Virtual Adapter Emulation for TCP Offload in VPN Tunnels
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The inefficiency of processing and sending a large number of TCP segments through tunnels in virtual private networks (VPNs) leads to performance degradation and reduced application throughput due to computational overhead and limited effectiveness of SSL compression and encryption for smaller segments.
Innovation Solution
Implementing virtual adapter emulation of transport protocol task offload, such as TCP offload engine (TOE), TCP segmentation offload (TSO), and large receive offload (LRO), to bypass or offload transport protocol processing, allowing bulk processing and transfer of larger data chunks, thereby improving efficiency and performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If TCP segmentation is performed at the endpoint before tunneling, then data can be transmitted through the VPN tunnel, but processing overhead increases and application throughput decreases
Solution Approach 1:
The patent extracts the TCP segmentation function from the endpoint device and relocates it to the gateway device. The virtual adapter at the endpoint detects transport protocol tasks and offloads them to the gateway, which then performs the actual segmentation. This extraction removes the processing burden from the endpoint, reducing computational overhead and improving application throughput while maintaining the necessary TCP segmentation functionality for tunnel transmission.
2Reliability
If SSL compression and encryption are applied to smaller TCP segments, then secure communication is maintained, but compression effectiveness decreases and processing efficiency is reduced
Solution Approach 1:
The patent applies preliminary action by performing TCP segmentation at the gateway before SSL compression and encryption are applied. By segmenting the data into smaller TCP segments at the gateway rather than at the endpoint, the system enables more effective SSL compression on appropriately sized segments. This preliminary segmentation action optimizes the subsequent compression and encryption processes, improving data transfer efficiency while maintaining security.
3Ease of operation
If transport protocol processing is performed at the endpoint, then TCP segments can be generated for tunnel transmission, but device complexity and processing burden increase
Solution Approach 1:
The patent introduces an intermediary mechanism - the virtual adapter - that sits between the application and the network stack. The virtual adapter detects transport protocol tasks and facilitates offloading to the gateway without requiring the endpoint to fully implement complex TCP segmentation logic. This intermediary approach simplifies the endpoint device complexity while maintaining the capability to generate properly formatted TCP segments for tunnel transmission.
Data Source
AI summary
Example methods are provided for a first endpoint to communicate with a second endpoint over a public network, the second endpoint being in a private network. The method may comprise detecting an offload segment from a protocol stack of the first endpoint. The offload segment may be destined for the second endpoint, generated by the protocol stack from a chunk of data sent by an application executing on the first endpoint and detected using a virtual adapter that emulates a transport protocol task offload. The method may further comprise processing the offload segment to generate a processed offload segment for transfer through a tunnel connecting the virtual adapter over the public network with a gateway associated with the private network; and sending the processed offload segment through the tunnel in a plurality of tunnel segments, the gateway being configured to generate a plurality of transport protocol segments.