How Does a QSPU Offload Encryption From a Server CPU?

A QSPU, or Quantum Security Processing Unit, moves selected cryptographic operations from a server’s general-purpose CPU into dedicated hardware. In the FPGA-based architecture described here, software submits work to a PCIe accelerator, which performs supported encryption or key-establishment operations and returns the results. The CPU continues running applications, managing requests, and coordinating the workload. QSPU is a product designation, rather than a standardized hardware category with uniform capabilities.

For storage encryption, the accelerator can sit in the block-device processing path. Data passes through the encryption hardware before being written to storage and through decryption hardware when read back. Applications continue accessing files or databases through their existing interfaces. This integration differs from asking each application to implement its own encryption: the operating system directs block-level cryptographic work to the accelerator beneath the filesystem.

For HTTPS and other TLS-protected services, offload can cover different parts of a connection. Establishing a connection involves cryptographic operations that differ from encrypting the application data sent afterward. An accelerator may support handshake operations, TLS record encryption, or both. The integration must explicitly route the supported operations through the hardware; installing a card does not automatically accelerate every encrypted connection.

Hardware offload can free CPU capacity, but its performance depends on the workload. Every request carries overhead for submission, data transfer, synchronization, and completion handling. With small requests, this overhead can outweigh the time saved by the accelerator. Larger transfers and batched requests can spread that cost across more work. Intel’s accelerator guidance identifies batching and efficient request handling as important ways to reduce offload overhead.

An FPGA implements processing circuits that can be reconfigured through a hardware configuration update. This allows supported cryptographic implementations to evolve without necessarily replacing the physical card. Post-quantum algorithms can run on this conventional digital hardware; they do not require a quantum computer. Whether an existing accelerator can support a new algorithm still depends on its available resources, interfaces, and implementation.

A useful QSPU benchmark measures the complete application path: encrypted throughput, request latency, CPU utilization, and behavior under sustained load. It should identify the algorithm, transfer size, concurrency, software versions, and whether hardware processing actually occurred. Comparing only the accelerator’s internal processing speed misses the time spent moving data and coordinating work—the costs that determine whether an application benefits from offload.