Network Interface TLS Offload Selective Retransmission
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic protocols, such as TLS, face inefficiencies in CPU resource utilization and network bandwidth when handling packet re-transmissions, particularly when the re-transmit rate exceeds 1-2% of transmitted packets, as they often fall back to CPU-based decryption, losing the benefits of hardware offload.
Innovation Solution
Implementing a network interface to perform line rate inline TLS encryption and decryption, with a receive path that manages packet re-transmits and congestion control, allowing for selective re-transmission of only necessary packets and maintaining offload capabilities, while using a buffer to store received segments until complete records are assembled.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Use of energy by moving object
If hardware offload is used for TLS encryption and decryption, then CPU resource usage is reduced, but when packet re-transmission rate exceeds 1-2%, the system falls back to CPU-based decryption causing loss of offload benefits
Solution Approach 1:
The patent segments the TLS processing function into two independent parts: encryption operations remain offloaded to the network interface card (NIC) hardware, while decryption operations are handled by the CPU. This segmentation allows the system to maintain hardware offload benefits for encryption while the CPU handles decryption, avoiding the need to fall back to full CPU-based processing during re-transmissions.
Solution Approach 2:
The patent implements preliminary action by having the NIC maintain state information and buffer encrypted segments locally. When packet re-transmission is needed, the NIC can directly re-transmit the encrypted segments without requiring CPU intervention for decryption, thus maintaining hardware offload capabilities during re-transmission events.
2Reliability
If all transmitted packets are re-transmitted upon packet loss, then reliable data delivery is ensured, but network bandwidth is wasted due to redundant transmission of already received packets
Solution Approach 1:
The patent segments the data transmission into independently re-transmittable encrypted segments at the NIC level. Each segment can be individually tracked and re-transmitted based on acknowledgment status, allowing selective re-transmission of only the missing segments rather than re-transmitting entire records or all packets.
Solution Approach 2:
The patent implements partial action by re-transmitting only the specific encrypted segments that were not successfully received, rather than re-transmitting all segments or entire TLS records. This partial re-transmission approach ensures reliable data delivery while minimizing unnecessary network bandwidth consumption.
3Productivity
If TLS encryption and segmentation are performed at the network interface, then line rate inline encryption is achieved, but device complexity of the network interface increases
Solution Approach 1:
The patent makes the network interface multi-functional by integrating TLS encryption capabilities directly into the NIC hardware. This allows the NIC to perform both traditional network interface functions and TLS encryption operations, achieving line rate inline encryption without requiring separate dedicated encryption hardware, thus managing device complexity while maintaining high productivity.
Data Source
AI summary
Examples described herein relate to an interface that is to receive data for transmission and based on indication of failure of receipt of one or more packets that carry segments of the data, cause re-transmission of solely one or more of the multiple packets that comprise a segment of the data referenced by the indication of failure of receipt of one or more packets. In some examples, the interface is to encrypt the data using an encryption engine and to segment the data for transmission using one or more packets. In some examples, the interface is to receive the data and an indication of which segment of the data to re-transmit; encrypt the data; segment the encrypted data into one or more packets; and based on the indication of which segment of the data to re-transmit, transmit solely one or more of the multiple packets that comprise a segment of the data referenced by the indication of failure of receipt of one or more packets.