Aggregating Secured Packets via Hardware Decryption

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current packet aggregation techniques do not support secured, encrypted packets due to hidden inner packet flows and lack of hardware support for stateful operations like replay protection updates.

Innovation Solution

A network device that receives secured packets, decrypts them based on offloaded cryptographic material, aggregates decrypted TCP packets into a single packet, and provides it to the host device for further processing, while supporting replay protection and sequence number validation.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If packet aggregation is applied to secured encrypted packets, then CPU overhead is reduced and network performance is improved, but the hidden inner packet flows prevent proper aggregation due to inability to validate sequence numbers and provide replay protection

Engineering Contradiction:

Improvenetwork processing throughputVSAvoidsecurity validation capability

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent segments the packet processing function by separating the security validation operations (decryption, sequence number validation, replay protection) from the aggregation operations. The network device performs security validation on individual secured packets, then aggregates the validated packets. This segmentation allows both security requirements and aggregation benefits to coexist by handling them at different stages of the processing pipeline.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent applies preliminary action by performing security validation (decryption and validation of sequence numbers) on secured packets before aggregation. The network device decrypts and validates each secured packet individually, ensuring security requirements are met, and only then aggregates the validated packets. This preliminary security processing enables subsequent aggregation without compromising security.

Inventive Principle:

Principle #10Preliminary action

2Productivity

If secured packets are decrypted and aggregated into a single packet, then the number of packets processed by CPU is reduced, but the complexity of packet processing circuitry increases due to decryption and validation requirements

Engineering Contradiction:

ImproveCPU utilization efficiencyVSAvoidpacket processing circuitry complexity

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The patent replaces software-based security processing with hardware-based packet processing circuitry that performs decryption and validation operations. By implementing cryptographic operations, sequence number validation, and replay protection in dedicated hardware circuits rather than software, the system achieves the necessary security functions while maintaining high processing efficiency and reducing CPU involvement.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The packet processing circuitry is designed with multi-functionality to handle multiple operations: decryption of secured packets, validation of sequence numbers, replay protection checks, and aggregation of validated packets. This universal circuitry performs all necessary security and aggregation functions in a single integrated hardware unit, avoiding the need for separate processing stages and reducing overall system complexity.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Reliability

If hardware performs decryption and aggregation of secured packets, then replay protection and sequence number validation are enabled, but the device requires stateful operations that are traditionally not supported in network device hardware

Engineering Contradiction:

Improvereplay protection capabilityVSAvoidhardware stateful operation support

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent introduces an intermediary approach where the network device hardware performs stateful security operations (decryption, validation) as an intermediate step between receiving secured packets and delivering aggregated packets to the host. The hardware maintains necessary state information (such as sequence numbers and replay protection data) temporarily during processing, then transfers the aggregated result to the host. This intermediary stateful processing in hardware enables both replay protection and aggregation without requiring the host to handle individual secured packets.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS20250193163A1Aggregating secured packets in a network device

Publication Date: 2025.06.12 MELLANOX TECHNOLOGIES LTD(IL)

AI summary

In one embodiment, a network device includes a network interface to receive secured packets from a remote device over a packet data network, each of the secured packets being secured according to a security protocol and including a respective security protocol header and a Transmission Control Protocol (TCP) packet, which is encrypted according to the security protocol, a host device interface to connect the network device to a host device, and packet processing circuitry to decrypt each of the secured packets based on the respective security protocol header yielding multiple decrypted packets including decrypted TCP packets, aggregate the decrypted TCP packets into a single aggregated packet, and provide the single aggregated packet to software running on a processor of the host device via the host device interface.