Hardware-accelerated payload filtering in secure communication

A hardware accelerator, comprising:

• a field programmable gate array (“FPGA”);
• a processor external to the FPGA, the processor being coupled to the FPGA via a communications bridge;
• a buffer operatively coupled to the FPGA and the processor;
• and
• a memory containing instructions executable by the processor to cause the processor to:
• receive, via the communications bridge from the FPGA, data representing a validation request from the FPGA for validating content contained in a message stored in the buffer, the message being secured using a Secure Sockets Layer or Transport Layer Security protocol;
• in response to receiving the validation request from the FPGA,
• identify a status header field contained in the message according to Hypertext Transfer Protocol (“HTTP”);
• determine whether the identified status header field contains a value that is indicative of the content in the message being valid;
• and
• in response to determining that the status header field is present and contains a value that is indicative of the content in the message being valid, generate and transmit, via the communications bridge to the FPGA, data representing a validation result containing an indicator indicating that the message contains valid content.

A method of facilitating secure communication management in a hardware accelerator containing a programmable hardware circuitry coupled to a processor external to the programmable hardware circuitry via a communications bridge, the programmable hardware circuitry having a buffer and a user kernel configured to perform a user function, wherein the method comprising:

• at the programmable hardware circuitry,
• receiving a data request from the user kernel, the data request requesting to read a message stored in the buffer, the message being secured using a Secure Sockets Layer or Transport Layer Security protocol;
• in response to receiving the data request from the user kernel, transmitting, via the communications bridge to the processor, data representing a request to validate content in the message;
• receiving, via the communications bridge from the processor, data representing a validation result of the message, the validation result containing an indication whether the content in the message is valid and at least one of a header size of the message or a payload size of the message;
• and
• when the indication indicates that the content of the message is valid, removing a header from the message according to the header size or the payload size in the validation result to extract a payload from the message and providing the extracted payload to the user kernel for processing.