NIC Hardware Offloading for IPsec Lookup Latency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing number of IPsec flows leads to a significant increase in the number of entries in security databases, resulting in longer lookup times and impacting system performance and scalability, as existing optimizations can only reduce search time complexity from O(N) to O(log N) at the expense of increased memory usage, with SA establishment and lookup processes still relying heavily on software CPU processing.
Innovation Solution
Offloading the lookup process for security associations from the CPU to NIC hardware by using flow markers (MARK) to index directly into security databases, reducing the lookup time complexity to O(1) and bypassing software lookup operations in the critical path, utilizing hardware capabilities for fast packet classification and processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If software lookup optimizations (caching and hash tables) are used to reduce search time complexity from O(N) to O(log N), then lookup time is reduced, but memory usage increases
Solution Approach 1:
The patent replaces the software-based lookup mechanism (caching and hash tables) with a hardware-based lookup mechanism in the NIC. The NIC maintains a flow table with flow identifiers and associated actions, allowing direct hardware-based packet classification and security database lookup. This substitution eliminates the need for software-based O(log N) search algorithms and their associated memory overhead, achieving O(1) lookup time through hardware indexing.
2Productivity
If SA establishment and lookup processes remain within CPU using software algorithm optimizations, then implementation simplicity is maintained, but system performance and scalability are limited
Solution Approach 1:
The patent extracts the security database lookup function from the CPU software processing path and relocates it to the NIC hardware. The NIC now independently performs packet classification, flow table lookup, and security database indexing using flow markers. This extraction removes the bottleneck from the CPU processing path, significantly improving system performance and scalability while distributing the processing load to dedicated network hardware.
Solution Approach 2:
The patent introduces flow markers as an intermediary mechanism that bridges packet classification and security database lookup. Flow markers are metadata fields embedded in hardware descriptors that contain indexed references to security database entries. This intermediary allows the NIC to efficiently map packets to their corresponding security associations without requiring complex CPU-based algorithmic searches, achieving fast O(1) lookup while maintaining implementation feasibility.
3Adaptability or versatility
If the number of IPsec flows increases to provide better network coverage, then security protection capability is improved, but lookup time increases drastically
Solution Approach 1:
The patent implements a dynamic flow table in the NIC that can be efficiently updated and maintained. The flow table stores flow identifiers and associated actions that can be dynamically added, modified, or removed based on network conditions. This dynamic structure allows the system to adapt to increasing numbers of IPsec flows while maintaining fast lookup performance through hardware-based indexing and classification, unlike static software-based approaches where lookup time grows with the number of entries.
Data Source
AI summary
Methods and apparatus for secure networking protocol optimization via NIC hardware offloading. Under a method, security offload entries are cached in a flow table or a security database offload table on a network interface coupled to a host that implements a host security database mapping flows to Security Association (SA) contexts. Each security offload entry includes information identify a flow and information, such as an offset value, to locate a corresponding entry for the flow in the host security database. Hardware descriptors for received packets that belong to flows with matching security offload entries are generated and marked with the information used to locate the corresponding entries in the host security database. The hardware descriptors are processed by software on the host and the location information is used to de-reference the location of applicable entries in the host security database.