Transparent TCP/TLS Proxy Offload on Programmable IO Hardware
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network systems face challenges in providing flexible network interfaces to adapt to changes in network device structure, protocols, operating systems, and applications, leading to high CPU usage and reduced availability for applications due to tasks like virtualization, encryption, and deep packet inspection, which are not addressed by traditional NICs.
Innovation Solution
A programmable IO device with a P4-based ASIC and ARM core offloads TLS operations to a hardware subsystem, implementing a transparent TCP/TLS proxy system that processes data packets without host intervention, using a programmable pipeline and cryptographic offload subsystem.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If traditional NICs are used for network processing, then device simplicity is maintained, but CPU usage increases due to tasks like virtualization, encryption, and deep packet inspection
Solution Approach 1:
The patent extracts network processing tasks (virtualization, encryption, deep packet inspection) from the host CPU and relocates them to a dedicated Network Processing Unit (NPU). This extraction resolves the contradiction by maintaining simple NIC structure while reducing CPU usage through functional separation.
Solution Approach 2:
The patent introduces an NPU as an intermediary component between the NIC and host CPU. This mediator handles complex network processing tasks, allowing the NIC to remain structurally simple while the CPU is freed from energy-intensive operations.
2Adaptability or versatility
If network processing tasks are handled by host CPU, then adaptability to protocols and applications is maintained, but availability for applications decreases
Solution Approach 1:
The patent segments network processing functions into two parts: protocol-adaptive functions handled by the programmable NPU and application-critical functions handled by the host CPU. This segmentation resolves the contradiction by providing protocol adaptability through the NPU while preserving application availability.
Solution Approach 2:
The patent enables the NPU to autonomously handle network processing tasks without requiring host CPU intervention. This self-service capability provides protocol adaptability while ensuring application availability by preventing CPU resource contention.
3Device complexity
If fixed network interface control structures are used, then device simplicity is maintained, but flexibility to adapt to changes in network device structure and protocols is reduced
Solution Approach 1:
The patent implements a programmable NPU that can dynamically adapt its control structures to match different network device formats and protocols. This dynamic capability resolves the contradiction by maintaining simple fixed hardware while providing software-based adaptability.
Solution Approach 2:
The patent uses configurable parameters and programmable logic in the NPU to adapt control structures to different protocols and device formats. This parameter-based approach resolves the contradiction by maintaining simple fixed hardware architecture while providing flexible adaptability through software configuration.
4Reliability
If encryption and security operations are performed by host CPU, then security functionality is provided, but CPU cycles available for applications are reduced
Solution Approach 1:
The patent extracts encryption and security operations from the host CPU and relocates them to the NPU. This extraction resolves the contradiction by maintaining security functionality while increasing application throughput through CPU resource liberation.
Solution Approach 2:
The patent introduces the NPU as an intermediary that handles security operations between the NIC and host CPU. This mediator provides robust security functionality while preserving application productivity by preventing CPU resource contention.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Described are platforms, systems, and methods for providing an in-line, transparent Transmission Control Protocol (TCP) / Transport Layer Security (TLS) proxy. In one aspect, a programmable input output (IO) device comprises at least one advanced reduced instruction set computer (RISC) machine (ARM) core communicably coupled to at least one central processing unit (CPU) core of a host device; a programable P4 pipeline comprising a cryptographic offload subsystem; and a memory unit. The programmable IO device executing instruction stored on the memory unit comprising: establishing a session for an incoming TCP connection received from a remote host via the at least one ARM core; processing data packets received from the remote host via the programable P4 pipeline; decrypting the received data packets via the cryptographic offload subsystem; and providing the decrypted data packets to the host device.