Abstract: A method for handling connection requests. The method includes receiving, by an operating system (OS), a request from an application to create a connection, wherein the request comprises a connection identifier and a service-level agreement (SLA), determining that the application is authorized to create the connection, creating the connection targeting the application in response to the determination that the application is authorized to create the connection, and applying the SLA to the connection in response to the determination that the application is authorized to create the connection. The method further includes receiving incoming data targeting the connection identifier from a network, processing, by a network protocol stack on the OS, the incoming data according to the SLA to obtain processed incoming data, and providing the processed incoming data to the application. Similar processing may be done on outgoing data from the application to the network.

Abstract: A method for handling connection requests. The method includes receiving, by an operating system (OS), a request from an application to create a connection, wherein the request comprises a connection identifier and a service-level agreement (SLA), determining that the application is authorized to create the connection, creating the connection targeting the application in response to the determination that the application is authorized to create the connection, and applying the SLA to the connection in response to the determination that the application is authorized to create the connection. The method further includes receiving incoming data targeting the connection identifier from a network, processing, by a network protocol stack on the OS, the incoming data according to the SLA to obtain processed incoming data, and providing the processed incoming data to the application. Similar processing may be done on outgoing data from the application to the network.

Abstract: A computer system that communicates cryptographic resource utilization information while processing data packets is described. During operation, the system receives a first data packet and generates a second data packet by performing a cryptographic transformation on the first data packet. Next, the system appends auxiliary information to the second data packet. This auxiliary information includes information associated with cryptographic resource utilization during the cryptographic transformation. Then, the system provides the second data packet including the auxiliary information.

Abstract: A system for processing encrypted SSL sessions includes a web application, a secure sockets layer socket, a TCP/IP stack network layer device. The secure sockets layer socket is coupled between the web application and the TCP/IP stack network layer device. The system also includes an Ethernet device. The TCP/IP stack network layer device is coupled to the Ethernet device. The system also includes a SSL kernel, a kernel SSL interface coupled between the kernel SSL module and the TCP/IP stack network layer device and a crypto subsystem coupled to the kernel SSL module. A method for processing encrypted SSL sessions is also described.

Abstract: A method for performing a cryptographic function including calling into an encryption framework to perform the cryptographic function, wherein calling into the encryption framework comprises sending a request to perform the cryptographic function from a kernel consumer, and processing the request and returning the result to the kernel consumer, wherein processing the request comprises determining whether the request is synchronous or asynchronous, and determining which cryptographic provider to use to perform the cryptographic function.

Abstract: A computer system that communicates cryptographic resource utilization information while processing data packets is described. During operation, the system receives a first data packet and generates a second data packet by performing a cryptographic transformation on the first data packet. Next, the system appends auxiliary information to the second data packet. This auxiliary information includes information associated with cryptographic resource utilization during the cryptographic transformation. Then, the system provides the second data packet including the auxiliary information.