Search papers, labs, and topics across Lattice.
This paper introduces TurboRetry, a novel mechanism that offloads the QUIC handshake Retry process to Data Processing Units (DPUs) to mitigate the impact of handshake flooding attacks. By partitioning the Retry tasks and utilizing an extended token format, TurboRetry significantly reduces the computational overhead associated with traditional host-side implementations. Evaluation results demonstrate that TurboRetry enhances throughput by 10-20 times compared to existing methods, addressing a critical vulnerability in QUIC's defense against large-scale attacks.
TurboRetry boosts QUIC performance by offloading handshake defenses to DPUs, achieving up to 20x throughput improvements against flooding attacks.
The modern transport protocol QUIC is designed to enhance network performance and security, but it remains vulnerable to handshake flooding attacks. Such attacks exhaust CPU resources by forcing the server to perform expensive cryptographic operations via a large number of handshaking requests. QUIC provides a built-in defense mechanism, the Retry mechanism, to mitigate these attacks. However, our experiments reveal that it can still become a performance bottleneck under large-scale QUIC handshake floods due to substantial computational overhead. In this paper, we design and implement TurboRetry, a split design, that offloads the Retry mechanism onto DPUs to efficiently mitigate QUIC handshake floods. TurboRetry partitions the tasks of the Retry into two categories, and then assigns them to the DPUs and the host, respectively. To preserve QUIC semantics and reduce the coordination overhead, TurboRetry designs an extended Retry token format and an efficient cooperation scheme. In addition, TurboRetry offloads the connection authorization task to the on-path DPA to further improve both performance and security. Our evaluation shows that TurboRetry outperforms the host-side implementation by a wide margin, improving throughput by 10-20$\times$.
