US 12,750,315 B2Granted

SPI differentiated thin pipes between endpoints with core balancing based on SPI selection

AssigneePalo Alto Networks, Inc.

InventorsKrishna Kumar Vavilala, Suresh Basavanagouda Patil, Naga Raghu Ramprasad Nandigama

Life of this patent

Estimating the term…

Loading patent…

Abstract

A sub-tunneling technique disclosed herein reserves a range of security parameters index (SPI) values when establishing a secure tunnel connection. At the sending tunnel peer, the network driver of the sending tunnel peer NIC (“sending NIC”) maps network traffic flows to different SPI values within the range reserved for the secure tunnel connection. This effectively creates logical sub-tunnels within the secure tunnel connection and allows the sending NIC to distribute network traffic flows across the sub-tunnels. At the receiving tunnel peer, the network driver of its NIC (“receiving NIC”) masks lower bits of the SPI values to obtain a base SPI value corresponding to the secure tunnel connection to determine the security association for decrypting packets from the tunnel. However, the receiving NIC uses the various SPI values of the sub-tunnels to distribute the network traffic flows across the RX queues.

Claims15

Dependent claims

A method comprising:

establishing a virtual private network (VPN) tunnel in a control plane of a first tunnel endpoint with a second tunnel endpoint;
determining, by the first tunnel endpoint, a quantity of different processing units and a hashing algorithm of the second tunnel endpoint;
based on the hashing algorithm and the quantity, determining different security parameters index values (SPIs) to avoid collision of hash values;
transmitting, from the first tunnel endpoint at a data plane, a plurality of network traffic flows in sub-tunnels of the VPN tunnel, wherein transmitting the plurality of network traffic flows in the sub-tunnels comprises using the SPIs in tunnel encapsulations to distinguish the sub-tunnels;
and
distributing, at the second tunnel endpoint, the plurality of network traffic flows across the different processing units based, at least in part, on the different SPIs,
wherein the second tunnel endpoint distributing the plurality of network traffic flows across the different processing units comprises hashing the SPIs and distributing the plurality of network traffic flows across the different processing units according to the hash values of the SPIs.

4 more elements

A non-transitory, machine-readable medium having program code stored therein, the program code comprising:

first instructions to,
determine a quantity of a plurality processing units and a hashing algorithm of a peer tunnel endpoint;
based on the hashing algorithm and the quantity, select a plurality of security parameters index values (SPIs) to avoid collision of hash values;
allocate the selected plurality of SPIs for a virtual private network (VPN) tunnel, wherein the plurality of SPIs includes a first SPI assigned to the VPN tunnel;
distributively map the plurality of SPIs to network traffic flows to be transmitted via the VPN;
and
transmit the network traffic flows according to the SPI mappings;
and
second instructions to,
hash endpoint identifiers and an SPI indicated in a tunnel encapsulation;
and
distribute the network traffic flows across a plurality of processing units based, at least in part, on the hash values of the SPIs.

9 more elements

A system comprising:

a first network device comprising data plane programming to,
determine a quantity of a plurality processing units and a hashing algorithm of a second network device;
based on the hashing algorithm and the quantity, select a plurality of security parameter index values (SPIs) to avoid collision of hash values;
allocate the selected plurality of SPIs for a virtual private network (VPN) tunnel, wherein the plurality of SPIs includes a first SPI assigned to the VPN tunnel in a control plane of the first network device;
and
use each of the plurality of SPIs as a sub-tunnel identifier and distributively assign network traffic flows to sub-tunnels for transmission;
and
transmit packets of the network traffic flows according to the sub-tunnel assignments;
and
a second network device comprising a plurality of processing units for a data plane and data plane programming to,
for each sub-tunnel, hash endpoint identifiers and the sub-tunnel identifier;
and
distribute across the plurality of processing units based on the hash values;
distribute received packets across the plurality of processing units based, at least in part, on the hash values of the SPIs indicated in tunnel encapsulations of the packets.

11 more elements

Dependencies are inferred from the claim text.

Facts

Application: 18/981,340Filed 13 Dec 2024
Published: US 2026/0172358 A118 Jun 2026
Granted: 29 Sep 2026
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

H04L 47/125
Avoiding congestion; Recovering from congestion: by balancing the load, e.g. traffic engineering
H04L 12/4633
Interconnection of networks: interconnection of networks using encapsulation techniques, e.g. tunneling
H04L 12/4641
Interconnection of networks: virtual LANs, VLANs, e.g. virtual private networks [VPN]
H04L 63/0272
For separating internal from external traffic, e.g. firewalls: virtual private networks