Stateful Connection Tracking Offload to Network Interface
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network devices lack the capability to create and destroy connection tracking contexts in hardware without software involvement, leading to inefficiencies in processing and security against advanced attacks like DDoS, as connection tracking imposes a heavy burden on the CPU and affects message throughput and latency.
Innovation Solution
Implementing connection tracking in network interface controllers (NICs) with embedded switches and flow tables, allowing hardware to perform stateful filtering and context updates for existing connections while passing exceptions to software for handling, thereby offloading connection tracking and filtering functions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If connection tracking is implemented in software, then security against advanced attacks is improved, but CPU burden increases and message throughput decreases
Solution Approach 1:
The patent extracts connection tracking functionality from the CPU/software domain and implements it in hardware within the NIC. The NIC now contains dedicated connection tracking hardware that maintains connection state tables and performs stateful packet filtering independently, removing this burden from the CPU while maintaining security functionality.
Solution Approach 2:
The patent introduces an intermediate connection tracking hardware layer between the network interface and the CPU. This hardware intermediary handles connection state management and packet filtering, acting as a mediator that protects the CPU from processing every packet while still enforcing security policies.
2Reliability
If connection tracking is implemented in software, then stateful filtering capability is improved, but latency increases
Solution Approach 1:
The patent replaces the software-based connection tracking mechanism with a hardware-based implementation. The NIC contains dedicated hardware circuits and logic that perform connection state lookup and filtering in parallel with packet reception, eliminating the sequential software processing delays that caused latency.
3Reliability
If connection tracking contexts are managed by software, then connection state monitoring is improved, but device complexity increases
Solution Approach 1:
The patent merges connection tracking functionality with the NIC hardware structure. The connection tracking tables, state machines, and filtering logic are integrated directly into the NIC's existing hardware architecture, combining multiple functions into a unified hardware component rather than adding separate software layers.
Data Source
AI summary
A mechanism is provided for partial offload of connection tracking from a host processor to a network interface device. Software running in the host processor is used for connection establishment. After a connection has been established the software initializes and transfers flow-control to the network interface device. Thereafter, the network interface device continues transferring packets to the destination, while the software in the host processor monitors the flow. If the connection has been terminated or has expired flow control reverts to the software. Modes of operation are provided for network interface devices with and without a specific connection-tracking module.