Network Device DTLS Selective Offload for Version Flexibility

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing network devices struggle with efficient processing of Datagram Transport Layer Security (DTLS) operations, particularly in handling DTLS packets with different versions and cryptographic key epochs, leading to processing bottlenecks and inefficiencies.

Innovation Solution

A network device with selective software offload capabilities, where DTLS processing is distributed between hardware and software, allowing for efficient handling of DTLS packets based on flow type, version, and cryptographic key epochs, with hardware performing primary processing and software handling specific packets or flows.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Speed

If DTLS processing is performed entirely in hardware, then processing speed is improved, but device complexity and inability to support multiple DTLS versions increase

Engineering Contradiction:

ImproveDTLS processing speedVSAvoidhardware complexity

Core Design Contradiction:

SpeedVSDevice complexity

Solution Approach 1:

The patent segments DTLS processing into two parts: hardware processing for first packets (using existing DTLS versions) and software processing for second packets (using new DTLS versions). This segmentation allows the hardware to maintain high processing speed for supported versions while the software handles newer versions, thereby resolving the contradiction between processing speed and device complexity.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces software as an intermediary component that mediates between the network interface and the hardware DTLS processing unit. The software receives second packets that require new DTLS versions, processes them using the appropriate software-based DTLS library, and forwards them to the host. This intermediary approach enables support for multiple DTLS versions without increasing hardware complexity.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If DTLS processing is performed entirely in software, then adaptability to different DTLS versions is improved, but processing speed decreases

Engineering Contradiction:

ImproveDTLS version supportVSAvoidDTLS processing speed

Core Design Contradiction:

Adaptability or versatilityVSSpeed

Solution Approach 1:

The patent segments the processing workload by packet type: first packets (using supported DTLS versions) are processed in hardware for high speed, while second packets (using new DTLS versions) are processed in software for adaptability. This segmentation resolves the contradiction by assigning each packet type to the most appropriate processing environment.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent applies local quality by treating different packets differently: hardware processing is applied locally to first packets where speed is critical and hardware support exists, while software processing is applied locally to second packets where version adaptability is critical. This localized approach optimizes both speed and adaptability simultaneously.

Inventive Principle:

Principle #3Local quality

3Productivity

If hardware processes all DTLS packets, then processing efficiency is improved, but ability to handle new DTLS versions deteriorates

Engineering Contradiction:

Improveprocessing efficiencyVSAvoidnew DTLS version support

Core Design Contradiction:

ProductivityVSAdaptability or versatility

Solution Approach 1:

The patent segments the DTLS processing based on packet classification: first packets matching existing hardware-supported DTLS versions are processed efficiently in hardware, while second packets requiring new DTLS versions are redirected to software processing. This segmentation maintains high processing efficiency for supported versions while enabling adaptability to new versions.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces dynamic processing where the processing path (hardware or software) is determined at runtime based on the DTLS version requirements of each packet. The system dynamically routes first packets to hardware and second packets to software, allowing the processing architecture to adapt to different packet types while maintaining overall efficiency.

Inventive Principle:

Principle #15Dynamics

Data Source

PatentUS12452219B2Network device with datagram transport layer security selective software offload

Publication Date: 2025.10.21 MELLANOX TECHNOLOGIES LTD(IL)

AI summary

In one embodiment, a system includes a networking device including a network interface to receive network packets having headers including datagram transport layer security (DTLS) headers from a remote device over a packet data network, packet processing circuitry to identify first packets of the received packets for DTLS processing in the packet processing circuitry, identify second packets of the received packets to bypass DTLS processing in the packet processing circuitry and to be provided to software to perform DTLS processing on the second packets, and perform DTLS processing on the first packets, and a host interface to provide the DTLS processed first packets to the software, and provide the second packets to the software to perform DTLS processing on the second packets.