TurboRetry: Mitigating Large-Scale QUIC Handshake Floods with Off-the-Shelf DPU Offloading
This paper presents TurboRetry, a DPU-offloaded solution that mitigates large-scale QUIC handshake floods by partitioning the Retry mechanism between host and DPU, achieving a 10–20× throughput improvement over traditional host-side implementations.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine the internet as a giant, bustling city where billions of people are constantly trying to enter different buildings to chat, shop, or watch videos. To get inside, you have to knock on the door and prove you belong there. In the world of computer networks, this "knocking" is called a handshake. It's a quick, polite exchange where your device and the server say hello, swap secret keys to lock the conversation, and agree on how to talk. The modern version of this handshake, called QUIC, is designed to be super fast and secure, letting you start chatting almost instantly.
However, just like a real city, this digital metropolis has a problem: bad actors. Imagine a mob of thousands of people, all pretending to be different customers, rushing the front door at the exact same time. They aren't there to buy anything; they are just there to knock, knock, knock, over and over. This is a DDoS attack (Distributed Denial of Service). Because the server has to do a lot of heavy math to verify each knock and check the secret keys, this flood of fake requests can exhaust the server's brain (its CPU), making it too tired to let the real customers in. The server's built-in security guard, called the Retry mechanism, tries to stop this by asking the knockers to prove they are real before doing the heavy math. But even this guard gets overwhelmed when the mob is huge.
This is where the story of TurboRetry begins. The researchers behind this paper asked a simple question: What if we didn't make the server's main brain do all the heavy lifting? What if we gave the security guard a super-powered robot assistant? They built a system called TurboRetry that moves the job of checking these fake knocks onto a special piece of hardware called a DPU (Data Processing Unit). Think of a DPU as a tiny, dedicated robot brain built right into the network cable that can handle millions of checks per second without getting tired. The paper shows that by letting this robot do the boring, repetitive work of checking IDs, the main server stays fresh and can still let real people in, even when a massive mob is trying to break in.
The Problem: A Door Guard Who Gets Tired
In the digital world, when you try to connect to a website using QUIC, the server has to perform some very expensive math operations to make sure you are who you say you are. If a hacker sends millions of fake connection requests at once, the server tries to do the math for every single one. This is like a bouncer at a club trying to check the ID of a million people at once; eventually, the bouncer gets exhausted, and the real guests can't get in.
The QUIC protocol already has a defense called Retry. Instead of doing the heavy math immediately, the server says, "Hold on, here is a special ticket (a token). Go get this ticket, bring it back, and then I'll let you in." This stops the server from wasting energy on people who never come back. However, the researchers found that even with this ticket system, the server still has to do a lot of work to generate and check these tickets. When the attack is huge, the server's main processor (the CPU) gets bogged down just checking tickets, and the whole system slows to a crawl.
The Solution: TurboRetry and the Robot Assistant
The team behind TurboRetry realized that the job of checking these tickets is actually very repetitive and doesn't need the server's main brain. They decided to offload this task to a DPU (Data Processing Unit). A DPU is like a smart network card that has its own little computer inside it. It's designed specifically to handle network traffic without bothering the main server.
TurboRetry splits the work into two parts:
- The Robot (DPU): The DPU takes over the "stateless" tasks. This means it checks the tickets, generates new ones, and makes sure they haven't been tampered with. It uses special hardware built into the DPU to do this incredibly fast. If the ticket is fake or the request is part of the attack, the robot simply drops it. The bad traffic never even reaches the main server.
- The Manager (Host CPU): The main server only gets involved when the robot says, "This one looks real!" Then, the server does the final, complex work of setting up the actual connection and managing the conversation.
To make sure the robot and the manager are on the same page, they invented a universal ticket format. It's like a special ID card that both the robot and the manager can read and understand, even though they are in different places. This ensures that the connection setup remains secure and follows all the rules, even though the heavy lifting is being done by the robot.
The Results: Super Speed and Zero Lag
The researchers tested TurboRetry on a real hardware setup using a BlueField-3 DPU. The results were impressive.
- Handling the Mob: While a standard server running on software alone could only handle about 209,000 fake requests per second before it started to choke, TurboRetry could handle up to 3 million packets per second without dropping a single real request. That is a 10 to 20 times improvement in throughput.
- Speed: The best part is that this didn't make the connection slower. For real users, the time it took to get in the door (connection setup latency) increased by only about 0.2 milliseconds—a blink of an eye that no human would notice.
- Safety Net: The system is also designed to be "fail-open." If the robot assistant (the DPU) ever crashes or breaks, the system automatically switches back to the main server's guard. The service doesn't shut down; it just gets a little slower, but it keeps working. This ensures that even if the hardware fails, the internet doesn't go dark.
Why This Matters
The paper demonstrates that by moving the boring, repetitive security checks to a dedicated robot assistant, we can protect our digital cities from massive floods of fake traffic. It proves that we don't have to choose between security and speed. With TurboRetry, servers can stand firm against huge attacks while still letting real users in instantly. It's a clever way of using new hardware to solve an old problem, ensuring that the internet stays open and fast for everyone, even when the bad guys are trying to push their way in.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.