Encrypted data packet forwarding

1. A method of transmitting an encrypted data packet, comprising:

providing, from a network device, a first encrypted data packet to a trusted application (TA) handling application located outside a trusted execution environment (TEE) of the network device;

receiving, from the TA handling application, packet-forwarding data that defines processing instructions for the first encrypted data packet;

in response to receiving a second encrypted data packet, executing an extended Berkeley packet filter (eBPF) application at an express data path (XDP) hook point located within a kernel space of the network device;

analyzing the second encrypted data packet by the eBPF application; and

determining that the second encrypted data packet is to be processed via a trusted application (TA) within the TEE based at least in part on the analyzing by the eBPF application and the processing instructions.

2. The method of claim 1 , further comprising:

in response to a determination that filtering criteria indicates additional processing via a trusted application (TA), updating an eBPF map database;

with the TA handling application:

monitoring the eBPF application for an update to the eBPF map database;

selecting relevant encrypted data within the first encrypted data packet; and

transmitting the relevant encrypted data to the TA;

with the TA:

processing the relevant encrypted data to create processed relevant encrypted data; and

transmitting the processed relevant encrypted data to the TA handling application; and

invoking a system call to update the eBPF map database based on the processed relevant encrypted data.

3. The method of claim 2 , wherein the eBPF map database comprises a map type comprising a data structure identifying an application type and an encrypted portion of the first encrypted data packet.

4. The method of claim 2 , wherein the determination that the filtering criteria indicates additional processing by the TA is based at least in part on a processing of initial packets to identify in instances where the TA has been pre-installed, is based at least in part on whether the initial packets have been transmitted to the TA handling application which triggers the updating of the eBPF map database, or combinations thereof.

5. The method of claim 1 , wherein the first encrypted data packet comprises QUIC transfer protocol enabled traffic comprising an en4-tupled identifier and encoded ConnectionID.

6. The method of claim 1 , wherein the first encrypted data packet comprises:

real-time (RT) media traffic comprising real-time protocol (RTP) header data comprising a synchronization source identifier (SSRC),

a plurality of multiplexed media channels transmitted via a quadruple, or

combinations thereof.

7. The method of claim 2 , further comprising handling subsequent encrypted data packets based on an updated eBPF map database based on the updating of the eBPF map database.

8. The method of claim 1 , further comprising:

receiving the first encrypted data packet at a processor of the network device to which an interrupt request (IRQ) of a network interface controller (NIC) receive (RX) queue is directed; and

executing the eBPF application to access the TA directly from the kernel space.

9. The method of claim 8 , further comprising:

determining if the processor is TEE-enabled; and

based at least in part on the processor not being TEE-enabled, executing the eBPF application to transmit the first encrypted data packet to a TEE-enabled processor.

10. The method of claim 9 , wherein the eBPF application comprises an inventory of a TA installation status of a plurality of processors.

11. A computing device, comprising:

a processor; and

a non-transitory computer-readable media storing instructions that, when executed by the processor, causes the processor to perform operations comprising:

providing, from a network device, a first encrypted data packet to a trusted application (TA) handling application located outside a trusted execution environment (TEE) of the network device;

receiving, from the TA handling application, packet-forwarding data that defines processing instructions for the first encrypted data packet;

in response to receiving a second encrypted data packet, executing an extended Berkeley packet filter (eBPF) application at an express data path (XDP) hook point located within a kernel space of the network device;

analyzing the second encrypted data packet by the eBPF application; and

determining that the second encrypted data packet is to be processed via a trusted application (TA) within the TEE based at least in part on the analyzing by the eBPF application and the processing instructions.

12. The computing device of claim 11 , the operations further comprising:

in response to a determination that filtering criteria indicates additional processing via a trusted application (TA), updating an eBPF map database;

with the TA handling application:

monitoring the eBPF application for an update to the eBPF map database;

selecting relevant encrypted data within the first encrypted data packet; and

transmitting the relevant encrypted data to the TA;

with the TA:

processing the relevant encrypted data to create processed relevant encrypted data; and

transmitting the processed relevant encrypted data to the TA handling application; and

invoking a system call to update the eBPF map database based on the processed relevant encrypted data.

13. The computing device of claim 12 , wherein the eBPF map database comprises a map type comprising a data structure identifying an application type and an encrypted portion of the first encrypted data packet.

14. The computing device of claim 12 , wherein the determination that the filtering criteria indicates additional processing by the TA is based at least in part on a processing of initial packets to identify in instances where the TA has been pre-installed, is based at least in part on whether the initial packets have been transmitted to the TA handling application which triggers the updating of the eBPF map database, or combinations thereof.

15. The computing device of claim 11 , wherein the first encrypted data packet comprises QUIC transfer protocol enabled traffic comprising an en4-tupled identifier and encoded ConnectionID.

16. The computing device of claim 11 , wherein the first encrypted data packet comprises:

real-time (RT) media traffic comprising real-time protocol (RTP) header data comprising a synchronization source identifier (SSRC),

a plurality of multiplexed media channels transmitted via a quadruple, or

combinations thereof.

17. The computing device of claim 12 , the operations further comprising handling subsequent encrypted data packets based on an updated eBPF map database based on the updating of the eBPF map database.

18. The computing device of claim 11 , the operations further comprising:

receiving the first encrypted data packet at the processor to which an interrupt request (IRQ) of a network interface controller (NIC) receive (RX) queue is directed; and

executing the eBPF application to access the TA directly from the kernel space.

19. The computing device of claim 18 , the operations further comprising:

determining if the processor is TEE-enabled; and

based at least in part on the processor not being TEE-enabled, executing the eBPF application to transmit the first encrypted data packet to a TEE-enabled processor.

20. The computing device of claim 19 , wherein the eBPF application comprises an inventory of a TA installation status of a plurality of processors.