over-TCP challenges
- 10:43Kernel TLS limits and workarounds
- 13:20TLS pre-shared key management
- 16:54TLS handshake in NVMe-over-TCP
- 19:26Two encrypted connection methods
- 21:35TLS offload challenges and future
- 24:50Key refresh and cert authentication
- 27:00NVMe-over-TCP encryption status
- 28:27Q&A
- 30:33Q&A
- 32:43Q&A
- 33:50Q&A
- 36:43Q&A
- 38:55Conclusion
related talks
37mSPDK Based User Space NVMe Over TCP Transport Solution
37mSPDK Based User Space NVMe Over TCP Transport Solution
17mRearchitecting the TCP Stack for I/O-Offloaded Content Delivery
16mEmbracing NVMe/TCP on the desktop
50mOptimizing for NVMe Drives: The 10 Microsecond Challenge
31mA Practical, Research‑Backed Introduction To Cloud‑Native Kernel‑Bypass Networking
33mKey Per IO Security Subsystem Class for NVM Express Storage Devices
30mOffloading QUIC Encryption to Enabled NICs