Method and apparatus for reducing TCP frame transmit latency

• US 20050232161A1
• Filed: 04/19/2004
• Published: 10/20/2005
• Est. Priority Date: 04/19/2004
• Status: Active Grant

• Current Assignee: NVIDIA Corporation
• Original Assignee: NVIDIA Corporation
• Inventors: Sidenblad, Paul J., Maufer, Thomas A.
• Granted Patent: US 7,502,925 B2
• Time in Patent Office: Days
• US Class Current: 370/252
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC

Abstract

An alternate checksum option for transmitting TCP frame data is used that does not require computing a TCP checksum. Instead, an integrity check value is computed and placed in the ESP authentication portion near the end of the frame. Transmission of a portion of the TCP frame data may begin before all of the TCP frame data is received by a TCP checksum offload device because the integrity check value is inserted at the end of the frame. Furthermore, the integrity check value is computed using a static key or a dynamic key may be computed to cover a greater portion of the frame compared with ESP authentication specified by the IPsec standard.

Claims

1. A method of setting up a TCP connection with a peer to use a TCP alternate checksum option, comprising:

determining whether the peer supports using a dynamic key code-point for the TCP alternate checksum option;

negotiating a key exchange with the peer when the dynamic key code-point is supported; and

using a static key code-point when the key exchange negotiation fails.

2. The method of claim 1, further comprising using a static key code-point when the peer does not support using the dynamic key code-point.

3. The method of claim 1, further comprising determining a maximum packet size.

4. The method of claim 1, further comprising negotiating a key exchange with the peer to obtain a private key for encrypting and decrypting payload data.

5. A method of transmitting TCP payload data using an alternate checksum option, comprising:

receiving a portion of the TCP payload data for transmission;

transmitting the portion of the TCP payload data without computing a TCP checksum; and

computing an integrity check value for the portion of the TCP payload data.

6. The method of claim 5, further comprising:

receiving another portion of the TCP payload data for transmission;

transmitting the other portion of the TCP payload data; and

further computing the integrity check value using the other portion of the TCP payload data.

7. The method of claim 5, further comprising placing a predetermined value in a field designated for the TCP checksum.

8. The method of claim 5, further comprising transmitting the integrity check value.

9. The method of claim 5, wherein the integrity check value is computed using a static key.

10. The method of claim 5, wherein the integrity check value is computed using a dynamic key.

11. The method of claim 5, wherein the integrity check value is computed using an ESP authentication transform.

12. The method of claim 5, further comprising encrypting the portion of the TCP payload data using a private key.

13. The method of claim 5, wherein the integrity check value is computed using an ESP header and the portion of the TCP payload data.

14. The method of claim 5, wherein the integrity check value is computed using an ESP header, the portion of the TCP payload data, and immutable fields within a frame including the TCP payload data.

15. A method of receiving TCP payload data over a connection using a TCP alternate checksum option, comprising:

receiving the TCP payload data within a frame;

determining the TCP alternate checksum option is setup for the connection;

determining whether a static key code point or a dynamic key code point is specified for the connection; and

computing an integrity check value using the TCP payload data and a shared key.

16. The method of claim 15, wherein the shared key is a dynamic key and the dynamic key code point is specified for the connection.

17. The method of claim 15, wherein the shared key is a static key and the static key code point is specified for the connection.

18. The method of claim 15, wherein the integrity check value is computed using an ESP header and the TCP payload data.

19. The method of claim 15, wherein the integrity check value is computed using an ESP header, the TCP payload data, and immutable fields within a frame including a frame header and an IP header.

20. The method of claim 15, wherein the integrity check value is computed using an ESP authentication transform.

21. The method of claim 15, further comprising decrypting the TCP payload data using a private key.

22. The method of claim 15, wherein the step of determining the TCP alternate checksum option is used identifies when a predetermined value is present in a TCP checksum field within the frame.

23. An apparatus for transmitting TCP payload data using a TCP alternate checksum option, comprising:

means for transmitting a TCP header including a predetermined TCP checksum value;

means for computing an integrity check value using the TCP payload data and a shared key; and

means for inserting the integrity check value into a frame including the TCP payload data following the TCP payload data.

24. The apparatus of claim 23, further comprising means for encrypting the TCP payload data.

25. The apparatus of claim 23, further comprising means for computing the integrity check value using an ESP authentication transform.

26. The apparatus of claim 23, further comprising means for decrypting the TCP payload data.

27. The apparatus of claim 23, further comprising:

means for receiving TCP payload data on a connection; and

means for determining a TCP alternate checksum option is used for the connection.