# US 2019/0173850 A1 · Scaling gateway to gateway traffic using flow hash > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0173850 A1 - Document ID: US20190173850A1 - Status: Published application - Kind: A1 - Application number: 15/831,162 - Filed: 2017-12-04 - Published: 2019-06-06 - Earliest claimed: 2017-12-04 - Assignees: Nicira, Inc. - Applicants: Nicira, Inc. - Inventors: Jayant Jain; Ly Loi; Anirban Sengupta; Yong Wang; Mike Parsa - Web page: https://patentgrep.com/patent/US20190173850A1 ## CPC - H04L 9/3215: {using a plurality of channels (network architectures or network communication protocols using different networks H04L63/18)} - H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC} - H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)} - H04L 9/3236: {using cryptographic hash functions} - H04L 45/74: Address processing for routing - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/0485: {Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up} - H04L 63/164: {at the network layer} - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04L 12/66: Arrangements for connecting between networks having differing types of switching systems, e.g. gateways - H04L 45/745: Address table lookup; Address filtering - H04L 47/20: Traffic policing - H04L 61/2592: using tunnelling or encapsulation - H04L 61/5007: Internet protocol [IP] addresses - H04L 61/5038: for local use, e.g. in LAN or USB networks, or in a controller area network [CAN] - H04L 2209/125: Parallelization or pipelining, e.g. for accelerating processing of cryptographic operations - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract For a network including multiple computers acting as tunnel endpoints in a network, some embodiments provide a method for processing data messages in parallel using multiple processors (e.g., cores) of each computer. Each computer in some embodiments has a set of interfaces configured as tunnel endpoints connecting to multiple tunnels. In some embodiments, the multiple processors encrypt data messages according to a set of encryption parameters or multiple sets of encryption parameters that specify an encryption policy for data messages requiring encryption, an encryption algorithm, an encryption key, a destination network address, and an encryption-parameter-set identifier. ## Claims ### Claim 1 A method for improving communication between gateway devices in different datacenters using multiple processing units of a first gateway computer in a first datacenter and multiple encryption-secured tunnels, the method comprising: defining a plurality of encryption-secured tunnels between a first set of interfaces of the first gateway computer and a second set of interfaces of a second gateway computer in a second datacenter; for each of a plurality of processing units of the first gateway computer, assigning a unique set of encryption-secured tunnels in the plurality of encryption secured tunnels for the processing unit to use as egress tunnels for encrypted data messages forwarded to the second gateway computer; and for a data message received at the first gateway computer, selecting a particular processing unit of the first gateway computer to process the data message, wherein processing the data message comprises selecting a particular encryption-secured tunnel in the set of encryption-secured tunnels assigned to the particular processing unit over which to transmit the data message. ### Claim 2 (depends on 1) The method of claim 1, wherein selecting the particular processing unit for the received data message comprises selecting the particular processing unit based on a hash of a set of the data message's attributes. ### Claim 3 (depends on 2) The method of claim 2, wherein the set of the data message's attributes is a set of header field values that define a data message flow, such that data messages in a same data message flow are encrypted by a same processing unit. ### Claim 4 (depends on 1) The method of claim 1, wherein selecting the particular encryption-secured tunnel comprises selecting the particular encryption-secured tunnel based on a hash of a set of the data message's attributes. ### Claim 5 (depends on 4) The method of claim 4, wherein the set of the data message's attributes is a set of header field values that define a data message flow, such that data messages in a same data message flow are transmitted over a same encryption-secured tunnel. ### Claim 6 (depends on 1) The method of claim 1, wherein each encryption-secured tunnel specifies (1) a set of destination addresses and (2) a set of source addresses for data messages that require encrypting. ### Claim 7 (depends on 1) The method of claim 1, wherein the plurality of encryption-secured tunnels is a first plurality of encryption-secured tunnels, the method further comprising: defining a second plurality of encryption-secured tunnels between a third set of interfaces of the first gateway computer and a fourth set of interfaces of a third gateway computer in a third datacenter; for each of the plurality of processing units of the first gateway computer, assigning a unique set of encryption-secured tunnels in the second plurality of encryption secured tunnels for the processing unit to use as egress tunnels for encrypted data messages forwarded to the third gateway computer; and for a data message received at the first gateway computer, selecting a particular processing unit of the first gateway computer to encrypt the data message for transmission over one of the second plurality of encryption-secured tunnels assigned to the particular processing unit. ### Claim 8 A method for improving communication between gateway devices in different datacenters using multiple processing units of a first gateway computer in a first datacenter and multiple encryption-secured tunnels, the method comprising: defining a plurality of encryption-secured tunnels between a first set of interfaces of the first gateway computer and a second set of interfaces of a second gateway computer in a second data center; for each of a plurality of processing units of the first gateway computer, assigning a unique set of encryption-secured tunnels in the plurality of encryption-secured tunnels to the processing unit, wherein the processing unit is to process data messages for its assigned set of encryption-secured tunnels; and for a data message received at the first gateway computer through a particular one of the encryption-secured tunnels, using the processing unit to which the particular encryption-secured tunnel is assigned to process the data message. ### Claim 9 (depends on 8) The method of claim 8, wherein data messages received over each encryption-secured tunnel are processed by a corresponding processing unit in the second gateway computer. ### Claim 10 (depends on 8) The method of claim 8, wherein the corresponding processing unit in the second gateway computer is selected based on a hash of a set of the data message's attributes that define a data message flow, such that data messages in a same data message flow are encrypted by a same processing unit. ### Claim 11 (depends on 8) The method of claim 8, wherein the particular encryption-secured tunnel is selected at the second gateway computer based on a hash of a set of the data message's attributes that define a data message flow, such that data messages in a same data message flow are transmitted over a same encryption-secured tunnel. ### Claim 12 (depends on 11) The method of claim 11, wherein each encryption-secured tunnel specifies (1) a set of destination addresses and (2) a set of source addresses for data messages that require encrypting. ### Claim 13 (depends on 8) The method of claim 8, wherein the plurality of encryption-secured tunnels is a first plurality of encryption-secured tunnels, and the plurality of processing units of the first gateway computer is a first plurality of processing units, the method further comprising: defining a plurality of encryption-secured tunnels between a third set of interfaces of the first gateway computer and a fourth set of interfaces of a second gateway computer in a third data center; for each of a second plurality of processing units of the first gateway computer, assigning a unique set of encryption-secured tunnels in the second plurality of encryption-secured tunnels to the processing unit, wherein the processing unit is to process data messages for its assigned set of encryption-secured tunnels; and for a data message received at the first gateway computer through a particular one of the encryption-secured tunnels, using the processing unit to which the particular encryption-secured tunnel is assigned to process the data message. ### Claim 14 A method of configuring a first computing device to assign different processing units to use different encryption-secured tunnels to transmit data messages requiring encryption, the method comprising: associate a virtual tunnel interface (VTI) to each of a plurality of encryption-secured tunnels between a set of interfaces of a first and second computer; assign a private network address to each VTI; for each processing unit, (1) create a rule for a desired encryption policy in a network address rule table that identifies a routing lookup table to use for data messages matching a network-address-based rule and (2) create a custom routing lookup table that identifies the private network address of at least one VTI as a nexthop for a data message matching the network-address-based rule that points to the custom routing lookup table, wherein the network address rule table and the custom routing lookup table are used to select an encryption-based tunnel to transmit a data message requiring encryption. ### Claim 15 (depends on 14) The method of claim 14, wherein for each particular network-address-based rule, each processing unit identifies in its custom routing table a different, non-overlapping set of VTIs. ### Claim 16 (depends on 15) The method of claim 15, wherein selecting an encryption-based tunnel to transmit the data message requiring encryption is based on the VTI identified using the custom routing lookup table. ### Claim 17 (depends on 14) The method of claim 14, wherein each encryption-secured tunnel specifies an encryption policy, the encryption policy specifying a key value associated with the encryption-secured tunnel's associated VTI. ### Claim 18 (depends on 17) The method of claim 17, wherein a data message which has a nexthop identified as a private network address of the VTI is marked with a key value associated with the VTI. ### Claim 19 (depends on 18) The method of claim 18, wherein the data message marked with the key value is compared to the encryption policies of the encryption-secured tunnels to select the encryption-secured tunnel that applies to the data message's attributes. ### Claim 20 (depends on 14) The method of claim 14, wherein the number of VTIs is based on at least one of the number of interfaces of the first computing device used to establish the plurality of encryption-secured tunnels and the number of processors of the first computing device.