🤖 AI Summary
This work addresses the challenge posed by HTTP/3’s reliance on the QUIC protocol, whose encryption and connection migration capabilities hinder stateful middleboxes—such as NATs, rate limiters, and load balancers—from accurately identifying and tracking network flows, often causing functional failures. To overcome this limitation, the paper presents the first general-purpose framework enabling stateful middleboxes to support QUIC connection migration. By leveraging QUIC protocol semantics, synchronizing connection state across instances, and co-designing with middlebox logic, the framework achieves reliable tracking of encrypted flows. A prototype implementation demonstrates that the approach preserves full middlebox functionality while incurring less than 5% overhead in both throughput and latency, and remains stable even under aggressive connection migration rates up to 100 Hz.
📝 Abstract
Stateful Middleboxes are integral part of enterprise and campus networks that provide essential in-network, security, and value-added services. These stateful middleboxes rely on precise network flow identification. However, the adoption of HTTP/3, which uses the QUIC protocol, poses significant challenges to the proper functioning of these devices. QUIC's encryption and connection migration features obscure flow semantics, disrupting middlebox visibility and functionality. We examine how QUIC disrupts middleboxes like Network Address Translators (NATs), Rate Limiters, Load Balancers, etc., and affects Kubernetes-based service deployments. To address these challenges, we propose a novel, generalized framework that enables stateful middleboxes to reliably track QUIC connections, even when the endpoints change their internet protocol (IP) address or port numbers. Our prototype implementation demonstrates that the proposed approach preserves middlebox functionality with HTTP/3 with negligible performance overhead (<5%) on both throughput and latency, and works effectively even under high QUIC connection migration rates of up to 100 Hz.