Prioritization of data packets in multiplexed sessions

Abstract

A method of defining priorities of a number of data packets within a queue includes generating a policy. The policy defines a first multiplex channel of a plurality of multiplex channels. The first multiplex channel has a first priority. The policy also defines a second multiplex channel of the plurality of multiplex channels. The second multiplex channel has a second priority. The first priority is defined as a higher priority relative to the second priority. The method also includes receiving the number of data packets through the plurality of multiplex channels associated with a session based at least in part on the policy.

Description

[0001] Related applications

[0002] This patent application claims priority to U.S. Patent Application No. 17 / 357,461, filed June 24, 2021, entitled “Data Packet Prioritization in Multiplexed Sessions.” The entire contents of the aforementioned application are hereby incorporated by reference. Technical Field

[0003] This disclosure generally relates to the transmission of data packets. More specifically, this disclosure relates to systems and methods for determining the priority of data packets before performing decryption and / or encryption processes. Background Technology

[0004] Computer networks are used to transfer data from one computing device to another for various reasons. Head-of-line (HOL) congestion in computer networking is a performance-limiting phenomenon that occurs when a queue of packets forms and gets stuck because of the first data packet in the queue. HOL congestion can occur, for example, in input-buffered network switches where out-of-order delivery of packets may happen, and when multiple requests are piped using the Hypertext Transfer Protocol (HTTP). In addition to reordering, HOL congestion can also be caused by a large number of low-priority packets in the same queue being ahead of high-priority packets. Such switches may consist of input-buffered ports, output-buffered ports, and switching structures. When using a first-in, first-out (FIFO) input buffer, only the first received packet is prepared for forwarding. If the first packet cannot be forwarded, all subsequent received packets are not forwarded, resulting in HOL congestion. Attached Figure Description

[0005] The following detailed description will be provided with reference to the accompanying drawings. In the drawings, the leftmost digit(s) of the reference numeral(s) identifies the drawing in which that numeral(s) first appears. The same reference numerals are used in different drawings to indicate similar or identical items. The systems depicted in the drawings are not to scale, and the components within the drawings may not be depicted to scale relative to each other.

[0006] Figure 1 The diagram illustrates the system architecture of an example network based on the principles described herein, which utilizes several cryptographic channels, including several high-priority channels and low-priority channels.

[0007] Figure 2The diagram illustrates a sample component of a client device based on the principles described herein.

[0008] Figure 3 The diagram illustrates a sample component of a server based on the principles described in this article.

[0009] Figure 4 The illustration shows a schematic diagram of an example M / M / 1 queuing model based on the principles described herein.

[0010] Figure 5 The diagram illustrates an example method for defining the priority of several data packets within a queue, based on the principles described in this article.

[0011] Figure 6 The diagram illustrates an example method for defining the priority of several data packets within a queue, based on the principles described in this article.

[0012] Figure 7 The diagram illustrates a computing system configuration of a data center that can be used to implement various aspects of the techniques disclosed herein.

[0013] Figure 8 The diagram illustrates a computer architecture, showing an example computer hardware architecture for implementing computing devices that can be used to realize various aspects of the technologies proposed in this paper. Detailed Implementation

[0014] HOL congestion in computer networking can limit the performance of computing devices within the network. Any system that incorporates and utilizes queues will limit performance, and mixing data packets with different priorities in a single queue can lead to HOL congestion. Without HOL congestion, arriving data packets have the opportunity to bypass the blocked packets and be forwarded, thus processing data packets out of order. Several different mechanisms can be employed to reorder packets. Protocols that multiplex data into a single encrypted channel or tunnel can include, for example, the QUIC universal transport layer network protocol (e.g., HTTP / 2 and / or HTTP / 3), datagram transport layer security (DTLS) communication protocols, virtual private network (VPN) protocols, Internet protocol security (IPsec) VPN protocols, and protocols associated with software-defined networking (SDN) in a wide area network (WAN), such as SD-WAN service VPNs. These protocols can address the HOL congestion problem through cryptographic techniques (e.g., encryption and / or decryption). These protocols can decrypt received data packets and / or payloads. This offers significant advantages compared to protocols based on transport layer security (TLS), such as HTTP and Secure Sockets Layer (SSL) / TLS VPN. Furthermore, HOL blocking of higher-priority packets may be a result of multiplexing multiple data streams of different priorities; therefore, lower-priority data packets may be processed before higher-priority data packets.

[0015] However, none of the aforementioned protocols completely solves the HOL (High-Order Blocking) problem regarding the payload and / or the rest of the packet processing path because these protocols require decryption to be performed first. In other words, these protocols have a problem that packets must be decrypted first to examine their internal fields in order to determine whether the packet contains data of a high- or low-priority nature. While packet-level schemes such as Quality of Service (QoS) marking can be used, QoS marking may not be adhered to end-to-end within the network and may often be lost during data packet transmission and processing. The decryption priority issue leads to wasted central processing unit (CPU) cycles in making traffic prioritization decisions, which become critical when attempting to schedule and coordinate cloud workloads that require decryption and routing of traffic with different priority orders (e.g., network traffic associated with video conferencing instances or sessions and network traffic associated with web browsing). Furthermore, decryption is not possible in the case of end-to-end encryption.

[0016] Overview

[0017] The independent claims describe various aspects of the invention, and the dependent claims describe preferred features. A feature of one aspect may be applied individually to each aspect or in combination with other aspects.

[0018] In the examples described herein, the methods, systems, and computer program products provide a way to determine packet priority before performing decryption and / or encryption processes. These methods, systems, and computer program products utilize one or more low-priority and high-priority encrypted channels or tunnels associated with each logical VPN or HTTP / 2 or HTTP / 3 (e.g., QUIC or multiplexed application substrate over QUIC encryption, MASQUE).

[0019] The examples described herein provide a non-transitory computer-readable medium storing instructions that, when executed, cause a processor to perform operations. The operations include receiving several data packets from multiple client devices via multiple multiplexed channels associated with a session. The multiple multiplexed channels include a first multiplexed channel having a first priority and a second multiplexed channel having a second priority. The first multiplexed channel is designated to have a higher priority than the second multiplexed channel. The operations also include processing several data packets transmitted via the first multiplexed channel, at least in part based on a policy, prior to processing several data packets transmitted via the second multiplexed channel.

[0020] In one example, the policy defines that m high-priority packets transmitted via the first multiplexing channel should be processed before n low-priority packets transmitted via the second multiplexing channel. In another example, the policy defines that m bytes of high-priority packets transmitted via the first multiplexing channel should be processed before n bytes of low-priority packets transmitted via the second multiplexing channel. In yet another example, a session may include multiple sessions, and the policy may define that the first session among the multiple sessions takes precedence over the second session among the multiple sessions.

[0021] The operation also includes policy-based execution of cryptographic processes. These processes may include decrypting, decapsulating, forwarding, and combinations thereof, of several data packets.

[0022] The operation also includes adding several data packets transmitted through multiple multiplexed channels to a queue, and processing the several data packets in the queue at least in part based on a policy.

[0023] The examples described herein also provide a system including a processor and a non-transitory computer-readable medium storing instructions that, when executed by the processor, cause the processor to perform operations. These operations include a generation policy. The policy defines a first multiplexed channel among a plurality of multiplexed channels. The first multiplexed channel includes a first priority. The policy also defines a second multiplexed channel among the plurality of multiplexed channels. The second multiplexed channel includes a second priority. The first priority is defined as a higher priority relative to the second priority. The operations also include receiving several data packets through the plurality of multiplexed channels associated with a session, and processing several data packets transmitted via the first multiplexed channel, at least in part based on the policy, before processing several data packets transmitted via the second multiplexed channel.

[0024] Several data packets are routed on a first multiplexing channel and a second multiplexing channel, at least partially based on a policy. The operation also includes performing a cryptographic process based on the policy. The cryptographic process includes encrypting the data packets, decrypting the data packets, decapsulating, forwarding, and combinations thereof.

[0025] The operation also includes adding several data packets transmitted via multiple multiplexed channels to a queue, and processing the data packets in the queue at least in part based on a policy. The policy defines that m high-priority packets transmitted via the first multiplexed channel should be processed before n low-priority packets transmitted via the second multiplexed channel. The policy also defines that m bytes of high-priority packets transmitted via the first multiplexed channel should be processed before n bytes of low-priority packets transmitted via the second multiplexed channel. A session comprises multiple sessions, and the policy defines that the first session among the multiple sessions takes precedence over the second session among the multiple sessions. The first session is associated with a live session transmitting data in real time, and the second session is associated with a non-live session transmitting data in a non-live instance.

[0026] The example described herein also provides a method for defining the priority of several data packets within a queue. The method includes generating a policy. The policy defines a first multiplexed channel among multiple multiplexed channels. The first multiplexed channel has a first priority. The policy also defines a second multiplexed channel among multiple multiplexed channels. The second multiplexed channel has a second priority. The first priority is defined as a higher priority relative to the second priority. The method also includes receiving several data packets through multiple multiplexed channels associated with a session, at least in part based on the policy.

[0027] The method also includes, at least partially based on a policy, processing several data packets transmitted via the first multiplexing channel before processing several data packets transmitted via the second multiplexing channel. The method further includes, at least partially based on a policy, routing several data packets on the first and second multiplexing channels.

[0028] The method also includes performing cryptographic processes based on a policy. These cryptographic processes include encrypting, decrypting, decapsulating, forwarding, and combinations thereof, of several data packets. The method also includes adding several data packets transmitted over multiple multiplexed channels to a queue and processing the data packets in the queue at least partially based on a policy. A session comprises multiple sessions. A policy defines that a first session among the multiple sessions takes precedence over a second session among the multiple sessions. The first session is associated with a live session transmitting data in real time, and the second session is associated with a non-live session transmitting data in a non-live instance.

[0029] Furthermore, the techniques described in this disclosure can be executed as methods and / or performed by a system having a non-transitory computer-readable medium storing computer-executable instructions that, when executed by one or more processors, perform the techniques described above.

[0030] Example Implementation

[0031] In traditional systems, cryptographic processing, including the encryption and decryption of data packets and / or their payloads, can be performed during data transmission operations. However, cryptographic processing is relatively computationally expensive because it utilizes central processing unit (CPU) bandwidth. This utilization of CPU bandwidth for cryptographic processing can exacerbate the aforementioned HOL congestion due to its computational cost. These encryption / decryption priority issues can be further amplified on server computing devices, as these devices will receive multiple sessions (e.g., n sessions, where n is any integer greater than or equal to 2) with mixed traffic types in terms of priority or importance (e.g., low-priority and high-priority traffic) and multiplexed into a single encrypted channel (e.g., a tunnel including encapsulated protocol data units (PDUs)). For example, a server computing device might need to use m CPU cores (where m is any integer greater than or equal to 1) to decrypt data packets from n HTTP / 2 sessions, only to find that the internal data of one of these packets has lower priority than an HTTP / 2 packet from another session in the same queue that will be cryptographically processed by the same m CPU cores. Note that m CPU cores are generally several orders of magnitude smaller than n HTTP / 2 sessions. In other words, the service rate of a CPU core may be less than the arrival rate of data packets in some cases, thus creating queues. Other channels(s) or data streams(s) may need to be de-prioritized and delayed. As mentioned above, these relatively high-priority channels(s) or data streams(s) may be real-time traffic, such as video conferencing instances or sessions.

[0032] As mentioned above, multiplexing in computer networking is the process of combining multiple signals into a single signal through a shared medium. An unintended consequence of the types of multiplexing that may exist in virtual private network (VPN) tunneling is that the same traffic shaping algorithm is applied to every flow. In other words, since no session or instance is processed with a relatively higher priority than another session or instance, all priority ordering is lost. As mentioned above, even when accelerated via CPU, cryptography can be the most computationally expensive operation; therefore, encrypting / decrypting data packets and / or their payloads to determine whether the traffic has a lower priority than another session may be suboptimal due to packet processing latency. This is true even if there is a one-to-one mapping between the encrypted channel or tunnel and the destination where multiplexing does not occur. This system and method decrypt and / or encrypt data packets, but decryption and / or encryption of high-priority data packets precede low-priority data packets. This allows data packets to be forwarded according to a defined policy.

[0033] This problem becomes apparent in real-world scenarios, such as VPN termination at the server, where many different types of traffic are multiplexed into a single encrypted VPN channel associated with that VPN session. For example, an x-VPN session (where x is any integer greater than or equal to 2) might be multiplexed with both the Outlook email application developed and published by Microsoft and the WebEx video conferencing application developed and published by Cisco Systems, based on a "full tunnel" traffic policy. In cases where a large number of concurrent sessions each include such multiplexing examples of Outlook and WebEx, the problem is amplified at the server computing device side. In general-purpose computing environments, shared CPU cores can also be used to perform other processing, such as decapsulation and forwarding, among other types of data processing.

[0034] Furthermore, in the worst-case scenario, an HTTP / 2 stream might be multiplexed onto another HTTP / 2 / 3 stream or a VPN tunnel. In fact, this scenario is not uncommon in secure internet gateway (SIG) implementations, where external streams that multiplex multiple HTTP / 2 streams with different priorities also affect the internal multiplexed streams in terms of priority and latency.

[0035] In view of this, the system and method provide a solution in which, by utilizing the concept of multiplexing priority channels (e.g., high priority channels) and multiplexing non-priority channels (e.g., low priority channels) associated with each session, priority and non-priority traffic can be sent in separate cryptographic channels or tunnels for QUIC (HTTP / 2), DTLS VPN, IPsec VPN, or SD-WAN service VPN.

[0036] Now turn to the attached image. Figure 1Figure 100 illustrates the system architecture of an example network 106 based on the principles described herein, which utilizes several cryptographic channels, including several high-priority (HP) channels and low-priority (LP) channels. The HP and LP channels described herein are logical channels, meaning that HP and LP channels can be transmitted together over the same network connection or over separate network connections. For example, a single network connection can be provided for both HP and LP channels, meaning that both HP and LP channels can be transmitted over the same network connection. In contrast, in one example, two separate network connections can be provided for HP and LP channels respectively. In the example described herein, each data packet may include an unencrypted generic routing encapsulation (GRE), generic user datagram protocol (UDP) encapsulation (GUE), generic network virtualization encapsulation (GENEVE), or other encapsulation header to indicate which channel the data packet is associated with. For both high-priority and low-priority channels, the tuples in the data packets can be the same.

[0037] Figure 1The system architecture diagram 100 may include several client devices 102-1, 102-2, 102-p, where p is any integer greater than or equal to 1 (collectively referred to as "(one or more) client devices 102"). As used herein and in the appended claims, the term "high priority (HP) channel" or similar language may be broadly defined as any channel within a multiplexed signal that has a relatively higher priority than several other channels. Similarly, as used herein and in the appended claims, the term "low priority (LP) channel" or similar language may be broadly defined as any channel within a multiplexed signal that has a relatively lower priority than several other channels. In other words, an HP channel may be a priority channel for transmitting priority data packets, while an LP channel may be a non-priority channel for transmitting non-priority data packets. Although two different multiplexed channels with relatively different priorities are described herein, multiplexed channels may include any number of channels with different priority levels. Additionally, in one example, each multiplexed channel may include multiple HP channels and / or LP channels. Increasing the number of HP channels, LP channels, and / or intermediate priority channels can be based on several factors, including, for example, processing resources within client device 102 and / or (one or more) servers 104 (e.g., the number of central processing unit (CPU) cores available for data processing), algorithmic constraints, other factors, and combinations thereof.

[0038] Client device 102 may be communicatively coupled to several servers 104 via network 106. Network 106 may include any number of intermediary or intermediary computing devices capable of transmitting data between client device 102 and one or more servers 104, such as relays, repeaters, routers, switches, encoder / receiver / transmitter (ERT), electrical appliances, personal computers (e.g., desktop computers, laptop computers, etc.), mobile devices (e.g., smartphones, tablets, personal digital assistants (PDAs), e-reader devices, etc.), wearable computers (e.g., smartwatches, optical head-mounted displays (OHMDs), etc.), servers, and access points, and gateway computing devices, etc.

[0039] Furthermore, although client device 102 is described herein as an endpoint communicating with several servers 104, client device 102 can take the form of any computing device capable of sending data packets to one or more servers 104. As shown in the description provided herein, one or more servers 104 are described as receiving data packets from multiple computing devices (e.g., client device 102), and the task of one or more servers 104 is to process data packets based on the priority (e.g., high priority and low priority) of data packets within a queue. Additionally, both client device 102 and one or more servers 104 are described herein as capable of processing both high-priority and low-priority data packets within a queue. However, since one or more servers 104 receive data packets from several sources (e.g., client device 102), but each individual client device 102 receives data packets from a single source (e.g., one or more servers 104), the practicality and economy of this system and method can be best understood from the perspective of one or more servers 104 and their ability to process data packets. In one example, client device 102 can be any device described herein, including, for example, another server device. It should be noted that client device 102 will also benefit from the proper handling of different priority streams as described herein, especially over high-latency connections between client device 102 and the terminating server device.

[0040] One or more servers 104 may include any number of computing devices for processing data sent from client device 102. One or more servers 104 may include any combination of computer hardware and software that provide the functions described herein, such as generating policies, routing data packets over multiple individual channels, adding data packets to queues, processing data packets in queues based on policies, and / or performing cryptographic processes based on policies. One or more servers 104 may provide various functions and services, such as sharing data and computing resources among client devices 102, and / or performing computations for client devices 102.

[0041] In one example, server(s) 104 may include a Virtual Private Network (VPN) device that acts as an intermediary device that forwards data packets to a destination device (not shown). In this example, server(s) 104 may process data packets according to the methods described herein.

[0042] Client devices 102 may each utilize multiple servers 104. One or more servers 104 may include web servers, media servers, database servers, file servers, mail servers, print servers, game servers, virtual servers, proxy servers (e.g., QUIC proxy servers), computing servers, communication servers, application servers, several private hosting servers, several enterprise hosting servers, and cloud networks of servers, as well as a wide range of other types of servers 104 and their associated functions and services. In one example, the functions and services of one or more servers 104 may be provided as cloud-based network infrastructure and services. In this example, one or more servers 104 may be provided as on-demand computer system resources, such as data storage, DNS services, and / or computing power, without direct active management by the user and / or administrator of client device 102. In one example, one or more cloud-based servers 104 may include private or enterprise clouds provided to an organization (e.g., an administrator's organization), and / or may include public clouds. In one example, the functions and services of server(s)104 may include email service, video conferencing service, streaming media service, content filtering service, secure web gateway service, firewall service, data processing service, and data storage service, as well as other services. Furthermore, the functions described in this article can appear as on-demand availability of computer system resources (e.g., communications platform as a service (CPaaa), content as a service (CaaS), infrastructure as a service (IaaS), hardware as a service (HaaS), Internet of Things as a Service (IoTaaS), load balancing as a service (LBaaS), media processing as a service (MPaaS), network as a service (NaaS), platform as a service (PaaS), function as a service (FaaS), software as a service (SaaS), anything as a service (XaaS), etc.), including data storage (cloud storage) and computing power.

[0043] Client device 102 can communicate with one or more servers 104 to transmit several data packets between client device 102 and one or more servers 104. The data packets can represent data with different priorities based on several policies defined by client device 102 and / or one or more servers 104. Additionally, in one example, the priorities described herein can also be defined based on the type of application(s) executed on client device 102 and / or one or more servers 104 and the network bandwidth required by such application(s). In the example described herein, client device 102 and one or more servers 104 can utilize multiple multiplexed channels and predetermine which data packets will be transmitted via several HP channels and which data packets will be transmitted via several LP channels before contacting the data packets in several queues to perform any cryptographic processing.

[0044] Therefore, as Figure 1 As shown, data packets can be multiplexed via several HP channels 108-1, 108-2, 108-r (where r is any integer greater than or equal to 1) (collectively referred to as "(one or more) HP channels 108") and several LP channels 110-1, 110-2, 110-s (where s is any integer greater than or equal to 1) (collectively referred to as "(one or more) LP channels 110"). Multiple HP channels 108 and multiple LP channels 110 can exist, but the examples in this paper utilize a single HP channel 108 and a single LP channel 110. In one example, the number of HP channels 108 and LP channels 110 can be more than one. Additionally, in another example, the number of HP channels 108 and LP channels 110 can be different.

[0045] HP channel 108 and LP channel 110 may be part of a pair of channels forming multiplexed communication channels 112-1, 112-2, 112-t, where t is any integer greater than or equal to 1 (collectively referred to as "multiplexed communication channel 112"). Multiplexed communication channel 112 can carry its respective HP channel 108 and LP channel 110 via the same signal and / or via the same medium (e.g., a physical communication line). Thus, HP channel 108 and LP channel 110 are multiplexed on their respective multiplexed communication channels 112.

[0046] In one example, data packets transmitted between client device 102 and server 104 may be assigned to HP channel 108 or LP channel 110 based on several policies that define which data packets will be assigned HP or LP. Alternatively, in one example, data packets may be labeled or identified as HP or LP based on, for example, identifiers contained within the data packet. In one example, a data packet may include HP or LP identifiers in the form of: a Type of Service (ToS) byte that may be included as a second byte in the header of the data packet (e.g., the IPv4 header), several QoS tags or identifiers associated with or identified within the data packet, and other data packet labeling or identification methods.

[0047] Additionally, policies defining whether data packets are transmitted via the HP channel 108 or LP channel 110 of the multiplexed communication channel 112 can be created by the administrator of client device 102, one or more servers 104, the entire system depicted in system architecture diagram 100, and combinations thereof. These policies can be distributed to client device 102 and one or more servers 104 so that these devices operate according to the processes described herein and the policies created.

[0048] Additionally, the prioritization of data packets between HP channel 108 and LP channel 110 can be based on any number of preferences, policies, service-level agreements (SLAs), etc. For example, prioritization of data packets between HP channel 108 and LP channel 110 may include ensuring that all HP data packets transmitted through HP channel 108 and in the queue of a device (e.g., client device 102 or (one or more) servers 104) are processed within a given time frame, and x LP data packets are processed. Further prioritization can be assigned to data packets associated with, for example, real-time communications, such as video conferencing instances (e.g., the Webex teleconferencing system developed and distributed by Cisco Systems), where these data packets may be assigned high priority within one or more policies, while data packets associated with media streaming services (e.g., the Netflix media streaming service developed and distributed by Netflix), email services (e.g., the Outlook email application developed and distributed by Microsoft), and web traffic (e.g., web downloads) may be assigned low priority. In these examples, data packets associated with real-time communication may be transmitted via HP channel 108, while data packets associated with media streaming (e.g., Netflix), email services (e.g., Microsoft Outlook mail server), or web traffic (e.g., web downloads) may be transmitted via LP channel 110.

[0049] In one example, one or more strategies utilized by client device 102 and / or (one or more) servers 104 may be defined based on different numbers of HP data packets and LP data packets, such that b HP packets in the queue (e.g., b = 10) are processed before c LP packets in the queue (e.g., c = 1) are processed. Thus, HP data packets are processed with their due priority, but LP data packets will still be processed at some point.

[0050] Additionally, in one example, one or more policies utilized by client device 102 and / or (one or more) servers 104 can be defined by the number of bytes allocated to HP data packets and LP data packets. In this example, the interface at the server may include a gigabit interface capable of processing gigabit data per second within a given time period. A policy can be defined such that 100 megabits (MB) (e.g., 100 Mbps) within that time period are utilized for LP data packets in the queue, and the remaining 900 MB (e.g., 900 Mbps) within that time period are utilized for HP data packet processing. Thus, essentially 90% of the network bandwidth is utilized for receiving HP data packets in the queue via HP channel 108, and 10% is utilized for receiving LP data packets in the queue via LP channel 110.

[0051] Furthermore, one or more strategies may include prioritizing a session of one client device 102 over a session of another client device 102 for any number of reasons. For example, client device 102-1 may be utilized by an administrator who is given higher priority than all other client devices 102 in the system. In this example, when receiving transmissions from multiple client devices 102, data packets sent by client device 102-1 via, for example, HP channel 108 may be queued in a common queue utilized by one or more servers 104.

[0052] Furthermore, in one example, client device 102 and / or (one or more) servers 104 may include sufficient processing resources to handle all HP data packets received via HP channel 108 and all LP data packets received via LP channel 110. In this example, the queue can actually be zero (0), and devices within the system (e.g., client device 102 and (one or more) servers 104) are capable of processing data packets in the queue without dropping any packets. In this example, since all data packets are processed promptly, a strategy for prioritizing data packets may not be triggered. However, in this example, a relatively larger number of data packets can be transmitted via HP channel 108 and LP channel 110 based on the priority ordering described herein, thereby queuing the data packets. When a relatively large number of data packets can be transmitted via HP channel 108 and LP channel 110 and are queued, a strategy for prioritizing data packets can be triggered, and HP data packets received via HP channel 108 and queued are given processing priority over LP data packets received via LP channel 110 and queued.

[0053] Additionally, in one example, client device 102 and / or (one or more) servers 104 may not include sufficient processing resources to handle all HP data packets received via HP channel 108 and all LP data packets received via LP channel 110. In other words, the arrival rate of data packets in the queues of client device 102 and / or (one or more) servers 104 may exceed the computing processing rate of client device 102 and / or (one or more) servers 104. In this example, one or more strategies may require processing all HP data packets transmitted via HP channel 108 and require any number of LP data packets transmitted via LP channel 110 to (1) wait in the queue until all HP data packets are processed; (2) exhaust all processing resources of the receiving computing device (e.g., client device 102 or (one or more) servers 104) to process HP data packets, leaving no processing resources for processing LP data packets; and / or (3) be allowed to discard (e.g., when the LP queue is full because it has been processed for a predetermined period of time). In this way, one or more strategies utilized by client device 102 and / or (one or more) servers 104 can always ensure that HP data packets transmitted via HP channel 108 are processed, regardless of how many LP data packets are transmitted.

[0054] In one example, the strategy implemented by server(s)104 may differ from the strategy implemented by any number of client devices(s)102. However, in the example described herein, the strategy implemented by client device(s)102 and server(s)104 at least ensures that HP channel(s)108, used for transmitting HP data packets, is preferred over LP channel(s)110, used for transmitting LP data packets.

[0055] Contact Now Figure 2 and Figure 3 Further details describe how data packets transmitted between client device 102 and server(s) 104 are prioritized. Figure 2 A component diagram 200 illustrates an example of the components of a client device 102 according to the principles described herein. As shown, the client device 102 may include one or more hardware processors 202 configured to execute one or more stored instructions. The processors 202 may include one or more cores. The processors 202 may define the level of computing power or processing resources available to the client device 102 for processing HP data packets transmitted to the client device 102 via HP channel 108 and LP data packets transmitted to the client device 102 via LP channel 110. As described above, since the client device 102 may receive data packets from a single source such as one or more servers 104, the number of processors 202 included within the client device 102 (and the resulting amount of processing power) may be relatively less than the number of processors included and utilized in the one or more servers 104. However, the number and / or processing power of the processors configured within the client device 102 may be sufficient to process the data packets according to the methods described herein. It should be noted that if all client network connections are made through a VPN, then client device 102 may be very busy sending data packets, for example, when streaming audio / video content and performing other processing tasks.

[0056] Additionally, client device 102 may include one or more network interfaces 204 configured to provide communication between client device 102 and other devices, such as with... Figure 1The system architecture associated with the client device 102 includes network 106, one or more servers 104, and / or other systems or devices associated with and / or remote from client device 102. Network interface 204 may include devices configured to couple to personal area networks (PANs), wired and wireless local area networks (LANs), wired and wireless wide area networks (WANs), etc. For example, network interface 204 may include devices compatible with client device 102, network 106, one or more servers, and / or other systems or devices associated with client device 102. The compatibility in this example provides access to the network, thereby enabling client device 102 to access one or more servers 104, but may be independent of server 104 and / or network 106.

[0057] Client device 102 may also include computer-readable medium 206 that stores various executable components (e.g., software-based components, firmware-based components, etc.). In one example, computer-readable medium 206 may include, for example, working memory, random access memory (RAM), read-only memory (ROM), and other forms of persistent, non-persistent, volatile, and other types of data storage devices. In addition to the various components discussed herein, computer-readable medium 206 may also store components that implement the functions described herein. Although not illustrated, computer-readable medium 206 may store one or more operating systems used to control the operation of one or more devices including client device 102. According to one example, the operating system includes the LINUX operating system. According to another example, the operating system(s) include the WINDOWS SERVER operating system from Microsoft Corporation, Redmond, Washington. According to yet another example, the operating system(s) may include the UNIX operating system or one of its variants. It will be understood that other operating systems may also be used.

[0058] In addition, client device 102 may include a data repository 208, which may include one or more repositories or other storage locations for persistently storing and managing collections of data, such as databases, simple files, binary data, and / or any other data. Data repository 208 may include one or more storage locations that may be managed by one or more database management systems. Data repository 208 may store, for example, application data 210 defining computer-executable code that is used by processor 202 to execute components stored within computer-readable medium 206. Furthermore, application data 210 may include data about user preferences associated with the component, passwords, usernames, and other data that the component may use to log in to services provided by server(s)104, as well as any other data related to the execution of the component.

[0059] Additionally, data repository 208 may store policy data 212. Policy data 212 may include any data about policies obtained and / or created by client device 102, which are used to process data packets transmitted to and from client device 102 via HP channel 108 and LP channel 110. For example, policy data 212 may include data defining parameters according to which HP data packets transmitted via HP channel 108 have a higher priority than LP data packets transmitted via LP channel 110. Policy data 212 may also include data defining what types of data packets to transmit via HP channel 108 and / or what types of data packets to transmit via LP channel 110. Policy data 212 may also include other data described herein, which may be used to assign data packets to HP channel 108 or LP channel 110, transmit data packets via HP channel 108 and LP channel 110, queue data packets, process data packets based on policies, and perform other policy-related processes as described herein.

[0060] Data repository 208 may also store queue data 214. A queue is any combination of hardware (e.g., memory and / or processor) and software that collects and maintains data packets sequentially. Queue component 220 described herein is an example of a queue. A queue can serve to give each queued element (e.g., a data packet) an additional associated priority. Elements with higher priority (e.g., those data packets sent via HP channel 108) are served before elements with lower priority (e.g., those data packets sent via LP channel 110). In one example, if two elements have the same priority, such as two separate HP data packets sent via HP channel 108 or two separate LP data packets sent via LP channel 110, they are served according to the order in which they were enqueued.

[0061] Computer-readable medium 206 may store portions or components of a service relating to the prioritization of data packets transmitted between client device 102 and server(s) 104 via HP channel 108 and LP channel 110. For example, the prioritization service of computer-readable medium 206 may include policy generation component 216 to generate or obtain several policies, when executed by processor(s) 202, for determining how data packets should be prioritized during transmission. Policy generation component 216 may allow a user to create and store several policies as policy data 212 within data repository 208 via a user interface or other methods. Additionally, policy generation component 216 may allow a user to request or import several policies as policy data 212 within data repository 208 from other sources or computing devices (e.g., an administrator's computing device, server(s) 104, and other sources). The policy generation component 216 may include all or part of the executable code associated with HP channel 108 and LP channel 110, and may be executed to implement the functions of HP channel 108 and LP channel 110, as well as their purpose of prioritizing data packets before other data processing (such as cryptographic processing, decapsulation, and data packet forwarding processing, and other data processing steps).

[0062] Computer-readable medium 206 may also include policy enforcement component 218. When executed by processor(s) 202, policy enforcement component 218 causes several policies stored as policy data 212 in data repository 208 to be enforced, and causes several data packets to be assigned to and transmitted via HP channel 108 and LP channel 110 according to the techniques described herein. In one example, policy enforcement component 218 may assign data packets to be transmitted via HP channel 108 or LP channel 110 based on the application from which the data packets originate and what policy requirements apply to these data packets. For example, if policy enforcement component 218 receives data packets from a real-time communication application (e.g., a video conferencing instance, such as the Webex teleconferencing system developed and distributed by Cisco Systems) and the policy defines that the data packets from the real-time communication application should be sent via HP channel 108, then policy enforcement component 218 will assign these data packets to be transmitted via HP channel 108. In contrast, if policy enforcement component 218 receives data packets from a non-real-time communication application (e.g., an email service or application (e.g., the Outlook email application developed and published by Microsoft Corporation)) and the policy defines that the data packets from the non-real-time communication application will be sent via LP channel 110, then policy enforcement component 218 will assign these data packets to be transmitted via LP channel 110.

[0063] In one example, there are two competing real-time traffic applications, such as the aforementioned video conferencing instance (e.g., the Webex teleconferencing system developed and distributed by Cisco Systems) and a media streaming application (e.g., the Netflix media streaming service developed and distributed by Netflix). Policies can define which real-time traffic should be placed on HP and which should be placed on LP. In this example, the administrator can require that data packets associated with enterprise-related applications (e.g., Webex) take precedence over data packets associated with non-enterprise-related applications (e.g., Netflix). Webex data packets will be transmitted via HP channel 108, and Netflix data packets will be transmitted via LP channel 110.

[0064] Additionally, in one example, policy enforcement component 218 may use identifiers, for example, appended to or included within the data packet, to label or otherwise identify the data packet as HP or LP. In one example, the data packet may include HP or LP identifiers in the form of: a ToS byte that may be included as a second byte in the header of the data packet (e.g., the IPv4 header), several QoS tags or identifiers associated with or identified within the data packet, and other data packet labeling or identification methods.

[0065] Computer-readable medium 206 may also include a queuing component 220. When executed by one or more processors 202, queuing component 220 can collect data packets transmitted from, for example, one or more servers 104 to client device 102 and maintain the data packets sequentially within a queue. Hardware components of queuing component 220 may include any data storage device or physical memory storage area, such as data buffers, working memory, RAM, ROM, and other forms of persistent, non-persistent, volatile, and other types of data storage. In one example, queuing component 220 may include a physical memory area for storing HP data packets transmitted via HP channel 108 of multiplexed communication channel 112, and a physical memory area for storing LP data packets transmitted via LP channel 110 of multiplexed communication channel 112.

[0066] Computer-readable medium 206 may also include data processing component 222. When executed by processor(s) 202, data processing component 222 may process data within received data packets for any purpose of transmitting the data packets and any additional applications being executed by processor(s) 202. For example, data processing component 222 may be responsible for performing cryptographic processing (e.g., encryption and / or decryption) to encrypt data packets when client device 102 sends data packets to server(s) 104, and / or decrypt data packets when client device 102 receives data packets from server(s) 104. In addition to performing cryptographic processing, other data processes performed by data processing component 222 may include, for example, forwarding data packets if client device 102 is an intermediary device. In the example described herein, client device 102 and server(s) 104 may utilize the HP and LP multiplexed channels 108, 110 of multiplexed communication channel 112 and determine in advance (e.g., before any additional processing by data processing component 222) which data packets will be transmitted via several HP channels and which data packets will be transmitted via several LP channels. Additionally, before any additional processing by data processing component 222, queuing component 220 may be instructed to queue data packets within queuing component 220 based on the priority identified by the data packets' transmission via HP channel 108 and LP channel 110.

[0067] Queuing component 220 and data processing component 222 can utilize transceiver 224 to transmit data packets via multiplexed communication channel 112, including HP channel 108 and LP channel 110. Thus, client device 102 may also include transceiver 224. Transceiver 224 provides communication with other data processing systems or devices, such as one or more servers 104 and / or other computing devices communicatively coupled to one or more servers 104 and / or client device 102. In one example, transceiver 224 includes one or more network interface cards. Transceiver 224 can provide communication by using either or both of physical and wireless communication links, including multiplexed communication channel 112.

[0068] One or more servers 104 may include elements similar to those described above for contacting client devices 102. However, since one or more servers 104 receive multiple signals from multiple client devices 102 via multiplexed communication channel 112, the processing load on one or more servers 104 may be relatively high compared to client devices 102. Therefore, the practicality of this system and method can be more fully realized for one or more servers 104.

[0069] Figure 3 Component diagram 300 illustrates an example component of a server based on the principles described herein. (See Figure 300.) Figure 3 As shown, server(s) 104 may include one or more hardware processors 302 configured to execute one or more stored instructions. Each processor 302 may include one or more cores. Each processor 302 may define the level of computing power or processing resources available to server(s) 104 for processing HP data packets transmitted to server(s) 104 via HP channel 108 and LP data packets transmitted to server(s) 104 via LP channel 110. As described above, since server(s) 104 may receive data packets from multiple sources such as multiple client devices 102, the number of processors 302 included within server(s) 104 (and the resulting amount of processing power) may be relatively greater than the number of processors included and utilized in client devices 102. However, the number and / or processing power of processors configured within client devices 102 may be sufficient to process data packets according to the methods described herein. In one example, server(s)104 may include m CPU cores, where m is any integer greater than or equal to 1, and in one example, the number of CPU cores may be orders of magnitude smaller than the number of data packets and / or sessions (e.g., n VPN, HTTP / 2 (QUIC) and / or HTTP / 3 (MASQUE) sessions).

[0070] Additionally, server(s)104 may include one or more network interfaces 304 configured to provide communication between server(s)104 and other devices, such as with... Figure 1 The system architecture-related devices include network 106, client device 102, and / or other systems or devices associated with and / or remote from server(s) 104. Network interface 304 may include devices configured to couple to personal area networks (PANs), wired and wireless local area networks (LANs), wired and wireless wide area networks (WANs), etc. For example, network interface 304 may include devices compatible with client device 102, network 106, server(s) 104, and / or other systems or devices associated with server(s) 104.

[0071] One or more servers 104 may also include a computer-readable medium 306 that stores various executable components (e.g., software-based components, firmware-based components, etc.). In one example, the computer-readable medium 306 may include, for example, working memory, random access memory (RAM), read-only memory (ROM), and other forms of persistent, non-persistent, volatile, non-volatile, and other types of data storage devices. In addition to the various components discussed herein, the computer-readable medium 306 may also store components that implement the functions described herein. Although not illustrated, the computer-readable medium 306 may store one or more operating systems used to control the operation of one or more devices of the server 104. According to one example, the operating system includes the LINUX operating system. According to another example, the operating system includes the WINDOWS SERVER operating system from Microsoft Corporation, Redmond, Washington. According to yet another example, the operating system may include the UNIX operating system or one of its variants. It will be understood that other operating systems may also be used.

[0072] In addition, similar to client device 102, server(s)104 may include data repository 308, which may include one or more repositories or other storage locations for persistently storing and managing collections of data, such as databases, simple files, binary data, and / or any other data. Data repository 308 may include one or more storage locations that may be managed by one or more database management systems. Data repository 308 may store, for example, application data 310 defining computer-executable code that is used by processor 302 to execute components stored in computer-readable medium 306. Additionally, application data 310 may include data about user preferences associated with the component, passwords, usernames, and other data that the component may use to log in to services provided by server(s)104, as well as any other data related to the execution of the component.

[0073] Additionally, data repository 308 may store policy data 312. Policy data 312 may include any data about policies obtained and / or created by one or more servers 104, which are used to process data packets transmitted to and from one or more servers 104 via HP channel 108 and LP channel 110. For example, policy data 312 may include data defining parameters according to which HP data packets transmitted via HP channel 108 have a higher priority than LP data packets transmitted via LP channel 110. Policy data 312 may also include data defining what types of data packets to transmit via HP channel 108 and / or what types of data packets to transmit via LP channel 110. Policy data 312 may also include other data described herein, which may be used to assign data packets to HP channel 108 or LP channel 110, transmit data packets via HP channel 108 and LP channel 110, queue data packets, process data packets based on policies, and perform other policy-related processes as described herein.

[0074] Data repository 308 may also store queue data 314. As described above, a queue is any combination of hardware (e.g., memory and / or processor) and software that collects and maintains data packets sequentially. Queue component 320 described herein is an example of a queue. Queues can serve to give each queued element (e.g., data packet) an additional associated priority. Elements with higher priority (e.g., those data packets sent via HP channel 108) are served before elements with lower priority (e.g., those data packets sent via LP channel 110). In one example, if two elements have the same priority, such as two separate HP data packets sent via HP channel 108 or two separate LP data packets sent via LP channel 110, they are served according to the order in which they were enqueued. In one example, the size of the queue of server(s) 104, and consequently, the amount of queue data 314 allocated within data repository 308, may be relatively large relative to the corresponding elements within client device 102.

[0075] Computer-readable medium 306 may store portions or components of a service relating to the prioritization of data packets transmitted between one or more servers 104 and client devices 102 via HP channel 108 and LP channel 110. For example, the prioritization service of computer-readable medium 306 may include a policy generation component 316 to generate or obtain several policies, when executed by one or more processors 302, for determining how data packets should be prioritized during transmission. Policy generation component 316 may allow a user to create and store several policies as policy data 312 within a data repository 308 via a user interface or other methods. Additionally, policy generation component 316 may allow a user to request or import several policies as policy data 312 within the data repository 308 from other sources or computing devices (e.g., an administrator's computing device, client device 102, and other sources). The policy generation component 316 may include all or part of the executable code associated with HP channel 108 and LP channel 110, and may be executed to implement the functions of HP channel 108 and LP channel 110, as well as their purpose of prioritizing data packets before other data processing (e.g., cryptographic processing, data packet forwarding processing, and other data processing steps).

[0076] Computer-readable medium 306 may also include policy enforcement component 318. When executed by processor(s) 302, policy enforcement component 318 causes several policies stored as policy data 312 in data repository 308 to be enforced, and causes several data packets to be assigned to and transmitted via HP channel 108 and LP channel 110 according to the techniques described herein. In one example, policy enforcement component 318 may assign data packets to be transmitted via HP channel 108 or LP channel 110 based on the application from which the data packets originate and what policy requirements apply to these data packets. For example, if policy enforcement component 318 receives data packets from a real-time communication application (e.g., a video conferencing instance, such as the Webex teleconferencing system developed and distributed by Cisco Systems) and the policy defines that the data packets from the real-time communication application should be sent via HP channel 108, then policy enforcement component 318 will assign these data packets to be transmitted via HP channel 108. In contrast, if the policy enforcement component 318 receives data packets from a non-real-time communication application (e.g., an email service or application (e.g., the Outlook email application developed and published by Microsoft Corporation)) and the policy defines that the data packets from the non-real-time communication application will be sent via LP channel 110, then the policy enforcement component 318 will assign the data packets to be transmitted via LP channel 110.

[0077] In one example, there are two competing real-time traffic applications, such as the aforementioned video conferencing instance (e.g., the Webex teleconferencing system developed and distributed by Cisco Systems) and a media streaming application (e.g., the Netflix media streaming service developed and distributed by Netflix). Policies can define which real-time traffic should be placed on HP and which should be placed on LP. In this example, the administrator can require that data packets associated with enterprise-related applications (e.g., Webex) take precedence over data packets associated with non-enterprise-related applications (e.g., Netflix). Webex data packets will be transmitted via HP channel 108, and Netflix data packets will be transmitted via LP channel 110.

[0078] Additionally, in one example, the policy enforcement component 318 may use identifiers, for example, appended to or included within the data packet, to label or otherwise identify the data packet as HP or LP. In one example, the data packet may include HP or LP identifiers in the form of: a ToS byte that may be included as a second byte in the header of the data packet (e.g., the IPv4 header), several QoS tags or identifiers associated with or identified within the data packet, and other data packet labeling or identification methods.

[0079] Computer-readable medium 306 may also include a queuing component 320. When executed by one or more processors 302, the queuing component 320 can collect data packets transmitted from, for example, client device 102 to one or more servers 104 and maintain the data packets sequentially within a queue. The hardware components of the queuing component 320 may include any data storage device or physical memory storage area, such as a data buffer, working memory, RAM, ROM, and other forms of persistent, non-persistent, volatile, and other types of data storage. In one example, the queuing component 320 may include a physical memory area for storing HP data packets transmitted via HP channel 108 of multiplexed communication channel 112, and a physical memory area for storing LP data packets transmitted via LP channel 110 of multiplexed communication channel 112.

[0080] Computer-readable medium 306 may also include a data processing component 322. When executed by one or more processors 302, the data processing component 322 may process data within received data packets for any purpose of transmitting the data packets and any additional applications being executed by the processors 302. For example, the data processing component 322, such as a CPU, field-programmable gate array (FPGA), application-specific integrated circuit (ASIC), and graphics processing unit (GPU), and other data processing devices, may be responsible for performing cryptographic processing (e.g., encryption and / or decryption) to encrypt data packets when the server 104 sends data packets to the client device 102, and / or decrypt data packets when the server 104 receives data packets from the client device 102. In addition to performing cryptographic processing, other data processes performed by the data processing component 322 may include, for example, forwarding data packets if the server 104 is an intermediary device. In the example described herein, client device 102 and server(s) 104 may utilize the HP and LP multiplexed channels 108, 110 of multiplexed communication channel 112 and determine in advance (e.g., before any additional processing by data processing component 322) which data packets will be transmitted via several HP channels and which data packets will be transmitted via several LP channels. Additionally, before any additional processing by data processing component 322, queuing component 320 may be instructed to queue data packets within queuing component 320 based on the priority identified by the data packets' transmission via HP channel 108 and LP channel 110.

[0081] Queuing component 320 and data processing component 322 can utilize transceiver 324 to transmit data packets via multiplexed communication channel 112, including HP channel 108 and LP channel 110. Thus, server(s)(one or more) may also include transceiver 324. Transceiver 324 provides communication with other data processing systems or devices, such as client device 102 and / or other computing devices communicatively coupled to server(s)(one or more) and / or client device 102. In one example, transceiver 324 includes one or more network interface cards. Transceiver 324 can provide communication by using either or both of physical and wireless communication links, including multiplexed communication channel 112.

[0082] Figure 4The illustration shows a schematic diagram of an example M / M / 1 queuing model 400 based on the principles described herein. Since the data packet processing at the contact server(s) 104 best describes the example described herein, the contact server(s) 104 will be used instead of the client device 102 for description. Figure 4 Examples. However, the systems and methods described for contacting (one or more) servers 104 also apply in the context of client device 102, and vice versa. Figure 4 A description of Kendall notation used to describe and classify queuing nodes such as client device 102 and (one or more) servers 104 is provided. In one example, a queuing scenario can be modeled where CPUs (e.g., (one or more) processors 202, 302) include queues of data packets waiting to be processed (e.g., decrypted). As described herein, there may be two types of data packets in the queues, including HP data packets transmitted via HP channel 108 and LP data packets transmitted via LP channel 110. When a data processing instance is completed for a first data packet, the CPU can select the next or second data packet from the queues (e.g., queue components 220, 320). If there are high-priority data packets in the queues, the CPU selects one of the high-priority data packets. Otherwise, if there are no high-priority data packets in the queues, the CPU selects one of the several lower-priority packets present in the queues. Thus, based on any strategy implemented on the queues, as long as there are high-priority data packets in the queues, no lower-priority data packets will be processed (e.g., decrypted, forwarded, etc.).

[0083] Taking the M / M / 1 queuing system in Kendall notation as an example, the first character (e.g., "M") represents the distribution of arrival times within packets, and the second character (e.g., "M") represents the service time distribution (e.g., exponential distribution). The last character indicates the number of service processors in the system. Other characters can also be used in conjunction with this notation, including characters representing system capacity, group size, and service specifications.

[0084] exist Figure 4In the queuing system depicted, data packet processing can occur in two phases: 1) waiting in the queue, as specified in 402; and 2) processing by a service node (e.g., one or more servers 104). 404. For simplicity, consider an example and associated model utilizing a single server 104. This single server 104 can utilize a single CPU (e.g., a single server is designated as "1" in the last character of M / M / 1) or a single-threaded application, so that server 104 can process one data packet at a time. Additionally, in this example, it is noted that data decryption affects the service rate; therefore, server 104 is considered to be performing data packet decryption processing. However, this system and method are applicable to any number of servers 104 with any number of CPUs or single-threaded applications, which can process any number of data packets simultaneously and perform any number or type of data packet processing.

[0085] In an M / M / 1 queuing system, the M / M / 1 queue is a stochastic process with a state space of set {0, 1, 2, 3, ...}, where the values ​​correspond to the number of data packets in the system, including any currently being served data packets. An M / M / 1 system represents a system with a queue length of 1 and a single server, where arrival is determined by a Poisson process and job service times follow an exponential distribution. M stands for "memoryless," meaning the distribution is exponential. Thus, in the case of an M / M / 1 queuing system, both arrival and service times are exponentially distributed. Additionally, the last number specified in M / M / 1 is the number of servers (CPUs), which is chosen as 1 in this example. For M / M / 1 modeling, the queue is considered infinite.

[0086] In other words, arrival occurs at a rate λ according to a Poisson process, and the process moves from state i to i+1. In the M / M / 1 queue, service time has an exponential distribution with a rate parameter of μ (e.g., service rate), where 1 / μ is the average service time. A single server serves customers one at a time, starting from the front of the queue, according to a first-come, first-served principle. When service is complete, the customer leaves the queue, and the number of customers in the system decreases by one. Similarly, the buffer size is infinite, so there is no limit to the number of customers the buffer can contain.

[0087] Based on the above understanding, the density of an exponential distribution with parameter μ is:

[0088] f(t) = μe -μt Formula 1, where t>0

[0089] The expectation of this distribution can be defined as follows:

[0090]

[0091] The variance of the exponential distribution can be defined as follows:

[0092]

[0093] Service time can be distributed according to an exponential distribution with parameter μ, and inter-packet arrival time can be distributed according to an exponential distribution with parameter λ. The average time between data packet arrivals can be defined as 1 / λ, and the average service time is 1 / μ. The time component of server 104's operation (e.g., traffic intensity) is:

[0094]

[0095] In one example, ρ < 1. Otherwise, the queue size might become too large.

[0096] Let L be a random variable representing the number of data packets in both the queue and the service in the system (e.g., at server 104). Let S be a random variable representing the dwell time of data packets in the system. To demonstrate the impact of this system and method, relevant measurements can be quantified, including, for example, measuring the average dwell time of a data packet, designated E(S). The average dwell time E(S) of a data packet indicates the average time (including processing time) required between the moment a data packet arrives at the queue of server 104 and the moment it is processed by server 104 (e.g., decrypted, forwarded, etc.). Additionally, the average number of data packets in the system can be represented by E(L). Formulas establishing the relationship between the average number of packets in the system E(L), the average dwell time in the system E(S), and the average number of incoming packets per time unit λ can include Little's Law as follows:

[0097] E(L)=λE(S) Formula 5

[0098] When considering two types of data packets (including HP data packets transmitted via HP channel 108 and LP data packets transmitted via LP channel 110), index 1 can be used for HP data packets and index 2 can be used for LP data packets. HP data packets may have an arrival rate λ1.

[0099] Additionally, LP data packets can have an arrival rate λ2.

[0100]

[0101] as well as

[0102]

[0103] When a type 1 data packet (e.g., an HP data packet) arrives in the queue of server 104, the HP data packet may find that another lower-priority data packet (e.g., an LP data packet) is being processed by server 104. In this case, the HP data packet will need to wait for a period of time defined by 1 / μ. The probability of this scenario occurring is equal to the amount of time server 104 spends processing type 2 data packets (e.g., LP data packets), which is equal to ρ2. If there are other higher-priority data packets, then it must wait for these data packets to finish processing, which will take a period of time defined as follows:

[0104]

[0105] Additionally, processing HP data packets that must wait in waiting area 402 may require a time period defined by 1 / μ. These waiting times can be expressed by the overall formula as follows:

[0106]

[0107] The above information can be combined with Little's Law as follows:

[0108] E(L1)=λE(S1) Formula 10

[0109] To obtain the following content:

[0110]

[0111] as well as

[0112]

[0113] In a no-priority M / M / 1 system, the following formula holds:

[0114]

[0115] Having identified the average dwell time and average number of HP data packets transmitted via HP channel 108, a similar analysis and mathematical expression can be derived for LP data packets transmitted via LP channel 110. The total number of data packets in the system (e.g., server 104) does not depend on the order in which they are served, and is therefore the same as the total number of data packets in a system where data packets are served in the order of arrival, as follows:

[0116]

[0117] Combining formulas 13 and 14, the estimated value of the LP data packet can be derived as follows:

[0118]

[0119] Combining Formula 5 (Little's Law) and Formula 15, we obtain the following:

[0120]

[0121] Consider an example system capable of decrypting μ = 4000 packets per second (packets / sec). In this example, the packet streams the system can handle have arrival rates of λ1 = 1000 HP packets / sec and λ2 = 2000 LP packets / sec. Applying Equations 11 and 16 in one example, the average time each type of data packet (e.g., HP data packets and LP data packets) can be determined in the system (e.g., server 104).

[0122] E(S1)=0.5ms Formula 17

[0123] E(S2) = 1.25ms (Formula 18)

[0124] HP data packets take 0.5 milliseconds (ms) in the system, while LP data packets take 1.25 ms. In contrast, in an example where the multiplexed communication channel 112, including HP channel 108 and LP channel 110, is not used (e.g., the system and method are not used), the result will be the same as using only HP data. Therefore, if ρ2 = 0 and applied to the formula for E(S1), the following is obtained:

[0125]

[0126] In this example, the index is removed because it is not needed when only one type of data packet exists. Empirically, for this system, when λ1 = 1000 and λ2 = 2000, we can transform it into a system with λ = 3000 because no distinction is made between data packets. In this example, applying Equation 19, the average time a data packet spends in the system (e.g., server 104) can be E(S) = 1 ms.

[0127] In summary, without isolating data packets based on priority using HP channel 108 and LP channel 110, the average latency is 1 ms. However, if data packets are segmented based on priority and transmitted from client device 102 to server 104 via HP channel 108 and LP channel 110, then queued based on their priority and processed according to the strategy described herein, HP data packets may wait 0.5 ms, while LP data packets may wait 1.25 ms. Thus, by using the systems and methods described herein, in the context of the above example, the latency of queuing and processing HP data packets leads to a significant reduction in total processing time compared to the case without these systems and methods, and on average, a reduction of two-fold in processing time for HP data packets is achieved. A significant improvement in data packet processing time is achieved in this simple example. The concepts and methods described in the above example can be similarly implemented for other systems that employ a different number of service processors within the system or differ from the above example in other aspects.

[0128] Figure 5 The illustration shows a flowchart of an example method 500 for defining the priority of several data packets within a queue, based on the principles described herein. Method 500 may include generating policies at 502. Any number of policies can be generated to identify priority data packets, applications from which priority data packets can be obtained, and to transmit these priority data packets via HP channel 108. The policies also define which data packets, applications, etc., should be identified as low priority and transmitted via LP channel 110.

[0129] The strategy defines a first multiplexed channel 108 among multiple multiplexed channels. The first multiplexed channel 108 has a first priority. The strategy also defines a second multiplexed channel 110 among multiple multiplexed channels. The second multiplexed channel 110 has a second priority. The first priority can be defined as a higher priority relative to the second multiplexed channel. Thus, the first priority can be associated with HP data packets transmitted via HP channel 108 of multiplexed communication channel 112, while the second priority can be associated with LP data packets transmitted via LP channel 110 of multiplexed communication channel 112.

[0130] Method 500 may also include, at 504, receiving several data packets via multiple multiplexed channels associated with the session. Throughout this specification, a session may be defined as a semi-permanent interactive information exchange between communication devices such as client device 102 and (one or more) server 104. Thus, in the case of sending several HP data packets from the same application (e.g., a real-time communication application), these HP data packets may be queued and processed before or with a higher priority than any LP data packets.

[0131] At 506, method 500 may include, at least in part, processing several data packets transmitted via the first multiplexing channel 108 prior to processing several data packets transmitted via the second multiplexing channel 110, based on a strategy. As described above, the strategy may define how many HP data packets to process before the LP data packets.

[0132] Figure 6 The diagram illustrates an example method 600 for defining the priority of several data packets within a queue, based on the principles described herein. Method 600 may include generating a strategy at 602. Similarly, any number of strategies can be generated, and those generated strategies can be utilized when processing data packets according to this system and method.

[0133] At 604, several data packets are routed on a first multiplexed channel (e.g., HP channel 108) and a second multiplexed channel (e.g., 110) based at least on a policy. In other words, the multiplexed communication channel 112, including HP channel 108 and LP channel 110, can be used to transmit data packets. HP channel 108 transmits HP data packets, while LP channel 110 transmits LP data packets.

[0134] Both client device 102 and server(s) 104 are capable of receiving several data packets at 606 via multiple multiplexed channels 108, 110 associated with the session. While client device 102 is capable of receiving data packets via multiplexed communication channel 112, server(s) 104 can receive several data packets from multiple client devices 102 via multiple multiplexed channels associated with the session, and this is related to... Figure 6 The example described will be based on receiving data packets from one or more servers 104, as the advantages of this system and method can be better realized from the perspective of one or more servers 104.

[0135] Multiple multiplexed channels include a first multiplexed channel with a first priority, such as HP channel 108 described herein. Additionally, multiple multiplexed channels include a second multiplexed channel with a second priority, such as LP channel 110 described herein. The first multiplexed channel can be designated to have a higher priority than the second multiplexed channel. Therefore, any data packet transmitted via the first multiplexed channel can be designated to have a higher priority than any data packet transmitted via the second multiplexed channel.

[0136] At 608, several data packets transmitted via multiple multiplexed channels can be added to queues, such as queue components 220 and 320. A queue may include one or more data packets that are queued based on their priority level. In one example, queue component 220 may include a physical memory area for storing HP data packets transmitted via HP channel 108 of multiplexed communication channel 112, and a physical memory area for storing LP data packets transmitted via LP channel 110 of multiplexed communication channel 112.

[0137] Data packets in the queue can be processed at 610, at least in part, based on the policy generated at 602. In one example, the policy may define that b HP data packets transmitted via a first multiplexed channel (e.g., HP channel 108) are processed first, followed by c LP data packets transmitted via a second multiplexed channel (e.g., LP channel 110). In another example, the policy may define that b bytes of HP data packets transmitted via the first multiplexed channel (e.g., HP channel 108) are processed first, followed by c bytes of LP data packets transmitted via the second multiplexed channel (e.g., LP channel 110). Additionally, the policy may define that the first session among multiple sessions takes precedence over the second session among multiple sessions. In this example, a session may include sessions invoked by several applications, such as real-time communications, like a video conferencing instance (e.g., the Webex teleconferencing system developed and distributed by Cisco Systems), where these data packets may be assigned high priority within one or more policies, and data packets associated with media streaming services (e.g., Netflix), email services (e.g., Microsoft Outlook mail server), and web traffic (e.g., web downloads) may be assigned low priority. Any other policies may be used to prioritize HP data packets over LP data packets within the queue.

[0138] Method 600 may also include performing several data processing procedures at 612 based on a policy. For example, the data processing procedures may include cryptographic processing, including encrypting several data packets, decrypting several data packets, decapsulating data packets, forwarding data packets, and combinations thereof.

[0139] Figure 7 The diagram illustrates a computing system configuration of a data center 700 that can be used to implement various aspects of the techniques disclosed herein. Figure 7The example data center 700 shown includes several server computers 702A-702F (which may be referred to herein simply as "server computer 702" or in the plural as "server computer 702") for providing computing resources. In some examples, the resources and / or server computer 702 may include or correspond to any type of networking device described herein. Although described as a server, server computer 702 may include any type of networking device, such as a server, switch, router, hub, bridge, gateway, modem, repeater, access point, etc.

[0140] Server computer 702 can be a standard tower, rack-mount, or blade server computer, appropriately configured to provide computing resources. In some examples, server computer 702 can provide computing resources 704, including data processing resources such as VM instances or hardware computing systems, database clusters, compute clusters, storage clusters, data storage resources, database resources, networking resources, virtual private networks (VPNs), and so on. Some server computers 702 may also be configured to execute a resource manager 706 capable of instantiating and / or managing computing resources. For example, in the case of VM instances, resource manager 706 could be a super-supervisor or another type of program configured to enable the execution of multiple VM instances on a single server computer 702. Server computer 702 in data center 700 may also be configured to provide network services and other types of services.

[0141] exist Figure 7 In the example data center 700 shown, appropriate LAN 708 is also utilized to interconnect server computers 702A-702F. It will be understood that the configuration and network topology described herein have been greatly simplified, and many other computing systems, software components, networks, and networking devices can be utilized to interconnect the various computing systems disclosed herein and provide the aforementioned functionality. Appropriate load balancing devices or other types of network infrastructure components can also be used to balance the load between data centers 700, between each server computer 702A-702F in each data center 700, and possibly among the computing resources in each server computer 702. It will be understood that references... Figure 7 The configuration of the data center 700 described is illustrative only; other implementations may be used.

[0142] In some examples, server computer 702 and / or computing resource 704 may each execute / host one or more tenant containers and / or virtual machines to perform the techniques described herein.

[0143] In some cases, data center 700 can provide computing resources permanently or on demand, such as tenant containers, VM instances, VPN instances, and storage. Among other types of functionality, computing resources provided by the cloud computing network can also be utilized to implement the various services and technologies described herein. Computing resources 704 provided by the cloud computing network can include various types of computing resources, such as data processing resources like tenant containers and VM instances, data storage resources, networking resources, data communication resources, network services, VPN instances, and so on.

[0144] Each type of computing resource 704 provided by a cloud computing network can be general-purpose or can be provided in several specific configurations. For example, data processing resources can be provided as physical computers or VM instances in several different configurations. VM instances can be configured to run applications, including web servers, application servers, media servers, database servers, some or all of the aforementioned network services, and / or other types of programs. Data storage resources may include file storage devices, block storage devices, and so on. Cloud computing networks can also be configured to provide other types of computing resources 704 not specifically mentioned herein.

[0145] In one example, computing resources 704 provided by a cloud computing network may be enabled by one or more data centers 700 (hereinafter referred to simply as "data center 700" or in the plural as "data center 700"). A data center 700 is a facility used to house and operate computer systems and associated components. A data center 700 typically includes redundant and backup power, communication, cooling, and security systems. Data centers 700 may also be located in geographically distinct locations. This document references, for example... Figures 1 to 6 An illustrative example of a data center 700 that can be used to implement the techniques disclosed herein is described.

[0146] Figure 8 The diagram illustrates a computer architecture, showing an example computer hardware architecture 800 for implementing computing devices that can be utilized to realize various aspects of the technologies proposed herein. Figure 8The computer hardware architecture 800 illustrated here represents client device 102, network 106, server(s) 104, and / or other systems or devices associated with and / or remote from client device 102, network 106, and / or server(s) 104, workstations, desktop computers, laptops, tablets, network devices, e-readers, smartphones, or other computing devices, and may be used to execute any of the software components described herein. In some examples, computer 800 may correspond to the network devices described herein (e.g., client device 102, network 106, and / or server(s) 104 (and associated devices)) and may include networked devices such as servers, switches, routers, hubs, bridges, gateways, modems, repeaters, access points, etc.

[0147] Computer 800 includes a baseboard 802, or "motherboard," which is a printed circuit board to which many components or devices can be connected via a system bus or other electrical communication paths. In an illustrative configuration, one or more central processing units (CPUs) 804 operate in conjunction with a chipset 806. The CPU 804 may be a standard programmable processor that performs the arithmetic and logic operations necessary for the operation of computer 800.

[0148] The CPU 804 performs operations by transitioning from one discrete physical state to the next, where state transitions are achieved by manipulating switching elements that distinguish and change these states. Switching elements typically include electronic circuitry, such as flip-flops, that maintains one of two binary states, and electronic circuitry, such as logic gates, that provides an output state based on a logical combination of the states of one or more other switching elements. These basic switching elements can be combined to create more complex logic circuits, including registers, adder-subtractor units, arithmetic logic units, floating-point units, and so on.

[0149] Chipset 806 provides an interface between CPU 804 and the remaining components and devices on substrate 802. Chipset 806 may provide an interface with RAM 808, which is used as the main memory in computer 800. Chipset 806 may further provide an interface with a computer-readable storage medium, such as read-only memory (ROM) 810 or non-volatile RAM (NVRAM), for storing basic routines that facilitate the startup of computer 800 and the transfer of information between various components and devices. ROM 810 or NVRAM may also store other software components necessary for the operation of computer 800 according to the configuration described herein.

[0150] Computer 800 can operate in a networked environment, using logical connections via a network to remote computing devices and computer systems (e.g., client device 102, network 106, and / or one or more servers 104, and other devices). Chipset 806 may include functionality for providing network connectivity via a Network Interface Controller (NIC) 812 (e.g., a Gigabit Ethernet adapter). NIC 812 enables computer 800 to connect to other computing devices within client device 102, network 106, and / or one or more servers 104, as well as external to client device 102, network 106, and / or one or more servers 104. It will be understood that multiple NICs 812 may be present in computer 800 to connect the computer to other types of networks and remote computer systems. In some examples, NIC 812 may be configured to perform at least some of the techniques described herein, such as packet redirection and / or other techniques described herein.

[0151] Computer 800 can be connected to storage device 818, which provides non-volatile storage for the computer. Storage device 818 can store operating system 820, programs 822 (e.g., any computer-readable and / or computer-executable code described herein), and data, which have been described in more detail herein. Storage device 818 can be connected to computer 800 via storage controller 814, which is connected to chipset 806. Storage device 818 can consist of one or more physical storage units. Storage controller 814 can be connected to physical storage units via a serial attached SCSI (SAS) interface, a serial advanced technology attachment (SATA) interface, a fiber channel (FC) interface, or other types of interfaces used for physical connection and data transfer between the computer and physical storage units.

[0152] Computer 800 can store data on storage device 818 by changing the physical state of physical storage units to reflect the stored information. In different examples of this specification, the specific changes in physical state can depend on various factors. Examples of such factors include, but are not limited to, the technology used to implement the physical storage units, whether storage device 818 is characterized as primary or secondary storage, and so on.

[0153] For example, computer 800 can store information in storage device 818 by issuing instructions through storage controller 814 to change the magnetic properties of a specific location within a disk drive unit, the reflection or refraction properties of a specific location in an optical storage unit, or the electrical properties of a specific capacitor, transistor, or other discrete component in a solid-state storage unit. Other transformations of the physical medium are possible without departing from the scope and spirit of this specification; the foregoing examples are provided merely for convenience. Computer 800 can further read information from storage device 818 by detecting the physical state or characteristics of one or more specific locations within the physical storage unit.

[0154] In addition to the storage device 818 described above, computer 800 may also access other computer-readable storage media to store and retrieve information, such as program modules, data structures, or other data. Those skilled in the art will understand that a computer-readable storage medium is any available medium that provides non-transitory storage of data and is accessible by computer 800. In some examples, operations performed by client device 102, network 106, (one or more) servers 104 and / or any components included therein may be supported by one or more devices similar to computer 800. In other words, some or all of the operations performed by client device 102, network 106, (one or more) servers 104 and / or any components included therein may be performed by one or more computer devices operating in a cloud-based configuration.

[0155] By way of example, and not limitation, computer-readable storage media may include volatile and non-volatile, removable and non-removable media implemented in any method or technology. Computer-readable storage media include, but are not limited to, RAM, ROM, erasable programmable ROM (EPROM), electrically-erasable programmable ROM (EEPROM), flash memory or other solid-state storage technologies, compact disc ROM (CD-ROM), digital versatile disk (DVD), high-definition DVD (HD-DVD), Blu-ray or other optical storage devices, cassette tape, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information in a non-transitory manner.

[0156] As briefly mentioned above, storage device 818 may store operating system 820, which is used to control the operation of computer 800. According to one example, operating system 820 includes a Linux operating system. According to another example, the operating system includes one from Microsoft Corporation of Redmond, Washington. The server operating system. According to another example, the operating system may include the UNIX operating system or one of its variants. It will be understood that other operating systems may also be used. Storage device 818 may store other systems, applications, and data used by computer 800.

[0157] In one example, storage device 818 or other computer-readable storage medium is encoded with computer-executable instructions that, when loaded into computer 800, transform the computer from a general-purpose computing system into a special-purpose computer capable of implementing the examples described herein. As described above, these computer-executable instructions transform computer 800 by specifying how CPU 804 transitions between states. According to one example, computer 800 has access to a computer-readable storage medium storing the computer-executable instructions, which, when executed by computer 800, perform the aforementioned... Figures 1-6 The various processes described herein. The computer 800 may also include a computer-readable storage medium storing instructions for performing any other computer-implemented operations described herein.

[0158] Computer 800 may also include one or more input / output controllers 816 for receiving and processing input from a number of input devices, such as a keyboard, mouse, touchpad, touchscreen, stylus, or other types of input devices. Similarly, input / output controllers 816 may provide output to a display, such as a computer monitor, flat panel display, digital projector, printer, or other types of output devices. It will be understood that computer 800 may not include... Figure 8 All components shown may include Figure 8 Other components not explicitly shown, or those that may utilize [the technology / method] Figure 8 The architecture shown is completely different.

[0159] The computer 800 may also include accelerator hardware 824, such as a field-programmable gate array (FPGA) and a graphics processing unit (GPU), as well as other accelerator hardware devices. Accelerator hardware 824 can be employed to perform functions in a more efficient manner.

[0160] As described herein, computer 800 may include one or more of client device 102, network 106, server(s) 104, and / or other systems or devices associated with and / or remote from client device 102, network 106, and / or server(s) 104. Computer 800 may include one or more hardware processors, such as CPU 804, configured to execute one or more stored instructions. CPU 804 may include one or more cores. Additionally, computer 800 may include one or more network interfaces configured to provide communication between computer 800 and other devices, such as those described herein as being performed by client device 102, network 106, server(s) 104, and other devices described herein. Network interfaces may include devices configured to couple to personal area networks (PANs), wired and wireless local area networks (LANs), wired and wireless wide area networks (WANs), etc. For example, network interfaces may include interfaces with Ethernet, Wi-Fi, etc. TM Compatible devices, etc.

[0161] Program 822 may include any type of program or process to perform the techniques described in this disclosure for client device 102, network 106, and / or (one or more) servers 104 as described herein. Program 822 may enable the devices described herein to perform a variety of operations.

[0162] in conclusion

[0163] The examples described herein provide a system, method, and a computer program product including a processor, and a non-transitory computer-readable medium storing instructions that, when executed by the processor, cause the processor to perform operations. These operations include a generation strategy. The strategy defines a first multiplexed channel among a plurality of multiplexed channels. The first multiplexed channel includes a first priority. The strategy also defines a second multiplexed channel among the plurality of multiplexed channels. The second multiplexed channel includes a second priority. The first priority is defined as a higher priority relative to the second priority. The operations also include receiving several data packets through the plurality of multiplexed channels associated with a session, and processing several data packets transmitted via the first multiplexed channel, at least in part based on the strategy, before processing several data packets transmitted via the second multiplexed channel.

[0164] Several data packets are routed on a first multiplexing channel and a second multiplexing channel, at least partially based on a policy. The operation also includes performing a cryptographic process based on the policy. The cryptographic process includes encrypting the data packets, decrypting the data packets, decapsulating, forwarding, and combinations thereof.

[0165] The operation also includes adding several data packets transmitted via multiple multiplexed channels to a queue, and processing the data packets in the queue at least in part based on a policy. The policy defines that m high-priority packets transmitted via the first multiplexed channel should be processed before n low-priority packets transmitted via the second multiplexed channel. The policy also defines that m bytes of high-priority packets transmitted via the first multiplexed channel should be processed before n bytes of low-priority packets transmitted via the second multiplexed channel. A session includes multiple sessions, and the policy defines that the first session among the multiple sessions takes precedence over the second session among the multiple sessions. The first session is associated with a live session transmitting data in real time, and the second session is associated with a non-live session transmitting data in a non-live instance.

[0166] In summary, a method for defining the priority of several data packets within a queue includes generating a policy. The policy defines a first multiplexed channel among multiple multiplexed channels. The first multiplexed channel has a first priority. The policy also defines a second multiplexed channel among multiple multiplexed channels. The second multiplexed channel has a second priority. The first priority is defined as a higher priority relative to the second priority. The method also includes receiving several data packets through multiple multiplexed channels associated with a session, at least partially based on the policy.

[0167] Although this system and method are described with reference to specific examples, it should be understood that the scope of this system and method is not limited to these specific examples. Since other modifications and variations made to adapt to specific operational requirements and environments are readily apparent to those skilled in the art, this system and method are not to be considered limited to the examples chosen for disclosure purposes, and all changes and modifications that do not constitute a departure from the true spirit and scope of this system and method are covered.

[0168] While this application describes examples with specific structural features and / or methodological actions, it should be understood that the claims are not necessarily limited to the specific features or actions described. Rather, the specific features and actions are merely examples illustrating the scope of the claims of this application.

Claims

1. A non-transitory computer-readable medium storing instructions, said instructions, when executed, causing a processor to perform operations, said operations including: A receiving strategy, which defines, at least in part, whether the data packet is transmitted via a first multiplexed channel or a second multiplexed channel based on the application that generated the data packet, wherein: The first multiplexed channel has a first priority. The second multiplexed channel has a second priority, and The first priority is defined as a higher priority than the second priority; The data packets are routed on the first multiplexing channel and the second multiplexing channel, at least in part, based on the strategy described above; The data packets transmitted through the first multiplexing channel and the second multiplexing channel are added to the queue; Based at least in part on the strategy, data packets transmitted via the first multiplexing channel are processed before data packets transmitted via the second multiplexing channel are processed, and the strategy further defines the processing of data packets in the queue based at least in part on the following: The first average dwell time and the first average number of high-priority data packets transmitted via the first multiplexing channel; and The second average dwell time and the second average number of data packets transmitted via the second multiplexing channel.

2. The non-transitory computer-readable medium as described in claim 1, wherein, The strategy defines that m high-priority packets transmitted via the first multiplexing channel must be processed before n low-priority packets are transmitted via the second multiplexing channel.

3. The non-transitory computer-readable medium as described in claim 1, wherein, The strategy defines that m bytes of high-priority packets transmitted via the first multiplexing channel should be processed before n bytes of low-priority packets transmitted via the second multiplexing channel.

4. The non-transitory computer-readable medium according to any one of claims 1 to 3, wherein: Routing the data packets includes routing the data packets across multiple sessions, and The strategy defines that the first session among the plurality of sessions takes precedence over the second session among the plurality of sessions.

5. The non-transitory computer-readable medium as described in any one of claims 1 to 3, the operation further comprising performing a cryptographic process based on the policy, the cryptographic process including decrypting, decapsulating, forwarding, and combinations thereof of the data packets.

6. A system for data transmission, comprising: processor; as well as A non-transitory computer-readable medium storing instructions that, when executed by the processor, cause the processor to perform operations, the operations including: A receiving strategy, which defines, at least in part, whether the data packet is transmitted via a first multiplexed channel or a second multiplexed channel based on the application that generated the data packet, wherein: The first multiplexed channel has a first priority. The second multiplexed channel has a second priority, and The first priority is defined as a higher priority than the second priority; The data packets are routed on the first multiplexing channel and the second multiplexing channel, at least in part, based on the strategy described above; The data packets transmitted through the first multiplexing channel and the second multiplexing channel are added to the queue; Based at least in part on the strategy, data packets transmitted via the first multiplexing channel are processed before data packets transmitted via the second multiplexing channel are processed, and the strategy further defines the processing of data packets in the queue based at least in part on the following: The first average dwell time and the first average number of high-priority data packets transmitted via the first multiplexing channel; and The second average dwell time and the second average number of data packets transmitted via the second multiplexing channel.

7. The system of claim 6, further comprising performing a cryptographic process based on the policy, the cryptographic process including encrypting the data packet, decrypting the data packet, decapsulating, forwarding, and combinations thereof.

8. The system of claim 6, wherein, The strategy defines that m high-priority packets transmitted via the first multiplexing channel must be processed before n low-priority packets are transmitted via the second multiplexing channel.

9. The system of claim 6, wherein, The strategy defines that m bytes of high-priority packets transmitted via the first multiplexing channel should be processed before n bytes of low-priority packets transmitted via the second multiplexing channel.

10. The system according to any one of claims 6 to 9, wherein: Routing the data packets includes routing the data packets across multiple sessions, and The strategy defines that the first session among the plurality of sessions takes precedence over the second session among the plurality of sessions.

11. The system of claim 10, wherein: The first session is associated with a live session that transmits data in real time, and The second session is associated with an off-site session that transmits data in a non-real-time instance.

12. A method for defining the priority of data packets within a queue, comprising: A receiving strategy, which defines, at least in part, whether the data packet is transmitted via a first multiplexed channel or a second multiplexed channel based on the application that generated the data packet, wherein: The first multiplexed channel has a first priority. The second multiplexed channel has a second priority, and The first priority is defined as a higher priority than the second priority; The data packets are routed on the first multiplexing channel and the second multiplexing channel, at least in part, based on the strategy described above; The data packets transmitted through the first multiplexing channel and the second multiplexing channel are added to the queue; Based at least in part on the strategy, data packets transmitted via the first multiplexing channel are processed before data packets transmitted via the second multiplexing channel are processed, and the strategy further defines the processing of data packets in the queue based at least in part on the following: The first average dwell time and the first average number of high-priority data packets transmitted via the first multiplexing channel; and The second average dwell time and the second average number of data packets transmitted via the second multiplexing channel.

13. The method of claim 12, further comprising performing a cryptographic process based on the policy, the cryptographic process including encrypting a plurality of data packets, decrypting the data packets, decapsulating, forwarding, and combinations thereof.

14. The method of any one of claims 12 to 13, wherein: Routing the data packets includes routing the data packets across multiple sessions. The policy defines that the first session among the plurality of sessions takes precedence over the second session among the plurality of sessions. The first session is associated with a live session that transmits data in real time, and The second session is associated with an off-site session that transmits data in a non-real-time instance.

15. An apparatus for defining the priority of data packets within a queue, comprising: A means for receiving a strategy, the strategy being at least in part based on the application generating the data packets to define whether the data packets are transmitted via a first multiplexed channel or a second multiplexed channel, wherein: The first multiplexed channel has a first priority. The second multiplexed channel has a second priority, and The first priority is defined as a higher priority than the second priority; A means for routing the data packets on the first multiplexing channel and the second multiplexing channel based at least in part on the strategy; A means for adding the data packets transmitted via the first multiplexing channel and the second multiplexing channel to the queue; A means for processing data packets transmitted via the first multiplexing channel prior to processing data packets transmitted via the second multiplexing channel, based at least in part on the strategy, wherein the strategy further defines the processing of data packets in the queue based at least in part on: The first average dwell time and the first average number of high-priority data packets transmitted via the first multiplexing channel; and The second average dwell time and the second average number of data packets transmitted via the second multiplexing channel.

16. The apparatus of claim 15, further comprising means for implementing the method of any one of claims 13 to 14.

17. A computer program product comprising instructions that, when executed by a computer, cause the computer to perform the steps of the method as claimed in any one of claims 12 to 14.

Images