Distributed IPSec load sharing device and method

Abstract

The invention relates to a distributed IPSec load sharing device and a method. The device comprises a cable card and a coprocessing card; the method comprises the following step of: establishing a corresponding relation table of IP addresses of an opposite end of an IPSec tunnel and corresponding coprocessing card numbers on the cable card; when the cable card receives IPSec messages, finding corresponding coprocessing card numbers for processing the messages by inquiring the corresponding relation table, and forwarding the messages to the coprocessing card corresponding to the card number so as to carry out IPSec processing. The invention can quickly position the coprocessing card, and has simple load sharing algorithm, little interaction of communication between panels and high forwarding performance of cable card.

Description

technical field [0001] The present invention relates to the communication field, in particular to a distributed IPSec (Internet Protocol Security, Internet Protocol Security) load sharing device and method. Background technique [0002] At present, the Internet has become the information infrastructure of the whole society, and most enterprise applications are based on IP (Internet Protocol, Internet Protocol). It has become an inevitable trend to build application systems on the Internet. At present, VPN (Virtual Private Network, Virtual Private Network) technology based on IP layer VPN protocol IPSec has become the best solution for WAN construction because of its application independence. It will not only greatly save the construction and operation and maintenance costs of WAN, but also enhance network reliability and security. [0003] IPSec protocols include: IKE (Internet Key Exchange Protocol), AH (Authentication Header), ESP (Encapsulating Security Payload), etc., w...

AI Technical Summary

Problems solved by technology

[0006] 1. The IPSec router based on CPU software forwarding occupies CPU resources, resulting in low operating efficiency, poor processing ability, and normal IP forwarding of images;

[0007] 2. Although the processing capability of routers based on hardware acceleration or network processors to implement IPSec forwarding has been improved to a certain extent, it is limited by hardware performance, has complicated implementation, poor scalability, and the device cannot be upgraded synchronously with the growth of IPSec user traffic;

[0008] 3. Based on distributed processing, usually the online card processes ordinary IP forwarding, and the co-processing card performs IPSec processing. After complex analysis of data packets and IPSec SPDB (Security Policy Database) and SADB (Security Association Database) , resulting in a load sharing algorithm. Because the algorithm is too complex, it consumes a lot of resources for the line card with the basic forwarding function, which affects the common IP forwarding performance of the line card.

Images