Patent Publication Number: US-2019199835-A1

Title: Quick user datagram protocol (udp) internet connections (quic) packet offloading

Description:
CROSS-REFERENCE TO RELATED APPLICATION 
     This application claims the benefit of U.S. Provisional Application No. 62/772,582, Nov. 28, 2018. 
    
    
     COPYRIGHT NOTICE/PERMISSION 
     Portions of the disclosure of this patent document may contain material that is subject to copyright protection. The copyright owner has no objection to the reproduction by anyone of the patent document or the patent disclosure as it appears in the Patent and Trademark Office patent file or records, but otherwise reserves all copyright rights whatsoever. The copyright notice applies to all data as described below, and in the accompanying drawings hereto, as well as to any software described below: Copyright © 2018, Intel Corporation, All Rights Reserved. 
     BACKGROUND 
     Quick User Datagram Protocol (UDP) Internet Connections (QUIC) is a transport layer network protocol used to improve performance of connection-oriented web applications that are currently using Transmission Control Protocol (TCP). See “QUIC: A UDP-Based Secure and Reliable Transport for HTTP/2”, a draft Internet Engineering Task Force (IETF) protocol dated Nov. 28, 2016. QUIC establishes a number of multiplexed connections between two endpoints over the UDP. This works hand-in-hand with hypertext transport protocol (HTTP) multiplexed connections, allowing multiple streams of data to reach the endpoints independently. In contrast, HTTP hosted on TCP can be blocked if any of the multiplexed data streams has an error, QUIC seeks to reduce connection and transport latency and estimate bandwidth in each direction to avoid congestion. It also moves control of congestion avoidance processes into the application space at both endpoints, rather than in the kernel space. Additionally, the QUIC protocol can be extended with forward error correction (FEC) to further improve performance when errors are expected. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  illustrates an example computing system. 
         FIG. 2  illustrates an example arrangement of a QUIC offload. 
         FIG. 3  illustrates an example network I/O device. 
         FIG. 4  illustrates an example offloader. 
         FIG. 5  illustrates an example security association (SA) table entry and packet number (PN) table entry. 
         FIG. 6  is a flow diagram of an example QUIC offload initialization. 
         FIG. 7  is a flow diagram of an example QUIC offload add security association operation. 
         FIG. 8  is a flow diagram of an example QUIC offload update packet number operation. 
         FIG. 9  is a flow diagram of an example QUIC connection lifecycle. 
         FIG. 10  is a flow diagram of example QUIC connection processing. 
         FIG. 11  is a flow diagram of example packet transmission processing. 
         FIG. 12  is a flow diagram of example packet segmentation processing. 
         FIG. 13  is a flow diagram of example packet reception processing. 
         FIG. 14  illustrates an example of a storage medium. 
         FIG. 15  illustrates an example computing platform. 
     
    
    
     DETAILED DESCRIPTION 
       FIG. 1  illustrates an example computing system  100 . As shown in  FIG. 1 , computing system  100  includes a computing platform  101  coupled to a network  170  (which may be the Internet, for example). In some examples, as shown in  FIG. 1 , computing platform  101  is coupled to network  170  via network communication channel  175  and through network I/O device  110  (e.g., a network interface controller (NIC)) having one or more ports connected or coupled to network communication channel  175 . In an embodiment, network communication channel  175  includes a PHY device (not shown). In an embodiment, network I/O device  110  is an Ethernet NIC. Network I/O device  110  transmits data packets from computing platform  101  over network  170  to other destinations and receives data packets from other destinations for forwarding to computing platform  101 . In some embodiments, network I/O device  110  may be integral with computing platform  101 . In an embodiment with a “SmartNIC” concept, where the NIC has central processing unit (CPU) cores onboard, the QUIC and networking stacks could run on the NIC. 
     According to some examples, computing platform  101 , as shown in  FIG. 1 , includes circuitry  120 , primary memory  130 , network (NW) I/O device driver  140 , operating system (OS)  150 , at least one application  160 , QUIC client  164 , QUIC server  166 , and one or more storage devices  165 . In one embodiment, OS  150  is Linux™. In another embodiment, OS  150  is Windows® Server. Network I/O device driver  140  operates to initialize and manage I/O requests performed by network I/O device  110 . In an embodiment, packets and/or packet metadata transmitted to network I/O device  110  and/or received from network I/O device  110  are stored in one or more of primary memory  130  and/or storage devices  165 . In at least one embodiment, storage devices  165  may be one or more of hard disk drives (HDDs) and/or solid-state drives (SSDs). In an embodiment, storage devices  165  may be non-volatile memories (NVMs). In some examples, as shown in  FIG. 1 , circuitry  120  may communicatively couple to network I/O device  110  via communications link  155 . In one embodiment, communications link  155  is a peripheral component interface express (PCIe) bus conforming to version 3.0 or other versions of the PCIe standard published by the PCI Special Interest Group (PCI-SIG). In some examples, operating system  150 , NW I/O device driver  140 , QUIC client  164 , QUIC server  166 , and application  160  are implemented, at least in part, via cooperation between one or more memory devices included in primary memory  130  (e.g., volatile or non-volatile memory devices), storage devices  165 , and elements of circuitry  120  such as processing cores  122 - 1  to  122 - m , where “m” is any positive whole integer greater than 2. In an embodiment, OS  150 , NW I/O device driver  140 , QUIC client  164 , QUIC server  166 , and application  160  are implemented as software executed by one or more processing cores  122 - 1  to  122 - m.    
     In an embodiment, computing platform  101  includes one or more QUIC client(s)  164  and/or one or more QUIC server(s)  166  supporting communications using the QUIC protocol. In an embodiment, QUIC server  166  is a QUIC software stack accepting connections from another QUIC software stack (e.g., QUIC client  164 ). The stack initiating the connection is the client, the stack accepting the connection is the server, for that connection. In an embodiment, the QUIC software stack may be implemented as part of application  160  in user space that opens a socket, or the QUIC software stack may be implemented as a kernel mode component accessible by applications through a socket. Thus, QUIC client  164  and QUIC server  166  may be implemented in application  160 , in OS  150 , or as separate components, depending on the embodiment. In an embodiment, QUIC client  164  and/or QUIC server  166  is coupled to user space socket  162 , which is coupled to kernel space socket  152  in OS  150 . In embodiments disclosed herein, the user space QUIC stack is described, but in various embodiments processing of packets may be offloaded from computing platform  101 . 
     In an embodiment, network I/O device  110  includes offloader circuitry  135  to offload processing of packets from software components in computing platform  101  such as application  160 , QUIC client  164 , QUIC server  166 , network I/O device driver  140 , and/or OS  150 . In an embodiment, offloader  135  includes a field programmable gate array (FPGA) (not shown in  FIG. 1 ), providing encryption/decryption and segmentation processing of offloaded packets through a defined interface. The interface allows separating the packet processing offload from connection state tracking. In another embodiment, offloader circuitry  135  includes one or more application specific integrated circuits (ASICs). In another embodiment, offloader circuitry  135  includes hardwired logic. 
     In some examples, computing platform  101 , includes but is not limited to a server, a server array or server farm, a web server, a network server, an Internet server, a work station, a mini-computer, a main frame computer, a supercomputer, a network appliance, a web appliance, a distributed computing system, multiprocessor systems, processor-based systems, a laptop computer, a tablet computer, a smartphone, or a combination thereof. In one example, computing platform  101  is a disaggregated server. A disaggregated server is a server that breaks up components and resources into subsystems. Disaggregated servers can be adapted to changing storage or compute loads as needed without replacing or disrupting an entire server for an extended period of time. A server could, for example, be broken into modular compute, I/O, power and storage modules that can be shared among other nearby servers. 
     Circuitry  120  having processing cores  122 - 1  to  122 - m  may include various commercially available processors, including without limitation Intel® Atom®, Celeron®, Core (2) Duo®, Core i3, Core i5, Core i7, Itanium®, Pentium®, Xeon® or Xeon Phi® processors, ARM processors, and similar processors. Circuitry  120  may include at least one cache  135  to store data. 
     According to some examples, primary memory  130  may be composed of one or more memory devices or dies which may include various types of volatile and/or non-volatile memory. Volatile types of memory may include, but are not limited to, dynamic random-access memory (DRAM), static random-access memory (SRAM), thyristor RAM (TRAM) or zero-capacitor RAM (ZRAM). Non-volatile types of memory may include byte or block addressable types of non-volatile memory having a 3-dimensional (3-D) cross-point memory structure that includes chalcogenide phase change material (e.g., chalcogenide glass) hereinafter referred to as “3-D cross-point memory”. Non-volatile types of memory may also include other types of byte or block addressable non-volatile memory such as, but not limited to, multi-threshold level NAND flash memory, NOR flash memory, single or multi-level phase change memory (PCM), resistive memory, nanowire memory, ferroelectric transistor random access memory (FeTRAM), magneto-resistive random-access memory (MRAM) that incorporates memristor technology, spin transfer torque MRAM (STT-MRAM), or a combination of any of the above. In another embodiment, primary memory  130  may include one or more hard disk drives within and/or accessible by computing platform  101 . 
     Current QUIC implementations in software do not support any hardware offloads. No hardware offload interfaces exist because all QUIC processing to date is done in software. Analysis of the QUIC protocol stack shows that there are several bottlenecks in cryptographic and UDP processing in the networking stack. Although some existing implementations use advanced encryption standard (AES) new instructions (AESNI) in the processor to increase cryptographic processing performance, an estimated cost for supporting the QUIC protocol in software is 2.5 times the cost of supporting an equivalent legacy protocol like TCP. 
     Embodiments of the present invention include a method to offload QUIC packet encryption/decryption and segmentation processing from QUIC client  164  and/or QUIC server  166  to offloader hardware  135  with minimal changes to host software (e.g., application  160 , network I/O device driver  140 , and/or OS  150 ). A QUIC software stack running in an operating system (OS) can communicate with offloader hardware  135  (e.g., a FPGA). 
     Embodiments used herein to optimize QUIC operations may be applied to other transport protocols such as Real-time Transfer Protocol (RTP) and TCP. Embodiments can also apply to other cryptographic protocols such as Transport Layer Security (TLS), Datagram Transport Layer Security (DTLS) and Internet Protocol Security (IPsec). Crypto and segmentation offloads in QUIC can reduce processor usage and improve network scaling. This leads to reduced deployment costs. 
       FIG. 2  illustrates an example arrangement of a QUIC offload. The QUIC offloads described herein require offloader hardware  135 , such as application specific integrated circuits (ASICs), sequestered cores or FPGAs. They expose a QUIC offload interface that can be managed by a software driver with an associated OS and protocol stack. 
     A requirement for processing received packet offloads is that offloader  135  can recognize received QUIC packets. Offloader  135  includes the ability to parse packet headers, and via runtime configuration, recognize QUIC packets. For example, Offloader  135  may recognize QUIC packets as UDP packets with specific destination ports, where the port numbers are supplied by network I/O device driver  140 . Conversely, offloading the transmit function requires the offloader to parse headers, identify the QUIC packets, and identify and compute the cryptographic parameters for the offloader to encrypt the packets. The transmit pipeline may also offload other optimizations like transmit segmentation. The offloader may further be programmed to have the offloads work independently or together. 
     In an embodiment, QUIC server  166  connects to the QUIC capability using a file descriptor to access the software stack ( 162 ,  152 ,  204 ) in OS  150 . Host software such as QUIC client  164  and/or QUIC server  166  configures QUIC offloader hardware  135  by sending commands with command data. The offloader sends back the status of the command to the network I/O device driver  140  for additional handling. Offloader  135  may provide registers, a command queue, or recognize special Ethernet packets to configure the offload. 
     OS  150  includes user space socket  162  to interface in user mode with QUIC client  164  and/or QUIC server  166 . User space socket  162  connects to kernel space socket  152 , which is in kernel mode. OS networking stack  204  is also in kernel mode. OS networking stack  204  includes one or more layers of software to handle various networking communications protocols (e.g., TCP/IP, UDP, etc.) as is well known. Network I/O device driver  140  is designed specific to network I/O device  110  to communicate packets, commands, and status. In an embodiment, network I/O device driver  140  sends control messages and/or metadata packets  214  to offloader  135  within network I/O device  110 . Offloader  135  returns response messages and/or metadata packets  216  to network I/O driver  140 . In an embodiment, network I/O device driver  140  is part of OS  150 . An alternative embodiment may provide access to the network I/O device from user space, where user space software may implement the QUIC server all the way down to the I/O driver. 
     Offloader  135  includes at least four tables, two for ingress and two for egress. On the ingress side, offloader  135  includes a first security association (SA) table  206 . SA table  206  includes a plurality of entries (up to a maximum size n, where n is a natural number), each entry storing a SA. In an embodiment, a SA includes a negotiated cryptographic key used by offloader  135  for encrypting and/or decrypting packets. Offloader also includes a first packet number (PN) table  208 , with each entry in SA table  206  being associated with an entry in PN table  208 . PN Table  208  includes a plurality of entries (up to a maximum size n, where n is a natural number), each entry storing a PN. In an embodiment, the number of entries in SA table  206  is the same as the number of entries in PN table  208 . On the egress side, offloader  135  includes a second SA table  210 , and a second PN table  212 . In an embodiment, the number of entries in SA table  210  is the same as the number of entries in PN table  212 . In an embodiment, offloader  135  encrypts and/or decrypts packet data using a selected SA table entry and associated PN table entry. 
     In  FIG. 2 , the SA Tables  206 ,  210  are shown as being split into ingress and egress tables, but the SA tables could also be combined into one table with a bit to indicate direction of packet flow. In  FIG. 2 , the PN Table is shown separate from the SA Table, but in other embodiments they could be combined. 
     In various embodiments, multiple methods may be used to pass metadata between software (e.g., application  160 , QUIC client  164 , QUIC server  166 , and OS  150 ) and hardware (e.g., network I/O device  110 ). Two methods are described herein, one using fields in descriptors (e.g., an out-of-band method) and the other passing metadata within Ethernet packets (e.g., an in-line method). On transmit (Tx), network I/O device driver  140  marks data packets for offload by writing Tx descriptor fields or by adding metadata to transmitted packets. Descriptors point to packet data, including packet headers, and contain metadata pertaining to those packets. 
     On receive (Rx), offloader  135  indicates both successful offloading of a packet, and a failure to offload a packet, by writing Rx descriptor fields in packet headers or adding metadata to receive packets that have been or should have been offloaded. 
     In the example implementation discussed herein, a media access control (MAC) component in network I/O device  110  is paired with an offloader implemented as an FPGA. In an embodiment, an image supporting QUIC encryption and decryption, plus transmit segmentation, is programmed into the FPGA. In an embodiment, host software (e.g., QUIC client  164 , QUIC server  166 , OS  150 , OS networking stack  204 , and network I/O driver  140 ) and FPGA communicate using the in-line method, by sending commands, results and metadata via Ethernet L2 tags indicated by special L2 Ethertypes. Control and result data are stored in the Ethernet packet payload. 
     The following commands provide an example set that implement the requirements set forth in the sections below. 
     
       
         
           
               
             
               
                 TABLE 1 
               
               
                   
               
               
                 Sample QUIC hardware interface commands 
               
               
                   
               
             
            
               
                   
               
            
           
           
               
               
            
               
                 Init Device 
                 Initialize hardware and set global configuration. 
               
               
                 Get 
                 Return hardware QUIC offload capabilities. 
               
               
                 Capabilities 
               
               
                 Set UDP Port 
                 Set the UDP port assigned to QUIC traffic. 
               
               
                 Add SA 
                 Add Security Association when for a QUIC connection. 
               
               
                 Delete SA 
                 Remove a Security Association. 
               
               
                 Update SA 
                 Update dynamic SA information, such as the full QUIC 
               
               
                   
                 packet number. 
               
               
                   
               
            
           
         
       
     
     Various embodiments could support more commands or combine some of the above commands. 
     In some circumstances it may not be feasible to offload the entire QUIC protocol to offloader hardware  135 . The offloader and host software (e.g., QUIC client  164  and/or QUIC server  166 ) must agree on which packets will be offloaded. 
     Since different QUIC versions may use different handshakes for starting connections and generating keys, the handshake is left in the OS networking stack  204 . A few Long Headers packets are exchanged to establish a connection and are handled completely in host software (e.g., OS  150 ). The offloader hardware only offloads QUIC Short Header packets, which carry the vast majority of QUIC traffic. 
     Furthermore, offloader  135  may pass some received Short Header packets through to host software for processing. Offloader  135  indicates the decryption and authentication status in out-of-band data so the host software knows to process passed-through packets. 
     Recognizing QUIC Packets: 
     Offloader  135  must be configured to properly recognize received QUIC packets. The QUIC UDP port is programmed into the offloader so the offloader&#39;s network packet parser can correctly identify QUIC packets based on the UDP header. 
       FIG. 3  illustrates an example network I/O device. In an embodiment, network I/O device  110  includes ingress  306  and egress  308  ports for receiving data from a network  170  and transmitting data to a network  170 , respectively. Network I/O device  110  include bus interface (I/F) circuitry  310  to communicate with computing platform  101 . In an embodiment, bus I/F  310  communicates over a PCIe bus. Network I/O device  110  includes media access control (MAC) circuitry  304  coupled to bus I/F  310 . In an embodiment, network I/O device  110  includes offloader  135  to communicate with ingress port  306 , egress port  308 , and MAC  304  to process the QUIC protocol. 
       FIG. 4  illustrates an example offloader. For transmit (Tx) operations, packets are received from the host via bus I/F  310  by parser  404  in offloader  302 . Parser  404  recognizes the packet as a QUIC packet and creates relevant metadata. If the packet is too large to transmit to the network, and segmentation information exists, the segmenter  406  segments the packet into smaller packets that may be transmitted. In some implementations, segmenter  406  may optionally use metadata from parser  404 . Whether segmented or not, the packets will be described as segmented in the subsequent steps. Egress lookup engine  408  uses metadata from the parser, and operating on the already segmented QUIC packets, fetches encryption information such as keys and nonces from SA Database  402 . Encrypter  410  encrypts the segmented packets using the information from SA Database  402 . Transmitter  412  transmits the encrypted QUIC packets over egress  308  to the network. 
     For receive (Rx) operations, receiver  420  receives the encrypted QUIC packet from the network via ingress  306 . Parser  418  recognizes the packet as a QUIC packet and creates relevant metadata. Ingress lookup engine  416  uses metadata from parser  418  to fetch decryption information such as keys and nonces from SA Database  402 . Decrypter  414  decrypts the packet using the information from SA Database  402 . Packets are delivered using bus I/F  310  to the host. 
     Security Association (SA) Database: 
     Host software configures offloader  135  with two SAs per QUIC connection, one each for egress and ingress. The SA entries contain information to match the connection and the connection&#39;s cryptographic parameters. In an embodiment, SA tables  206 ,  210  are match action tables. The match characteristics can be flexibly configured to use combinations of Destination IP Address, virtual local area network (VLAN) identifier (ID), Source Connection ID, Destination Connection ID and Key Phase. 
       FIG. 5  illustrates an example  500  security association (SA) table entry  502  and an associated packet number (PN) table entry  504 . In an embodiment, SA table entry  502  represents one of the entries in SA table  206  or SA table  210 , and PN table entry  504  represents one of the entries in PN table  208  or PN table  212 . 
     Destination Internet Protocol (IP) address  506  and virtual local area network (VLAN) ID  508  may sort connections into different domains, like virtual machines (VMs) or containers, which allows the offloader to handle duplicate Connection IDs (e.g., source Connection ID  510 , Destination Connection ID  512 ) in cases where multiple QUIC stacks are active. The offloader could make the pragmatic choice to support only Connection IDs and Key Phase, not allowing conflicting Connection IDs to be offloaded. When offloading multiple domains with this limited match criteria, the likelihood of duplicates will depend on QUIC stack implementation choices. 
     The QUIC Version field  514  indicates which QUIC version has been negotiated for the connection. The offloader may use this information to adjust its processing of the QUIC protocol or cause an Add SA command to fail if offloader  135  does not support the specified QUIC version. The Key Phase flag  516  indicates which key phase the SA applies to. QUIC connections may change a key phase, which requires a different set of SA information. This flag (e.g., a bit) allows the offloader to switch to the next SA or start passing packets through unprocessed until host software updates the SA with the new key. The Packet Number Encryption (PNE) flag  516  indicates that the offloader shall perform PNE on the connection. 
     Post-match, the offloader fetches the encryption/decryption cryptographic key  520 , cryptographic Initialization Vector (IV)  522 , and packet number information  504  so the offloader can construct the full packet number, to combine with the IV to form a nonce and encrypt/decrypt the packet being processed. 
     Packet Number Update: 
     In the QUIC protocol&#39;s current form, QUIC packet numbers are used in constructing the cryptographic nonce. Since QUIC packet headers only contain a portion of the packet number, the offloader is programmed periodically with a full packet number, which is stored per SA. The match action table mentioned above (e.g., one of the SA tables) fetches the full packet number, along with the key and IV, to perform encryption/decryption. The offloader uses the full packet number to determine the high bytes of the packet number from the packet before performing the encryption/decryption. Note that the packet number field must always be up-to-date for an otherwise valid SA, to prevent the offloader from attempting encryption or decryption with an invalid nonce. This means the Add SA operation must be performed atomically; a valid bit must be set at the end of the add process or the packet number must be updated before the SA is added. 
     As discussed herein, in an embodiment the initial packet number is an example of a seed value that is used to infer the sequence of unique nonces. In other applications of this concept, the packet number could be replaced by the equivalent seed value. 
     Flexible Nonce Interface: 
     To simplify the offloader implementation, host software could pass the nonce as metadata per packet to offloader  135 . This would remove the requirement to update and store the full packet number in the offloader, and for the offloader to extract the packet number from packets on egress. However, this approach has a limitation, in that it would only work for egress traffic, and so would be best suited for an offloader targeting a video-streaming server model. 
     Ingress Decryption Status: 
     The offloader passes decryption and authentication status  216  to the host software. If the host software is network I/O device driver  140 , the driver may interpret this information, convert the information to a network stack format and pass the data to the upper protocol layers (e.g., OS networking stack  204 ) via a software interface. 
     Transmit Segmentation: 
     Transmit Segmentation Offload (TSO) improves performance by reducing the number of packets traversing the network stack, saving per-packet overhead. Two forms of TSO are possible. TSO may be implemented by enabling the QUIC stack (e.g., software layers  164 ,  166 ,  162 ,  152 , and  204 ) to pre-segment QUIC frames into maximum segment sized (MSS) sections across one or more buffers. Host software programs the offloader with a scatter gather list and maximum segment size (MSS) per outgoing packet; the MSS may be passed using metadata. The offloader then replicates the IP and UDP header, while segmenting the QUIC payload into MSS-sized chunks for transmission. 
     The QUIC protocol describes various types of QUIC frames to implement the protocol. Data is transmitted via stream frames. When combined with encryption offload, a segmentation offload that understands the QUIC protocol may further improve performance by allowing the QUIC stack (e.g., software layers  164 ,  166 ,  162 ,  152 , and  204 ) to send large QUIC stream frames all the way down the stack to offloader  135 , where the offloader will replicate the stream header, in addition to the IP and UDP header. In order for the offloader to segment a QUIC packet, the offloader must be told the maximum segment size per outgoing packet. This is passed to the offloader via the transmit metadata mentioned above. 
     In an embodiment, the host software interface defines a new set of QUIC-specific socket options for a UDP socket; these socket options call hooks in network I/O device driver  140  to communicate with offloader  135 , which will in turn send control packets  214  with commands to the offloader. Most QUIC stacks are currently implemented in user space, so they open UDP sockets like any other network-aware application. In an embodiment, the lower parts of the interface could also support a kernel QUIC stack. 
     In an embodiment, the QUIC stack (e.g., software layers  164 ,  166 ,  162 ,  152 , and  204 ) first enables the QUIC interface on the socket by calling setsockopt with SOL_UDP and UDP_ULP options, thus enabling the newly defined QUIC upper layer protocol. Unlike normal UDP sockets, because encryption/decryption will be performed on a specific device (e.g., network I/O device  110 ), in an embodiment the QUIC stack then calls setsockopt with SO_BINDTODEVICE. This call checks that the network I/O device supports the QUIC offload and returns failure if the network I/O device does not support the QUIC offload. The QUIC stack may then attempt to bind to a different device or close the socket. 
     Various new socket options are defined that correspond to the commands sent to offloader  135 . These options include: 
     1) Fetching offloader hardware capabilities—host software receives the following: a) supported QUIC versions and global versus per SA capability; b) number of SAs; c) supported match criteria (Connection IDs, VLANs, IP addresses); and d) support for Packet Number Encryption. 
     2) Initializing the device—program the offloader hardware with the UDP QUIC port and QUIC version. This will fail if the device does not support the version of QUIC offload attempting to be offloaded. 
     3) Adding a Security Association (SA)—pass SA lookup information and cryptographic parameters to kernel space for forwarding to offloader hardware  135  by network I/O device driver  140 ; each socket can have multiple SAs, so the socket maintains a list of the SAs based on a hash of the connection ID. 
     4) Deleting a SA—pass SA lookup info to the network I/O device driver  140  to be forwarded to offloader hardware  135  in a Delete SA command. 
     5) Updating the QUIC packet number—periodically update the full packet number so the offloader can create the correct nonce for encryption/decryption. 
     In an embodiment, these socket options ultimately call functions that hook into the network I/O device driver  140  through a device operations structure registered with the network interface structure. These function hooks are registered with the network interface when the driver first loads and indicates the driver supports QUIC offload. 
     In an example Linux implementation, the following device operations structure is defined for function callbacks that map to each of the above commands. 
     
       
         
           
               
             
               
                   
               
             
            
               
                  © 2018 Intel Corporation 
               
               
                 struct quicdev_ops { 
               
            
           
           
               
               
            
               
                   
                 int (*quic_get_capabilities)(struct net_device *netdev, 
               
            
           
           
               
               
            
               
                   
                 struct quic_offload_caps *caps); 
               
            
           
           
               
               
            
               
                   
                 int (*quic_init_dev)(struct net_device *netdev, u32 quic_port); 
               
               
                   
                 int (*quic_add_sa)(struct net_device *netdev, 
               
            
           
           
               
               
            
               
                   
                 struct quic_sa_context *sa, 
               
               
                   
                 struct quic_crypto_info *crypto_info, 
               
               
                   
                 u64 initial_pn); 
               
            
           
           
               
               
            
               
                   
                 int (*quic_update_pn)(struct net_device *netdev, 
               
            
           
           
               
               
            
               
                   
                 struct quic_sa_context *sa, 
               
               
                   
                 u64 new_pn); 
               
            
           
           
               
               
            
               
                   
                 int (*quic_del_sa)(struct net_device *netdev, 
               
            
           
           
               
               
            
               
                   
                 struct quic_sa_context *sa); 
               
            
           
           
               
               
            
               
                   
                 int (*quic_offload_ok)(struct net_device *netdev); 
               
            
           
           
               
            
               
                 }; 
               
               
                   
               
            
           
         
       
     
     In an embodiment, each of these operations is called from either a getsockopt or setsockopt call from the QUIC stack (e.g., software layers  164 ,  166 ,  162 ,  152 , and  204 ). For example,
         setsockopt(socketfd, SOL_QUIC, ADD_QUIC_TX, sa, sizeof(struct quic_add_sa));   goes through the socket application programming interface (API), with all of the cryptographics parameters, and eventually results in a call to quic_add_sa in the network I/O driver  140 .       

     In an embodiment, the quic_offload ok hook is called with getsockopt periodically to get the state of the offloader hardware, for example to check if a reset occurred, to decide whether or not the offloaded SAs should be removed, reprogrammed, etc. 
     Ingress Metadata: 
     As discussed above, offloader hardware  135  passes back the decryption status  216  for ingress QUIC packets to the network I/O device driver  140 . The driver parses this information and then passes the information to the upper protocol layers (e.g., OS networking stack  204 ) via a private variable field in the packet structure. Finally, this is communicated to the user-space stack via an out-of-band data channel in the socket API. 
     Transmit Segmentation: 
     As discussed above, the maximum segment size (MSS) is passed per packet from OS networking stack  204  to tell offloader  135  how large each segment is. The segment size is sent to the network I/O device driver  140  as out-of-band data with each packet. The network I/O driver then places this segment size in the Tx metadata. 
     If the offloader supports one MSS per transmit segmentation operation (TSO), then packets may need to be padded to make them fit the uniform MSS. Padding is required to fill the end of a packet where a QUIC frame would be split across two outgoing packets. If the offloader takes MSS per outgoing packet, no padding is required. 
     Flexible Egress Interface: 
     As discussed above, the interface should support a flexible nonce that could change with the QUIC specification as the specification evolves over time. This is achieved by using the out-of-band data channel in the socket API to send the nonce with each Tx packet. The kernel stack will extract the nonce from the out-of-band data and send the nonce with the packet structure via the private variable field. The network I/O device driver must parse this and send the nonce to the offloader as metadata. 
     In an example Linux implementation, control message (CMSG) headers are used to pass out-of-band control data to the driver along with the QUIC packet. The following example interface allows the caller to create an array of QUIC payloads along with an array of nonces corresponding to each packet. This reduces the number of system calls for sending multiple packets. 
     
       
         
           
               
             
               
                   
               
             
            
               
                  © 2018 Intel Corporation 
               
               
                 int send_quic_packets(int socketfd, struct quic_header *quichdr, char **data, char 
               
               
                  **nonces, int numpackets) 
               
               
                 { 
               
            
           
           
               
               
            
               
                   
                 struct msghdr msg = {0}; 
               
            
           
           
               
            
               
                  struct cmsghdr *cmsg; 
               
               
                  char *control; 
               
               
                  struct iovec *msg_iov; 
               
               
                  int rc; 
               
            
           
           
               
               
            
               
                   
                 int cmsg_len = CMSG_SPACE(sizeof(*quic_hdr) + 
               
               
                   
                 (CMSG_SPACE(QUIC_AES_GCM_IV_BYTES) * numpackets); 
               
            
           
           
               
            
               
                  control = malloc(cmsg_len); 
               
               
                  if (!control) { 
               
            
           
           
               
               
            
               
                   
                  printf(“failed to allocate cmsg headers\n”); 
               
               
                   
                  return −1; 
               
            
           
           
               
            
               
                  } 
               
               
                  msg.msg_control = control; 
               
               
                  msg.msg_controllen = cmsg_len 
               
               
                  // First CMSG header is QUIC header each packet will use 
               
               
                 cmsg = CMSG_FIRSTHDR(&amp;msg); 
               
            
           
           
               
               
            
               
                   
                 cmsg−&gt;cmsg_level = SOL_QUIC; 
               
            
           
           
               
            
               
                  cmsg−&gt;cmsg_type = QUIC_SET_HEADER; 
               
               
                  cmsg−&gt;cmsg_len = CMSG_LEN(sizeof(*quichdr)); 
               
               
                  memcpy(CMSG_DATA(cmsg), quichdr, sizeof(*quichdr)); 
               
            
           
           
               
               
            
               
                   
                 for (i = 0; i &lt; numpackets; i++) { 
               
               
                   
                  // add each NONCE as cmsg header 
               
               
                   
                  cmsg = CMSG_NXTHDR(&amp;msg, cmsg); 
               
               
                   
                  cmsg−&gt;cmsg_level = SOL_QUIC; 
               
               
                   
                  cmsg−&gt;cmsg_type = QUIC_SET_NONCE; 
               
               
                   
                  cmsg−&gt;cmsg_len = CMSG_LEN(QUIC_AES_GCM_IV_BYTES); 
               
               
                   
                  memset(CMSG_DATA(cmsg), nonces[i], 
               
            
           
           
               
               
            
               
                   
                 QUIC_AES_GCM_IV_BYTES); 
               
            
           
           
               
               
            
               
                   
                  // add payload contents to msg 
               
               
                   
                  msg_iov[i].iov_base = data[i]; 
               
               
                   
                  msg_iov[i].iov_len = sizeof(data[i]); 
               
               
                   
                 } 
               
            
           
           
               
            
               
                  msg.msg_iov = msg_iov; 
               
               
                  msg.msg_iovlen = numpackets; 
               
               
                  rc = sendmsg(socketfd, &amp;msg, 0); 
               
               
                 } 
               
               
                   
               
            
           
         
       
     
       FIG. 6  is a flow diagram of an example QUIC offload initialization. The steps of  FIG. 6  are performed to initialize a socket. At block  602 , user space socket  162  sends an initialization command (INIT) including a version and a port to a kernel space socket  152 . At block  604 , kernel space socket  152  sends a device initialization command (INIT_DEV) with the version and port to network I/O device driver  140 . At block  606 , network I/O device driver  140  sends the INIT_DEV command  214  to offloader  135 . Offloader  135  initializes a connection for the selected port. In an embodiment, the INIT_DEV commands adds the selected UDP port to the packet parser so that the offloader can quickly identify QUIC packets. At block  608 , offloader  135  sends a status  216  of the INIT_DEV request back to network I/O device driver  140 . At block  610 , network I/O device driver  140  sends the status back to kernel space socket  152 . At block  612 , kernel space socket  152  sends the status back to user space socket  162 . 
       FIG. 7  is a flow diagram of an example QUIC offload add security association operation. The steps of  FIG. 6  are performed for each connection of a socket. At block  702 , user space socket  162  sends an add SA command (ADD_SA) including an identifier and cryptographic information to a kernel space socket  152 . At block  704 , kernel space socket  152  sends a device add SA command (DEV_ADD_SA) with the identifier and cryptographic information to network I/O device driver  140 . At block  706 , network I/O device driver  140  sends the ADD_SA command  214  to offloader  135 . Offloader  135  adds the identifier to an entry in SA table  206  (ingress) or SA table  210  (egress). At block  708 , offloader  135  sends a status  216  of the ADD_SA request back to network I/O device driver  140 . At block  710 , network I/O device driver  140  sends the status back to kernel space socket  152 . At block  712 , kernel space socket sends the status back to user space socket  162 . In an embodiment, the UPDATE_PN is performed such that the SA is not used with an invalid packet number. 
       FIG. 8  is a flow diagram of an example QUIC offload update packet number operation. The steps of  FIG. 8  are performed any time a packet number (PN) is to be updated. At block  802 , user space socket  162  sends an update PN command (UPDATE_PN) including a PN to a kernel space socket  152 . At block  804 , kernel space socket  152  sends a device update PN command (DEV_UPDATE_PN) with the PN to network I/O device driver  140 . At block  806 , network I/O device driver  140  sends the UPDATE_PN command  214  to offloader  135 . Offloader  135  updates the PM in an entry in PN table  208  (ingress) or PN table  212  (egress). At block  808 , offloader  135  sends a status  216  of the UPDATE_PN request back to network I/O device driver  140 . At block  810 , network I/O device driver  140  sends the status back to kernel space socket  152 . At block  812 , kernel space socket  152  sends the status back to user space socket  162 . 
       FIG. 9  is a flow diagram  900  of an example QUIC connection lifecycle. At block  902 , QUIC server  166  opens a QUIC socket (e.g., user space socket  162 ). At block  904 , QUIC server  166  call an initialization (INIT) function in the QUIC socket to enable hardware (HW) offload processing for packets. Once the HW offload capability is initialized, QUIC server  166  opens and closes one or more QUIC connections. When a QUIC connection is open, processing of QUIC packets may be offloaded to offloader  135 . At block  908 , QUIC server  166  closes the QUIC socket. 
       FIG. 10  is a flow diagram  1000  of example QUIC connection processing. At block  1002 , QUIC client  164  initiates a QUIC connection. At block  1004 , QUIC client  164  and QUIC server  166  establish the QUIC connection by exchanging QUIC Long Header packets (which do not need to be offloaded). At block  1006 , QUIC server  166  determines cryptographic parameters to be used by offloader  135  to encrypt and/or decrypt packets. In an embodiment, different cryptographic parameters may be used for transmit (Tx) and receive (Rx) operations. Before packet traffic can be offloaded, the following steps are performed. At block  1008 , QUIC server  166  calls the ADD_SA command to add the Tx and/or Rx cryptographic parameters to offloader  135  so the offloader can process QUIC encryption and decryption of packets. At block  1010 , QUIC server  166  calls the UPDATE_PN command to set Tx and Rx QUIC packet numbers when necessary (including before any packet traffic will be offloaded), that is, before offloader  135  will be unable to reconstitute a full packet number (PN). In an embodiment, packet numbers in a packet are encoded using fewer bits than the maximum allowed for packet numbers. For example, a packet number may be represented by one byte. Offloader  135  must be informed via the UPDATE_PN command of a recently sent full packet number such that the offloader can unambiguously calculate new packet numbers. See section 17.1 “Packet Number Encoding and Decoding” in the QUIC: A UDP-Based Multiplexed and Secure Transport specification. 
     While the QUIC connection is open (e.g., active) at block  1012 , QUIC server  166  at block  1014  sends QUIC Short Header packets that may be offloaded using the cryptographic parameters to offloader  135  via the QUIC stack. As per the QUIC protocol, the QUIC server increments the packet number in the QUIC packet header by one for each packet sent. Processing continues back at block  1012 . While the QUIC connection is open, QUIC server  166  at block  1016  receives QUIC Short Header packets with an indication of whether they have been decrypted (e.g., by the offloader) or still require decryption (for example, the Rx cryptographic parameters may have changed, but not yet been updated). Processing continues back at block  1012 . While the QUIC connection is open, QUIC server  166  at block  1018  calls the UPDATE_PN command to set Tx and Rx QUIC packet numbers when necessary. Processing continues back at block  1012 . While the QUIC connection is open, if the QUIC connection requires new Tx and/or RX cryptographic parameters at block  1020 , QUIC server  166  at block  1022  calls the DEL_SA command to removed expired cryptographic parameters. Processing continues back at block  1012 . When the QUIC connection is closed at block  1012 , QUIC server  166  calls the DEL_SA command at block  1024  to remove the Tx and Rx cryptographic parameters. 
       FIG. 11  is a flow diagram  1100  of example packet transmission processing. At block  1102 , in one embodiment QUIC server  166  sends a QUIC packet via a QUIC socket. In another embodiment, application  160  opens a QUIC socket and QUIC server  166  is implemented in the QUIC stack (e.g.,  162 ,  152 ,  204 ). At block  1104 , OS networking stack  204  processes the QUIC packet and sends the QUIC packet to network I/O device driver  140 . The QUIC packet is identified in one of the following ways. First, network I/O device driver  140  may determine that the packet is a QUIC packet by examining the packet headers. Second, OS networking stack  204  may indicate that the packet is a QUIC packet by passing metadata to that effect to the device driver. Third, in one embodiment, offloader  135  is capable of detecting QUIC packets by parsing the packet. At block  1106 , network I/O device driver  140  sends the QUIC packet to offloader  135 . In an embodiment, network I/O device driver uses descriptors in a descriptor ring to send the packet. The nature of the packet is determined by one of the following methods. For the first and second cases above, network I/O device driver  140  indicates to offloader  135  via metadata that the packet is a QUIC packet that should be processed further by the offloader. Metadata could be inserted in the packet or provided in descriptors. In one embodiment, metadata can furthermore describe the nature of the QUIC packet, including the header, such that the offloader may not be tied to a particular version of the QUIC protocol. Alternatively, for the third case above, the offloader parses the packet, identifying that the packet is a QUIC packet. Metadata can be used to describe the QUIC packet. 
     Assuming the packet is identified as a QUIC packet, offloader  135  determines the security association (SA) that is to be used to encrypt the packet at block  1108 . The offloader may use information that uniquely identifies the QUIC connection, such as the QUIC Destination Connection ID. If the offloader fails to find a SA, the offloader reports an error back to network I/O device driver  140  and does not transmit the packet. Alternatively, another method involves a counter, which could be incremented when the packet is dropped, and requires the driver to read the counter to learn of dropped packets. At block  1110 , offloader  135  determines the packet number for the QUIC packet from the QUIC packet contents and the SA&#39;s associated packet number. The packet number is used as an input parameter to the encryption process as described in the QUIC protocol specification, currently combined with the packet protection IV to form the nonce. At block  1112 , offloader encrypts the QUIC payload of the packet. In an embodiment, offloader may apply header protection, as described in the QUIC protocol specification, which may include a process involving sampling of the packet&#39;s encrypted output in order to encrypt bits in the packet header, including the packet number. At block  1114 , offloader  135  transmits the encrypted QUIC packet over connection  175  to network  170 . 
       FIG. 12  is a flow diagram  1200  of example packet segmentation processing. In an embodiment, in order to minimize the number of communications between QUIC server  166  and offloader  135 , packets are collected in a batch and sent to the offloader. Once cryptographic parameters have been determined and the QUIC connection has been opened, packet segmentation processing may be performed. At block  1202 , QUIC server  166  coalesces a plurality of QUIC Short Header packets into a single large packet. Padding frames may be used at any time. Padding frames may be used to complete the MSS for packets, other than a last packet, that may be smaller than the MSS. At block  1204 , QUIC server  166  prepares metadata specifying the MSS. At bloc  1206 , QUIC server  166  transmits the single large packet through the socket. At block  1208 , OS networking stack  204  attaches metadata to the large packet so that the metadata flows down the stack to network I/O device driver  140 . At block  1210 , the network I/O device driver extracts the metadata, converts the metadata to the offloader&#39;s format, and sends the large packet and the metadata to the offloader. At block  1212 , offloader  135  receives the large packet and stores the IP and UDP headers of the large packet. At block  1214 , offloader  1335  divides the large packet payload into a plurality of smaller payloads of size MSS until one segment (e.g., smaller payload) remains that is the MSS or smaller. At block  1216 , offloader  135  replicates the IP and UDP headers, updating lengths and checksums, and transmits a packet for each payload segment created at block  1214 . The number of packets transmitted is equal to the payload size divided by the MSS, rounded up, and the last packet may contain a payload size equal to or less than the MSS. If QUIC encryption is offloaded, each packet is transmitted as described at blocks  1108 - 1114  of  FIG. 11 . 
       FIG. 13  illustrates a flow diagram  1300  of example packet reception processing. At block  1302 , offloader  135  in network I/O device  110  receives a QUIC packet over connection  175  from network  170 . At block  1304 , offloader parses the received packet, including the contents of the QUIC header. If the packet is identified as a QUIC packet, at block  1306  the offloader determines the SA that is to be used to decrypt the packet. The offloader uses information that uniquely identifies the QUIC connection, such as the QUIC Destination Connection ID. If the offloader fails to find a SA, the offloader sends the packet to network I/O device driver  140  without modification, indicating via metadata that this packet is a QUIC packet that was not processed by the offloader. In an embodiment, if QUIC header protection was used on the packet, the offloader removes the QUIC header protection. At block  1308 , offloader  135  determines the packet number for the QUIC packet from the QUIC packet contents and the SA&#39;s associated packet number. The packet number is used as an input parameter to the decryption operation as described in the QUIC protocol specification, currently combined with the packet protection IV to form the nonce. At block  1310 , the offloader decrypts the QUIC packet payload. At block  1312 , the offloader sends the QUIC packet to network I/O device driver  140 . In an embodiment, this is performed using descriptors in a descriptor ring, indicating via metadata that this packet is a QUIC packet that was processed by the offloader, and including processing information, such as the SA used to process the packet. At block  1314 , network I/O device driver  140  sends the QUIC packet to OS networking stack  204 . At block  1316 , OS networking stack  204  delivers the QUIC packet to QUIC server  166  via the socket. In another embodiment, application  160  opens a QUIC socket and QUIC server  166  is implemented with the QUIC stack  162 ,  152 ,  204  in OS  150 . 
       FIG. 14  illustrates an example of a storage medium  1400 . Storage medium  1400  may comprise an article of manufacture. In some examples, storage medium  1400  may include any non-transitory computer readable medium or machine readable medium, such as an optical, magnetic or semiconductor storage. Storage medium  1400  may store various types of computer executable instructions, such as instructions  1402  to implement logic flows and pseudo code described above. Examples of a computer readable or machine-readable storage medium may include any tangible media capable of storing electronic data, including volatile memory or non-volatile memory, removable or non-removable memory, erasable or non-erasable memory, writeable or re-writeable memory, and so forth. Examples of computer executable instructions may include any suitable type of code, such as source code, compiled code, interpreted code, executable code, static code, dynamic code, object-oriented code, visual code, and the like. The examples are not limited in this context. 
       FIG. 15  illustrates an example computing platform  1500 . In some examples, as shown in  FIG. 15 , computing platform  1500  may include a processing component  1502 , other platform components  1504  and/or a communications interface  1506 . 
     According to some examples, processing component  1502  may execute processing operations or logic for instructions stored on storage medium  1400 . Processing component  1502  may include various hardware elements, software elements, or a combination of both. Examples of hardware elements may include devices, logic devices, components, processors, microprocessors, circuits, processor circuits, circuit elements (e.g., transistors, resistors, capacitors, inductors, and so forth), integrated circuits, application specific integrated circuits (ASIC), programmable logic devices (PLD), digital signal processors (DSP), field programmable gate array (FPGA), memory units, logic gates, registers, semiconductor device, chips, microchips, chip sets, and so forth. Examples of software elements may include software components, programs, applications, computer programs, application programs, device drivers, system programs, software development programs, machine programs, operating system software, middleware, firmware, software modules, routines, subroutines, functions, methods, procedures, software interfaces, application program interfaces (API), instruction sets, computing code, computer code, code segments, computer code segments, words, values, symbols, or any combination thereof. Determining whether an example is implemented using hardware elements and/or software elements may vary in accordance with any number of factors, such as desired computational rate, power levels, heat tolerances, processing cycle budget, input data rates, output data rates, memory resources, data bus speeds and other design or performance constraints, as desired for a given example. 
     In some examples, other platform components  1504  may include common computing elements, such as one or more processors, multi-core processors, co-processors, memory units, chipsets, controllers, peripherals, interfaces, oscillators, timing devices, video cards, audio cards, multimedia input/output (I/O) components (e.g., digital displays), power supplies, and so forth. Examples of memory units may include without limitation various types of computer readable and machine readable storage media in the form of one or more higher speed memory units, such as read-only memory (ROM), random-access memory (RAM), dynamic RAM (DRAM), Double-Data-Rate DRAM (DDRAM), synchronous DRAM (SDRAM), static RAM (SRAM), programmable ROM (PROM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), types of non-volatile memory such as 3-D cross-point memory that may be byte or block addressable. Non-volatile types of memory may also include other types of byte or block addressable non-volatile memory such as, but not limited to, multi-threshold level NAND flash memory, NOR flash memory, single or multi-level PCM, resistive memory, nanowire memory, FeTRAM, MRAM that incorporates memristor technology, STT-MRAM, or a combination of any of the above. Other types of computer readable and machine-readable storage media may also include magnetic or optical cards, an array of devices such as Redundant Array of Independent Disks (RAID) drives, solid state memory devices (e.g., USB memory), solid state drives (SSD) and any other type of storage media suitable for storing information. 
     In some examples, communications interface  1506  may include logic and/or features to support a communication interface. For these examples, communications interface  1506  may include one or more communication interfaces that operate according to various communication protocols or standards to communicate over direct or network communication links or channels. Direct communications may occur via use of communication protocols or standards described in one or more industry standards (including progenies and variants) such as those associated with the PCIe specification. Network communications may occur via use of communication protocols or standards such those described in one or more Ethernet standards promulgated by IEEE. For example, one such Ethernet standard may include IEEE 802.3. Network communication may also occur according to one or more OpenFlow specifications such as the OpenFlow Switch Specification. 
     The components and features of computing platform  1500 , including logic represented by the instructions stored on storage medium  1400  may be implemented using any combination of discrete circuitry, ASICs, logic gates and/or single chip architectures. Further, the features of computing platform  1400  may be implemented using microcontrollers, programmable logic arrays and/or microprocessors or any combination of the foregoing where suitably appropriate. It is noted that hardware, firmware and/or software elements may be collectively or individually referred to herein as “logic” or “circuit.” 
     It should be appreciated that the exemplary computing platform  1500  shown in the block diagram of  FIG. 15  may represent one functionally descriptive example of many potential implementations. Accordingly, division, omission or inclusion of block functions depicted in the accompanying figures does not infer that the hardware components, circuits, software and/or elements for implementing these functions would necessarily be divided, omitted, or included in embodiments. 
     Various examples may be implemented using hardware elements, software elements, or a combination of both. In some examples, hardware elements may include devices, components, processors, microprocessors, circuits, circuit elements (e.g., transistors, resistors, capacitors, inductors, and so forth), integrated circuits, ASIC, programmable logic devices (PLD), digital signal processors (DSP), FPGA, memory units, logic gates, registers, semiconductor device, chips, microchips, chip sets, and so forth. In some examples, software elements may include software components, programs, applications, computer programs, application programs, system programs, machine programs, operating system software, middleware, firmware, software modules, routines, subroutines, functions, methods, procedures, software interfaces, application program interfaces (API), instruction sets, computing code, computer code, code segments, computer code segments, words, values, symbols, or any combination thereof. Determining whether an example is implemented using hardware elements and/or software elements may vary in accordance with any number of factors, such as desired computational rate, power levels, heat tolerances, processing cycle budget, input data rates, output data rates, memory resources, data bus speeds and other design or performance constraints, as desired for a given implementation. 
     Some examples may include an article of manufacture or at least one computer-readable medium. A computer-readable medium may include a non-transitory storage medium to store logic. In some examples, the non-transitory storage medium may include one or more types of computer-readable storage media capable of storing electronic data, including volatile memory or non-volatile memory, removable or non-removable memory, erasable or non-erasable memory, writeable or re-writeable memory, and so forth. In some examples, the logic may include various software elements, such as software components, programs, applications, computer programs, application programs, system programs, machine programs, operating system software, middleware, firmware, software modules, routines, subroutines, functions, methods, procedures, software interfaces, API, instruction sets, computing code, computer code, code segments, computer code segments, words, values, symbols, or any combination thereof. 
     Some examples may be described using the expression “in one example” or “an example” along with their derivatives. These terms mean that a particular feature, structure, or characteristic described in connection with the example is included in at least one example. The appearances of the phrase “in one example” in various places in the specification are not necessarily all referring to the same example. 
     Included herein are logic flows or schemes representative of example methodologies for performing novel aspects of the disclosed architecture. While, for purposes of simplicity of explanation, the one or more methodologies shown herein are shown and described as a series of acts, those skilled in the art will understand and appreciate that the methodologies are not limited by the order of acts. Some acts may, in accordance therewith, occur in a different order and/or concurrently with other acts from that shown and described herein. For example, those skilled in the art will understand and appreciate that a methodology could alternatively be represented as a series of interrelated states or events, such as in a state diagram. Moreover, not all acts illustrated in a methodology may be required for a novel implementation. 
     A logic flow or scheme may be implemented in software, firmware, and/or hardware. In software and firmware embodiments, a logic flow or scheme may be implemented by computer executable instructions stored on at least one non-transitory computer readable medium or machine readable medium, such as an optical, magnetic or semiconductor storage. The embodiments are not limited in this context. 
     Some examples are described using the expression “coupled” and “connected” along with their derivatives. These terms are not necessarily intended as synonyms for each other. For example, descriptions using the terms “connected” and/or “coupled” may indicate that two or more elements are in direct physical or electrical contact with each other. The term “coupled,” however, may also mean that two or more elements are not in direct contact with each other, but yet still co-operate or interact with each other. 
     It is emphasized that the Abstract of the Disclosure is provided to comply with 37 C.F.R. Section 1.72(b), requiring an abstract that will allow the reader to quickly ascertain the nature of the technical disclosure. It is submitted with the understanding that it will not be used to interpret or limit the scope or meaning of the claims. In addition, in the foregoing Detailed Description, it can be seen that various features are grouped together in a single example for the purpose of streamlining the disclosure. This method of disclosure is not to be interpreted as reflecting an intention that the claimed examples require more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive subject matter lies in less than all features of a single disclosed example. Thus, the following claims are hereby incorporated into the Detailed Description, with each claim standing on its own as a separate example. In the appended claims, the terms “including” and “in which” are used as the plain-English equivalents of the respective terms “comprising” and “wherein,” respectively. Moreover, the terms “first,” “second,” “third,” and so forth, are used merely as labels, and are not intended to impose numerical requirements on their objects. 
     Although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.