# US 2019/0319933 A1 · Cooperative tls acceleration > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0319933 A1 - Document ID: US20190319933A1 - Status: Published application - Kind: A1 - Application number: 15/952,154 - Filed: 2018-04-12 - Published: 2019-10-17 - Earliest claimed: 2018-04-12 - Assignees: Alibaba Group Holding Limited - Applicants: Alibaba Group Holding Limited - Inventors: Xiaowei JIANG - Web page: https://patentgrep.com/patent/US20190319933A1 ## CPC - G06F 9/505: {considering the load} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - G06F 9/5083: {Techniques for rebalancing the load in a distributed system} - H04L 63/0485: {Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up} - H04L 63/166: {at the transport layer} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An integrated circuit and a method for improving performance of cryptographic protocols in the performance of web services by making TLS operations efficient and also solving the unproportioned capacity issues surrounding front-end clusters of a data center is provided. The circuit comprises a peripheral interface configured to communicate with a host system comprising a host processor, a network adaptor configured to receive network packets in a secure session, a chip processor configured to execute a secure communication software stack to process the packets and to generate data load information of the chip processor, and a load balancer configured to acquire a notification in response to scheduling decisions and to redirect the packets based on the notification that a load of one of the host processor or the chip processor is determined to be overloaded. ## Claims ### Claim 1 An integrated circuit comprising: a peripheral interface configured to communicate with a host system comprising a host processor; a network adaptor configured to receive network packets in a secure communication session; a chip processor having one or more cores, wherein the chip processor is configured to execute a secure communication software stack to process network packets in the secure communication session; and a load balancer configured to redirect the received network packets based on a notification that a data load of one of the host processor and the chip processor is determined to be overloaded. ### Claim 2 (depends on 1) The integrated circuit of claim 1, wherein the chip processor is further configured to generate data load information of the chip processor, wherein the data load information is provided to a scheduler to make a scheduling decision that is based on a data load of the host processor and a data load of the chip processor. ### Claim 3 (depends on 2) The integrated circuit of claim 2, wherein the load balancer is further configured to acquire the notification in response to the scheduling decision. ### Claim 4 (depends on 1) The integrated circuit of claim 1, further comprising: a secure communication engine configured to transfer a network stack task from the chip processor to the host processor based on a redirect instruction received from the load balancer. ### Claim 5 (depends on 1) The integrated circuit of claims 1, wherein the load balancer is further configured to allow the secure communication engine to provide a software stack task to the host processor based on a determination that the data load of the chip processor is overloaded. ### Claim 6 (depends on 5) The integrated circuit of claim 5, further comprising a first controller on the chip processor configured to enable connectivity of the chip processor to the host processor for transferring the network stack task. ### Claim 7 (depends on 5) The integrated circuit of claim 5, further comprising a second controller on the chip processor configured to permit the chip processor additional memory capacity provided by a peripheral interface card on the chip processor. ### Claim 8 (depends on 4) The integrated circuit of claims 4, wherein the secure communication engine comprises: one or more sequencers configured to control cipher operations, and a plurality of tiles comprising one or more operation modules to assist with the cipher operations. ### Claim 9 (depends on 8) The integrated circuit of claim 8, wherein each of the one or more sequencers are configured to: accept an acceleration request obtained from the load balancer; fetch cipher parameters of the request; break cipher operations into one or more arithmetic operations; and send each of the one or more arithmetic operations to the plurality of tiles for execution. ### Claim 10 (depends on 1) The integrated circuit of claim 1 further comprising an SDN controller configured to turn on the load balancer to start receiving network traffic from the network adapter. ### Claim 11 (depends on 1) The integrated circuit of claim 1, wherein the load balancer includes a packet parser configured to evaluate header information of received network packets. ### Claim 12 (depends on 11) The integrated circuit of claim 11, wherein the load balancer is further configured to include a packet parser configured to determine whether the received network packets are part of a secure communication session. ### Claim 13 (depends on 12) The integrated circuit of claim 12, wherein the load balancer is further configured to in response to the determination that the received network packets are part of the secure communication session and a determination that the secure communication session is part of a new connection, update packet header information of network packets to be redirected. ### Claim 14 A method performed by an integrated circuit including a chip processor, wherein the integrated circuit communicates with a host system including a host processor, the method comprising: receiving network packets in a secure communication session; executing a secure communication software stack to process network packets in the secure communication session; generating data load information of the chip processor; acquiring, based on the data load information of the chip processor and a data load of the host processor, information that one of the chip processor and the host processor is overloaded; and based on the information, redirecting network packets from the overloaded processor to the other processor. ### Claim 15 (depends on 14) The method of claim 14, wherein acquiring information that one of the chip processor and the host processor is overloaded further comprises: providing the data load information to a scheduler to make a scheduling decision based on the data load of the host processor and a data load of the chip processor; and receiving a notification in response to the scheduling decision. ### Claim 16 (depends on 14) The method of claim 14, further comprising: evaluating header information of the received network packets; and determining whether the received network packets are part of a secure communication session based on the evaluated header information. ### Claim 17 (depends on 16) The method of claim 16, wherein the evaluated header information is associated with at least one of destination MAC address, destination IP address associated with the chip processor, a source port, and a destination port. ### Claim 18 (depends on 16) The method of claim 16, further comprising: determining whether the secure communication session is part of a new connection based on the header information of the received network packets. ### Claim 19 (depends on 14) The method of claim 14, wherein in response to acquiring information, redirecting network packets from the overloaded processor to the other processor further comprises: in response to determining that the received network packets are part of a secure communication session and that the secure communication session is part of a new connection, updating packet header information of network packets to be redirected. ### Claim 20 (depends on 19) The method of claim 19 wherein updating packet header information of network packets to be redirected comprises updating at least one of destination IP address and destination MAC address of overloaded processor to at least one of destination IP address and destination MAC address of the other processor.