Skip to content

architecture.md

Latest commit

 

History

History
59 lines (44 loc) · 2.65 KB

architecture.md

File metadata and controls

59 lines (44 loc) · 2.65 KB
Raw

Architecture

System Overview

The project evaluates the same PQC-secured request/response protocol over several transport implementations. The important design point is that the cryptographic protocol is kept stable while the packet I/O path changes.

Client benchmark
  |
  |  Four-message PQC handshake
  v
Transport backend
  |
  |  Linux TCP/UDP, packet_mmap, XDP/AF_XDP, DPDK, F-Stack, mTCP, Seastar
  v
Server endpoint
  |
  |  AES-256-GCM encrypted request/response data path
  v
Metrics and logs

The diagram used in the README is stored at ../figures/architecture_diagram.png.

Protocol Components

The handshake has four messages:

  1. CLIENT_HELLO: client nonce, ephemeral KEM public key, certificate/signature material.
  2. SERVER_HELLO: server nonce, ephemeral KEM public key, certificate/signature material bound to the client transcript.
  3. CLIENT_KEM: client encapsulation to the server KEM key, signed over the transcript.
  4. SERVER_KEM: server encapsulation to the client KEM key, signed over the transcript.

Both sides derive client and server write keys plus IVs from the two KEM shared secrets and the complete transcript. The data plane uses AES-256-GCM with sequence-number-derived nonces and AAD that binds direction and sequence number.

Backend Families

Family Directories Kernel involvement
Linux socket baselines experiments/default_sockets, experiments/udp_linux Full kernel networking stack
AF_PACKET / packet_mmap experiments/packet_mmap, experiments/packet_mmap_v3, experiments/zerocopy_mmap, experiments/zerocopy_mmap_v3 Kernel packet path with memory-mapped receive rings
eBPF/XDP experiments/ebpf_xdp XDP program redirects selected traffic to AF_XDP
Raw DPDK experiments/dpdk Full userspace packet I/O, UDP framing and fragmentation
Userspace TCP over DPDK experiments/fstack-dpdk, experiments/mtcp-dpdk, experiments/seastar-dpdk TCP stack runs in userspace
Additional dataplane prototypes experiments/ix-dpdk, experiments/netmap_generic Userspace dataplane experiments

Benchmark Instrumentation

The benchmark layer records:

  • Per-phase handshake timing.
  • CPU cycle counters via Linux perf_event_open when available.
  • Context switches, page faults, CPU time, and RSS.
  • Interface-level PPS and Mbps logs.
  • Message timing breakdown for established encrypted sessions.

The final summary is generated from raw artifacts by ../scripts/analyze_results.py.

See backend_matrix.md for a backend-by-backend implementation and result coverage table.