US 2019/0173920 A1 · DETERMINISTIC LOAD BALANCING OF IPSEC PROCESSING

Abstract

Certain embodiments described herein are generally directed to deterministic load balancing of processing encapsulated encrypted data packets at a destination tunnel endpoint. In some embodiments, an IPSec component residing within a destination tunnel endpoint is configured to select a CPU core ID of a virtual CPU using a CPU selection function. In some embodiments, the IPSec component selects an SPI value corresponding to the CPU core ID. In some embodiments, the IPsec component indicates the SPI value to a source tunnel endpoint for use in establishing an in-bound security association, wherein the in-bound security association is used by the source tunnel endpoint to encrypt a data packet received from the source endpoint and destined for the destination endpoint

Claims24

Dependent claims

A method for deterministic load balancing of processing encapsulated encrypted data packets at a destination tunnel endpoint, comprising:

initiating, using an IP Security (IPSec) component, an IPSec tunnel creation with a source tunnel endpoint for encrypting data packets communicated between a source endpoint and a destination endpoint;
selecting, using the IPSec component, a CPU core ID associated with a virtual CPU of a plurality of virtual CPUs residing in the destination tunnel endpoint;
selecting, using the IPSec component, a security parameter index (SPI) value corresponding to the CPU core ID;
and
indicating, using the IPSec component, the SPI value to the source tunnel endpoint for use in establishing an in-bound security association, wherein the in-bound security association is used by the source tunnel endpoint to encrypt a data packet received from the source endpoint and destined for the destination endpoint.

2 more elements

A non-transitory computer readable medium comprising instructions to be executed in a computer system, wherein the instructions when executed in the computer system perform a method for deterministic load balancing of processing encapsulated encrypted data packets at a destination tunnel endpoint, the method comprising:

initiating, using an IP Security (IPSec) component, an IPSec tunnel creation with a source tunnel endpoint for encrypting data packets communicated between a source endpoint and a destination endpoint;
selecting, using the IPSec component, a CPU core ID associated with a virtual CPU of a plurality of virtual CPUs residing in the destination tunnel endpoint;
selecting, using the IPSec component, a security parameter index (SPI) value corresponding to the CPU core ID;
and
indicating, using the IPSec component, the SPI value to the source tunnel endpoint for use in establishing an in-bound security association, wherein the in-bound security association is used by the source tunnel endpoint to encrypt a data packet received from the source endpoint and destined for the destination endpoint.

2 more elements

A computer system, wherein system software for the computer system is programmed to execute a method for deterministic load balancing of processing encapsulated encrypted data packets at a destination tunnel endpoint, the method comprising:

initiating, using an IP Security (IPSec) component, an IPSec tunnel creation with a source tunnel endpoint for encrypting data packets communicated between a source endpoint and a destination endpoint;
selecting, using the IPSec component, a CPU core ID associated with a virtual CPU of a plurality of virtual CPUs residing in the destination tunnel endpoint;
selecting, using the IPSec component, a security parameter index (SPI) value corresponding to the CPU core ID;
and
indicating, using the IPSec component, the SPI value to the source tunnel endpoint for use in establishing an in-bound security association, wherein the in-bound security association is used by the source tunnel endpoint to encrypt a data packet received from the source endpoint and destined for the destination endpoint.

2 more elements

Dependencies are inferred from the claim text.

Deterministic load balancing of ipsec processing

Life of this patent

Deterministic load balancing of ipsec processing

Life of this patent

Abstract

Claims24