Performance improvement of ipsec traffic using sa-groups and mixed-mode sas
AssigneeVMware, Inc.
InventorSudesh Pawar
Life of this patent
Estimating the term…
Abstract
Some embodiments provide a method of load balancing data message flows across multiple secure connections. The method receives a data message having source and destination addresses formatted according to a first protocol. Based on the source and destination addresses, the method selects one of the multiple secure connections for the data message. Each of the secure connections handles a first set of connections formatted according to the first protocol and a second set of connections formatted according to a second protocol that is an alternative to the first protocol. The method securely encapsulates the data message and forwards the encapsulated data message onto a network. The encapsulation includes an identifier for the selected secure connection.
Claims21
1-20. (canceled)
A method of forwarding encrypted packets between a source and a destination, the method comprising:
- receiving a data message flow that uses an IPv4 (Internet Protocol version 4) protocol or an IPv6 (version 6) protocol;
- selecting one mixed-mode security association (SA) from a plurality of mixed-mode SAs, each mixed-mode SA for use to encrypt IPv4 or IPv6 data message flows;
- using the selected mixed-mode SA to encrypt and encapsulate the data message flow;
- and
- forwarding the encapsulated data message flow to the destination, wherein the encapsulation comprises an identifier for the selected SA.
A non-transitory machine readable medium storing a program for execution by a set of processing units to forward encrypted packets between a source and a destination, the program comprising sets of instructions for:
- receiving a data message flow that uses an IPv4 (Internet Protocol version 4) protocol or an IPv6 (version 6) protocol;
- selecting one mixed-mode security association (SA) from a plurality of mixed-mode SAs, each mixed-mode SA for use to encrypt IPv4 or IPv6 data message flows;
- using the selected mixed-mode SA to encrypt and encapsulate the data message flow;
- and
- forwarding the encapsulated data message flow to the destination, wherein the encapsulation comprises an identifier for the selected SA.
Dependencies are inferred from the claim text.