{"id":75939,"date":"2020-03-29T19:42:19","date_gmt":"2020-03-29T17:42:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kompaniya-cloudflare-podgotovila-patchi-kardinalno-uskoryayushhie-diskovoe-shifrovanie-v-linux"},"modified":"2020-03-29T19:42:19","modified_gmt":"2020-03-29T17:42:19","slug":"kompaniya-cloudflare-podgotovila-patchi-kardinalno-uskoryayushhie-diskovoe-shifrovanie-v-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/kompaniya-cloudflare-podgotovila-patchi-kardinalno-uskoryayushhie-diskovoe-shifrovanie-v-linux","title":{"rendered":"Cloudflare has prepared patches that significantly speed up disk encryption in Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Developers from Cloudflare , that over the past three years, the company has spent $30 billion on expanding its data center network. Since then, this figure has only increased.<\/a><\/noindex> discussed their work on optimizing the performance of disk encryption in the Linux kernel. As a result, they prepared patches<\/a><\/noindex> for the subsystem dm-crypt<\/a><\/noindex> and Crypto API, which allowed them to more than double the throughput in synthetic tests for reading and writing, as well as reduce latencies by half. When tested on actual hardware, the overhead from encryption was reduced to almost the level observed when operating with a disk that does not use data encryption.<\/p>\n

Cloudflare uses dm-crypt for data encryption on the storage devices used for content caching in its CDN network. Dm-crypt operates at the block device level and performs encryption for write input\/output requests and decryption for read requests, acting as a layer between the block device and the file system driver. <\/p>\n

\"Cloudflare<\/a><\/noindex><\/center><\/p>\n

To assess the performance of dm-crypt using the package Flexible I\/O tester<\/a><\/noindex> measurements were taken of the performance with encrypted and unencrypted partitions on a RAM disk, located in RAM to eliminate fluctuations in disk performance and focus on code performance. For unencrypted partitions, the read and write performance remained at 1126 MB\/s, but when encryption was enabled, the speed dropped by 7 times<\/b> to 147 MB\/s. <\/p>\n

Initially, there was suspicion of inefficient algorithms being used in the core cryptosystem. However, the fastest algorithm, aes-xts with a 256-bit encryption key, was employed in the tests, and its performance, as measured by the 'cryptsetup benchmark,' was more than twice that of the result obtained when testing the RAM drive. Experiments with dm-crypt flags for performance tuning did not yield positive results: using the flag '--perf-same_cpu_crypt' even decreased performance to 136 MB\/s, while specifying the flag '--perf-submit_from_crypt_cpus' only increased it to 166 MB\/s.<\/p>\n

A deeper analysis of the operational logic revealed that dm-crypt is not as straightforward as it seems. When there is a write request from the FS driver, dm-crypt does not process it immediately but places it in the 'kcryptd' queue, which is not handled right away but rather when a suitable moment arises. From the queue, the request is sent to the Linux Crypto API for encryption execution. However, since the Crypto API utilizes an asynchronous execution model, the encryption is also not performed immediately, but rather goes through another queue. Once encryption is completed, dm-crypt may attempt to sort the pending write requests using a search tree. red-black<\/a><\/noindex>. At the end, a separate kernel thread again picks up the accumulated input\/output requests with a certain delay and sends them to the block device stack.<\/p>\n

\"Cloudflare<\/a><\/noindex><\/center><\/p>\n

When reading, dm-crypt first adds a request to the 'kcryptd_io' queue to retrieve data from the storage. After a while, the data becomes accessible and is placed in the 'kcryptd' queue for decryption.
\nKcryptd sends a request to the Linux Crypto API, which decrypts the information in asynchronous mode. Requests do not always get through all queues, but in the worst-case scenario, a write request can sit in queues up to 4 times, while a read request can sit up to 3 times. Each entry into a queue leads to delays, which are the key reason for the significant drop in dm-crypt performance. <\/p>\n

The use of queues is due to the necessity of operating under interruption conditions. In 2005, when the current queue-based model of dm-crypt was implemented, the Crypto API was not yet asynchronous. After transitioning the Crypto API to an asynchronous execution model, a form of double protection came into play. Queues were also introduced to save kernel stack usage, but after its increase in 2014, these optimizations became less relevant. An additional queue, 'kcryptd_io', was introduced to overcome the bottleneck leading to memory allocation waits when a large number of requests arrived. In 2015, a sorting phase was added since encryption requests on multiprocessor systems could finish out of the order they were sent (instead of sequential disk access, random access occurred, and the CFQ scheduler was inefficient). Currently, with SSDs, sorting has lost its relevance, and the CFQ scheduler is no longer used in the kernel.<\/p>\n

Considering that modern drives have become faster and smarter, the resource allocation system in the Linux kernel has been re-evaluated, and some subsystems have been redesigned, engineers from Cloudflare added<\/a><\/noindex> In dm-crypt, a new operational mode has been introduced that eliminates the use of unnecessary queues and asynchronous calls. This mode is activated with the separate flag 'force_inline', transforming dm-crypt into a simple proxy that encrypts and decrypts incoming requests. Interaction with the Crypto API has been optimized by explicitly selecting encryption algorithms that operate in synchronous mode and do not use request queues. For synchronous operation with the Crypto API, there was introduced<\/a><\/noindex> module has been introduced that allows the use of FPU\/AES-NI for acceleration and directly passes through encryption and decryption requests.<\/p>\n

As a result, testing with a RAM disk managed to increase the performance of dm-crypt by more than twice \u2014 performance rose from 294 MB\/s (2 x 147 MB\/s) to 640 MB\/s, which is very close to the performance of raw encryption (696 MB\/s).
\n

\"Cloudflare<\/a><\/noindex><\/center>
\n
\"Cloudflare<\/a><\/noindex><\/center>
\n
\"Cloudflare<\/a><\/noindex><\/center><\/p>\n

During load testing on real servers, the new implementation demonstrated performance very close to the configuration operating without encryption, and enabling encryption on servers with Cloudflare's cache had no impact on response time. In the future, Cloudflare plans to submit the prepared patches for inclusion in the main Linux kernel, but they will need to be revised first, as they are optimized for specific loads and do not cover all use cases, such as encryption on low-powered embedded devices.<\/p>\n

\"Cloudflare<\/a><\/noindex><\/center><\/p>\n

<\/a><\/noindex><\/p>\n

Source: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Cloudflare \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438 \u043e \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0438 \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0434\u0438\u0441\u043a\u043e\u0432\u043e\u0433\u043e \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u044f\u0434\u0440\u0435 Linux. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0431\u044b\u043b\u0438 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u044b \u043f\u0430\u0442\u0447\u0438 \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b dm-crypt \u0438 Crypto API, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0432\u0448\u0438\u0435 \u0432 \u0441\u0438\u043d\u0442\u0435\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0442\u0435\u0441\u0442\u0435 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c \u0432 \u0434\u0432\u0430 \u0440\u0430\u0437\u0430 \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u043f\u0443\u0441\u043a\u043d\u0443\u044e \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438 \u0447\u0442\u0435\u043d\u0438\u0438 \u0438 \u0437\u0430\u043f\u0438\u0441\u0438, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432 \u0434\u0432\u0430 \u0440\u0430\u0437\u0430 \u0441\u043d\u0438\u0437\u0438\u0442\u044c \u0437\u0430\u0434\u0435\u0440\u0436\u043a\u0438. \u041f\u0440\u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438 \u043d\u0430 \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u043c \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":75940,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-75939","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Cloudflare has prepared patches that dramatically accelerate disk encryption in Linux | ProHoster","description":"Developers from Cloudflare reported on their work to optimize performance.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/kompaniya-cloudflare-podgotovila-patchi-kardinalno-uskoryayushhie-diskovoe-shifrovanie-v-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u043b\u0430 \u043f\u0430\u0442\u0447\u0438, \u043a\u0430\u0440\u0434\u0438\u043d\u0430\u043b\u044c\u043d\u043e \u0443\u0441\u043a\u043e\u0440\u044f\u044e\u0449\u0438\u0435 \u0434\u0438\u0441\u043a\u043e\u0432\u043e\u0435 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 Linux | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Cloudflare \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438 \u043e \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0438 \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/kompaniya-cloudflare-podgotovila-patchi-kardinalno-uskoryayushhie-diskovoe-shifrovanie-v-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-29T17:42:19+00:00","article:modified_time":"2020-03-29T17:42:19+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"75939","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:46:22","updated":"2022-10-01 10:55:48","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/75939","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=75939"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/75939\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/75940"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=75939"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=75939"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=75939"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}