Systems and methods for offloading inline ssl processing to an embedded networking device

Patent metadata

Field	Value
Publication number	US-2016352870-A1
Application number	US-201615152164-A
Country	US
Kind code	A1
Filing date	May 11, 2016
Priority date	May 26, 2015
Publication date	Dec 1, 2016
Grant date	—

Abstract

A new approach is proposed that contemplates systems and methods to support a mechanism to offload all aspects of inline SSL processing of an application running on a server/host to an embedded networking device such as a Network Interface Card (NIC), which serves as a hardware accelerator for all applications running on the server that need to have a secure connection with a remote client device over a network. By utilizing a plurality of its software and hardware features, the embedded networking device is configured to process all SSL operations of the secure connection inline, i.e., the SSL operations are performed as packets are transferred between the host and the client over the network, rather than having the SSL operations offloaded to the NIC, which then returns the packets to the host (or the remote client device) before they can be transmitted to the remote client device (or to the host).

First claim

What is claimed is:

1 . A system to support offloading of inline SSL processing, comprising:
a host running a plurality of applications and configured to
identify an application running on the host that requires a secured connection with a remote client device;
offload Secure Sockets Layer (SSL) processing of a plurality of network packets exchanged between the application and the remote client device over the secured connection to an external embedded networking device;
said embedded networking device configured to
establish the secured connection based on information exchanged between the host and the external embedded networking device;
perform a plurality of inline SSL operations to process the network packets received from the application running on the host or the remote client device over the secured connection;
transmit the processed packets to the remote client device following TCP/IP protocol or to the application running on the host without returning the packets back to the host or the remote client device, respectively.

2 . The system of claim 1 , wherein:
the host is one of an OCTEON, x86, and ARM based devices.

3 . The system of claim 1 , wherein:
the embedded networking device is a hardware-based, software-programmable Network Interface Card (NIC).

4 . The system of claim 3 , wherein:
the embedded networking device is a multi-core network packet processing engine or a single System-on-Chip (SoC) chip comprising one or more of coprocessors.

5 . The system of claim 1 , wherein:
the host and the embedded networking device are configured to communicate with each other over a Peripheral Component Interconnect (PCI) bus.

6 . The system of claim 1 , wherein:
the embedded networking device is configured to terminate TCP/IP processing for the secured connection between the host and the remote client device.

7 . The system of claim 1 , wherein:
the host is configured to enable the application to offload its SSL processing to the embedded networking device via a socket on the host by invoking an Application Programming Interface (API) having same syntax as a normal TCP/IP socket, wherein the socket is configured to implement all necessary socket operations to enable the application to offload its SSL processing to the embedded networking device.

8 . The system of claim 7 , wherein:
the sockets are configured to route data through a kernel-based socket handling module, which is configured to
packetize the data and include relevant information about the data and its context in the packets;
send the packets to the embedded networking device for inline SSL processing.

9 . The system of claim 1 , wherein:
the embedded networking device is configured to enable an application running on the host that do not need SSL processing to use the embedded networking device as a normal Ethernet device by forwarding all standard traffic from the application directly to the remote client device over the network without SSL processing.

10 . The system of claim 9 , wherein:
the host is configured to multiplex both the standard traffic and the offloaded packets for SSL processing through a driver configured to communicate with embedded networking device.

11 . The system of claim 1 , wherein:
the embedded networking device is configured to
match and tag encrypted packets coming in from the remote client device for SSL processing by looking up a flow table;
perform required SSL processing on the packets tagged for SSL processing before forwarding the processed packets to an application on the host.

12 . The system of claim 1 , wherein:
the embedded networking device is configured to establish and terminate the secured connection between the host and the remote client device and to pass appropriate information to the host via a simple proxy between the host and SSL stack implemented on the embedded networking device.

13 . The system of claim 1 , wherein:
the application requiring SSL processing is configured to listen on a specific port on the host for information to establish the secured connection with the remote client device.

14 . A method to support offloading of inline SSL processing, comprising:
identifying an application running on a host that requires a secured connection with a remote client device; establishing the secured connection based on information exchanged between the host and the external embedded networking device; offloading Secure Sockets Layer (SSL) processing of a plurality of network packets exchanged between the application and the remote client device over a secured connection to an external embedded networking device; perform a plurality of inline SSL operations via the embedded networking device to process the network packets received from the application running on the host or the remote client device over the secured connection; transmitting the processed packets to the remote client device following TCP/IP protocol or to the application running on the host without returning the packets back to the host or the remote client device, respectively.

15 . The method of claim 14 , wherein:
the embedded networking device is a hardware-based, software-programmable Network Interface Card (NIC).

16 . The method of claim 14 , wherein:
the host and the embedded networking device are configured to communicate with each other over a Peripheral Component Interconnect (PCI) bus.

17 . The method of claim 14 , further comprising:
terminating TCP/IP processing for the secured connection between the host and the remote client device.

18 . The method of claim 14 , further comprising:
enabling the application to offload its SSL processing to the embedded networking device via a socket on the host by invoking an Application Programming Interface (API) having same syntax as a normal TCP/IP socket, wherein the socket is configured to implement all necessary socket operations to enable the application to offload its SSL processing to the embedded networking device.

19 . The method of claim 18 , further comprising:
routing data through a kernel-based socket handling module, which is configured to
packetize the data and include relevant information about the data and its context in the packets;
send the packets to the embedded networking device for inline SSL processing.

20 . The method of claim 14 , further comprising:
enabling an application running on the host that do not need SSL processing to use the embedded networking device as a normal Ethernet device by forwarding all standard traffic from the application directly to the remote client device over the network without SSL processing.

21 . The method of claim 20 , further comprising:
multiplexing both the standard traffic and the offloaded packets for SSL processing through a driver configured to communicate with embedded networking device.

22 . The method of claim 14 , further comprising:
matching and tagging encrypted packets coming in from the remote client device for SSL processing by looking up a flow table; performing required SSL processing on the packets tagged for SSL processing before forwarding the processed packets to an application on the host.

23 . The method of claim 14 , further comprising:
establishing and terminating the secured connection between the host and the remote client device and to pass appropriate information to the host via a simple proxy between the host and SSL s

Assignees

• Cavium Inc

Inventors

• Manapragada Ram Kumar
• Panicker Manojkumar
• Masood Faisal
• Kikkeri Satish

Classifications

• G06F13/4282 Primary

  on a serial bus, e.g. I2C bus, SPI bus (on daisy chain buses G06F13/4247) · CPC title

• H04L67/34

  involving the movement of software or configuration parameters  (network booting or remote initial program loading [RIPL] G06F9/4416) · CPC title

• H04L63/168

  above the transport layer · CPC title

• G06F9/54 Primary

  Interprogram communication · CPC title

• H04L69/162 Primary

  involving adaptations of sockets based mechanisms (secure socket layer H04L63/168) · CPC title