AI 中文总结
TurboRetry将QUIC内置的Retry机制拆分后卸载至DPU，解决其在大规模握手泛洪下的性能瓶颈，吞吐量提升10-20倍，有效缓解QUIC握手泛洪攻击。
AI 中文摘要
现代传输协议QUIC旨在提升网络性能与安全性，但仍易遭受握手泛洪攻击。此类攻击通过迫使服务器处理大量握手请求以执行高开销的密码操作，耗尽CPU资源。QUIC内置防御机制Retry机制以缓解此类攻击，但实验显示，在大规模QUIC握手泛洪下，该机制因计算开销巨大仍会成为性能瓶颈。本文设计并实现了TurboRetry，一种拆分式设计，将Retry机制卸载至DPU以高效缓解QUIC握手泛洪。TurboRetry将Retry任务划分为两类，分别分配给DPU和主机；为保留QUIC语义并降低协调开销，设计了扩展的Retry令牌格式与高效协作方案；此外，将连接授权任务卸载至路径上的DPU，进一步提升性能与安全性。评估表明，TurboRetry性能远超主机侧实现，吞吐量提升10至20倍。
英文摘要
The modern transport protocol QUIC is designed to enhance network performance and security, but it remains vulnerable to handshake flooding attacks. Such attacks exhaust CPU resources by forcing the server to perform expensive cryptographic operations via a large number of handshaking requests. QUIC provides a built-in defense mechanism, the Retry mechanism, to mitigate these attacks. However, our experiments reveal that it can still become a performance bottleneck under large-scale QUIC handshake floods due to substantial computational overhead. In this paper, we design and implement TurboRetry, a split design, that offloads the Retry mechanism onto DPUs to efficiently mitigate QUIC handshake floods. TurboRetry partitions the tasks of the Retry into two categories, and then assigns them to the DPUs and the host, respectively. To preserve QUIC semantics and reduce the coordination overhead, TurboRetry designs an extended Retry token format and an efficient cooperation scheme. In addition, TurboRetry offloads the connection authorization task to the on-path DPA to further improve both performance and security. Our evaluation shows that TurboRetry outperforms the host-side implementation by a wide margin, improving throughput by 10-20$\times$.
