TurboRetry: Mitigating Large-Scale QUIC Handshake Floods with Off-the-Shelf DPU Offloading

2026-08-03

AI Summary

This work addresses the high computational overhead of QUIC’s Retry mechanism under large-scale handshake flooding attacks, which severely limits server CPU protection. To overcome this bottleneck, the authors propose TurboRetry, the first approach to offload connection admission control to a Data Processing Unit (DPU). TurboRetry introduces an extended Retry token format and a novel, efficient host-DPU coordination mechanism that preserves QUIC semantics while drastically reducing coordination overhead. Through careful task partitioning and optimized communication between the host and DPU, TurboRetry achieves 10–20× higher throughput than host-only implementations under real-world attack conditions, significantly enhancing both system performance and resilience against volumetric attacks.

Abstract

The modern transport protocol QUIC is designed to enhance network performance and security, but it remains vulnerable to handshake flooding attacks. Such attacks exhaust CPU resources by forcing the server to perform expensive cryptographic operations via a large number of handshaking requests. QUIC provides a built-in defense mechanism, the Retry mechanism, to mitigate these attacks. However, our experiments reveal that it can still become a performance bottleneck under large-scale QUIC handshake floods due to substantial computational overhead. In this paper, we design and implement TurboRetry, a split design, that offloads the Retry mechanism onto DPUs to efficiently mitigate QUIC handshake floods. TurboRetry partitions the tasks of the Retry into two categories, and then assigns them to the DPUs and the host, respectively. To preserve QUIC semantics and reduce the coordination overhead, TurboRetry designs an extended Retry token format and an efficient cooperation scheme. In addition, TurboRetry offloads the connection authorization task to the on-path DPA to further improve both performance and security. Our evaluation shows that TurboRetry outperforms the host-side implementation by a wide margin, improving throughput by 10-20$\times$.

Problem

• QUIC
• handshake flood
• Retry mechanism
• DDoS mitigation
• transport protocol security

Innovation

• QUIC
• Retry mechanism
• DPU offloading
• handshake flood mitigation
• connection authorization