Post-Fragmented Traffic Processing in Network Interface Cards
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security protocols, such as IPsec, face challenges in handling post-fragmented traffic due to header expansion, leading to inefficiencies and increased hardware requirements, particularly in multi-operator networks where post-fragmentation occurs frequently, and conventional solutions like in-line IP reassembly are costly and limit scalability.
Innovation Solution
A method that splits the processing of post-fragmented and non-post-fragmented traffic, where non-post-fragmented traffic is processed in-line within a Network Interface Card (NIC) and post-fragmented traffic is handled as an exception path by a software entity, using a hierarchical Anti-Replay Window scheme to manage both types of traffic independently with minimal hardware enhancements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If in-line IP reassembly is implemented to handle post-fragmented traffic, then security protocol processing can be maintained, but hardware complexity and cost increase significantly
Solution Approach 1:
The patent segments the handling of fragmented packets by identifying the first fragment separately from subsequent fragments. The first fragment is processed through standard security protocols, while subsequent fragments are recognized and handled differently by checking the fragmentation flags and offset values. This segmentation allows the system to process most traffic normally while handling fragmented traffic through a specialized path, avoiding the need for full in-line reassembly hardware.
Solution Approach 2:
The patent introduces an intermediary classification mechanism that identifies post-fragmented traffic and routes it through a specialized processing path. This intermediary layer checks the IP header fragmentation flags and directs traffic appropriately - either through standard security processing or through a reassembly-bypass path. This mediator approach allows the system to handle fragmented traffic without requiring expensive reassembly offload blocks.
2Reliability
If post-fragmented traffic is handled through standard security processing, then processing consistency is maintained, but performance degrades due to inability to process in parallel
Solution Approach 1:
The patent segments the processing path into two parallel channels: one for standard security protocol processing and another for post-fragmented traffic. By identifying the first fragment and subsequent fragments through header inspection, the system can route them through appropriate paths. This allows non-fragmented traffic to be processed in parallel with accelerated performance while maintaining consistent security processing for fragmented traffic.
Solution Approach 2:
The patent implements dynamic routing based on the fragmentation state of each packet. The system inspects the IP header to determine if a packet is the first fragment, a subsequent fragment, or non-fragmented traffic, and dynamically routes it through the appropriate processing path. This dynamic approach allows the system to optimize performance for the majority of non-fragmented traffic while ensuring proper security handling for fragmented traffic.
3Reliability
If header expansion is implemented for security protocols, then security features are enhanced, but post-fragmentation occurs more frequently
Solution Approach 1:
The patent converts the harmful effect of post-fragmentation into a beneficial classification opportunity. By inspecting the IP header fragmentation flags, the system identifies post-fragmented traffic and routes it through a specialized processing path. This approach transforms the problem of header expansion causing fragmentation into an opportunity to optimize handling of fragmented packets, avoiding the need for expensive reassembly hardware while maintaining security.
Solution Approach 2:
The patent segments traffic handling based on the fragmentation status caused by header expansion. First fragments are processed through standard security protocols, while subsequent fragments are identified through offset checking and routed through a reassembly-bypass path. This segmentation allows the system to handle the fragmentation issue created by security header expansion without requiring complex reassembly infrastructure.
Data Source
Figure 1~3
Figure 4
Figure 5
AI summary
A method for processing data of a security protocol comprises receiving a data packet associated to the security protocol over a network; determining, whether the data packet belongs to a group of post fragmented, PF, packets; processing the content of the data packet according to the security protocol if the data packet does not belong to the group of post fragmented packets; and forwarding the data packet if the data packet does belong to the group of post fragmented packets.