Methods and systems for selectively applying a transform to a packet
Packets may be transformed cryptographically or compressively in order to secure network communications and to preserve network bandwidth. The transformations may be applied at more than one protocol layer which can result in unnecessary operations such encrypting or compressing data that is already encrypted. This wastes processing resources. A solution is to selectively apply transformations. A network appliance can receive an initial layer packet for transmission to a network destination. The initial layer header of the initial layer packet can be used to determine an initial state indicator that indicates an initial state (e.g., encrypted, compressed, etc.) of an initial layer payload of the initial layer packet. The initial layer packet can be encapsulated in a subsequent layer packet as a subsequent layer payload. Selectively applying a transform to the subsequent layer payload based on the initial state indicator can avoid the unnecessary operation.
1 . A method comprising:
storing a transformation policy table that associates a plurality of transformation intents with a plurality of payload states for a plurality of network protocols;
receiving an initial layer packet for transmission to a network destination;
using the transformation policy table to determine a transformation intent for the initial layer packet in response to determining an initial state of an initial layer payload of the initial layer packet; and
encapsulating the initial layer packet in a subsequent layer packet as a subsequent layer payload, the initial layer packet selectively transformed in accordance with the transformation intent.
2 . The method of claim 1 , wherein:
the transformation intent is determined based on a cryptographic state or a compressive state of the initial layer payload; and
the transformation intent indicates a compressive transform or a cryptographic transform.
3 . The method of claim 1 , wherein the subsequent layer packet is an internet protocol (IP) packet.
4 . The method of claim 1 , wherein the subsequent layer packet is an Ethernet packet.
5 . The method of claim 1 , further including:
using header field data extracted from a packet header of the initial layer packet to determine the transformation intent.
6 . The method of claim 1 , wherein no transform is not applied to the initial layer packet in response to determining that the initial layer payload is encrypted.
7 . The method of claim 6 , wherein the initial layer packet is a transport layer security (TLS) record or a Secure Socket Layer (SSL) message or a layer 7 packet.
8 . The method of claim 6 , wherein the initial layer packet is a layer 4 packet.
9 . The method of claim 6 , wherein the initial layer packet is a layer 3 packet or an IP packet.
10 . The method of claim 6 , wherein the subsequent layer packet is an internet protocol security (IPSEC) packet.
11 . The method of claim 6 , wherein the initial layer packet is an internet protocol security (IPSEC) packet.
12 . The method of claim 6 , wherein the subsequent layer packet is a media access control security (MACsec) packet.
13 . The method of claim 1 , wherein no transform is applied to the initial layer packet in response to determining that the initial layer payload is compressed.
14 . The method of claim 1 , wherein:
the transformation policy table further associates the transformation intents with the payload states for a plurality of protocol layers.
15 . The method of claim 14 , wherein the transformation policy table further associates the transformation intents with a plurality of tenant identifiers, the transformation intent selected in response to determining a one of the tenant identifiers corresponding to the initial layer packet.
16 . The method of claim 1 , wherein:
the transformation policy table further associates the transformation intents with a plurality of tenant identifiers; and
the transformation intent is selected in response to determining a one of the tenant identifiers corresponding to the initial layer packet.
17 . The method of claim 1 , wherein:
a network appliance includes a packet processing pipeline circuit that includes a parser;
the parser extracts a header field data from the initial layer packet; and
the network appliance uses the header field data to determine the initial state of the initial layer payload of the initial layer packet.
18 . The method of claim 1 , wherein the transformation intent indicates applying a cryptographic transform, the transformation intent selected in response to determining that the initial layer payload is not encrypted.
19 . The method of claim 1 , wherein the transformation intent indicates a compressive transform is not applied, the transformation intent selected in response to determining that the initial layer payload is encrypted.
20 . The method of claim 1 , wherein the transformation intent indicates not applying a compressive transform, the transformation intent selected in response to determining that the initial layer payload is encrypted.
21 . A method comprising:
storing a transformation policy table that associates a plurality of transformation intents with a plurality of payload states for a plurality of network protocols;
communicating with a remote host using a plurality of session packets of a session that includes a plurality of inbound session packets and a plurality of outbound session packets;
using the transformation policy table to determine a transformation intent for the outbound session packets in response to determining an initial state of the session; and
selectively applying a transform to the outbound session packets in accordance with the transformation intent,
wherein
the initial state is an initial cryptographic state or an initial compressive state,
the transform is a compressive transform or a cryptographic transform,
the outbound session packets are transmitted to the remote host, and
the inbound session packets are received from the remote host.
22 . The method of claim 21 , wherein the transformation intent is determined using an internet protocol header of one of the session packets.
23 . The method of claim 21 , wherein the transformation intent is determined using a TLS, SSL or layer 7 header of one of the session packets.
24 . The method of claim 21 , wherein:
the transformation intent is determined using data extracted from a header field of one of the session packets by a parser of a packet processing pipeline circuit in a network appliance; and
the network appliance selectively applies the transform to the outbound session packets.
25 . A system comprising:
a storage means for storing a transformation policy table that associates a plurality of transformation intents with a plurality of payload states for a plurality of network protocols;
a determination means for using the transformation policy table to determine a transformation intent for a packet in response to determining an initial state of the packet; and
a means for encapsulating the packet in a second packet, the packet selectively transformed in accordance with the transformation intent.
26 . The system of claim 25 , wherein:
the transformation intent is determined based on the initial state of the packet and a network protocol of the packet.
27 . The system of claim 25 , further including:
a CPU offload means for extracting a header field data from a packet header
wherein the transformation intent is determined based on the header field data and a network protocol of the packet.
28 . A system comprising:
a memory configured to store a transformation policy table that associates a plurality of transformation intents with a plurality of payload states for a plurality of network protocols;
packet processing pipeline circuitry that includes a parser and a plurality of match-action units configured as a plurality of processing stages of a packet processing pipeline;
at least one central processing unit (CPU) core that configures the packet processing pipeline to:
use the transformation policy table to determine a transformation intent in response to determining an encryption state of a payload of a packet; and
encapsulate the packet in a second packet after the second packet is selectively transformed in accordance with the transformation intent.
29 . The system of claim 28 , wherein:
the at least one CPU core further configures the packet processing pipeline to command a cryptographic transform circuit to apply a cryptographic transform to the packet in accordance with the transformation intent.
30 . The system of claim 28 , wherein the at least one CPU core configures the packet processing pipeline to implement a packet cryptographic and compressive transform inferencer.
31 . The system of claim 30 , further including:
a cryptographic transform circuit configured to selectively apply a cryptographic transform in accordance with the transformation intent.
32 . The system of claim 28 , wherein:
a cryptographic transform circuit applies a cryptographic transform to the packet in accordance with the transformation intent after a compression circuit applies a compressive transform to the packet in accordance with the transformation intent.
33 . The system of claim 32 , wherein a transform is applied to the packet in response to determining that the payload is not encrypted or not compressed.
34 . The system of claim 28 , further including:
a compression circuit,
wherein the at least one CPU core further configures the packet processing pipeline to command the compression circuit to apply a compressive transform to the packet in accordance with the transformation intent.