UPF IPsec Packet Processing on FPGA-GPU Network Hardware

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing communication networks face inefficiencies in data routing and security, particularly in 4G and 5G networks, due to excessive signaling and throughput limitations in user plane functions, which are exacerbated by the need for external host servers and inadequate IPsec implementations.

Innovation Solution

Incorporating field-programmable gate arrays (FPGAs) and graphics processing units (GPUs) into programmable network devices to perform user plane functions, including QoS, session management, and IPsec security, eliminating the need for external host servers and minimizing excessive communication.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If data packets are routed through external host servers for user plane functions, then security management and QoS control can be performed, but excessive signaling communication overhead occurs and throughput is limited

Engineering Contradiction:

Improvesecurity managementVSAvoidthroughput

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent combines external host server functions with embedded hardware device functions into a single integrated system. The host server communicates with the embedded hardware device via standardized interfaces (PCIe, CXL, NVLink), allowing security management and QoS control to be performed without excessive signaling overhead, thereby improving throughput while maintaining reliability.

Inventive Principle:

Principle #5Merging (Combining)

2Reliability

If multiple external host servers are used for IPsec security functions, then data security can be ensured, but device complexity and communication overhead increase

Engineering Contradiction:

Improvedata securityVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent extracts IPsec security functions from external host servers and implements them directly in the embedded hardware device. This extraction eliminates the need for multiple external servers while maintaining data security, thereby reducing device complexity and communication overhead.

Inventive Principle:

Principle #2Taking out (Extraction)

3Productivity

If traditional gateway architectures are used for packet processing, then network routing can be performed, but billions of packets per second cause excessive signaling between control and user planes

Engineering Contradiction:

Improvepacket processing capacityVSAvoidsignaling delay

Core Design Contradiction:

ProductivityVSLoss of time

Solution Approach 1:

The patent introduces an embedded hardware device as an intermediary between the host server and the network interface. This intermediary handles packet processing locally, enabling billions of packets per second to be processed without excessive signaling between control and user planes, thereby reducing signaling delay while maintaining high packet processing capacity.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS12489788B1Programmable networking device for user plane function with internet protocol security (IPsec)

Publication Date: 2025.12.02 T MOBILE INNOVATIONS LLC

AI summary

Programmable network devices configured to perform various packet processing functions are further configured to use IPsec to secure control and data packets associated with data sessions traversing the UPF. Field-programmable gate arrays (FPGAs) and/or graphics processing units (GPUs) coupled with network interfaces are configured to perform user plane functions and secure data packet within a compact and modular hardware unit to minimize excessive communication while maintaining control and user plane separation (CUPS).