Session

Envoy Meets DPDK: Unlocking Scalable, Hardware-Agnostic TLS Performance

Envoy is a widely used Layer 7 proxy often deployed at the network edge to terminate large volumes of TLS connections, but the high CPU cost of TLS handshakes can limit scalability. To address this, we leveraged Envoy's Private Key Provider extension to enable asynchronous execution of custom private key operations. By integrating the DPDK crypto API, we offloaded sign operation to hardware, enabling high-throughput TLS handshakes across DPDK-compatible platforms. Our implementation is hardware-agnostic and would work seamlessly with all DPDK-compatible devices. We validated our solution on the OCTEON 10 platform, which features industry-leading cryptographic performance. Using 2K-bit RSA certificate, we achieved 2.5K TLS handshakes per second (QPS) with a single Envoy worker and scaled to 20K QPS with multiple workers—all with low power usage. We present the design, integration, and performance data demonstrating the scalability and efficiency of hardware acceleration TLS at the edge.

Garvit Varshney

Software Engineer in Marvell Technology

Actions

Please note that Sessionize is not responsible for the accuracy or validity of the data provided by speakers. If you suspect this profile to be fake or spam, please let us know.

Jump to top