US 11,108,751 B2 · Segmentation of encrypted segments in networks

Abstract

A first host receives a packet from a first compute node for a second compute node of a second host. The payload is larger than a maximum transmission unit size. The first packet is encapsulated with an outer header. The first host analyzes a length of at least a portion of the outer header in determining a size of an encrypted segment of the payload. Then, the first host forms a plurality of packets where each packet in the packets includes an encrypted segment of the payload, a respective encryption header, and a respective authentication value. The payload of the first packet is segmented to form a plurality of encrypted segments based on the size. The first host sends the packets to the second host and receives an indication that a packet was not received. A second packet including the encrypted segment is sent to the second compute node.

Claims24

Dependent claims

A method for sending packets to a destination node, the method comprising:

generating, from a payload of a first packet, and in response to a determination that the first packet exceeds a maximum transmission unit (MTU) size that defines a maximum size for sending packets from a source node to the destination node, a plurality of encrypted packet segments, a respective encryption header for each encrypted packet segment, and a respective authentication value for each encrypted packet segment;
forming a plurality of packets from the plurality of encrypted packet segments, wherein each packet in the plurality of packets includes one of the encrypted packet segments, a respective encryption header for the one of the encrypted packet segments, and a respective authentication value that is used to verify the one of the encrypted packet segments, wherein each packet in the plurality of packets is less than or equal to the MTU size;
sending the plurality of packets to the destination node;
receiving an indication that one of the plurality of packets was not received by the destination node;
and
sending a second packet including the encrypted segment that was not received in the one of the plurality of the packets to the destination node, wherein encrypted segments other than one or more encrypted segments that were not received are not resent to the destination node.

3 more elements

A non-transitory computer-readable storage medium containing instructions for forming a plurality of packets from a first packet, wherein, the instructions, when executed, control a computer system to be operable for:

calculating a maximum segment size based on a maximum transmission unit (MTU) size that defines a maximum size for sending packets from a source node to a destination node;
calculating a size of an encrypted segment based on the maximum segment size, a size of an encryption header for the encrypted segment, and a size of an authentication value for the encrypted segment;
generating, from a payload of the first packet, and in response to a determination that the first packet exceeds the maximum transmission unit size, a plurality of encrypted packet segments, a respective encryption header for each encrypted packet segment, and a respective authentication value for each encrypted packet segment;
and
forming the plurality of packets from the plurality of encrypted packet segments, wherein each packet in the plurality of packets includes one of the encrypted packet segments, a respective encryption header for the one of the encrypted packet segments, and a respective authentication value that is used to verify the one of the encrypted packet segments, wherein each packet in the plurality of packets is less than or equal to the MTU size.

2 more elements

An apparatus for sending packets to a destination, the apparatus comprising:

one or more computer processors;
and
a non-transitory computer-readable storage medium comprising instructions, that when executed, control the one or more computer processors to be operable for:
generating, from a payload of a first packet, and in response to a determination that the first packet exceeds a maximum transmission unit (MTU) size that defines a maximum size for sending packets from a source node to the destination node, a plurality of encrypted packet segments, a respective encryption header for each encrypted packet segment, and a respective authentication value for each encrypted packet segment;
forming a plurality of packets from the plurality of encrypted packet segments, wherein each packet in the plurality of packets includes one of the encrypted packet segments, a respective encryption header for the one of the encrypted packet segments, and a respective authentication value that is used to verify the one of the encrypted packet segments, wherein each packet in the plurality of packets is less than or equal to the MTU size;
sending the plurality of packets to the destination node;
receiving an indication that one of the plurality of packets was not received by the destination node;
and
sending a second packet including the encrypted segment that was not received in the one of the plurality of the packets to the destination node, wherein encrypted segments other than one or more encrypted segments that were not received are not resent to the destination node.

6 more elements

An apparatus for forming a plurality of packets from a first packet, the apparatus comprising:

one or more computer processors;
and
a non-transitory computer-readable storage medium comprising instructions, that when executed, control the one or more computer processors to be operable for:
calculating a maximum segment size based on a maximum transmission unit (MTU) size that defines a maximum size for sending packets from a source node to a destination node;
calculating a size of an encrypted segment based on the maximum segment size, a size of an encryption header for the encrypted segment, and a size of an authentication value for the encrypted segment;
generating, from a payload of the first packet, and in response to a determination that the first packet exceeds the maximum transmission unit size, a plurality of encrypted packet segments, a respective encryption header for each encrypted packet segment, and a respective authentication value for each encrypted packet segment;
and
forming the plurality of packets from the plurality of encrypted packet segments, wherein each packet in the plurality of packets includes one of the encrypted packet segments, a respective encryption header for the one of the encrypted packet segments, and a respective authentication value that is used to verify the one of the encrypted packet segments, wherein each packet in the plurality of packets is less than or equal to the MTU size.

5 more elements

Dependencies are inferred from the claim text.

Segmentation of encrypted segments in networks

Life of this patent

Segmentation of encrypted segments in networks

Life of this patent

Abstract

Claims24