Hashmvt: Accelerating Parallel Networking Services With Hardware Offloaded Hash-Based Match-Value Tables

Modern network infrastructures rely heavily on stateful networking services (NSes), such as firewall and network address translation (NAT). These services utilize state variables (a.k.a., states) to process network flows. However, existing state management mechanisms face significant performance bottlenecks in attaining high-throughput performance, primarily due to the substantial overhead incurred by frequent state matching and the inability to partition states across instances. To address these challenges, we propose HASHMVT, a novel abstraction optimized for state management in NSes. HashMVT employs a MatchValue Table (MVT) that associates network flows with their corresponding states and incorporates built-in partitioning operations that cope with the distribution of states across instances running in parallel. Additionally, it integrates a carefully designed hash-based flow matching mechanism, with hash calculations offloaded to general-purpose platforms using widely available hash instructions. This architecture achieves $O(1)$ time complexity for state lookup operations while supporting concurrent state access via built-in atomic operations, which is particularly crucial for parallel NS deployments. We validate HASHMVT using a representative use case-network address translation. Experimental evaluations demonstrate that HASHMVT exhibits superior scalability compared to existing solutions, delivering over a 60 % improvement in throughput compare to the state-of-the-art implementation. Furthermore, comprehensive analyses on adapting HASHMVT to various real-world NSes confirm its generalizability through a systematic examination of state management requirements across different NS categories.