Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper presents a novel approach to stateless load balancing over the QUIC transport protocol that avoids modifications to Connection ID fields, addressing the challenge of maintaining server consistency as backend pools change. By enabling non-initial QUIC packets to bypass the load balancer, the method enhances performance while adhering to QUIC's unlinkability requirements. The authors also explore potential security vulnerabilities, such as load balancer bypass and 0-RTT IP spoofing, and propose mitigations for these attacks.
Stateless load balancing over QUIC can be achieved without altering Connection IDs, preserving both performance and protocol integrity.
In-network load balancing outperforms traditional software load balancing while costing less. For instance, programmable switch ASICs can use hashing to select the backend server for the initial packet of each flow at the line rate. However, when the pool of available servers changes, ensuring that the subsequent flow packets are mapped to the same server is challenging due to the data plane's limited memory resources and performance requirements. With the emergence of the QUIC transport protocol, several works show how Connection ID fields (CIDs) can embed the server identifier for all non-initial packets. This approach requires modifications on the server side and violates the QUIC specification, which mandates that CIDs remain unlinkable. In this work, we show that stateless QUIC load balancing can be implemented inside the data plane with no changes to CIDs. Moreover, QUIC packets, except the initial client packet, can bypass the load balancer. We also investigate and mitigate attacks on QUIC in this scenario, including full load balancer bypass and 0-RTT IP spoofing.