Systems and methods for offloading inline SSL processing to an embedded networking device
View Patent ↗A new approach is proposed that contemplates systems and methods to support a mechanism to offload all aspects of inline SSL processing of an application running on a server/host to an embedded networking device such as a Network Interface Card (NIC), which serves as a hardware accelerator for all applications running on the server that need to have a secure connection with a remote client device over a network. By utilizing a plurality of its software and hardware features, the embedded networking device is configured to process all SSL operations of the secure connection inline, i.e., the SSL operations are performed as packets are transferred between the host and the client over the network, rather than having the SSL operations offloaded to the NIC, which then returns the packets to the host (or the remote client device) before they can be transmitted to the remote client device (or to the host).
1. A system to support offloading of inline SSL processing, comprising:
a host running a plurality of applications and configured to
identify an application running on the host that requires a secured connection with a remote client device;
offload Secure Sockets Layer (SSL) processing of a plurality of network packets exchanged between the application and the remote client device over the secured connection to a separate embedded networking device;
said embedded networking device configured to
establish the secured connection based on information exchanged between the host and the embedded networking device;
perform a plurality of inline SSL operations to process the network packets received from the application running on the host or the remote client device over the secured connection;
transmit the processed packets to the remote client device following TCP/IP protocol or to the application running on the host without returning the packets back to the host or the remote client device, respectively.
2. The system of claim 1 , wherein:
the host is one of an OCTEON, x86, and ARM based devices.
3. The system of claim 1 , wherein:
the embedded networking device is a hardware-based, software-programmable Network Interface Card (NIC).
4. The system of claim 3 , wherein:
the embedded networking device is a multi-core network packet processing engine or a single System-on-Chip (SoC) chip comprising one or more of coprocessors.
5. The system of claim 1 , wherein:
the host and the embedded networking device are configured to communicate with each other over a Peripheral Component Interconnect (PCI) bus.
6. The system of claim 1 , wherein:
the embedded networking device is configured to terminate TCP/IP processing for the secured connection between the host and the remote client device.
7. The system of claim 1 , wherein:
the host is configured to enable the application to offload its SSL processing to the embedded networking device via a socket on the host by invoking an Application Programming Interface (API) having same syntax as a normal TCP/IP socket, wherein the socket is configured to implement all necessary socket operations to enable the application to offload its SSL processing to the embedded networking device.
8. The system of claim 7 , wherein:
the sockets are configured to route data through a kernel-based socket handling module, which is configured to
packetize the data and include relevant information about the data and its context in the packets;
send the packets to the embedded networking device for inline SSL processing.
9. The system of claim 1 , wherein:
the embedded networking device is configured to enable an application running on the host that do not need SSL processing to use the embedded networking device as a normal Ethernet device by forwarding all standard traffic from the application directly to the remote client device over the network without SSL processing.
10. The system of claim 9 , wherein:
the host is configured to multiplex both the standard traffic and the offloaded packets for SSL processing through a driver configured to communicate with embedded networking device.
11. The system of claim 1 , wherein:
the embedded networking device is configured to
match and tag encrypted packets coming in from the remote client device for SSL processing by looking up a flow table;
perform required SSL processing on the packets tagged for SSL processing before forwarding the processed packets to an application on the host.
12. The system of claim 1 , wherein:
the embedded networking device is configured to establish and terminate the secured connection between the host and the remote client device and to pass appropriate information to the host via a simple proxy between the host and SSL stack implemented on the embedded networking device.
13. The system of claim 1 , wherein:
the application requiring SSL processing is configured to listen on a specific port on the host for information to establish the secured connection with the remote client device.
14. A method to support offloading of inline SSL processing, comprising:
identifying an application running on a host that requires a secured connection with a remote client device;
establishing the secured connection based on information exchanged between the host and a separate embedded networking device;
offloading Secure Sockets Layer (SSL) processing of a plurality of network packets exchanged between the application and the remote client device over a secured connection to the embedded networking device;
perform a plurality of inline SSL operations via the embedded networking device to process the network packets received from the application running on the host or the remote client device over the secured connection;
transmitting the processed packets to the remote client device following TCP/IP protocol or to the application running on the host without returning the packets back to the host or the remote client device, respectively.
15. The method of claim 14 , wherein:
the embedded networking device is a hardware-based, software-programmable Network Interface Card (NIC).
16. The method of claim 14 , wherein:
the host and the embedded networking device are configured to communicate with each other over a Peripheral Component Interconnect (PCI) bus.
17. The method of claim 14 , further comprising:
terminating TCP/IP processing for the secured connection between the host and the remote client device.
18. The method of claim 14 , further comprising:
enabling the application to offload its SSL processing to the embedded networking device via a socket on the host by invoking an Application Programming Interface (API) having same syntax as a normal TCP/IP socket, wherein the socket is configured to implement all necessary socket operations to enable the application to offload its SSL processing to the embedded networking device.
19. The method of claim 18 , further comprising:
routing data through a kernel-based socket handling module, which is configured to
packetize the data and include relevant information about the data and its context in the packets;
send the packets to the embedded networking device for inline SSL processing.
20. The method of claim 14 , further comprising:
enabling an application running on the host that do not need SSL processing to use the embedded networking device as a normal Ethernet device by forwarding all standard traffic from the application directly to the remote client device over the network without SSL processing.
21. The method of claim 20 , further comprising:
multiplexing both the standard traffic and the offloaded packets for SSL processing through a driver configured to communicate with embedded networking device.
22. The method of claim 14 , further comprising:
matching and tagging encrypted packets coming in from the remote client device for SSL processing by looking up a flow table;
performing required SSL processing on the packets tagged for SSL processing before forwarding the processed packets to an application on the host.
23. The method of claim 14 , further comprising:
establishing and terminating the secured connection between the host and the remote client device and to pass appropriate information to the host via a simple proxy between the host and SSL stack implemented on the embedded networking device.
24. The method of claim 14 , further comprising:
listening on a specific port on the host for information to establish the secured connection between the host and the remote client device.