An In-Kernel Inline Crypto Solution for eXpress Data Path With QuickAssist Technology: Design, Prototyping and Performance Evaluation

The eXpress Data Path (XDP) has been part of mainline Linux kernel as an approach of high-performance programmable packet processing. It has demonstrated strong capabilities in inline DDoS prevention, routing, forwarding, load balancing, etc. However, the fast-growing encrypted data in network have undermined the XDP’s capabilities since XDP is unable to parse and process the encrypted packet. The AF_XDP enables the packet redirection to the XDP socket in user space with high performance. But it also lacks cryptographic function in its path. To overcome the limitations, in this paper we propose an inline crypto approach in XDP with a hardware-based accelerator, QuickAssist Technology (QAT), by introducing a new eBPF accelerator device map framework. The ingress encrypted packets from network interface controller (NIC) driver would be redirected to QAT accelerator device for decryption. Afterwards the flexible packet processing continues based on the plaintext. We investigate the feasibility and performance of XDP chaining QAT to process IPsec packet, with kernel networking stack and kernel networking stack bypass separately.