# US 2021/0243169 A1 · Proxy service through hardware acceleration using an io device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0243169 A1 - Document ID: US20210243169A1 - Status: Published application - Kind: A1 - Application number: 16/779,096 - Filed: 2020-01-31 - Published: 2021-08-05 - Earliest claimed: 2020-01-31 - Assignees: Pensando Systems Inc. - Applicants: Pensando Systems Inc. - Inventors: Sameer KITTUR; Raghava Kodigenahalli SIVARAMU; Alok RATHORE; Vijay SAMPATH; Vipin JAIN - Web page: https://patentgrep.com/patent/US20210243169A1 ## CPC - H04L 63/0485: {Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up} - G06F 13/4282: {on a serial bus, e.g. I2C bus, SPI bus (on daisy chain buses G06F13/4247)} - G06F 21/606: {by securing the transmission between two devices or processes} - H04L 63/0281: {Proxies} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/166: {at the transport layer} - G06F 2213/0026: PCI express - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Described are platforms, systems, and methods for providing an in-line, transparent Transmission Control Protocol (TCP)/Transport Layer Security (TLS) proxy. In one aspect, a programmable input output (IO) device comprises at least one advanced reduced instruction set computer (RISC) machine (ARM) core communicably coupled to at least one central processing unit (CPU) core of a host device; a programmable P4 pipeline comprising a cryptographic offload subsystem; and a memory unit. The programmable IO device executing instruction stored on the memory unit comprising: establishing a session for an incoming TCP connection received from a remote host via the at least one ARM core; processing data packets received from the remote host via the programmable P4 pipeline; decrypting the received data packets via the cryptographic offload subsystem; and providing the decrypted data packets to the host device. ## Claims ### Claim 1 A programmable input output (IO) device comprising: at least one advanced reduced instruction set computer (RISC) machine (ARM) core communicably coupled to at least one central processing unit (CPU) core of a host device; a programmable P4 pipeline comprising a cryptographic offload subsystem; and a memory unit, the memory unit having instructions stored thereon which, when executed by the programmable IO device, cause the programmable IO device to perform operations to enable an in-line, transparent Transmission Control Protocol (TCP)/Transport Layer Security (TLS) proxy, the operations comprising: establishing a session for an incoming TCP connection received from a remote host via the at least one ARM core; processing data packets received from the remote host via the programmable P4 pipeline; decrypting the received data packets via the cryptographic offload subsystem; and providing the decrypted data packets to the host device. ### Claim 2 (depends on 1) The programmable IO device of claim 1, wherein the programmable IO device is an intelligent server adapter (ISA). ### Claim 3 (depends on 1) The programmable IO device of claim 1, wherein the programmable IO device is a distributed service card. ### Claim 4 (depends on 1) The programmable IO device of claim 1, wherein the TCP/TLS proxy is transparent to the host device. ### Claim 5 (depends on 1) The programmable IO device of claim 1, wherein the TCP/TLS proxy is transparent to applications executing on the host device. ### Claim 6 (depends on 5) The programmable IO device of claim 5, wherein the TCP/TLS proxy is provided without disrupting applications executing on the host device. ### Claim 7 (depends on 1) The programmable IO device of claim 1, wherein the session is established via a TLS handshake with the remote host. ### Claim 8 (depends on 1) The programmable IO device of claim 1, wherein the TCP/TLS proxy is applied in-line through hardware acceleration. ### Claim 9 (depends on 1) The programmable IO device of claim 1, wherein the TCP/TLS proxy incurs no latency or bandwidth datapath penalties on the host device. ### Claim 10 (depends on 1) The programmable IO device of claim 1, wherein the TLS datapath is offloaded into hardware of the programmable IO device via the operations. ### Claim 11 (depends on 1) The programmable IO device of claim 1, wherein establishing the session comprises implementing a TCP stack on a data-plane via the programmable P4 pipeline. ### Claim 12 (depends on 11) The programmable IO device of claim 11, wherein the TCP stack is implemented using extended P4 programmable language. ### Claim 13 (depends on 11) The programmable IO device of claim 11, wherein a TLS record processor is implemented on the data-plane via the programmable P4 pipeline to achieve a high rate of TLS record processing. ### Claim 14 (depends on 1) The programmable IO device of claim 1, wherein the session is not established via software executed by the at least on CPU of the host device. ### Claim 15 (depends on 1) The programmable IO device of claim 1, wherein the at least one ARM core and the CPU core are communicably coupled via Peripheral Component Interconnect Express (PCIe) via the programmable P4 pipeline. ### Claim 16 (depends on 1) The programmable IO device of claim 1, wherein the TCP/TLS proxy is implemented as close to the host device as possible. ### Claim 17 (depends on 1) The programmable IO device of claim 1, wherein the TCP/TLS proxy secures the data packets for legacy applications and new applications to provide lower CPU consumption on the host device. ### Claim 18 (depends on 1) The programmable IO device of claim 1, wherein the TCP/TLS proxy provides for decreased traffic in a network comprising the host device. ### Claim 19 (depends on 1) The programmable IO device of claim 1, wherein establishing the session for the incoming TCP connection received from the remote host comprises: receiving a request for the TCP connection from the remote host; and requesting a control-plane processor to handle a new TCP flow. ### Claim 20 (depends on 19) The programmable IO device of claim 19, wherein the at least one ARM cores comprise the control-plane processor. ### Claim 21 (depends on 19) The programmable IO device of claim 19, wherein a connection state is offloaded to a data-plane processor once the session is established. ### Claim 22 (depends on 21) The programmable IO device of claim 21, wherein the programmable P4 pipeline comprises the data-plane processor. ### Claim 23 (depends on 21) The programmable IO device of claim 21, wherein a TLS state is transferred to the data-plane processor, and wherein the session is offloaded once TLS authentication is complete and session keys have been negotiated. ### Claim 24 (depends on 1) The programmable IO device of claim 1, wherein the cryptographic offload subsystem comprises a cryptographic hardware block. ### Claim 25 (depends on 1) The programmable IO device of claim 1, wherein the decrypted data packets are provided in plain text to the host device. ### Claim 26 (depends on 1) The programmable IO device of claim 1, wherein the operations comprise: receiving policies for workloads from a central controller. ### Claim 27 (depends on 26) The programmable IO device of claim 26, wherein the central controller is not hosted on the host device. ### Claim 28 A method for enabling an in-line, transparent Transmission Control Protocol (TCP)/Transport Layer Security (TLS) proxy, the method being executed by a programmable input output (IO) device installed in a host device and comprising: establishing a session for an incoming TCP connection received from a remote host; processing data packets received from the remote host via a programmable P4 pipeline; decrypting the received data packets via a cryptographic offload subsystem; and providing the decrypted data packets to the host device. ### Claim 29 A transparent proxy system, comprising: a remote host; a host device comprising: at least one central processing unit (CPU) core; and a programmable input output (IO) device comprising: a programmable P4 pipeline comprising a cryptographic offload subsystem; and at least one advanced reduced instruction set computer (RISC) machine (ARM) core communicably coupled to the at least one CPU core, the programmable input output (IO) device configured to execute instructions that cause the programmable IO device to perform operations enabling an in-line, transparent Transmission Control Protocol (TCP)/Transport Layer Security (TLS) proxy, the operations comprising: establishing a session for an incoming TCP connection received from the remote host via the at least one ARM core; processing data packets received from the remote host via the programmable P4 pipeline; decrypting the received data packets via the cryptographic offload subsystem; and providing the decrypted data packets to the at least one CPU core.