Performance improvement of IPSEC traffic using SA-groups and mixed-mode SAS
AssigneeVMware, Inc.
InventorSudesh Pawar
Life of this patent
Estimating the term…
Abstract
Some embodiments provide a method of load balancing data message flows across multiple secure connections. The method receives a data message having source and destination addresses formatted according to a first protocol. Based on the source and destination addresses, the method selects one of the multiple secure connections for the data message. Each of the secure connections handles a first set of connections formatted according to the first protocol and a second set of connections formatted according to a second protocol that is an alternative to the first protocol. The method securely encapsulates the data message and forwards the encapsulated data message onto a network. The encapsulation includes an identifier for the selected secure connection.
Claims20
A method comprising:
- receiving a data message, the data message being associated with a first protocol and comprising an identifier;
- determining a hash value based at least on the identifier;
- performing a load balancing operation using at least the hash value to select a mixed-mode security association (SA), the mixed-mode SA being configured to operate according to the first protocol and a second protocol;
- and
- encapsulating the data message using according to a network address format of the first protocol by the mixed-mode SA.
A non-transitory machine readable medium storing a program for execution by a set of processing units, the program comprising sets of instructions for:
- receiving a data message, the data message being associated with a first protocol and comprising an identifier;
- determining a hash value based at least on the identifier;
- performing a load balancing operation using at least the hash value to select a mixed-mode security association (SA), the mixed-mode SA being configured to operate according to the first protocol and a second protocol;
- and
- encapsulating the data message using according to a network address format of the first protocol by the mixed-mode SA.
Dependencies are inferred from the claim text.