TurboRetry: Mitigating Large-Scale QUIC Handshake Floods with Off-the-Shelf DPU Offloading
2026-08-03 • Cryptography and Security
Cryptography and SecurityNetworking and Internet Architecture
AI summaryⓘ
The authors study QUIC, a network protocol that improves speed and security but can be overwhelmed by many handshake requests that use up too much CPU power. They find that QUIC's built-in defense, called the Retry mechanism, can still slow things down during large attacks. To fix this, they create TurboRetry, which moves part of the Retry work to specialized hardware called DPUs to handle requests more efficiently. Their method keeps QUIC working correctly while reducing the computer's burden, leading to much better performance.
QUIChandshake flooding attackRetry mechanismDPU (Data Processing Unit)cryptographic operationsnetwork securityperformance optimizationconnection authorizationtoken format
Authors
Jiahao Wu, Heng Pan, Kai Lv, Zhenyu Li, Yanbiao Li, Gaogang Xie
Abstract
The modern transport protocol QUIC is designed to enhance network performance and security, but it remains vulnerable to handshake flooding attacks. Such attacks exhaust CPU resources by forcing the server to perform expensive cryptographic operations via a large number of handshaking requests. QUIC provides a built-in defense mechanism, the Retry mechanism, to mitigate these attacks. However, our experiments reveal that it can still become a performance bottleneck under large-scale QUIC handshake floods due to substantial computational overhead. In this paper, we design and implement TurboRetry, a split design, that offloads the Retry mechanism onto DPUs to efficiently mitigate QUIC handshake floods. TurboRetry partitions the tasks of the Retry into two categories, and then assigns them to the DPUs and the host, respectively. To preserve QUIC semantics and reduce the coordination overhead, TurboRetry designs an extended Retry token format and an efficient cooperation scheme. In addition, TurboRetry offloads the connection authorization task to the on-path DPA to further improve both performance and security. Our evaluation shows that TurboRetry outperforms the host-side implementation by a wide margin, improving throughput by 10-20$\times$.