Flow-Based Anti-Replay Checking for Multi-Core IPSec
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-core processor environments, maintaining sequence number integrity for IPSec tunnel mode leads to serialization of packet processing, degrading throughput due to lock acquisition and difficulty in non-memory shared cluster systems, which hampers effective distribution of packets across processing units and increases the risk of replay attacks.
Innovation Solution
Implementing a flow-based sequence context for each packet flow, where one core manages a flow and maintains the sequence number, allowing parallel processing of IPSec tunnels and using the Internet Key Exchange (IKE) protocol for negotiation between sender and receiver systems to manage and distribute packets across multiple cores.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sequence number checking is performed in anti-replay protocol, then replay attack prevention is improved, but packet processing throughput deteriorates due to serialization
Solution Approach 1:
The patent segments the single sequence number context into multiple flow-specific sequence contexts, where each flow maintains its own sequence number. This allows different flows to be processed in parallel by different cores without requiring serialization, thus maintaining replay attack prevention while improving packet processing throughput in multi-core systems.
2Stability of the object's composition
If locks are taken to serialize packet processing for sequence number integrity, then sequence number integrity is improved, but overall throughput deteriorates
Solution Approach 1:
The patent divides the sequence number state into multiple independent flow contexts, each maintained by the same or different cores. This segmentation eliminates the need for locks when processing different flows simultaneously, as each flow's sequence number is independent. Sequence number integrity is maintained within each flow while overall throughput improves through parallel processing.
3Measurement precision
If sequence numbers are read and updated on per packet basis, then anti-replay checking accuracy is improved, but distribution of packets to processing units deteriorates
Solution Approach 1:
The patent segments the anti-replay checking into flow-specific sequence contexts rather than a single global sequence number. Each core can maintain and check sequence numbers for assigned flows independently, enabling efficient packet distribution to multiple processing units while maintaining accurate anti-replay checking for each flow.
4Productivity
If per-flow sequence context is maintained by each core, then parallel processing of IPSec tunnels is improved, but device complexity increases
Solution Approach 1:
The patent segments sequence context management into independent per-flow contexts that can be distributed across multiple cores. Each core manages sequence contexts for flows assigned to it, enabling parallel processing of IPSec tunnels. The complexity is managed through clear separation of concerns, where each core independently handles its assigned flows without requiring complex inter-core coordination.
Data Source
AI summary
This disclosure describes an approach to detect replay attacks while having multiple cores in a multi-core processor manage an established tunneling session. The tunneling session includes a number of flows. One of the cores is assigned to manage one of the flows, and another core is assigned to manage another of the flows. A replay attack over the tunneling session is inhibited by maintaining a flow-based sequence context at each of the flows, and the flow-based sequence context is maintained by the core that is managing the respective flow.