Offload of decryption operations
Examples described herein relate to a Transport Layer Security (TLS) offload engine to: based on detection of encrypted data unassociated with a previously detected data header: search for one or more data headers; identify at least two candidate data headers for validation; and based on receipt of an indication that the at least two candidate data headers are valid, perform decryption of received data in one or more packets. In some examples, the TLS offload engine is to: based on receipt of an indication that one or more of the at least two candidate data headers is not a valid header, search for two or more other candidate data headers.
1. An apparatus comprising:
an interface and
a Transport Layer Security (TLS) offload engine circuitry coupled to the interface, the TLS offload engine circuitry to:
based on detection of packets received out-of-order:
search for at least two candidate data headers;
based on the at least two candidate data headers being valid, perform decryption of received data in two or more packets associated with the at least two candidate data headers; and
based on at least one of the at least two candidate data headers is not valid, do not perform decryption of the received data in the two or more packets, wherein to search for at least two candidate data headers, the TLS offload engine circuitry is to:
determine a data length associated with a first candidate data header and
identify a second candidate data header at a location based on the data length.
2. The apparatus of claim 1 , wherein the TLS offload engine circuitry is to:
based on the at least one of the at least two candidate data headers is not a valid, search for at least one other candidate data header.
3. The apparatus of claim 1 , wherein to search for at least two candidate data headers, the TLS offload engine circuitry is to:
provide the first and second candidate data headers to another agent or entity for validation.
4. The apparatus of claim 1 , wherein the TLS offload engine circuitry is to:
search for another candidate data header after the first candidate data header and before the second candidate data header.
5. The apparatus of claim 1 , wherein at least one candidate data header of the at least two candidate data headers comprises one or more of: a preamble, header, and length field.
6. The apparatus of claim 1 , wherein to search for the at least two candidate data headers, the TLS offload engine circuitry is to utilize resources otherwise used for decryption to search for one or more data headers.
7. The apparatus of claim 1 , comprising a network interface that includes the TLS offload engine circuitry, wherein the network interface comprises one or more of: an Infrastructure Processing Unit (IPU), data processing unit (DPU), network interface controller (NIC), or smartNIC.
8. The apparatus of claim 1 , comprising a server, wherein the server is to determine if the at least two candidate data headers are valid and indicate whether the at least two candidate data headers are valid or includes one or more invalid candidate data headers.
9. A method comprising:
a Transport Layer Security (TLS) offload engine performing:
based on detection of packets received out-of-order:
searching for at least two candidate headers;
based on the at least two candidate headers are valid headers, performing decryption of received data in two or more packets associated with the at least two candidate headers; and
based on at least one of the at least two candidate headers is not valid, do not perform decryption of the received data in the two or more packets, wherein searching for at least two candidate headers comprises:
determining a data length associated with a first candidate header and
identifying a second candidate header at a location based on the data length.
10. The method of claim 9 , comprising:
the TLS offload engine performing:
based on one or more of the at least two candidate headers is not a valid header, searching for at least one other candidate header.
11. The method of claim 9 , wherein searching for at least two candidate headers comprises:
providing the first and second candidate headers to a server for validation.
12. The method of claim 9 , comprising:
searching for another candidate header after the first candidate header and before the second candidate header.
13. The method of claim 9 , wherein at least one candidate header of the at least two candidate headers comprises one or more of: a preamble, header, and length field.
14. At least one non-transitory computer-readable medium, comprising instructions stored thereon, that if executed by at least one processor, cause the at least one processor to:
execute a device driver to configure a network interface controller to:
based on receipt of packets out-of-order:
search for two or more candidate headers, wherein the search for two or more candidate data headers, the network interface controller is to:
determine a data length associated with a first candidate data header and
identify a second candidate data header at a location based on the data length;
based on the two or more candidate headers being valid, perform decryption of received data in two or more packets associated with the at least two or more candidate headers; and
based on at least one of the two or more candidate headers is not valid, do not perform decryption of the received data in the two or more packets.
15. The at least one computer-readable medium of claim 14 , wherein the network interface controller is to:
provide the first and second candidate headers to a host system for validation.
16. The at least one computer-readable medium of claim 14 , wherein to search for one or more candidate headers, the network interface is to:
search for another candidate header after the first candidate header and before the second candidate header.
17. The at least one computer-readable medium of claim 15 , wherein at least one candidate header of the at least two candidate headers comprises one or more of: a preamble, header, and length field.