NIC kTLS Offload Switching for TCP Loss-Induced DoS
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing NIC kTLS approaches are susceptible to denial-of-service (DoS) attacks due to the need to re-read and re-encrypt entire plaintext TLS records when TCP packets are lost, leading to reduced bus bandwidth and increased processing resources, while software kTLS consumes substantial processing resources and memory bandwidth.
Innovation Solution
A method where a kernel offloads TLS data encryption to a NIC initially, but upon exceeding a configurable re-transmission threshold, switches to software-based encryption to mitigate DoS attacks and reduce resource consumption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Use of energy by moving object
If NIC kTLS is used to offload TLS encryption to the network interface controller, then processing resources and memory bandwidth consumption are reduced, but the system becomes susceptible to DoS attacks where lost TCP packets force re-reading and re-encrypting entire TLS records
Solution Approach 1:
The system dynamically switches between NIC kTLS mode and software kTLS mode based on detected packet loss conditions. When packet loss exceeds a threshold, the system transitions from hardware-based encryption to software-based encryption, allowing adaptive response to network conditions and attack scenarios
Solution Approach 2:
The system implements feedback mechanisms by monitoring packet loss statistics and using this information to determine when to switch encryption modes. The feedback loop detects packet loss, compares it against thresholds, and triggers mode switching accordingly to mitigate DoS attacks
2Productivity
If NIC kTLS is used for hardware-based TLS offload, then system memory bandwidth is reduced, but re-transmission of lost packets requires reading and re-encrypting entire plaintext TLS records
Solution Approach 1:
The system dynamically adjusts the encryption implementation based on network conditions. When packet loss is detected, it switches from NIC-based encryption to software-based encryption, changing the re-transmission behavior to avoid the time penalty of re-encrypting entire records
3Reliability
If software-based TLS offload is used, then processing resources are consumed, but it avoids the DoS attack vulnerability of NIC kTLS
Solution Approach 1:
The system dynamically selects between software and hardware encryption modes based on network conditions, using software kTLS when packet loss is detected to avoid DoS attacks, and NIC kTLS when network conditions are good to optimize performance
Data Source
AI summary
In various embodiments, a kernel uses a NIC to transmit encrypted data over TCP connections. The kernel causes the NIC to encrypt first data to generate a first transmission control protocol (TCP) packet in accordance with a hardware-based transport layer security (TLS) offload mode. The kernel computes a first re-transmission statistic in response to the first TCP packet failing to reach a first device over a first TCP connection; the kernel assigns the first TCP connection to a software-based TLS offload mode instead of the hardware-based TLS offload mode based on the first re-transmission statistic. Subsequently, the kernel encrypts second data to generate a second TCP packet in accordance with the software-based TLS offload mode, the kernel then causes the NIC to transmit the second TCP packet to the first device over the first TCP connection.