Network Device Selective DTLS Software Offload
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current DTLS implementations in networking devices face inefficiencies due to the need for cryptographic operations, particularly in handling different DTLS versions and cryptographic key epochs, which can lead to packet processing bottlenecks and dropped packets when cryptographic material is not yet offloaded.
Innovation Solution
A system that selectively offloads DTLS processing between hardware and software, allowing networking devices to handle DTLS packets with offloaded cryptographic information while software handles packets requiring newer key epochs or unsupported DTLS versions, ensuring seamless encryption and decryption without packet loss.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If DTLS processing is performed in hardware for all packets, then processing speed is improved, but device complexity increases and packets with unsupported DTLS versions or new key epochs may be dropped
Solution Approach 1:
The patent segments DTLS packet processing into two paths: hardware processing for packets with supported DTLS versions and offloaded cryptographic material, and software processing for packets with unsupported versions or new key epochs. This segmentation allows the system to maintain high-speed hardware processing for compatible packets while preserving adaptability to handle emerging DTLS versions through software fallback.
Solution Approach 2:
The patent introduces an intermediary mechanism (the network interface controller with selective offload capability) that mediates between hardware DTLS processing and software DTLS processing. This intermediary selectively routes packets to appropriate processing paths based on DTLS version compatibility and cryptographic material availability, resolving the contradiction between speed and adaptability.
2Productivity
If DTLS processing is performed in hardware, then productivity is improved, but reliability decreases when cryptographic material is not yet offloaded
Solution Approach 1:
The patent implements dynamic packet routing that adapts processing path selection based on real-time conditions. When cryptographic material for a particular DTLS version or key epoch is not yet offloaded to hardware, the system dynamically redirects those packets to software processing, ensuring reliable delivery while maintaining high throughput for packets that can be processed in hardware.
Solution Approach 2:
The system employs feedback mechanisms to monitor the availability of offloaded cryptographic material and adjust processing path selection accordingly. This feedback loop ensures that packets are routed through the appropriate processing path (hardware or software) based on current system state, maintaining both productivity and reliability.
3Adaptability or versatility
If selective software offload is implemented, then adaptability to different DTLS versions is improved, but device complexity increases
Solution Approach 1:
The patent extracts the handling of complex DTLS version compatibility and cryptographic material management from the core network processing path and places it in a dedicated selective offload mechanism. This extraction allows the main processing path to remain simple and efficient while the offload mechanism handles the complexity of supporting multiple DTLS versions and key epochs.
Data Source
Figure 1
Figure 2A~2D
Figure 3
AI summary
In one embodiment, a system includes a networking device including a network interface to receive network packets having headers including datagram transport layer security (DTLS) headers from a remote device over a packet data network, packet processing circuitry to identify first packets of the received packets for DTLS processing in the packet processing circuitry, identify second packets of the received packets to bypass DTLS processing in the packet processing circuitry and to be provided to software to perform DTLS processing on the second packets, and perform DTLS processing on the first packets, and a host interface to provide the DTLS processed first packets to the software, and provide the second packets to the software to perform DTLS processing on the second packets.