CPRAM: Cryptographic Performance-Aware Resource Affinity Management in Para-virtualized Environment

The rapid growth of cloud computing has made security a key challenge, with cryptographic technology playing a central role in ensuring the integrity and confidentiality of cloud services. Cryptographic services in the cloud are typically implemented using virtualized cryptographic resources, such as Virtual Cryptographic Machines (VCMs), which allow multiple tenants to share hardware cryptographic cards. The DPDK-based para-virtualized cryptographic card solution experiences performance degradation in NUMA-based multi-core systems due to cross-node memory access and resource affinity. This paper addresses these challenges by proposing Cryptographic Performance-Aware Resource Affinity Management (CPRAM), a method that optimizes cryptographic resource allocation while maintaining load balancing across shared system resources. CPRAM enhances VCM performance by considering both global hardware resource affinity and the impact of Intel DDIO on cryptographic card throughput. We establish priori models for affinity optimization. Our approach also mitigates the overhead of memory page migration through a multi-threaded migration strategy. We implement the prototype system and demonstrate the effectiveness of CPRAM on an Intel platform. The results show significant improvements in cryptographic performance, making CPRAM an efficient and scalable solution for cloud cryptographic services.