Load balancing based on security parameter index values
AssigneeCisco Technology, Inc.
InventorsGrzegorz Boguslaw Duraj, Leonardo Rangel Augusto, Kyle Andrew Donald Mestery
Life of this patent
Estimating the term…
Abstract
Techniques for load balancing encrypted traffic based on security parameter index (SPI) values of packet headers and sets of 5-tuple values of the packet headers are described herein. Additionally, techniques for including quality of service (QoS)-type information in SPI value fields of packet headers are also described herein. The QoS-type information may indicate a particular traffic class according to which the packet is to be handled. Further, techniques for pre-configuring a backend host such that encrypted traffic may be migrated to the backend host from another backend host without causing temporary service disruptions are also described herein.
Claims20
A method comprising:
- receiving, from a client device and at a network device of a network, a request to establish an encrypted tunnel through the network such that data-plane traffic flows between the client device and a service via the encrypted tunnel;
- generating a security parameter index (SPI) value to be used by the client device for the data-plane traffic;
- sending, to the client device, an indication of the SPI value;
- receiving, at a load balancer, a data packet that includes the SPI value and a set of 5-tuple values;
- computing, by the load balancer, a hash value representing the SPI value and the set of 5-tuple values;
- determining, by the load balancer and based at least in part on the hash value, to send the data packet through the encrypted tunnel to a server of a group of servers that support the service;
- and
- sending the data packet to the server.
A system comprising:
- one or more processors;
- and
- one or more computer-readable media storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
- receiving, from a client device, a request to establish an encrypted tunnel through a network such that data-plane traffic flows between the client device and a service via the encrypted tunnel;
- generating a security parameter index (SPI) value to be used by the client device for the data-plane traffic;
- sending, to the client device, an indication of the SPI value;
- receiving, at a load balancer, a data packet that includes the SPI value and a set of 5-tuple values;
- computing, by the load balancer, a hash value representing the SPI value and the set of 5-tuple values;
- and
- based at least in part on the hash value, sending, via the encrypted tunnel, the data packet to a server of a group of servers that support the service.
A method comprising:
- receiving, at a first control node of a network that is disposed between a client device and a service, control-plane traffic including a request to establish an encrypted tunnel through the network such that data-plane traffic flows between the client device and the service via the encrypted tunnel, wherein the network is configured such that the data-plane traffic flows through one or more data nodes of the network and the control-plane traffic flows through one or more control nodes of the network different than the one or more data nodes;
- generating, at the first control node, a security parameter index (SPI) value to be used by the client device for the data-plane traffic;
- sending, to the client device, an indication of the SPI value;
- receiving, at a load balancing node of the network, a packet of the data-plane traffic that includes the SPI value and a set of 5-tuple values;
- computing, by the load balancing node and using a hashing function, a hash value representing the SPI value and the set of 5-tuple values;
- and
- based at least in part on the hash value, sending the packet to a first data node of the one or more data nodes via the encrypted tunnel.
Dependencies are inferred from the claim text.