Hardware offload of QUIC distributed denial of service protection

A method implemented by a QUIC server operating in a computer system that includes a processor system, comprising:

• sending, to a network interface controller device, a key for generating a QUIC stateless reset packet;
• sending, to the network interface controller device, a first indication that a first CID (connection identifier) is allowed, based on the first CID being associated with a first QUIC connection established by the QUIC server;
• and
• after sending the first indication to the network interface controller device, performing at least one of:
• sending, to the network interface controller device, a second indication that a second CID replaces the first CID and is allowed;
• sending, to the network interface controller device, a third indication that the first CID is no longer allowed;
• and
• sending, to the network interface controller device, a fourth indication that a third CID is allowed.

A computer system, comprising:

• a first processor system;
• a first computer storage medium that stores first computer-executable instructions that are executable by the first processor system to perform first operations comprising:
• sending, to a network interface controller device, a key for generating a stateless reset token;
• and
• sending, to the network interface controller device, a first indication that a first CID (connection identifier) is allowed, based on the first CID being associated with a first QUIC connection established by a QUIC server operating at the first processor system;
• and
• the network interface controller device, which comprises a second processor system, network interface hardware, and a second computer storage medium that stores second computer-executable instructions that are executable by the second processor system to perform second operations comprising:
• adding the first CID to a set of CIDs stored at the network interface controller device;
• identifying a second CID within a QUIC packet received at the network interface hardware;
• determining that the second CID is not present in the set of CIDs;
• generating a QUIC stateless reset packet targeted at a source address identified from the QUIC packet, the QUIC stateless reset packet including the stateless reset token;
• initiating communication of the QUIC stateless reset packet at the network interface hardware;
• and
• discarding the QUIC packet.