Abstract:
A system and method for improving performance while transferring encrypted data in an input/output (I/O) operation are provided. The method includes receiving a block of data. The method also includes dividing the block of data into a plurality of sub-blocks of data. The method further includes performing a first operation on a first sub-block. The method also includes performing a second operation on a second sub-block at substantially the same time as performing the first operation on the first sub-block. The method still further includes reassembling the plurality of sub-blocks into the block of data.

Description:
CROSS-REFERENCE TO RELATED APPLICATION(S) AND CLAIM OF PRIORITY 
       [0001]    The present application is related to U.S. Provisional Patent Application No. 61/266,829, filed Dec. 4, 2009, entitled “METHODS FOR INCREASING I/O PERFORMANCE IN SYSTEMS HAVING AN ENCRYPTION CO-PROCESSOR”. Provisional Patent Application No. 61/266,829 is assigned to the assignee of the present application and is hereby incorporated by reference into the present application as if fully set forth herein. The present application hereby claims priority under 35 U.S.C. §119(e) to U.S. Provisional Patent Application No. 61/266,829. 
     
    
     TECHNICAL FIELD 
       [0002]    The present disclosure is directed, in general, to data input/output (I/O) operations, and more specifically, to methods for improving I/O performance in systems having one or more encryption co-processors. 
       BACKGROUND 
       [0003]    When adding encryption/decryption to a computing system that includes a data storage component, such as a hard disk drive (HDD), input/output (I/O) performance to the HDD can suffer due to the added step of encrypting/decrypting the data. For example, if cryptographic algorithms are applied in series with large transfers to or from the HDD, this can be detrimental to the overall system performance. 
         [0004]    There is, therefore, a need in the art for I/O methods that improve system performance between computing systems with encryption co-processors and their associated data storage components. 
       SUMMARY 
       [0005]    A method for transferring encrypted data in an input/output (I/O) operation is provided. The method includes receiving a block of data. The method also includes dividing the block of data into a plurality of sub-blocks of data. The method further includes performing a first operation on a first sub-block. The method also includes performing a second operation on a second sub-block at substantially the same time as performing the first operation on the first sub-block. The method still further includes reassembling the plurality of sub-blocks into the block of data. 
         [0006]    A system for transferring encrypted data in an I/O operation is provided. The system includes a data splitting engine configured to receive a block of data, divide the block of data into a plurality of sub-blocks of data, and reassemble the plurality of sub-blocks into the block of data. The system also includes a processor configured to perform a first operation on a first sub-block. The system further includes an encryption processor in communication with the processor, the encryption processor configured to perform a second operation on a second sub-block at substantially the same time as the processor performs the first operation on the first sub-block. 
         [0007]    A computer program product for transferring encrypted data in an input/output (I/O) operation is provided. The computer program product includes a tangible machine-readable medium encoded with computer-executable instructions that when executed cause a data processing system to perform the steps of the method described above. 
         [0008]    Other technical features may be readily apparent to one skilled in the art from the following figures, descriptions and claims. 
         [0009]    Before undertaking the DETAILED DESCRIPTION below, it may be advantageous to set forth definitions of certain words and phrases used throughout this patent document: the terms “include” and “comprise,” as well as derivatives thereof, mean inclusion without limitation; the term “or,” is inclusive, meaning and/or; the phrases “associated with” and “associated therewith,” as well as derivatives thereof, may mean to include, be included within, interconnect with, contain, be contained within, connect to or with, couple to or with, be communicable with, cooperate with, interleave, juxtapose, be proximate to, be bound to or with, have, have a property of, or the like; and the term “controller” means any device, system or part thereof that controls at least one operation, such a device may be implemented in hardware, firmware or software, or some combination of at least two of the same. It should be noted that the functionality associated with any particular controller may be centralized or distributed, whether locally or remotely. Definitions for certain words and phrases are provided throughout this patent document, those of ordinary skill in the art should understand that in many, if not most instances, such definitions apply to prior, as well as future uses of such defined words and phrases. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0010]    For a more complete understanding of the present disclosure and its advantages, reference is now made to the following description taken in conjunction with the accompanying drawings, in which like reference numerals represent like parts: 
           [0011]      FIG. 1  depicts a block diagram of a data processing system capable of implementing a system in accordance with embodiments of the present disclosure; 
           [0012]      FIG. 2  depicts a single interleaved I/O operation for a block of data between an operating system and an associated data storage device, according to embodiments of the present disclosure; 
           [0013]      FIG. 3  depicts a single sequential I/O operation for a block of data between an operating system and an associated data storage device, according to embodiments of the present disclosure; 
           [0014]      FIG. 4  depicts a graph showing a combined performance impact for various split values, according to one embodiment of the present disclosure; and 
           [0015]      FIG. 5  depicts a graph showing a combined performance impact for various split values, according to another embodiment of the present disclosure. 
       
    
    
     DETAILED DESCRIPTION 
       [0016]      FIGS. 1 through 5 , discussed below, and the various embodiments used to describe the principles of the present disclosure in this patent document are by way of illustration only and should not be construed in any way to limit the scope of the disclosure. Those skilled in the art will understand that the principles of the present disclosure may be implemented in any suitably arranged transmission medium. 
         [0017]    To improve I/O performance by minimizing the detrimental effects of transferring a large block of encrypted data in series, a single I/O operation may be broken up into smaller data units. The cryptographic operation can then be applied to the smaller units in parallel with the subsequent disk transfers, thereby creating interleaved subordinate operations. A data splitting engine is disclosed herein that is responsible for splitting and reassembling the encrypted units, as described below. 
         [0018]      FIG. 1  depicts a block diagram of a data processing system capable of implementing a system in accordance with embodiments of the present disclosure. Data processing system  100  includes a processor  102  (e.g., a central processing unit, or “CPU”) connected to a local system bus  106 . Local system bus  106  may be, for example, a peripheral component interconnect (PCI) architecture bus. Also connected to local system bus  106  in the depicted example are a main memory  104  and a graphics adapter  110 . The graphics adapter  110  may be connected to display  111 . Collectively, processor  102  and memory  104  may represent all or part of an operating system  108 . 
         [0019]    Other peripherals, such as network adapter  112 , may also be connected to local system bus  106 . Expansion bus interface  114  connects local system bus  106  to input/output (I/O) bus  116 . I/O bus  116  is connected to keyboard/mouse adapter  118 , disk controller  120 , and I/O adapter  122 . Disk controller  120  can be connected to a storage  126 , which can be any suitable machine usable or machine readable storage medium, including but not limited to nonvolatile, hard-coded type mediums such as read only memories (ROMs) or erasable, electrically programmable read only memories (EEPROMs), magnetic tape storage, and user-recordable type mediums such as flash drives, hard disk drives and compact disk read only memories (CD-ROMs) or digital versatile disks (DVDs), and other known optical, electrical, or magnetic storage devices. 
         [0020]    Also connected to I/O bus  116  in the example shown is audio adapter  124 , to which speakers (not shown) may be connected for playing sounds. Keyboard/mouse adapter  118  provides a connection for a pointing device (not shown), such as a mouse, trackball, track pointer, etc. 
         [0021]    Network adapter  112  can be connected to a network  150 , which can be any public or private data processing system network or combination of networks, as known to those of skill in the art, including the Internet. Data processing system  100  can communicate over network  150  with server system  160 , which can be implemented as a separate data processing system. 
         [0022]    In accordance with embodiments of the present disclosure, data processing system also includes data encryption co-processor  130  and data splitting engine  140 . Data encryption co-processor  130  and data splitting engine  140  are in communication with other parts of system  100 , including processor  102 , disk controller  120 , and storage  126 . 
         [0023]    Those of ordinary skill in the art will appreciate that the components depicted in  FIG. 1  may vary for particular embodiments. For example, processor  102  may actually represent a multi-processor or a distributed processing system. Likewise, operating system  108  may include additional or other components, including those already depicted in  FIG. 1 . Other peripheral devices, such as an optical disk drive and the like, also may be used in addition or in place of the components depicted. Furthermore, although data encryption co-processor  130  and data splitting engine  140  are shown as separate components, they may be implemented together as one component, or as part of one or more other components, such as processor  102 . The depicted example is provided for the purpose of explanation only and is not meant to imply architectural limitations with respect to the present disclosure. 
         [0024]      FIG. 2  depicts a single interleaved I/O operation for a block of data between an operating system and an associated data storage device, according to embodiments of the present disclosure. For ease of explanation, I/O operation  200  shown in  FIG. 2  is described with respect to the data processing system  100  of  FIG. 1 . However, it will be understood that I/O operation  200  may be implemented with any other suitable system or device. Although the embodiment depicted in  FIG. 2  describes communication with a data storage device (e.g., storage  126 ), it is understood that encryption co-processors may be used in communication other than to a data storage device. For example, embodiments of the present disclosure may be used in communication across networks (e.g., network  150 ) or other communication mechanisms. 
         [0025]    In the embodiment depicted in  FIG. 2 , I/O operation  200  is a read operation of a block of data from storage  126  to operating system  108 . A write operation according to the present disclosure would include the same or similar components; however, the operation would be performed in the opposite direction. In the example embodiment, storage  126  is a HDD having a serial advanced technology attachment (SATA) adapter. In one advantageous embodiment, the block of data that is read from HDD  126  to operating system  108  is 128 kilobytes (128 KB) of data. However, it is understood that other block sizes are possible. 
         [0026]    Data splitting engine  140  divides a block of data to be transferred in I/O operation  200  into N sub-blocks of data. I/O operation  200  is also divided into subordinate I/O operations, or steps, where the steps are generally indicated in  FIG. 2  by the letters A through H. Steps A, B, and C of I/O operation  200  correspond to the operation up to the point where the frame information structure (FIS) is received at HDD  126 . Steps A, B, and C are repeated for each of the N sub-blocks of data, as indicated by reference numeral  202 . 
         [0027]    Step A represents the time it takes for data splitting engine  140  to split each sub-block of data in I/O operation  200  from the larger data block. This is a CPU-intensive operation. In one embodiment, data splitting engine  140  parses out each sub-block of data from the data block at the time that the sub-block is ready to be processed. In another embodiment, the entire data block is first divided into N data sub-blocks, and the N sub-blocks are then stored until they are ready to be processed. 
         [0028]    Step B represents the time for the I/O operation to be sent to HDD  126 . This includes the scatter/gather time and FIS construction time. Step C is the time required for the SATA bus to receive the FIS. In a typical HDD, this value is a constant. 
         [0029]    Steps D, E, and F of I/O operation  200  correspond to the direct memory access (DMA) of the data from the HDD to host memory. Steps D, E, and F are also repeated for each of the N sub-blocks of data, as indicated by reference numeral  204 . Step D corresponds to the drive delay (e.g., the seek time). Step E represents the DMA of data from HDD  126  to host memory. Step F includes the time to complete the following components: the notification to data splitting engine  140  that the split is complete, the overhead of data splitting engine  140  to queue the data block to encryption co-processor  130 , and the encryption co-processor program time. 
         [0030]    Finally, steps G and H of I/O operation  200  correspond to the DMA of data from host memory, then back to host memory. Steps G and H are also repeated for each of the N sub-blocks of data, as indicated by reference numeral  206 . Specifically, step G corresponds to the encryption co-processor DMA from host memory and back to host memory. Essentially, G represents a performance capability of encryption co-processor  130 . This is described below in greater detail. Step H represents the encryption co-processor interrupt processing time and the processing time for data splitting engine  140  to coalesce the N sub-blocks of data back to one complete data block (e.g., the original 128 KB data block). In one embodiment, each sub-block may be added to the data block as the I/O operation for that sub-block completes. In another embodiment, all of the sub-blocks may be reassembled at the same time, once the I/O operation for the final sub-block completes. This is analogous to the described alternative methods of splitting the data block in step A. 
         [0031]    As shown in  FIG. 2 , steps A through H are interleaved so that different sub-blocks of data are processed in parallel (i.e., at the same time or substantially the same time) in different I/O operations. For example,  FIG. 2  shows that while the request for the second sub-block of data is being sent to HDD  126  (step B in operation  202 ), the first sub-block of data is being transferred from HDD  126  to host memory (step E in operation  204 ). As another example, while the Nth (e.g., third) sub-block of data is being split out from the larger data block (step A in operation  202 ), the second sub-block is transferred from HDD  126  to host memory (step E in operation  204 ), and the first sub-block is being reassembled into the final data block (step H in operation  206 ). 
         [0032]    Although  FIG. 2  depicts one example embodiment of an interleaved I/O operation, it will be understood that various modifications to the embodiment of  FIG. 2  are possible. For example, the amount of time required by each step A through H may vary from those depicted in  FIG. 2 . As another example, the steps performed in each parallel operation  202 - 206  may also vary between embodiments. Similarly, although  FIG. 2  depicts three parallel operations  202 - 206 , more or fewer parallel operations are possible. 
         [0033]    In contrast to interleaved I/O operation  200 ,  FIG. 3  depicts a single sequential I/O operation for a block of data between an operating system and an associated data storage device, according to embodiments of the present disclosure. For ease of explanation, I/O operation  300  shown in  FIG. 3  is described with respect to the data processing system  100  of  FIG. 1 . However, it will be understood that I/O operation  300  may be implemented with any other suitable system or device. 
         [0034]    Like interleaved I/O operation  200 , sequential I/O operation  300  is a read operation of a block of data from storage  126  to operating system  108 . A write operation according to the present disclosure would include the same or similar components; however, the operation would be performed in the opposite direction. In the example embodiment, storage  126  is a HDD having a serial advanced technology attachment (SATA) adapter. In one advantageous embodiment, the block of data that is read from HDD  126  to operating system  108  is 128 kilobytes (128 KB) of data. However, it is understood that other block sizes are possible. 
         [0035]    As in interleaved I/O operation  200  in  FIG. 2 , the block of data to be transferred in sequential I/O operation  300  is divided into N sub-blocks of data. I/O operation  300  is also divided into steps A through H. Steps A through H are repeated for each of the N sub-blocks of data, as indicated in  FIG. 3 . However, unlike the interleaved subordinate operations described in  FIG. 2 , the steps in I/O operation  300  are sequential. Each sub-block of data is processed completely (i.e., steps A through H are performed on each sub-block) before the next sub-block of data is processed. Only one process or operation occurs at a time. 
         [0036]    Time I represents the total time of sequential I/O operation  300 , where the sum of D, E, and G are assumed to be constant for any value N. Other values increase with the value of N. The total time I is determined according to the formula below: 
         [0000]    
       
         
           
             I 
             = 
             
               
                 ∑ 
                 
                   i 
                   = 
                   1 
                 
                 n 
               
                
               
                   
               
                
               
                 ( 
                 
                   
                     A 
                     i 
                   
                   + 
                   
                     B 
                     i 
                   
                   + 
                   
                     C 
                     i 
                   
                   + 
                   
                     D 
                     i 
                   
                   + 
                   
                     E 
                     i 
                   
                   + 
                   
                     F 
                     i 
                   
                   + 
                   
                     G 
                     i 
                   
                   + 
                   
                     H 
                     i 
                   
                 
                 ) 
               
             
           
         
       
     
         [0037]    In this formula, the values A, B, C, D, E, F, G, and H correspond to the times elapsed in the steps described above. Because each step in I/O operation  300  is performed in sequence, time I reflects no advantage or performance improvement from interleaving. In contrast, the interleaving of subordinate I/O operations in I/O operation  200  provides a performance improvement over sequential I/O operation  300 . The performance improvement in I/O operation  200  due to the data splitting engine and interleaving can be defined and measured. Referring back to  FIG. 2 , time J represents the total time of interleaved I/O operation  200 . Total time J is determined according to the formula below: 
         [0000]    
       
         
           
             
               J 
                
               
                 ( 
                 n 
                 ) 
               
             
             = 
             
               
                 
                   A 
                   1 
                 
                  
                 f 
               
               + 
               
                 ( 
                 
                   
                     ∑ 
                     
                       i 
                       = 
                       2 
                     
                     n 
                   
                    
                   
                       
                   
                    
                   
                     ( 
                     
                       
                         
                           A 
                           i 
                         
                          
                         f 
                       
                       + 
                       
                         
                           B 
                           i 
                         
                          
                         f 
                       
                       + 
                       
                         C 
                         i 
                       
                     
                     ) 
                   
                 
                 ) 
               
               + 
               
                 
                   F 
                   n 
                 
                  
                 f 
               
               + 
               
                 ( 
                 
                   G 
                   n 
                 
                 ) 
               
               + 
               
                 
                   H 
                   n 
                 
                  
                 f 
               
             
           
         
       
     
         [0038]    In this formula, n is equal to N, the number of data sub-blocks split from the larger data block. The following variable is also defined: 
         [0039]    f=CPU Factor 
         [0040]    The variable f represents the performance capabilities of the CPU. This is analogous to the variable G, which represents a performance capability of the encryption co-processor. Low values for f and G correspond to a high-performance (i.e., fast) operation. The variable f is included in the formula because the CPU speed necessarily has an impact on the time it takes to complete an I/O operation. In a theoretical system where f equals zero (i.e., an infinitely fast CPU), the formula for the total time J is simplified to the following formula: 
         [0000]    
       
         
           
             
               
                 J 
                  
                 
                   ( 
                   n 
                   ) 
                 
               
               
                 f 
                 = 
                 0 
               
             
             = 
             
               
                 ( 
                 
                   
                     ∑ 
                     
                       i 
                       = 
                       2 
                     
                     n 
                   
                    
                   
                       
                   
                    
                   
                     ( 
                     
                       C 
                       i 
                     
                     ) 
                   
                 
                 ) 
               
                
               
                 ( 
                 
                   G 
                   n 
                 
                 ) 
               
             
           
         
       
     
         [0041]    A combined performance impact K can also be defined. The combined performance impact takes into account the performance capability of the HDD (defined by variable L) and the performance capability of the encryption co-processor (defined by variable G). Depending on whether or not the HDD has a higher performance capability than the encryption co-processor (i.e., whether L&lt;G or L&gt;=G), the combined transfer rate K is defined by one of the two formulas below: 
         [0000]    
       
         
           
             
               K 
               
                 L 
                 &lt; 
                 G 
               
             
             = 
             
               L 
               + 
               
                 J 
                  
                 
                   ( 
                   n 
                   ) 
                 
               
             
           
         
       
       
         
           
             
               K 
               
                 L 
                 &gt;= 
                 G 
               
             
             = 
             
               
                 L 
                 n 
               
               + 
               
                 ( 
                 
                   G 
                   - 
                   
                     G 
                     n 
                   
                 
                 ) 
               
               + 
               
                 J 
                  
                 
                   ( 
                   n 
                   ) 
                 
               
             
           
         
       
     
         [0042]      FIG. 4  depicts a graph showing combined performance impact K for various values of N, the number of sub-blocks of data, according to one embodiment of the present disclosure. In the embodiment depicted in the graph, the CPU factor f equals zero (i.e., a theoretical CPU having infinite speed), and the encryption co-processor performance value G equals 100 megabytes/second (100 MB/sec). Value C (the time required for the SATA bus to receive the FIS) is assumed to be approximately zero, the theoretical minimum. The graph depicts performance for a number of different HDD speeds, from 40 megabytes/second to 200 megabytes/second (40 MB/sec-200 MB/sec). For each speed, as the number of sub-blocks of data is increased, the combined performance K improves. 
         [0043]      FIG. 5  depicts a graph showing combined performance impact K for various values of N, the number of sub-blocks of data, according to another embodiment of the present disclosure. In this embodiment, the CPU factor f also equals zero, but the encryption co-processor performance value G now equals 200 megabytes/second (200 MB/sec). Value C is once again assumed to be approximately zero, the theoretical minimum. The graph in  FIG. 4  also depicts performance for a number of different HDD speeds, from 40 megabytes/second to 200 megabytes/second (40 MB/sec-200 MB/sec). For each speed, as the number of sub-blocks of data is increased, the HDD performance improves. 
         [0044]    As the graphs in  FIGS. 4 and 5  show, it is possible to obtain different levels of performance improvement by selecting different values for N. Because the optimal value of N may not be empirically available for every HDD, data block size, and/or other environmental parameter, it may be necessary or desirable to dynamically tune the value of N, thereby adjusting the size of the data sub-blocks. In one embodiment, a first value of N is chosen, then one or more data blocks are transferred in an I/O operation such as interleaved I/O operation  200 . Once the I/O operation of the one or more data blocks is complete, performance metrics of the I/O operation are obtained and examined. If the performance metrics are close enough to a desired value, the current value of N may be identified as the optimal value for that particular I/O environment. Alternatively, if the performance metrics are not close enough to the desired value, the value of N may be adjusted higher or lower. The I/O operation is then performed again using the new value of N. 
         [0045]    Note that various details have been provided above describing specific implementations of a system that interleaves an I/O operation for a block of encrypted data. These details are provided for illustration and explanation of the specific implementations. Various modifications to the specific implementations may be made according to particular needs. 
         [0046]    In some embodiments, various functions described above are implemented or supported by a computer program that is formed from computer readable program code and that is embodied in a computer readable medium. The phrase “computer readable program code” includes any type of computer code, including source code, object code, and executable code. The phrase “computer readable medium” includes any type of medium capable of being accessed by a computer, such as read only memory (ROM), random access memory (RAM), a hard disk drive, a compact disc (CD), a digital video disc (DVD), or any other type of memory. 
         [0047]    While this disclosure has described certain embodiments and generally associated methods, alterations and permutations of these embodiments and methods will be apparent to those skilled in the art. Accordingly, the above description of example embodiments does not define or constrain this disclosure. Other changes, substitutions, and alterations are also possible without departing from the spirit and scope of this disclosure, as defined by the following claims.