# US 2019/0173841 A1 · Load balancing ipsec tunnel processing with extended berkeley packet filer (ebpf) > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0173841 A1 - Document ID: US20190173841A1 - Status: Published application - Kind: A1 - Application number: 15/833,092 - Filed: 2017-12-06 - Published: 2019-06-06 - Earliest claimed: 2017-12-06 - Assignees: Nicira, Inc. - Applicants: Nicira, Inc. - Inventors: Yong WANG; Brenden BLANCO; Ly LOI - Web page: https://patentgrep.com/patent/US20190173841A1 ## CPC - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - G06F 9/5077: {Logical partitioning of resources; Management or configuration of virtualized resources (specific details on emulation or internal functioning of virtual machines G06F9/455)} - G06F 9/5083: {Techniques for rebalancing the load in a distributed system} - H04L 45/74: Address processing for routing - H04L 49/70: {Virtual switches} - H04L 63/0272: {Virtual private networks} - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/164: {at the network layer} - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Certain embodiments described herein are generally directed to load balancing IPSec tunnels at an extended Berkeley Packet Filter (eBPF) module of a destination tunnel endpoint for encapsulated ESP encrypted data packets for encapsulated encrypted data packets based on a security parameter index value of the encapsulated encrypted data packets. ## Claims ### Claim 1 A method for processing encapsulated encrypted data packets at an extended Berkeley Packet Filter (eBPF) module on a host machine, comprising: receiving, at the eBPF module, an encapsulated encrypted data packet, the encapsulated encrypted data packet comprising a first header and an encrypted payload, the first header comprising a source IP address of a source tunnel endpoint, a destination IP address of a destination tunnel endpoint, and a security parameter index (SPI) value corresponding to a security association between a source endpoint and a destination endpoint, the encrypted payload comprising a second header comprising a source IP address of the source endpoint and a destination IP address of the destination endpoint; selecting a CPU core ID from a plurality of CPU cored IDs based at least in part on the SPI value, wherein the CPU core ID corresponds to a virtual CPU of a plurality of virtual CPUs; and inserting the CPU core ID into the encapsulated encrypted data packet; passing the encapsulated encrypted data packet to a receive packet steering (RPS) module for assignment of the encapsulated encrypted data packet to the virtual CPU based on the CPU core ID. ### Claim 2 (depends on 1) The method of claim 1, further comprising: parsing the packet to determine the SPI value and at least one of the source IP address of the source tunnel endpoint and the destination IP address of the destination tunnel endpoint; performing a look-up of a mapping table stored in the eBPF module using the SPI value and the at least one of the source IP address of the source tunnel endpoint and the destination IP address of the destination tunnel endpoint; and determining if a matching entry for the SPI value and the at least one of the source IP address of the source tunnel endpoint and the destination IP address of the destination tunnel endpoint is found in the mapping table, prior to the selecting. ### Claim 3 (depends on 2) The method of claim 2, wherein the selecting further comprises selecting the CPU core ID using a CPU selection function upon determining that no matching entry is found. ### Claim 4 (depends on 3) The method of claim 3, wherein the CPU selection function uses a load level of each of the plurality of virtual CPUs as input. ### Claim 5 (depends on 4) The method of claim 4, wherein a load level of the virtual CPU is lowest among load levels of the plurality of virtual CPUs. ### Claim 6 (depends on 3) The method of claim 3, wherein the CPU selection function performs the selecting using a round-robin mechanism. ### Claim 7 (depends on 1) The method of claim 1, wherein the eBPF module is configured by a configuration engine. ### Claim 8 (depends on 7) The method of claim 7, wherein the mapping table is replaced by the configuration engine in response to an event. ### Claim 9 (depends on 8) The method of claim 8, wherein the event comprises a change in the SPI value corresponding to the security association between the source endpoint and the destination endpoint. ### Claim 10 (depends on 1) The method of claim 1, further comprising: storing a mapping of the SPI value to the selected CPU core ID in the mapping table, prior to the passing. ### Claim 11 A non-transitory computer readable medium comprising instructions to be executed in a computer system, wherein the instructions when executed in the computer system perform a method for processing encapsulated encrypted data packets at an extended Berkeley Packet Filter (eBPF) module on a host machine, the method comprising: receiving, at the eBPF module, an encapsulated encrypted data packet, the encapsulated encrypted data packet comprising a first header and an encrypted payload, the first header comprising a source IP address of a source tunnel endpoint, a destination IP address of a destination tunnel endpoint, and a security parameter index (SPI) value corresponding to a security association between a source endpoint and a destination endpoint, the encrypted payload comprising a second header comprising a source IP address of the source endpoint and a destination IP address of the destination endpoint; selecting a CPU core ID from a plurality of CPU cored IDs based at least in part on the SPI value, wherein the CPU core ID corresponds to a virtual CPU of a plurality of virtual CPUs; and inserting the CPU core ID into the encapsulated encrypted data packet; passing the encapsulated encrypted data packet to a receive packet steering (RPS) module for assignment of the encapsulated encrypted data packet to the virtual CPU based on the CPU core ID. ### Claim 12 (depends on 11) The non-transitory computer readable medium of claim 11, wherein the method further comprises: parsing the packet to determine the SPI value and at least one of the source IP address of the source tunnel endpoint and the destination IP address of the destination tunnel endpoint; performing a look-up of a mapping table stored in the eBPF module using the SPI value and the at least one of the source IP address of the source tunnel endpoint and the destination IP address of the destination tunnel endpoint; and determining if a matching entry for the SPI value and the at least one of the source IP address of the source tunnel endpoint and the destination IP address of the destination tunnel endpoint is found in the mapping table, prior to the selecting. ### Claim 13 (depends on 12) The non-transitory computer readable medium of claim 12, wherein the selecting further comprises selecting the CPU core ID using a CPU selection function upon determining that no matching entry is found. ### Claim 14 (depends on 13) The non-transitory computer readable medium of claim 13, wherein the CPU selection function uses a load level of each of the plurality of virtual CPUs as input. ### Claim 15 (depends on 14) The non-transitory computer readable medium of claim 14, wherein a load level of the virtual CPU is lowest among load levels of the plurality of virtual CPUs. ### Claim 16 (depends on 13) The non-transitory computer readable medium of claim 13, wherein the CPU selection function performs the selecting using a round-robin mechanism. ### Claim 17 (depends on 11) The non-transitory computer readable medium of claim 11, wherein the eBPF module is configured by a configuration engine. ### Claim 18 (depends on 17) The non-transitory computer readable medium of claim 17, wherein the mapping table is replaced by the configuration engine in response to an event. ### Claim 19 (depends on 18) The non-transitory computer readable medium of claim 18, wherein the event comprises a change in the SPI value corresponding to the security association between the source endpoint and the destination endpoint. ### Claim 20 (depends on 11) The non-transitory computer readable medium of claim 11, wherein the method further comprises: storing a mapping of the SPI value to the selected CPU core ID in the mapping table, prior to the passing. ### Claim 21 A computer system, wherein system software for the computer system is programmed to execute a method for processing encapsulated encrypted data packets at an extended Berkeley Packet Filter (eBPF) module on a host machine, the method comprising: receiving, at the eBPF module, an encapsulated encrypted data packet, the encapsulated encrypted data packet comprising a first header and an encrypted payload, the first header comprising a source IP address of a source tunnel endpoint, a destination IP address of a destination tunnel endpoint, and a security parameter index (SPI) value corresponding to a security association between a source endpoint and a destination endpoint, the encrypted payload comprising a second header comprising a source IP address of the source endpoint and a destination IP address of the destination endpoint; selecting a CPU core ID from a plurality of CPU cored IDs based at least in part on the SPI value, wherein the CPU core ID corresponds to a virtual CPU of a plurality of virtual CPUs; and inserting the CPU core ID into the encapsulated encrypted data packet; passing the encapsulated encrypted data packet to a receive packet steering (RPS) module for assignment of the encapsulated encrypted data packet to the virtual CPU based on the CPU core ID. ### Claim 22 (depends on 21) The computer system of claim 21, wherein the method further comprises: parsing the packet to determine the SPI value and at least one of the source IP address of the source tunnel endpoint and the destination IP address of the destination tunnel endpoint; performing a look-up of a mapping table stored in the eBPF module using the SPI value and the at least one of the source IP address of the source tunnel endpoint and the destination IP address of the destination tunnel endpoint; and determining if a matching entry for the SPI value and the at least one of the source IP address of the source tunnel endpoint and the destination IP address of the destination tunnel endpoint is found in the mapping table, prior to the selecting. ### Claim 23 (depends on 22) The computer system of claim 22, wherein the selecting further comprises selecting the CPU core ID using a CPU selection function upon determining that no matching entry is found. ### Claim 24 (depends on 23) The computer system of claim 23, wherein the CPU selection function uses a load level of each of the plurality of virtual CPUs as input. ### Claim 25 (depends on 24) The computer system of claim 24, wherein a load level of the virtual CPU is lowest among load levels of the plurality of virtual CPUs. ### Claim 26 (depends on 23) The computer system of claim 23, wherein the CPU selection function performs the selecting using a round-robin mechanism. ### Claim 27 (depends on 21) The computer system of claim 21, wherein the eBPF module is configured by a configuration engine. ### Claim 28 (depends on 27) The computer system of claim 27, wherein the mapping table is replaced by the configuration engine in response to an event. ### Claim 29 (depends on 28) The computer system of claim 28, wherein the event comprises a change in the SPI value corresponding to the security association between the source endpoint and the destination endpoint. ### Claim 30 (depends on 21) The computer system of claim 21, wherein the method further comprises: storing a mapping of the SPI value to the selected CPU core ID in the mapping table, prior to the passing.