Method and device for processing data of security protocol and readable storage medium

Abstract

The invention relates to a method and device for processing data of a security protocol and a readable storage medium. A method for processing data of a security protocol includes receiving a data packet associated with the security protocol over a network; determining whether the data packet belongs to a set of post-segmented PF packets; if the data packet does not belong to a group of post-segmented packets, processing the content of the data packet according to a security protocol; and forwarding the data packet if the data packet does belong to a group of post-segmented packets.

Description

Technical Field

[0001] Examples relate to methods, apparatus, and computer-readable storage media for processing data of a security protocol. Background Art

[0002] Security protocols such as IPsec are used in the network to provide data security. Due to header extension, this traffic is also susceptible to post-fragmentation in the network. Post-fragmentation (PF) means that the IP datagram or message is segmented after the security transformation, so that it is divided into multiple data packets. This is also called external segmentation. Post-fragmentation occurs even if there are several mechanisms (such as path maximum transfer unit discovery (pMTUd), collaborative MTU, etc.) to limit the amount of post-segmentation traffic in the network. An example where post-segmentation may exist is a multi-operator network, where different segments of the network are managed independently, for example on the backhaul / midhaul of the radio access network (RAN) or edge appliances. Summary of the invention

[0003] According to one aspect of the present disclosure, a method for processing data of a security protocol is provided, the method comprising: receiving a data packet associated with the security protocol through a network; determining whether the data packet belongs to a group of post-fragmentation PF packets; if the data packet does not belong to the group of post-fragmentation packets, processing the content of the data packet according to the security protocol; and if the data packet does belong to the group of post-fragmentation packets, forwarding the data packet.

[0004] According to one aspect of the present disclosure, a device for processing data of a security protocol is provided, comprising: an interface circuit; a memory for storing machine-readable instructions; and a processing circuit for executing the machine-readable instructions to perform the following operations: receiving a data packet associated with the security protocol through a network; determining whether the data packet belongs to a group of post-fragmentation PF packets; if the data packet does not belong to the group of post-fragmentation packets, processing the content of the data packet according to the security protocol; and if the data packet does belong to the group of post-fragmentation packets, forwarding the data packet.

[0005] According to one aspect of the present disclosure, a computer-readable storage medium having program code stored thereon is provided, wherein the program code is used to execute a method for processing data of a security protocol when the computer program is executed on a computer or a processor, the method comprising: receiving a data packet associated with the security protocol through a network; determining whether the data packet belongs to a group of post-fragmentation PF packets; if the data packet does not belong to the group of post-fragmentation packets, processing the content of the data packet according to the security protocol; and if the data packet does belong to the group of post-fragmentation packets, forwarding the data packet. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] Some examples of apparatus and / or methods will be described below, by way of example only, and with reference to the accompanying drawings, in which:

[0007] Figure 1 A flow chart illustrating an example of a method for processing data for a security protocol;

[0008] Figure 2 A schematic diagram illustrating the concept of implementing a method for processing data of a security protocol;

[0009] Figure 3 A schematic diagram illustrating concepts of an example of implementing a method for processing data of a security protocol using an anti-replay window;

[0010] Figure 4 A schematic diagram illustrating multiple protocol layers involved in the processing of a security protocol;

[0011] Figure 5 A flow chart illustrating an example of a method for processing data of a security protocol within a dedicated device;

[0012] Figure 6 Illustrated for use in Figure 5 A flowchart of an example of a method for processing data of a security protocol within a device in which the device cooperates; and

[0013] Figure 7 An apparatus for processing data of a security protocol is schematically illustrated. DETAILED DESCRIPTION

[0014] In the following description, specific details are set forth, but examples of the technology described herein may be practiced without these specific details. Well-known circuits, structures, and techniques are not shown in detail to avoid obscuring the understanding of this specification. "One example / example", "various examples / examples", "some examples / examples", etc. may include features, structures, or characteristics, but not every example must include a particular feature, structure, or characteristic.

[0015] Some examples may have some, all or none of the features described for other examples. "First", "second", "third" etc. describe common elements, and indicate different instances of referring to the same element. Such adjectives do not imply that the element items described in this way must be in a given order in time or space by sorting or in any other way. "Connected" may indicate that elements are in direct physical or electrical contact with each other, while "coupled" may indicate that elements cooperate or interact with each other, but they may or may not be in direct physical or electrical contact with each other.

[0016] As used herein, the terms "operate," "execute," or "run" may be used interchangeably when they refer to software or firmware associated with a system, device, platform, or resource, and may refer to software or firmware stored in one or more computer-readable storage media accessible by a system, device, platform, or resource, even if the instructions contained in the software or firmware are not actively executed by the system, device, platform, or resource.

[0017] The description may use the phrases "in one example / example", "in multiple examples / examples", "in some examples / examples", and / or "in various examples / examples", each of which may refer to one or more of the same or different examples. Furthermore, the terms "including", "comprising", "having", etc., as used with respect to the examples of the present disclosure, are synonymous.

[0018] Figure 1 A flow chart illustrating an example of a method for processing data of a security protocol.

[0019] The method includes receiving a data packet associated with a security protocol 100. The data packet may be received over a network. A determination is made as to whether the data packet belongs to a set of post-fragmentation (PF) packets 110, and if not, the contents of the data packet are processed according to the security protocol 120. If the data packet does belong to the set of post-fragmentation packets, the data packet is forwarded 130, for example, to be processed by another entity.

[0020] The method allows, for example, stateful processing of post-segmentation traffic and non-post-segmentation traffic of a split security protocol. The split enables, for example, online processing of data packets (traffic) of nominal traffic (non-PF) in a network interface card (NIC). The security protocol offloaded to online processing may be, for example, IPsec, TLS, or DTLS. On the other hand, the post-segmentation traffic may be processed by another entity or in software as an exception path. The method provides processing of post-segmentation traffic and non-post-segmentation traffic of a security protocol with minimal hardware enhancement of existing solutions (e.g., NIC) and without the need for expensive additional blocks (such as IP reassembly offload). Otherwise, additional blocks would be required to reassemble the PF data packets before the PF data packets can be processed (e.g., decrypted or hash values ​​generated) according to the security protocol. Therefore, the security protocol may implement encryption, authentication, or both.

[0021] Conventional NICs can support in-line (between the network and compute processors) algorithm offloading to accelerate networking workloads. The continued growth in bandwidth and workload demands drives the need for higher acceleration to facilitate the increased availability of compute resources for value-added workloads. For example, 5G deployments and the emerging 6G are huge motivating factors for the need for fully secure protocol termination in-line within the NIC.

[0022] The presence of post-fragmentation (PF) traffic presents additional challenges to this acceleration, as PF traffic needs to be reassembled prior to IPsec processing, and full-protocol offload is required to support stateful services such as anti-replay, where both classes of traffic (post-fragmentation and non-post-fragmentation) require a consistent view of the state of the anti-replay window (ARW).

[0023] Anti-replay is a security mechanism used in network communication protocols to prevent attackers from intercepting and replaying legitimate network traffic. The mechanism works by assigning a unique identifier (e.g., a timestamp or sequence number) to each packet sent by the sender, and the receiver tracks the identifiers it has seen to ensure that it only accepts each packet once. In the context of network security, a replay attack is a network attack in which an attacker intercepts legitimate network communication, records it, and later sends it again to the receiver in an attempt to impersonate the sender. This can be used to gain unauthorized access to the network or perform other malicious actions, such as wasting computing resources. Anti-replay mechanisms can be implemented at various layers of the network stack, including the application layer, the transport layer, and the network layer. For example, the Secure Real-time Transport Protocol (SRTP) uses an anti-replay mechanism at the transport layer to prevent replay attacks. Anti-replay mechanisms typically involve adding a sequence number or timestamp to each packet sent by the sender, and the receiver keeps a list of the sequence numbers or timestamps it has seen. When a packet is received, the receiver checks whether its sequence number or timestamp has been seen. If so, the packet is discarded as a potential replay attack. If it is a new sequence number or timestamp, the packet is accepted as legitimate and is processed further.

[0024] For TCP communications, the anti-replay window can be used with "Additive Increase, Multiplicative Decrease, and Random Early Detection (AIMD) for TCP Congestion Control", resulting in the size of the ARW changing over time. AIMD is a modification to the standard TCP congestion control algorithm that aims to improve network performance by reducing congestion and increasing throughput. AIMD works by linearly increasing the sender's congestion window (cwnd) until packet loss is detected, and then multiplicatively halving cwnd to reduce congestion. However, the AIMD algorithm can be too aggressive, resulting in unnecessary packet drops and lower network performance. Therefore, the size of the ARW is also dynamic. AIMD can be supplemented by a Random Early Detection (RED) mechanism to reduce congestion before packet loss occurs. The RED mechanism randomly drops packets when the average queue length exceeds a certain threshold. This signals the sender to reduce its transmission rate before the queue becomes full and packet loss occurs.

[0025] Obviously, in the presence of post-segmentation traffic, full inline protocol offload within the NIC requires complex hardware blocks (such as inline IP reassembly), associated memory and logic, which can be based on Figure 1 method to avoid it.

[0026] Other conventional implementations may demonstrate inline stateless offload for nominal / non-PF traffic and stateful software implementation for all traffic. Stateless offload for post-segment traffic may be achieved through software / fallback acceleration, including software IP reassembly of post-segment traffic and reinjection of traffic into the Ethernet complex for inline protocol offload. Another alternative is a hardware IP reassembly block that can perform IP reassembly prior to inline security protocol offload. Full protocol offload suitable for controlled environments with end-to-end (EtE) network ownership and zero post-segmentation incidence may be another option.

[0027] However, the stateless / stateful split results in software operation not only for low-intensity post-segmentation traffic, but for all traffic, which limits the scaling of single SA performance. Re-circulating the reassembled datagrams after software reassembly into the inline NIC results in additional latency and often results in ARW window out-of-bounds drops. Hardware IP reassembly blocks are expensive, place heavy demands on the hardware, and have limited scalability. As an example, the total number of simultaneous reassembled sessions, as well as the size of the reassembled datagrams, etc., scale all the way up to 64kB. In an uncontrolled environment, with mixed network ownership, post-segmentation traffic is dropped, leading to potential connection black holes.

[0028] Figure 2 A schematic diagram illustrating an example of a concept for processing data of a security protocol that is split between hardware (eg, NIC 200 ) and a software protocol stack running on another entity 220 .

[0029] The content of data packets 202 that do not belong to a group of post-segmented data packets (data packets of a nominal flow) are processed within the NIC 200 according to a security protocol.

[0030] If the data packet does belong to the group of post-segment packets (abnormal PF flow 204), the data packet is pre-processed within NIC200 and finally forwarded using another entity 220 for stateful processing. In the illustrated embodiment, the other entity 220 is a general-purpose computing unit (CPU) running a software stack. In other embodiments, the other entity can be any hardware or software or a combination of the two. For example, the other entity can include at least one of a (field) programmable logic array ((F)PLA), a (field) programmable gate array ((F)PGA), a graphics processor unit (GPU), an application-specific integrated circuit (ASIC), an integrated circuit (IC), or a system on a chip (SoC) system.

[0031] Figure 3 A schematic diagram illustrating concepts of an example implementing a method for processing data of a security protocol utilizing an anti-replay window.

[0032] The network interface implements a standard anti-replay window 302. The standard anti-replay window 302 is extended by a supplementary ARW 304.

[0033] Another entity implements the PF anti-replay window 306 for monitoring post-fragmented data packets associated with the security protocol.

[0034] The standard anti-replay window 302 works according to the existing implementation, which monitors the replay of data packets to avoid associated attacks. If the same data packet has been received within the standard anti-replay window 302, the data packet is discarded, regardless of whether it is a post-segment data packet.

[0035] Figure 2 and Figure 3 The illustrated concept can be viewed as a layered anti-replay window scheme.

[0036] Both classes of traffic (PF and non-PF) use independent windows and do not require any shared state consistency.

[0037] The total window space is thus divided into three components. In the NIC, a hardware window is implemented which includes a standard anti-replay window 302 that maintains an occupancy bitmap for non-post-segmented traffic.

[0038] The supplemental window (extended opaque window) only keeps the latest post-segment SN beyond the leading edge and is a speculative view of the software window size and range, while the content is not visible. In other words, the NIC does not decrypt data packets belonging to PF traffic, and the effort to implement the supplemental window is small because it does not have a complete occupancy bitmap for post-segment traffic, but only keeps the latest post-segment SN beyond the leading edge.

[0039] Instead, only the PF anti-replay window 306 implemented in software maintains the occupancy bitmap for post-segment traffic.

[0040] With this approach, post-segment traffic and non-post-segment traffic are handled independently via software using the PF anti-replay window 306 and in hardware using the standard anti-replay window 302 extended by the supplementary ARW 304, respectively. Additional filtering of post-segmentation in hardware can be used. Therefore, the additional hardware requirements are very small.

[0041] Much like the standard ARW, the supplementary ARW is variable in size. The extended ARW used in the NIC is the standard ARW extended by the supplementary ARW. There is a maximum allowable size for the standard ARW as well as the supplementary ARW, which is implementation specific. If one of the window sizes is to be increased, the resulting maximum length of the combination of the two windows is the allowable extended ARW.

[0042] Since the window length is variable, if a PF data packet arrives that is inside the allowable extended ARW, the supplemental ARW can be increased to include the data packet.

[0043] Likewise, if a data packet belonging to a group of post-segment packets is outside the allowable extended ARW, the data packet will be discarded.

[0044] If the same data packet has been received within an extended ARW or within a previous post-segment data packet, the data packet may be discarded.

[0045] In order to comply with the existing management model of specifying the standard ARW window size W, the window size can be optionally selected based on subsequent considerations. L should be the length of the supplementary ARW 304, and L* is the maximum allowable length of the supplementary ARW 304. The selection of the size of L* and L can be based on the following factors, for example. L* can be selected based on the expected post-segmentation of a specific deployment. Given the beneficial implementation of the supplementary ARW 304 represented by a single SN, the size of L* does not impose additional hardware resource expectations. Further, in a well-designed network, the supplementary ARW 304 is only used intermittently and is subject to limited growth. For example, pMTU detection causes the occasional arrival of post-segmentation data packets, and is usually interspersed with non-post-segmentation services that do not use the supplementary window.

[0046] However, during route reconfiguration, for example when the new path has a lower pMTU, the supplemental ARW 304 may be significantly exercised / used. This may result in intermittent bursts of post-segment traffic for the duration of the round trip delay. Therefore, L* may be derived as line rate / (RTT*average packet size in bits), where RTT is the round trip time.

[0047] The size of the PF anti-replay window 306 of the additional entity (eg, software stack) may be set to W+L, where L may be set to W to meet the IPsec ARW requirement assuming 100% post-fragmentation traffic.

[0048] Figures 4 to 6 A schematic diagram jointly illustrates the multiple protocol layers involved in the processing of security protocols for a non-limiting example of processing IPsec traffic and for split processing between the NIC 410 (hardware) and the software protocol stack 450.

[0049] If a non-post-segment data packet 412 arrives, standard ARW processing 420, 520 for non-PF data packets is performed, including applying grant / reject conditions and updating the ESN and forwarding the data packet for upper layer processing. Figure 4 The standard ARW process 420 is illustrated in a conceptual overview, and Figure 5 The decisions and actions performed during the standard ARW process 520 are illustrated by a flow chart.

[0050] When a post-segment data packet arrives, PF data filtering / processing is performed in the NIC to distinguish the first received data packet belonging to a group of post-segment packets (according to the processing of sub-flow chart 514) and subsequent data packets belonging to the same group of post-segment packets (according to the processing of sub-flow chart 512).

[0051] When the first received data packet belonging to a group of post-segment packets arrives, the following conditions are applied.

[0052] If the arrival sequence number SN of the first received data packet satisfies SN T + L*, the data packet is discarded, where B represents the start or bottom of the standard ARW. In the case of SN > T + L*, the data packet belonging to a group of post-segment packets is discarded because it is received outside the allowable extended ARW, and the extended ARW is the maximum allowable length where the standard ARW of length T is potentially extended by the supplementary ARW.

[0053] If SN is within the standard ARW (B <= arrival SN < T), and if it is not a duplicate SN, the data packet is forwarded to the upper layer.

[0054] If SN is within the existing supplementary window, the data packet is forwarded (T <= arrival SN < T_PF*, where T_PF* is the top of the supplementary window).

[0055] If SN is within the maximum allowable length L* of the supplementary ARW 304, the data packet is forwarded and the size of the supplementary ARW 304 is increased (T_PF* < arrival SN, update T_PF* = arrival SN). In other words, if the data packet is within the allowable extended ARW, the supplementary ARW is increased to include the data packet.

[0056] Subsequent data packets belonging to the same group of post-segment packets (according to the processing of flow chart 512) are forwarded to the CPU software stack for IP reassembly and software exception handling.

[0057] Figure 6 A flow chart illustrating an example of a method for processing data of a security protocol, particularly for processing PF data packets associated with the IPSec protocol within a software stack.

[0058] Data packets belonging to a group of post-segment packets undergo standard lower-layer protocol processing, including IP reassembly. Subsequently, decryption and ARW processing 620 are performed.

[0059] Decryption 622 may optionally be implemented using additional entities to improve performance, such as protocol offloading using a back-up acceleration software library, etc. After successful decryption, software ARW processing is performed, for example, using a window of size W+L.

[0060] Figure 7 An apparatus 700 for processing data of a security protocol is schematically illustrated.

[0061] The apparatus 700 includes an interface circuit 710, a memory 720 for storing machine-readable instructions, and a processing circuit 730 for executing the machine-readable instructions. When executing the machine-readable instructions, the processing circuit 730 is configured to receive a data packet associated with a security protocol through a network (e.g., via the interface circuit 710), and determine whether the data packet belongs to a group of post-fragmentation PF packets. The processing circuit 730 processes the content of the data packet according to the security protocol if the data packet does not belong to the group of post-fragmentation packets, or forwards the data packet if the data packet does belong to the group of post-fragmentation packets.

[0062] In other words, the examples described herein can be understood as proposing a hierarchical scheme with 2 independently operable windows. The first window includes the ARW (a history buffer of SNs of authenticated nominal traffic) plus a supplementary window (speculative opaque window) for post-segment traffic in the online NIC. The supplementary window tracks the highest post-segment SN that is permitted for software processing. The supplementary window and pre-processing on hardware serve as bridging logic between the two windows, eliminating the need for any shared state or unified view of the ARW. Post-segment traffic is processed in a hierarchical manner, where the first level of admission is performed in the online NIC and the final admission with window updates is performed in software (using the PF anti-replay window), while nominal non-PF traffic is processed entirely in the online NIC.

[0063] According to the example, each hardware / software window thus sees independent categories of traffic - non-post-segmented and post-segmented. It sees another class of traffic as an arrival gap, and depending on the implementation, it can tolerate up to 2^32-1 arrival gaps or even more. In most networks, post-segmentation occurs occasionally, which may cause the ESN prediction for the software ARW to be stale / incorrect. Once the successfully granted non-post-segmented sequence number increases by at least 2^31, this can optionally be solved by hardware generating an event ( / interrupt) at the first non-post-segmented SN. It is also possible to generate only one event per (2^32-D) sequence number, where D is the number of packets taking into account the pipeline delay from the hardware ARW to the software ARW. Using 2^31 can simplify the logic. The opposite event can also be designed to solve the gap of 2^32-1 sequence numbers in the nominal packet, where >2^32-1 consecutive post-segment arrivals occur.

[0064] The example allows efficient handling of PF and non-PF traffic while allowing replay attacks to be addressed. In a replay attack, traffic in the network is replayed as is by the attacker. Since all post-segments are stored in the same history buffer / software window, duplication within a post-segment is detected. Since all non-post-segments are managed in the same history buffer / hardware window, duplication within a non-post-segment is detected.

[0065] Replaying traffic in the network after fragmentation has been applied only applies to IPv4 traffic. IPv6 traffic can only be fragmented at the source (i.e., the IPsec initiator). If the original non-post-fragmented packet arrives first, and the copy is post-fragmented, the copy is detected as part of the pre-processing of post-fragmented traffic in hardware and is discarded.

[0066] If post-fragmented traffic arrives before the original unfragmented packet (which can happen in the case of a true network reconfiguration that results in a valid duplication of packets arriving on two different paths), then one post-fragmented and the other unfragmented traffic will be admitted and delivered to the endpoint. This situation is no different than a true duplication which rarely occurs in an unsecured / clear network and is not considered a security risk. This can also happen in the case of a man-in-the-middle attack that snoops, performs additional processing to create a valid post-fragment and arrives at the destination before the original packet could possibly arrive, so it is not considered a risk.

[0067] In the case of SN collision / partial replay attack, the attacker injects fraudulent packets to collide with future valid packets. The man-in-the-middle eavesdropper will observe the SN of non-post-segmented traffic, predict the future SN, and use that SN to generate fraudulent post-segments, which will be discarded in the IP reassembly logic.

[0068] If a man-in-the-middle eavesdropper observes the SN of a post-segment, and generates a fraudulent non-post-segment with a future SN, such data packets will be discarded in hardware decryption / authentication.

[0069] Considering the potential attacks described previously, the expected system behavior of the examples described in this document can be observed under certain input traffic stimuli.

[0070] Examples of systems as described herein have performance that is insensitive to replay attacks on nominal traffic. The performance is only sensitive to increased post-segmentation traffic.

[0071] An example of a system as described herein will discard post-segment traffic so that the delay between the first segment and the last segment is such that the segment arrival delay is greater than the differential delay between post-segment / non-post-segment in the system, which in turn is greater than the ARW out-of-order delay tolerance (as given by line rate / (window size in bits*packet size)).

[0072] An example of a system as described herein would react to engineered traffic with a targeted packet copy / replay attack using PCAP or other traffic generation methods, where the following arrival sequence enters the system under test:

[0073] If the first arrival is a non-post-segment packet, and the copy is a post-segment packet, only one packet is admitted into the system.

[0074] If the first arrival is a post-segment packet, and the copy is a non-post-segment packet, both packets are admitted into the system.

[0075] Examples described herein may also feature providing nominal support for inline IPsec protocol offload while accepting post-segmentation traffic, without providing hardware inline IP reassembly offload.

[0076] On a full-stack security gateway benchmark, there is a 2x performance improvement from inline pre-processing IPsec offload to full IPsec protocol offload, freeing up compute resources for higher-layer applications to perform customer workloads. This solution allows the system to accelerate nominal flows and isolate the additional cost of tracking the volume of PFs encountered in the network.

[0077] While providing the previously mentioned performance and efficiency advantages, the examples described herein also result in reduced quadratic losses in the post-segmentation case due to large differential packet processing delays between post-segmentation traffic and non-post-segmentation traffic. Further, by employing a window of at least W and at most W+L, there is improved out-of-order tolerance in certain bursty post-segmentation scenarios.

[0078] The examples described herein can be used in the field of messaging using any type of wired or wireless network. Figures 4 to 6 The ARW scheme for the IPsec protocol is described in detail, but the additional examples are also applicable to other layer 3 + Protocols, such as IP fragmentation or split protocols, which apply anti-replay schemes and require software assistance to complete the underlying processing. Such security protocols may include DTLS (Datagram Transport Layer Security), TLS (Transport Layer Security), etc. The upper layers depicted in the present invention figure may reside in the Ethernet complex (online) or in software. Although this document references the implementation as an online NIC cooperating with adjacent host software, the concept can be extended to intelligent NIC / IPU with embedded computing complex.

[0079] Based on the previously described embodiments, which additionally do not allow for real (non-attack) rare network duplications that may occur in any network, the examples can be extended with additional filtering logic and adapted for deployments with intermittent post-fragmentation, such as pMTU probing.

[0080] In this extended algorithm, the hardware ARW will be tri-state instead of a binary bitmap. The newly introduced 3rd state will represent the previous post-segmented traffic that has been admitted into the software by the hardware filter. The supplementary window will be converted into a classic ARW binary bitmap, where the occupancy indication in the hardware window is admitted into the software by the hardware.

[0081] Non-post-segment traffic with SN of previous post-segment SN will first be fully processed in hardware, including hardware ARW update. Then, it will be forwarded to software to check for duplication against allowed post-segment traffic.

[0082] In systems with software upper layers, additional checks are performed on nominal traffic before continuing with upper layer processing. It should be noted that this check is not stateful for software ARW processing, does not pose software single SA scaling challenges, and requires only a read-only view of the software window.

[0083] In summary, the examples described herein can provide many benefits. A feasible solution for splitting the anti-replay window, splitting the stateful security protocol offload into a nominal flow and an exception flow is provided, and a feasible path to fully inline security protocol offload to the nominal flow is achieved. This improves CPU availability through increased offload. Performance dynamically tracks the occurrence of post-segmentation rather than static degradation. They are extensible to other layer 3 supporting anti-replay services. + Security protocols and are prone to lower layer segmentation / segmentation, such as DTLS.

[0084] The example can further provide reduced quadratic loss. Independent windows for post-segment and non-post-segment subspaces cause packets visible to each window to experience similar processing delays. This increases the probability of successfully accepting valid post-processing packets, because intermittent non-post-segment arrivals will not advance the window.

[0085] These examples may also provide increased out-of-order tolerance. In the presence of large post-segment bursts, the algorithm may detect duplications over a larger window than the minimum W requirement, and thus may grant valid packets with greater out-of-order tolerance.

[0086] The secure protocol offload solution developed for a controlled environment (no post-segmentation and EtE network management ownership) can be extended to an uncontrolled environment with post-segmentation with minimal incremental hardware cost. This is achieved through a layered anti-replay window design. The extension can be applied by introducing additional state variables to track the supplementary windows. Further, a subset of the full protocol offload logic can be applied to the first segment of the post-segmentation traffic.

[0087] In the following, some examples of the proposed concepts are presented:

[0088] An example (e.g., Example 1) relates to a method for processing data of a security protocol, the method comprising: receiving a data packet associated with a security protocol through a network; determining whether the data packet belongs to a set of post-fragmentation PF packets; if the data packet does not belong to a set of post-fragmentation packets, processing the content of the data packet according to the security protocol; and if the data packet does belong to a set of post-fragmentation packets, forwarding the data packet.

[0089] Another example (eg, Example 2) relates to the previous example (eg, Example 1) or any other example, further comprising: the security protocol implements at least one of encryption or authentication.

[0090] Another example (eg, Example 3) relates to the previous example (eg, one of Examples 1 or 2) or any other example, and further includes: the security protocol is at least one of IPsec, TLS, or DTLS.

[0091] Another example (e.g., Example 4) relates to the previous example (e.g., one of Examples 1 to 3) or any other example, and also includes: discarding the data packet if the same data packet (PF and non-PF) has been received within the standard anti-replay window ARW.

[0092] Another example (e.g., Example 5) relates to the previous example (e.g., one of Examples 1 to 4) or any other example, and also includes: discarding the data packet if the data packet belongs to a group of post-segment packets and if the data packet is outside an allowable extended ARW, where the extended ARW is a standard ARW extended by a supplementary ARW.

[0093] Another example (eg, Example 6) relates to the previous example (eg, Example 5) or any other example, further comprising: if the data packet is within the allowable extended ARW, increasing the supplemental ARW to include the data packet.

[0094] Another example (eg, Example 7) relates to the previous example (eg, one of Examples 1-6) or any other example, further comprising: forwarding data packets belonging to a group of post-segment packets using an additional entity for stateful processing.

[0095] Another example (e.g., Example 8) relates to the previous example (e.g., Example 7) or any other example, and further includes: the additional entity includes a circuit, and the circuit is configured to: discard a data packet belonging to a group of post-segment packets if the same data packet has been received within an extended ARW or within a previous post-segment data packet.

[0096] An example (e.g., Example 9) relates to an apparatus for processing data of a security protocol, comprising: an interface circuit; a memory for storing machine-readable instructions; and a processing circuit for executing the machine-readable instructions to perform the following operations: receiving a data packet associated with a security protocol through a network; determining whether the data packet belongs to a group of post-fragmentation PF packets; if the data packet does not belong to a group of post-fragmentation packets, processing the content of the data packet according to the security protocol; and if the data packet does belong to a group of post-fragmentation packets, forwarding the data packet.

[0097] Another example (eg, Example 10) relates to the previous example (eg, Example 9) or any other example, further comprising: the security protocol implements at least one of encryption or authentication.

[0098] Another example (eg, Example 11) relates to the previous example (eg, one of Examples 9 or 10) or any other example, further including: the security protocol is at least one of IPsec, TLS, or DTLS.

[0099] Another example (e.g., Example 12) relates to the previous example (e.g., one of Examples 9 to 11) or any other example, and also includes: the circuit is also configured to: discard the data packet if the same data packet has been received within the standard anti-replay window ARW.

[0100] Another example (e.g., Example 13) relates to the previous example (e.g., one of Examples 9 to 12) or any other example, and also includes: the circuit is also configured to: discard the data packet if the data packet belongs to a group of post-segment packets and if the data packet is outside an allowable extended ARW, where the extended ARW is a standard ARW extended by a supplementary ARW.

[0101] Another example (eg, Example 14) relates to the previous example (eg, Example 13) or any other example, further comprising: the circuit is further configured to: if the data packet is within the allowable extended ARW, increase the supplemental ARW to include the data packet.

[0102] Another example (e.g., Example 15) relates to the previous example (e.g., one of Examples 9 to 14) or any other example, and also includes: the circuit is also configured to: forward data packets belonging to a group of post-segment packets using another entity for stateful processing.

[0103] Another example (eg, Example 16) relates to a network interface card (NIC) comprising an apparatus according to a previous example (eg, one of Examples 9 to 15).

[0104] An example (e.g., Example 17) relates to a computer-readable storage medium having program code stored thereon, the program code being used to execute a method for processing data of a security protocol when a computer program is executed on a computer or processor, the method comprising: receiving a data packet associated with a security protocol through a network; determining whether the data packet belongs to a group of post-fragmentation PF packets; if the data packet does not belong to a group of post-fragmentation packets, processing the content of the data packet according to the security protocol; and if the data packet does belong to a group of post-fragmentation packets, forwarding the data packet.

[0105] Another example (e.g., Example 18) relates to the previous example (e.g., Example 17) or any other example, wherein the security protocol implements at least one of encryption or authentication.

[0106] An example (e.g., Example 19) relates to a previous example (e.g., one of Examples 17 or 18) or any other example, wherein the security protocol is at least one of IPsec, TLS, or DTLS.

[0107] Another example (eg, Example 20) relates to a method, further comprising discarding the data packet if the same data packet (PF and non-PF) has been received within a standard anti-replay window ARW.

[0108] The aspects and features described with respect to a specific one of the previous examples may also be combined with one or more of the other examples to replace the same or similar features of the other examples or to additionally introduce features into the other examples.

[0109] As used herein, the term "module" refers to a logic that can be implemented in a hardware component or device, software or firmware running on a processing unit, or a combination thereof to perform one or more operations consistent with the present disclosure. Software and firmware can be specifically implemented as instructions and / or data stored on a non-transient computer-readable storage medium. As used herein, the term "circuit" can include, individually or in any combination, non-programmable (hard-wired) circuits, programmable circuits such as processing units, state machine circuits, and / or firmware that stores instructions that can be executed by programmable circuits. The modules described herein can be collectively or individually embodied as circuits that form a part of a computing system. Thus, any module can be implemented as a circuit. A computing system that is referred to as being programmed to perform a method can be programmed to perform the method via software, hardware, firmware, or a combination thereof.

[0110] Any of the disclosed methods (or a portion thereof) may be implemented as computer-executable instructions or computer program products. Such instructions may enable a computing system or one or more processing units capable of executing computer-executable instructions to perform any of the disclosed methods. As used herein, the term "computer" refers to any computing system or device described or mentioned herein. Thus, the term "computer-executable instructions" refers to instructions that can be executed by any computing system or device described or mentioned herein.

[0111] Computer executable instructions may be, for example, part of an operating system of a computing system, an application stored locally to a computing system, or a remote application accessible to a computing system (e.g., via a web browser). Any of the methods described herein may be performed by computer executable instructions executed by a single computing system or one or more networked computing systems operating in a network environment. Computer executable instructions and updates to computer executable instructions may be downloaded from a remote server to a computing system.

[0112] Further, it should be understood that implementations of the disclosed technology are not limited to any particular computer language or program. For example, the disclosed technology can be implemented by software written in C++, C#, Java, Perl, Python, JavaScript, Adobe Flash, C#, assembly language, or any other programming language. Likewise, the disclosed technology is not limited to any particular computer system or hardware type.

[0113] Furthermore, any software-based examples (including, for example, computer-executable instructions for causing a computer to perform any disclosed method) can be uploaded, downloaded, or remotely accessed via suitable communication means, including, for example, the Internet, the World Wide Web, an intranet, cables (including fiber optic cables), magnetic communications, electromagnetic communications (including RF, microwave, ultrasonic, and infrared communications), electronic communications, or other such communications means.

[0114] The disclosed methods, apparatus, and systems should not be construed as limiting in any way. Rather, the present disclosure is directed to all novel and non-obvious features and aspects of the various disclosed examples (individually and in various combinations and sub-combinations with each other). The disclosed methods, apparatus, and systems are not limited to any particular aspect or feature or combination thereof, nor do the disclosed examples require the presence of any one or more specific advantages or problems to be solved.

[0115] The theories of operation, scientific principles or other theoretical descriptions presented herein with reference to the devices or methods disclosed herein are provided for the purpose of better understanding and are not intended to limit the scope. The devices and methods in the appended claims are not limited to those devices and methods that function in the manner described by these theories of operation.

Claims

1. A method for processing data of a security protocol, the method comprising: receiving, via a network, data packets associated with the security protocol; Determining whether the data packet belongs to a group of post-fragmentation PF packets; If the data packet does not belong to the set of post-segment packets, processing the content of the data packet according to the security protocol; as well as If the data packet does belong to the group of post-fragment packets, the data packet is forwarded.

2. The method according to claim 1, wherein: The security protocol implements at least one of encryption or authentication.

3. The method according to claim 1 or 2, wherein: The security protocol is at least one of IPsec, TLS or DTLS.

4. The method according to claim 1, further comprising: If the same data packet (PF and non-PF) has been received within the standard anti-replay window ARW, the data packet is discarded.

5. The method according to claim 1, further comprising: If the data packet belongs to a group of post-segment packets and if the data packet is outside an allowable extended ARW, the data packet is discarded, the extended ARW being the standard ARW extended by a supplemental ARW.

6. The method according to claim 5, further comprising: If the data packet is within the allowable extended ARW, the supplemental ARW is increased to include the data packet.

7. The method according to claim 1, wherein: The data packets belonging to the set of post-fragmented packets are forwarded using a further entity for stateful processing.

8. The method according to claim 7, wherein: The further entity comprises a circuit configured to discard the data packet belonging to the group of post-segment packets if the same data packet has been received within the extended ARW or within a previous post-segment data packet.

9. An apparatus for processing data of a security protocol, comprising: Interface circuit; a memory for storing machine-readable instructions; as well as Processing circuitry for executing the machine-readable instructions to perform the following operations: receiving, via a network, data packets associated with the security protocol; Determining whether the data packet belongs to a group of post-fragmentation PF packets; If the data packet does not belong to the set of post-segment packets, processing the content of the data packet according to the security protocol; as well as If the data packet does belong to the group of post-fragment packets, the data packet is forwarded.

10. The device according to claim 9, wherein: The security protocol implements at least one of encryption or authentication.

11. The device according to claim 9 or 10, wherein: The security protocol is at least one of IPsec, TLS or DTLS.

12. The device according to claim 9, wherein: The circuit is also configured to: If the same data packet has been received within the standard anti-replay window ARW, the data packet is discarded.

13. The device according to claim 9, wherein: The circuit is also configured to: If the data packet belongs to a group of post-segment packets and if the data packet is outside an allowable extended ARW, the data packet is discarded, the extended ARW being the standard ARW extended by a supplemental ARW.

14. The device according to claim 13, wherein: The circuit is also configured to: If the data packet is within the allowable extended ARW, the supplemental ARW is increased to include the data packet.

15. The device according to claim 9, wherein: The circuit is also configured to: The data packets belonging to the set of post-fragmented packets are forwarded using a further entity for stateful processing.

16. A computer readable storage medium having program code stored thereon for executing a method for processing data of a security protocol when the computer program is executed on a computer or processor, the method comprising: receiving, via a network, data packets associated with the security protocol; Determining whether the data packet belongs to a group of post-fragmentation PF packets; If the data packet does not belong to the set of post-segment packets, processing the content of the data packet according to the security protocol; as well as If the data packet does belong to the group of post-fragment packets, the data packet is forwarded.

17. The computer-readable storage medium of claim 16, wherein: The security protocol implements at least one of encryption or authentication.

18. The computer-readable storage medium according to claim 16 or 17, wherein: The security protocol is at least one of IPsec, TLS or DTLS.

19. The computer-readable storage medium of claim 16, the method further comprising: If the same data packet (PF and non-PF) has been received within the standard anti-replay window ARW, the data packet is discarded.

Images