Gateway Flow Label Allocation for IPsec Queue Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In computing networks, gateways face difficulties in distributing packets across multiple queues for processing, particularly when using IPsec tunnels, as maintaining sequence numbers and replay windows becomes challenging due to varying queue identification rates.
Innovation Solution
A first gateway identifies the number of processing queues at a second gateway, generates a flow label based on packet addressing attributes, encapsulates the packet with this label, and communicates it to the second gateway, allowing for efficient queue allocation and sequence number management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If packets are distributed across multiple queues for processing, then processing throughput is improved, but maintaining sequence numbers and replay windows becomes difficult due to varying queue identification rates
Solution Approach 1:
The patent introduces an intermediary mechanism (flow label and sequence number mapping structure) that bridges the sender gateway and receiver gateway to maintain sequence number consistency across multiple queues. The flow label acts as a mediator that carries queue identification information through the IPsec tunnel, enabling the receiver to correctly associate packets with their respective sequence numbers regardless of which queue processes them.
Solution Approach 2:
The sender gateway performs preliminary actions by generating flow labels and establishing sequence number mappings before packets are distributed to multiple queues. This pre-configuration ensures that when packets arrive at the receiver through different queues, the sequence number information is already embedded in the flow labels, eliminating the need for complex real-time synchronization between queues.
2Productivity
If multiple queues are used for packet processing, then load distribution is improved, but queue allocation and sequence number management complexity increases
Solution Approach 1:
The patent changes the parameter representation by introducing flow labels that encode queue identification information. Instead of managing complex queue states and synchronization protocols, the system transforms queue management into a parameter-based approach where flow labels carry all necessary information about packet-to-queue mapping, significantly simplifying the management complexity.
Solution Approach 2:
The patent segments the sequence number management by creating separate sequence number spaces for different flows (identified by flow labels). This segmentation allows each queue to independently manage its own sequence numbers without interfering with other queues, reducing the overall system complexity while maintaining efficient load distribution.
3Reliability
If sequence numbers are maintained for each queue, then replay window accuracy is improved, but processing overhead increases due to varying identification rates
Solution Approach 1:
The patent merges the queue identification function with the flow label mechanism. By combining queue identification and sequence number tracking into a unified flow label structure, the system eliminates the need for separate queue management overhead. The flow label serves multiple purposes simultaneously: identifying the queue, carrying sequence number information, and enabling replay window validation, thereby reducing processing overhead while maintaining accuracy.
Data Source
AI summary
Described herein are systems, methods, and software to manage processing queue allocation based on addressing attributes of an inner packet. In one implementation, a first gateway identifies processing queues at a second gateway and assigns a unique flow label to each of the processing queues. The first gateway further receives a packet from a computing node that is directed toward the second gateway. The first gateway hashes addressing information in the packet to select a flow label, encapsulates the packet with the flow label in the outer encapsulation header for the encapsulated packet, and forwards the packet toward the second gateway.