In today's cloud networks, host servers widely deploy Data Processing Units (DPUs) as network accelerators under the "Sep-Path" paradigm. However, as server capabilities scale with increasing CPU cores and network bandwidth, the software slow path (executed on a DPU's CPU) has become a critical bottleneck for workloads with high new-flow rates. Meanwhile, new-flow setup logic on host servers must continuously evolve to meet diverse and changing customer demands, making flexibility a key requirement alongside performance. To address this gap, we present XFir, the first hardware-accelerated new-flow setup system for cloud host servers that delivers high CPS throughput while preserving sufficient flexibility. XFir leverages a next-generation DPU equipped with a Cloud Network co-Processor (CNP) to execute the host server's new-flow setup logic. XFir redesigns the host-server flow-setup datapath and table layout, optimizes LPM lookups, and introduces CPU-CNP collaboration mechanisms to further improve performance and reliability. Our evaluation shows that XFir achieves over 776K new-flow CPS on a single host server with 11.7μs slow-path latency. Compared to prior work (Fornax), XFir achieves 4.8x CPS and reduces latency by 69.2%. Moreover, XFir is cost-effective to deploy, requiring only a single DPU per host. Overall, XFir improves new-flow throughput while maintaining development flexibility at low financial cost.

HTTP/3 (H3) has experienced significant growth and extensive adoption in various scenarios, especially in Content Delivery Networks (CDNs). Over the past few years, there have been numerous insightful studies on its deployment in industrial CDNs. However, these studies often separately analyze H3 and CDN, overlooking their synergistic integration. In this work, we explore the applicability of H3 in CDN from a holistic perspective. We analyze 325 websites hosted by seven CDN providers and identify three key characteristics where CDN align perfectly with H3's strengths. Firstly, CDN resources dominate the composition of webpages, where enabling H3 can amplify H3's benefits in connection acceleration. Secondly, CDN providers also exhibit a dominant characteristic, with the majority of CDN resources hosted by a few large providers. This phenomenon makes different webpages share the same provider. When browsing consecutively, H3 helps to skip the connection phase by resuming the connections to the same CDN provider across pages. Thirdly, H3 mitigates the congestion problem on webpages serving multiple CDN resources. This work provides a deeper insight into the applicability of H3 in large-scale distributed systems like CDNs, holding promise for informing the development and optimization of industrial H3.

Third-party web cookies are often used for privacy-invasive behavior tracking. Partly due to privacy concerns, browser vendors have started to block all third-party cookies in recent years. To understand the effects of such third-party cookieless browsing, we crawled and measured the top 10,000 Tranco websites. We developed a framework to remove third-party cookies and analyze the differences between the appearance of web pages with and without these cookies. We find that disabling third-party cookies has no substantial effect on website appearance including layouts, text, and images. This validates the industry-wide shift towards cookieless browsing as a way to protect user privacy without compromising on the user experience.

The future of networking must address the connectivity demands of billions of people and trillions of networked devices. The Intelligent Internet of Everything (IoE) is widely considered the next evolution of the Internet, yet it poses significant challenges to the current TCP/IP architecture. To overcome these challenges, the concept of the Cybertwin network has been proposed as a promising future Internet architecture. To facilitate the advancement of Cybertwin-related research, we have developed CTSim, a Cybertwin network simulator. Our demo demonstrates that the Cybertwin network could effectively enhances mobility, availability, and security in Internet of Things scenarios, making it a powerful tool for researchers in these fields.

In today's web ecosystem, a website that uses a Content Delivery Network (CDN) shares its Transport Layer Security (TLS) private key or session key with the CDN. In this paper, we present the design and implementation of InviCloak, a system that protects the confidentiality and integrity of a user and a website's private communications without changing TLS or upgrading a CDN. InviCloak builds a lightweight but secure and practical key distribution mechanism using the existing DNS infrastructure to distribute a new public key associated with a website's domain name. A web client and a website can use the new key pair to build an encryption channel inside TLS. InviCloak accommodates the current web ecosystem. A website can deploy InviCloak unilaterally without a client's involvement to prevent a passive attacker inside a CDN from eavesdropping on their communications. If a client also installs InviCloak's browser extension, the client and the website can achieve end-to-end confidential and untampered communications in the presence of an active attacker inside a CDN. Our evaluation shows that InviCloak increases the median page load times (PLTs) of realistic web pages from 2.0s to 2.1s, which is smaller than the median PLTs (2.8s) of a state-of-the-art TEE-based solution.