High performance communication link and method of operation

Abstract

Embodiments of the present disclosure relate to secure, high performance communication links dependent on single network, multiple logical port addressing. Embodiments of the infrastructure are associated with a high performance communication link that allows network traffic to be distributed across multiple interconnects using a single network address with different logical network port addressing. This high performance communication link supports data traffic across different processing logic units residing within a destination computing device.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of priority to U.S. Patent Application No. 63 / 353,498, filed on June 17, 2022, the entire contents of which are incorporated herein by reference. Technical Field

[0003] Embodiments of the present disclosure relate to the field of networking. More specifically, one embodiment of the present disclosure relates to a secure, high-performance communication link that relies on single-network, multi-logical port addressing. Background Art

[0004] Over the past few years, cloud computing has provided infrastructure as a service (IaaS), where components have been developed to utilize and control all types of public cloud networks (such as Web Services (AWS), Cloud Services, Virtual cloud network, These components can operate as part of a software-defined overlay network infrastructure (i.e., a network configured to control the transmission of messages between resources maintained within different virtual networking infrastructures of a public cloud network).

[0005] More specifically, the overlay network can be configured to support ingress and egress communications at selected virtual networking infrastructures (i.e., gateways sometimes referred to as "branch gateways" and "transit gateways"). These gateways utilize secure networking protocols such as, for example, Internet Protocol Security (IPSec) for gateway-to-gateway connections in the transmission of User Datagram Protocol (UDP) Encapsulated Security Payload (ESP) packets. However, IPSec has inherent performance limitations, in which a single IPSec UDP connection cannot provide more than approximately one gigabit per second (~1 Gbps) of data throughput. Although throughput limitations can be addressed by using multiple Internet Protocol (IP) addresses, such a solution may impose significant constraints on the operability of the network, especially in situations where IP addresses are not readily available and where pre-network provisioning has occurred in situations where the required IP address range is not available.

[0006] In this article, IPSec is a set of protocols for establishing an encrypted connection channel between two computing devices, each of which is assigned a unique IP address. IPSec involves (i) key exchange and negotiation (IKE protocol) running on UDP port 500 / 4500; and (ii) encrypted packet tunnel formation according to the Encapsulating Security Payload (ESP) protocol. ESP works over the original IP protocol similar to TCP / UDP / ICMP. However, due to the widespread adoption of firewalls / network address translation, it is usually used in UDP encapsulation tunnel mode using UDP port 4500. ESP can work in tunnel / S2S mode (carrying the entire IP packet) or transport / P2P mode (carrying IP packet data).

[0007] In addition, and other operating systems, packets for a single TCP or UDP connection are typically handled on a specific processor core of a multi-core system. Currently, when operating according to the IPSec protocol, distributing packets over a single connection across multiple processor cores at a destination computing device is cumbersome because the processor core is selected based on a hash calculation of addressing information including an IP address and a port identifier (e.g., port 4500). According to RFC 3948, entitled "UDP Encapsulation of IPSec ESP Packets," the IPsec protocol, when utilized by a single source with a static IP address, cannot provide entropy for IPsec encrypted traffic to be directed to different processor cores at a destination computing device. As a result, data transmitted from the source computing device is consistently directed to a specific processor core of the destination computing device. Due to the lack of uniqueness in the addressing information, IPSec encrypted traffic is limited to approximately one gigabit per second (Gbps).

[0008] What is needed is an alternative solution to the constraints associated with IPSec that does not depend on creating additional IP addresses. Summary of the invention

[0009] One embodiment of the claimed invention is directed to a high performance communication link connecting a first computing device and a second computing device, the communication link comprising a plurality of interconnects between the first computing device and the second computing device.

[0010] Additional embodiments of the claimed invention are directed to a high performance communication link connecting a first computing device and a second computing device, wherein each of the first computing device and the second computing device includes at least one network interface, and the at least one network interface includes at least one network interface controller. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Embodiments of the invention are illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings in which like reference numerals indicate similar elements and in which:

[0012] Figure 1A is an exemplary embodiment of a high performance communications link featuring multiple interconnections established between computing devices.

[0013] Figure 1B is through Figure 1A An exemplary embodiment of a 5-tuple address header for messages transmitted over a high performance communications link.

[0014] Figure 2A is an exemplary embodiment of a network interface controller (NIC) that is deployed in Figure 1A The NIC queue and the processing logic unit within the second computing device interact.

[0015] Figure 2B An exemplary embodiment of hashing logic is provided that operates on meta-information of a message, including a logical port identifier, to determine a network interface controller (NIC) queue at a second computing device to receive the message.

[0016] Figure 3 is formed by Figure 1A A first exemplary embodiment of a message flow for interconnecting a high performance communication link wherein NIC queue assignment is based on assigned logical source port identifiers.

[0017] Figure 4 is formed by Figure 1A A second exemplary embodiment of a message flow for interconnecting a high performance communication link wherein NIC queue assignment is based on an assigned logical destination port identifier.

[0018] Figure 5 is as perceived by a computing device via Figure 1A An exemplary logical representation of communications over a high performance communications link.

[0019] Figure 6 Yes Support Figure 5 An exemplary embodiment of the operability of network address translation (NAT) logic of a first (source) computing device for a high-performance communications link.

[0020] Figure 7 Yes Support Figure 5 An exemplary embodiment of the operability of network address translation (NAT) logic of a second (destination) computing device for a high-performance communications link.

[0021] Figure 8is an exemplary embodiment of an overlay network that operates in cooperation with a cloud architecture and is characterized by computing devices deployed within multiple virtual private cloud networks with high-performance communication links between the computing devices.

[0022] Fig. 9A yes Figure 1A An illustrative embodiment of the operability of a high performance communication link as Figure 8 A portion of the overlay network is deployed between a first computing device operating as a branch gateway and a second computing device operating as a transit gateway.

[0023] Fig. 9B yes Figure 1A An illustrative embodiment of the operability of a high performance communication link as Figure 8 A portion of an overlay network is deployed between a first computing device operating as a first transit gateway and deployed within a first public cloud network and a second computing device operating as a second transit gateway and deployed within a second public cloud network. DETAILED DESCRIPTION

[0024] An embodiment of the infrastructure is associated with a high-performance communication link that allows network traffic to be distributed across multiple interconnects using a single network address with different logical network port addressing. Such a high-performance communication link supports data traffic across different processing logic units (e.g., different processor cores) residing within a destination computing device. In this document, according to one embodiment of the present disclosure, these high-performance communication links can be deployed as part of a software-defined single-cloud or multi-cloud overlay network. In other words, the high-performance communication link can be part of an overlay network that supports communication between computing devices residing in different virtual networking infrastructures, which can be deployed within the same public cloud network or deployed within different public cloud networks.

[0025] As an example of illustration, computing devices may constitute gateways, such as, for example, a "branch" gateway residing within a first virtual networking infrastructure and a "transit" gateway included as part of a second virtual networking infrastructure. Each gateway may constitute a virtual or physical logic featuring data monitoring and / or data routing functionality. Each virtual networking infrastructure may constitute a gateway deployed on Virtual private network within the AWS public cloud network, deployed on Virtual private networks within cloud public cloud networks, deployed in Virtual networks (VNets) within public cloud networks, etc. As described below, each of these types of virtual networking infrastructures shall be referred to as a "virtual private cloud network" or "VPC," independent of the cloud service provider.

[0026] In this article, a high-performance communication link can be created by establishing multiple interconnections between computing devices. According to one embodiment of the present disclosure, these interconnections can be configured according to a secure network protocol (e.g., an Internet Protocol Security "IPSec" tunnel), wherein multiple IPSec tunnels can run over different ports to achieve increased aggregate throughput. For this embodiment, a high-performance communication link can achieve increased data throughput by replacing an actual network (source or destination) port (such as port 500 or 4500 for IPSec data traffic) with a logical (ephemeral) network port. The logical port can be included as part of a 5-tuple header of a message exchanged between a first computing device and a second computing device.

[0027] To ensure a substantially equal distribution of data traffic processed by a destination computing device and received via an interconnect (e.g., an encrypted message tunnel such as an IPSec tunnel), content from the data traffic (e.g., a 5-tuple header from a message forming the data traffic) may be manipulated to produce a result. A processing logic unit targeted to receive the incoming data traffic is selected in dependence upon the result. More specifically, a network interface controller (NIC) of a second computing device may be configured to receive data traffic addressed by a destination IP address assigned to the second computing device over a high-performance communications link, but scaling is achieved by replacing actual source or destination ports with logical source or destination ports residing within a selected logical port range. The NIC operates on the content (including the selected logical (source or destination) port) to select a (NIC) queue to receive the data traffic. The logical ports provide pseudo-predictive entropy in directing data traffic to different NIC queues, each NIC queue being associated with a particular processing logic unit.

[0028] The selection of the NIC queue can be based on the result from a one-way hash operation on meta information associated with the data traffic (e.g., header information including a logical source or destination port number). Each queue is uniquely associated with a processing logic unit associated with the second computing device. Therefore, by directing data traffic to different NIC queues, the communication scheme effectively directs data traffic to different processing logic units, thereby increasing the aggregate data throughput through the high-performance communication link.

[0029] It is contemplated that the number of interconnects (R) may be greater than or equal to the number of processing logic units (M) that are deployed within the destination computing device and configured to consume IPSec data traffic. For example, the number of interconnects (e.g., "R" IPSec tunnels) may be equal to or exceed the number of processing logic units deployed at the destination computing device (R ≥ M) to ensure saturation and utilization of each NIC queue, thereby optimizing data throughput. The selection of a logical port range - which may be a continuous series of port identifiers (e.g., 4501-4516) or discrete port numbers (e.g., 4502, 4507, etc.) - may be predetermined based on test operations performed by the NIC to generate a logical port range that is subsequently routed to each processing logic unit within the second computing device. As an illustrative example, these operations may correspond to a one-way hash operation to convert the contents of a 5-tuple address of an incoming message into a static result for use in selecting a NIC queue to receive the incoming message. In other words, the result is associated with a logical port identifier residing within the logical port range as determined by the hash function to ensure that all NIC queues are accessible based on at least one logical port within the logical port range.

[0030] According to another embodiment of the present disclosure, the load (data traffic) across the high-performance communication link can be distributed to multiple processing logic units through network address translation (NAT) logic, which operates as a process within the NIC or a process separated from the NIC. In order to handle incoming data traffic, the NAT logic can be configured with access to one or more data stores, which are configured to maintain (i) a first mapping between peer IP address / logical port combinations and their corresponding ephemeral network address / actual port combinations, and (ii) a second mapping between the ephemeral network address / actual port combination and the peer IP address / actual port combination. Additionally, in order to handle outgoing data traffic, the NAT logic can be configured with access to the mapping between the logical port and a specific processing logic unit (or a NIC queue at the destination). The address translation scheme allows communication through a high-performance communication link to rely on a single IP address assigned to a destination computing device despite multiple interconnections (e.g., IPSec tunnels), where the actual source and / or destination port identifiers are replaced by logical source port identifiers and / or logical destination port identifiers to assist in (NIC) queue selection at the destination computing device.

[0031] As mentioned above, the NIC queue can be determined and selected to receive messages associated with incoming data traffic from a source computing device in reliance on the logical port replacement, followed by a subsequent transient address translation based on the replaced logical port. By distributing the content of the data traffic via the selection of different logical ports, a higher aggregate data throughput between computing devices can be achieved. The NAT logic is configured to overcome throughput issues experienced by tenants who have already provisioned their VPC networks in some way and now want to add high-performance communication links. First, public IP addresses may not be readily available, and adjustments to additional features (such as, for example, horizontal autoscaling) may be difficult to deploy because each expansion gateway requires a new set of IP addresses.

[0032] Therefore, according to the first embodiment of the present disclosure, different (logical) source ports, destination ports, or both can be used to implement a high-performance communication link, such as Figure 1A-Figure 4 In particular, Figure 3 A representative diagram of communications over a high performance communications link utilizing the same destination IP address but different logical source ports residing within the logical port range 4501-4516 is provided. Figure 4 A representative diagram of communications over a high performance communications link utilizing the same destination IP address but residing at different logical destination ports within the logical port range 4501-4516 is provided. According to a second embodiment of the present disclosure, Figure 5-Figure 7 A representative diagram is provided showing establishment of a high performance communication link through ephemeral network addressing that is generated based on a logical destination port and the content of the ephemeral network address is dependent on selection of a processing logic unit from a plurality of processing logic units deployed within a destination computing device.

[0033] According to a third embodiment of the present disclosure, Figure 8 - Figure 9 provides a representative diagram of an illustrative deployment of high-performance communication links within an overlay network that bridges two different public cloud networks. For this embodiment, each branch subnetwork (subnet) includes multiple branch gateways that operate as entry (input) points and / or exit (output) points for network traffic sent through the overlay network, which can span a single public cloud network or can span multiple public cloud networks (referred to as a "multi-cloud overlay network"). More specifically, the overlay network can be deployed to support communications between different VPCs within the same public cloud network or different public cloud networks. However, for the purposes of clarity and illustration, the overlay network is described herein as a multi-cloud overlay network that supports communications between different networks (i.e., different VPCs located in different public cloud networks).

[0034] I. the term

[0035] In the following description, certain terms are used to describe features of the present invention. In some cases, each of the terms "computing device" or "logic" represents hardware, software, or a combination thereof configured to perform one or more functions. As hardware, a computing device (or logic) may include circuits with data processing, data routing, and / or storage functions. Examples of such circuits may include, but are not limited to, processing logic units (e.g., microprocessors, one or more processor cores, programmable gate arrays, microcontrollers, application specific integrated circuits, etc.); non-transitory storage media; circuits based on superconductors; combinational circuit elements that collectively perform a specific function or multiple functions; and the like.

[0036] Instead of the above-mentioned hardware circuit or in combination with the above-mentioned hardware circuit, the computing device (or logic) can be software in the form of one or more software modules. (One or more) software modules can be configured to operate as one or more software instances with selected functions (e.g., virtual processing logic unit, virtual router, etc.), virtual network devices with one or more virtual hardware components, or applications. Generally, (one or more) software modules may include but are not limited to executable applications, application programming interfaces (APIs), subroutines, functions, processes, small applications, small service programs, routines, source codes, shared libraries / dynamically loaded libraries, or one or more instructions. (One or more) software modules can be stored in any type of suitable non-transitory storage medium or temporary storage medium (e.g., electrical, optical, acoustic, or other forms of propagation signals, such as carrier waves, infrared signals, or digital signals). Examples of non-transitory storage media may include, but are not limited to, programmable circuits; superconductor or semiconductor memory; non-permanent storage devices, such as volatile memory (e.g., any type of random access memory "RAM"); or permanent storage devices, such as non-volatile memory (e.g., read-only memory "ROM", powered RAM, flash memory, phase change memory, etc.), solid-state drives, hard disk drives, optical disk drives, or portable memory devices.

[0037] One type of component may be a cloud component, i.e., a component operating as part of a public cloud network. The cloud component may be configured to control network traffic by limiting data propagation between cloud components of a multi-cloud network, such as, for example, cloud components of a multi-cloud overlay network or cloud components operating as part of a native cloud infrastructure of a public cloud network (hereinafter referred to as "native cloud components").

[0038] Processing logic unitA "processing logic unit" is generally defined as a physical or virtual component that performs one or more specific functions, such as data processing and / or assisting in the propagation of data across a network. Examples of processing logic units may include processor cores (virtual or physical), etc.

[0039] Controller A "controller" is generally defined as a component that provides and manages the operability of cloud components on a multi-cloud network (e.g., two or more public cloud networks), as well as the management of the operability of a virtual networking infrastructure. According to one embodiment, a controller may be a software instance created for a tenant to provide and manage a multi-cloud overlay network, which facilitates communication between different public cloud networks. The provision and management of a multi-cloud overlay network is performed to manage network traffic, including data transfer between components within different public cloud networks.

[0040] Tenants : Each "tenant" uniquely corresponds to a specific customer, such as a company, individual, partnership, or any group of entities (e.g., (one or more) individuals and / or (one or more) enterprises) that is provided access to a cloud or multi-cloud network.

[0041] Computing equipment A "computing device" is generally defined as a specific component or collection of components, such as (one or more) logical components with data processing, data routing and / or data storage functions. In this document, a computing device may include a software instance configured to perform functions such as a gateway (defined below).

[0042] Gateway A "gateway" is generally defined as a virtual or physical logic that has data monitoring and / or data routing functionality. As an illustrative example, a first type of gateway may correspond to virtual logic, such as a data routing software component, that is assigned an Internet Protocol (IP) address within an IP address range associated with a virtual networking infrastructure (VPC) that includes the gateway to handle routing of messages to and from the VPC. In this document, although the logical architecture is similar, the first type of gateway may be identified differently based on its location / operability in a public cloud network.

[0043] For example, a "branch" gateway is a gateway that supports routing network traffic between components residing in different VPCs, such as application instances requesting cloud-based services and VPCs that maintain cloud-based services available to multiple (two or more) tenants. A "transit" gateway is a gateway that is configured to further assist in the propagation of network traffic (e.g., one or more messages) between different VPCs, such as different branch gateways within different branch VPCs. Alternatively, in some embodiments, a gateway may correspond to a physical logic, such as a class of computing devices that support and are addressable (e.g., assigned a network address such as a private IP address).

[0044] Branch Subnet : A "branch subnet" corresponding to a type of subnet is a collection of components (i.e., one or more branch gateways) that are responsible for routing network traffic between components residing in different VPCs within the same or different public cloud networks, such as application instances in a first VPC and cloud-based services that may be available to multiple (two or more) tenants in a second VPC. For example, a "branch" gateway is a computing device (e.g., a software instance) that supports routing network traffic through an overlay network (e.g., a single-cloud overlay network or a multi-cloud overlay network) between two resources requesting a cloud-based service and maintaining a cloud-based service. Each branch gateway includes logic accessible to a gateway routing data store that identifies available routes for transmitting data between resources that may reside in different subnets (subnets). Types of resources can include application instances and / or virtual machine (VM) instances, such as compute engines, local data stores, and the like.

[0045] Transit VPC A "transit VPC" can generally be defined as a collection of components (i.e., one or more transit gateways) that are responsible for further facilitating the propagation of network traffic (e.g., one or more messages) between different VPCs (such as between different spoke gateways within different spoke subnets). Each transit gateway allows the connection of multiple geographically dispersed spoke subnets as part of the control plane and / or data plane.

[0046] interconnection An "interconnect" is generally defined as a physical or logical connection between two or more computing devices. For example, as a physical interconnect, the following forms of wired and / or wireless interconnects can be used: wires, optical fibers, cables, bus traces, or wireless channels using infrared, radio frequency (RF). For logical interconnects, a set of standards and protocols are followed to generate secure connections (e.g., tunnels or other logical connections) for routing messages between computing devices.

[0047] Computerization : This term and other notations generally indicate that any corresponding operation is performed by hardware in conjunction with software.

[0048] information : Information transmitted in a specified format and according to an appropriate transport protocol. Therefore, each message can be in the form of one or more packets (e.g., data plane packets, control plane packets, etc.), frames, or any other bit sequence with a specified format.

[0049] Finally, the terms "or" and "and / or" as used herein should be interpreted as inclusive or meaning any one or any combination. As an example, "A, B, or C" or "A, B, and / or C" means "any of the following: A; B; C; A and B; A and C; B and C; A, B, and C". An exception to this definition will only occur if a combination of elements, functions, steps, or actions are inherently mutually exclusive in some way.

[0050] As the invention is susceptible of embodiment in many different forms, it is intended that this disclosure be considered as an exemplification of the principles of the invention and is not intended to limit the invention to the specific embodiments shown and described.

[0051] II. First communication link architecture and communication scheme

[0052] refer to Figure 1A , illustrates an exemplary embodiment of an architecture and communication scheme utilized by a high performance communication link 100 that supports communication between computing devices 110 and 120. Each of the computing devices 110 and 120 includes a network interface 115 and 125, respectively. The network interfaces 115 and 125 are configured to transmit and / or receive data routed via the communication link 100, wherein each of the network interfaces 115 and 125 may constitute or at least include, for example, a network interface controller (NIC). Although not shown in FIG. 1 , each of the network interfaces 115 and 125 is configured with a number of queues (N, M), each queue being dedicated to a particular processing logic unit (PLU) 1401-1402, respectively. N and 1501-150 M .

[0053] According to one embodiment of the present disclosure, the communication link 100 is created as a collection of interconnects 130, the number of which may exceed the number of queues (N or M) between computing devices 110 and 120. R , where R ≥ M or N) is provided in processing logic units 1401-140 residing in different computing devices 110 and 120 N and / or 1501-150 MFor example, the first interconnect 1301 may provide communication between the first processing logic unit 1401 of the first computing device 110 and the second processing logic unit 1502 deployed in the second computing device 120 and their corresponding queues.

[0054] As an illustrative example, interconnections 1301-130 R Each of the interconnects 1301-130 R It may be presented to the processing logic unit as a virtual interface. As a result, the first computing device 110 communicates with the second computing device 120 as if the first computing device 110 was communicatively coupled to different servers rather than a single computing device.

[0055] Therefore, if Figure 1A-1B As shown in , the first computing device 110, when transmitting data traffic 160 (e.g., one or more messages referred to as “message(s)”) from the resource 170 over the communication link 100, transmits the message(s) 160 to a selected virtual interface that operates as a termination point for a selected interconnect (e.g., the first interconnect 1301). Prior to propagation over the first interconnect 1301, a network interface controller (NIC) 180 as part of the first network interface 115 may be configured to replace the actual port number within the meta-information 165 of the message(s) 160 with a logical port identifier (LP) prior to transmission over the high-performance communication link 100.

[0056] According to one embodiment of the present disclosure, the NIC 180 may be configured to hash one or more selected parameters of the message(s) 160 to generate a logical port identifier (LP) 195 to be included in the message(s) 160 as part of the meta-information 165. The message(s) 160 are then output from the first computing device 110 over the high-performance communication link 100 via the selected interconnect 1301. The meta-information 165 may be a 5-tuple header of the message 160, such as Figure 1B . The logical port identifier (LP) 195 may replace the destination port identifier 166 or the source port identifier 167. In this context, the destination port identifier 166 or the source port identifier 167 may constitute a logical (ephemeral) port number to be used when selecting a NIC queue and a processing logic unit 1501-150 associated with the second computing device 120. M One moment provides entropy.

[0057] Alternatively, according to another embodiment of the present disclosure, the NIC 180 may be configured to access a data store 175 characterized by a list of logical port identifiers along with the expected queues and / or processing logic units 1501 . . . or 150 M These logical port identifiers represent logical ports within a specified range of port numbers that are routed by the NIC 190 operating as part of the second network interface 125 to a particular processing logic unit 1501 ... or 1502 within the second computing device 120 when included as a destination port or source port within the meta information 165 of the message(s) 160 in transit. M In particular, the NIC 190 uses the logical (ephemeral) port identifier to determine the processing logic unit 150 i (1≤i≤M) to receive message(s) 160. The data store 175 may be populated by monitoring previous transmissions and updating the data store 175, or updating / uploading based on data learned from previous analysis.

[0058] As described herein, the use of logical ports (source or destination) may be used to select processing logic units 1501-1502 associated with the second computing device 120. M The hashing algorithm may be pre-tested to determine which logical ports will correspond to which NIC queues or provide communication paths to which NIC queues. As a result, logical ports may be pre-selected for subsequently directing data traffic to various processing logic units 1501-1502 at the second (destination) computing device 120. M Without such pre-testing, the number of IPSec tunnels may exceed the number of NIC queues and / or processing logic units 150 to allow interconnects 1301-130 R NIC queues to ensure that the appropriate interconnect is directed to each individual NIC queue.

[0059] Reference now Figure 2A , showing the deployment in Figure 1A Multiple (NIC) queues 2001-200 in the second computing device 120 M and processing logic units 1501-150 M 1. An exemplary embodiment of a NIC 190 for interacting. In this document, a NIC queue 200... or 200 M Each of which is dedicated to at least one processing logic unit 1501 ... or 150 deployed in the second computing device 120 M A similar architecture may be constructed for NIC 180, which operates to control processing logic units 1401-1402 from / to the first computing device 110.N In this article, the processing logic units 1401-140 N and / or 1501-150 M There may be a virtual processing logic unit that is configured to process data associated with its corresponding NIC queue.

[0060] refer to Figure 2B , shows an exemplary embodiment of logic 250 deployed within NIC 190, which performs operations on meta information 165, which is included as part of (one or more) messages 160 forming incoming data traffic, and is processed to determine the intended queue to receive the incoming data traffic. In this article, logic 250 is configured to identify correlations between results generated from operations on at least a portion of meta information 165 (including logical (ephemeral) source ports or logical (ephemeral) destination ports) to determine the queue targeted for receiving (one or more) messages. According to one embodiment of the present disclosure, as shown, logic 250 can be configured to use logical source or destination ports (or representations thereof, such as hash values ​​based on logical source or destination ports) as a lookup to determine the target queue for receiving data traffic. As another alternative embodiment, logic 250 can be configured to perform operations on a portion of meta information 165 (including logical (ephemeral) source ports or logical (ephemeral) destination ports) to generate a result that can be used as a lookup to determine the queue corresponding to the result (or a portion thereof).

[0061] According to an illustrative embodiment, the NIC 190 may be adapted to receive meta information 165 (which is part of the addressing information associated with the message(s) 160). The meta information 165 may include, but is not limited to, a destination network address 260, a destination port 166, a source network address 270, and / or a source port 167. The NIC 190 may be configured to perform a process where the results from the process may be used as a NIC queue 2001-2002 selected to receive the content of the message(s) 160. M NIC queues 2001-200 M As processing logic units 1501-150 M The only storage is operated.

[0062] Reference now Figure 3 , showing that by forming Figure 1A The high performance communication link 100 interconnects 1301-130 1616) message flow 300, wherein NIC queue allocation is based on a specific logical source network port. In this context, the first computing device 110 operating as a source computing device is responsible for selecting a processing logic unit 1501 ... or 150 M One of them is used to receive and transmit the content of the message(s) 160. Therefore, the first computing device 110 is configured for and is responsible for the selection and / or generation of a logical (ephemeral) source port.

[0063] As shown, processing logic units 1401-1402 associated with first computing device 110 N The first processing logic unit 1401 generates the message(s) 160, wherein the peer destination IP address (CIDR 10.2.0.1) is the IP address of the second computing device 120, and the peer source IP address (CIDR 10.1.0.1) is the IP address of the first computing device 110. Additionally, instead of the first computing device 110 using source port 4500 for transmission control protocol (TCP) transmission, the logical (ephemeral) source port 310 is used for the message(s) 160 from the first computing device 110. Using different logical source port identifiers (4501-4516) instead of the actual port number (4500) allows the NIC 190 to communicate across the interconnects 1301-130 R Transmitted data traffic 160 and different processing logic units 1501-150 M Use for load balancing operations.

[0064] As an illustrative example, Figure 3 As shown in , the (source) NIC 180 is configured to receive (one or more) messages 160 from the first processing logic unit 1401, wherein the meta-information 165 associated with the (one or more) messages 160 includes a peer destination IP address (CIDR 10.2.0.1) 320 and a peer source IP address (CIDR 10.1.0.1) 330. In this document, the destination port 340 and the source port 350 are identified by the actual destination port (e.g., port 4500). In order to provide scaling for communications that allow transmissions in excess of 1 Gigabit per second (Gbps) found in traditional IPSec communication links, the NIC 180 utilizes the target direction of the data traffic to be directed toward different processing logic units 1501-1500 of the second (destination) computing device 120 by assigning a logical source port identifier (4501...4516) to the meta-information 165 of each of the (one or more) messages 160 that form the data traffic. M The logical source port identifier, when analyzed by NIC 190, causes the message(s) to be redirected to the corresponding processing logic unit 1501-150M Specific NIC queues 2001-200 M As shown, logical source port identifier 4501 may direct workload to first processing logic unit 1501, while logical source port identifier 4503 may direct workload to second processing logic unit 1502, etc. In summary, utilizing "R" IPSec tunnels (e.g., R=16) through dynamic logical source port selection allows for increased data throughput.

[0065] refer to Figure 4 , showing that by forming Figure 1A The high performance communication link 100 interconnects 1301-130 R 1. The second exemplary embodiment of a message flow 400 in which the NIC queue assignment is based on the generation of different logical destination ports. In this context, the NIC 180 of the first computing device 110 does not perform any operations on the peer destination IP address (CIDR 10.2.0.1) 320, peer source IP address (CIDR 10.1.0.1) 330, and source port 350 of the message(s) 160 forwarded to the second computing device 150. However, the destination port 340 may be changed, wherein the change affects the destination of the message(s) 160 to the specific processing logic unit 1501-1502. M The NIC 190 deployed at the second computing device 120 is responsible for directing the message(s) 160 to the first NIC queue 2001 based on the detection of the first logical destination port identifier (4501) for processing by the first processing logic unit 1501 of the second computing device 120. Similarly, the NIC 190 is responsible for directing the message(s) 160 to the other NIC queues 2002-2003 based on the assigned logical destination port identifiers (4502-4516, where "M" = 16). M The use of logical (ephemeral) port identifiers is handled on the receive side for redirecting data traffic to saturate the NIC queues, thereby increasing the throughput of the communication link 100 .

[0066] III. Second communication link architecture and communication scheme

[0067] refer to Figure 5 , showing as perceived by computing devices 110 and 120 Figure 1A 1. The present invention provides an exemplary logical representation of a second embodiment of an architecture and communication scheme utilized by a high-performance communication link 100 of FIG. 1. Herein, source network address translation (NAT) logic 500 and destination NAT logic 510 together support the distribution of data traffic 160 (e.g., (one or more) messages) across the high-performance communication link 100 to multiple processing logic units 1501-150 MMore specifically, from a logical perspective, the source NAT logic 500 operates so that each source processing logic unit 1401-140 N The 500 devices sense that they are connecting to computing devices, each of which is associated with a different, ephemeral destination IP address 520. These destination IP addresses 520 are represented by CIDR 100.64.0.x, where the least significant octet (x) represents the address used to select the processing logic unit 1501-150 M A unique number used in one of the .

[0068] like Figure 5 As shown in FIG. 1 , the first computing device 110 associated with the first source network address 530 (e.g., CIDR 10.1.0.1) and the “4500” destination network port identifier 535 perceives that the data traffic 160 is directed to the destination IP address range (e.g., CIDR 100.64.0.x) 540, where the least significant octet (x) represents the address used to identify the processing logic units 1501-150 M A unique number used in one of the .

[0069] More specifically, if Figure 6 As shown in Figure 5 1. An exemplary embodiment of the operability of source NAT logic 500 of a first (source) computing device 110 of a first high-performance communication link 100. In this article, source NAT logic 500 operates as a process within a NIC or a process separate from the NIC. In order to handle outgoing data traffic, source NAT logic 500 can be configured with access to one or more data stores to perform a conversion of a <100.64.0.X> ephemeral destination IP address 540 to a peer IP address 550 (e.g., CIDR 10.2.0.1), and peer IP address 550 has a logical destination port equivalent to an actual port (e.g., 4500), which is adjusted based on the least significant octet x. For example, a destination IP address 10.64.0.3 and a destination port identified as "4500" can be converted to a peer IP address 10.2.0.1 with a destination port identifier "4503". This conversion can be used as a means for replacing an actual destination port "4500" with a logical destination port identifier "4503".

[0070] like Figure 7 As shown in FIG. 1 , it is shown that the second (destination) computing device 120 is deployed and supported as part of the second (destination) computing device 120. Figure 5100. Herein, to handle incoming data traffic 700, the destination NAT logic 510 may be configured with access to one or more data stores 760 and 770 that are configured to maintain (i) a first mapping 710 between peer IP address / logical port combinations 720 and their corresponding ephemeral network address / real port combinations 730, and (ii) a second mapping 715 between an ephemeral destination IP address / real port combination 740 and a destination peer IP address / real port combination 750. Additionally, although not shown, to handle outgoing data traffic 700, the destination NAT logic 510 may be configured with access to mappings between logical ports and their specific processing logic units (or NIC queues at the destination). Although there are multiple interconnects 1301-130 R (e.g., IPSec tunnel, R=16), the address translation scheme also allows communications over the high-performance communications link 100 to rely on a single IP address assigned to the destination computing device 120, where the actual source port and / or destination port identifiers are replaced by logical source port identifiers and / or logical destination port identifiers to assist in the selection of processing logic units at the destination computing device 120.

[0071] IV. Overlay network with high-performance communication links

[0072] Reference Figure 8 , an exemplary embodiment of an overlay network 800 deployed as part of a multi-cloud network including high-performance communication links between one or more branch gateways and transit gateways is shown. Herein, a first public cloud network 810 and a second public cloud network 815 are coupled together via the overlay network 800. The overlay network 800 allows and supports communications within different public cloud networks 810 and 815 associated with the multi-cloud network 830.

[0073] According to one embodiment of the present disclosure, the overlay network 800 is configured to provide connections between resources 835, which may constitute one or more virtual machines (VM instances), one or more application instances, or other software instances. The resources 835 are separated from the overlay network 800. The overlay network 800 may be adapted to include at least a first branch gateway VPC 840, a first transit gateway VPC 850, a second transit gateway VPC 860, and at least a second branch gateway VPC 870. The second transit gateway VPC 860 and the second branch gateway VPC 870 may be located in the second public cloud network 815 for communicating with local resources 880 (e.g., software instances).

[0074] For redundancy purposes, two or more branch gateways 842 can be associated with a first branch gateway VPC 843, and multiple branch gateways 845 can be associated with another branch gateway VPC 846. Branch gateways 842 and 845 are commonly coupled to transit gateway 855 via a first high-performance communication link 890. In particular, each branch gateway can correspond to Figure 1A The first computing device 110, and the transit gateway 855 may correspond to Figure 1A 890 , 892 , and 894 , which are interconnected to a second computing device 120. Herein, the first transit gateway 855 is commonly coupled to a transit gateway 865 of a second transit gateway VPC 860 via a second high-performance communication link 892. Similarly, a third high-performance communication link 894 is commonly coupled to (one or more) branch gateway VPCs 870. The high-performance communication links 890, 892, and 894 operate in a manner similar to multiple interconnects that provide dedicated communications with NIC queues and their corresponding processing logic units responsible for processing data stored in the NIC queues.

[0075] refer to Fig. 9A , showing Figure 8 An exemplary embodiment of the operability of the first high performance communication link 890 as Figure 8 A portion of the overlay network 800 is deployed between a first computing device operating as a first branch gateway 842 and a second computing device operating as a first transit gateway 855. In this document, a first high-performance communication link 890 is configured to provide multiple interconnections to corresponding processing logic units assigned to the branch gateway 842 and the transit gateway 855.

[0076] In addition, the transit gateway is characterized by a second set of processing logic units and corresponding NIC queues (not shown) to communicate with the second transit gateway 865 via a high-performance communication link 892, such as Fig. 9B The configuration of transit gateway 855 relies on a set of processing logic units to support each individual high performance communication link 890 and 892.

[0077] Without departing from the spirit of the present disclosure, embodiments of the present invention may be embodied in other specific forms. The described embodiments should be considered in all respects only as illustrative and not restrictive. Therefore, the scope of the embodiments is indicated by the appended claims rather than by the preceding description. All changes falling within the meaning and scope of the equivalents of the claims should be included within their scope.

Claims

1. A high performance communication link connecting a first computing device and a second computing device, the communication link comprising a plurality of interconnections between the first computing device and the second computing device, wherein the plurality of interconnections are configured according to a secure network protocol that transmits data through different port tunnels to achieve increased aggregate throughput.

2. The high performance communications link of claim 1, wherein the first computing device and the second computing device each comprise at least one network interface, and further wherein the at least one network interface comprises at least one network interface controller.

3. The high performance communication link of claim 2, wherein at least one network interface of the first computing device and the second computing device is configured with a plurality of queues.

4. A high performance communications link according to claim 3, wherein the number of interconnections exceeds the number of queues between the first computing device and the second computing device.

5. The high performance communications link of claim 2, wherein at least one network interface controller of the second computing unit is configured to receive data traffic addressed by a destination IP address assigned to the second computing device.

6. The high performance communications link of claim 1, wherein the first computing device transmits data traffic from the resource to the selected virtual interface, the selected virtual interface operating as a termination point for the selected interconnect.

7. The high performance communication link of claim 2, wherein at least one network interface controller of the first computing device is configured to replace an actual port number within the meta-information of the data with a logical port identifier.

8. A high performance communication link according to claim 7, wherein the meta information is a 5-tuple header.

9. A high performance communications link according to claim 2, wherein at least one network interface controller of the first computing device is configured to access a data store characterized by a list of logical port identifiers together with expected queues and / or processing logic units.

10. The high performance communications link of claim 9, wherein the logical port identifier represents a logical port within a specified range of port numbers that is routed by at least one network interface controller of the second computing device to a processing logic unit within the second computing device.

11. The high performance communications link of claim 2, wherein at least one network interface controller of the second computing device interacts with a plurality of queues and processing logic units deployed within the second computing device.

12. A high performance communications link according to claim 2, wherein at least one network interface controller of the second computing device deploys a logic that operates on metadata included as part of the incoming data traffic and is processed to determine an expected queue to receive the incoming data traffic.

13. A high performance communication link according to claim 12, wherein the meta-information is selected from a destination network address, a destination port, a source network address or a source port.

14. The high performance communications link of claim 12, wherein the logic is configured to identify correlations between results resulting from operations performed on at least a portion of the meta-information.

15. The high performance communications link of claim 12, wherein the logic is configured to utilize a logical source or destination port as a lookup to determine a target queue for receiving data traffic.

16. The high performance communications link of claim 12, wherein the logic is configured to perform an operation on a portion of the meta-information to generate a result that can be used as a lookup to determine a queue corresponding to the result.

17. The high performance communications link of claim 1, wherein the first computing device operates as a source computing device and is responsible for selecting a processing logic unit for receiving and transmitting data.

18. A high-performance communications link according to claim 1, wherein the first computing device includes source network address translation logic and the second computing device includes destination network address translation logic, and further wherein the source network address translation logic and the destination network translation logic jointly support the distribution of data traffic across the high-performance communications link.

19. A high performance communications link according to claim 18, wherein the source network address translation logic operates such that each source processing logic unit perceives that they are connecting to a computing device, each computing device being associated with a different, ephemeral destination IP address.

20. A high-performance communications link according to claim 18, wherein the destination network address translation logic is configured with access to one or more data stores, wherein the one or more data stores are configured to maintain (i) a first mapping between peer IP address / logical port combinations and their corresponding ephemeral network address / real port combinations, and (ii) a second mapping between ephemeral destination IP address / real port combinations and destination peer IP address / real port combinations.

Images