Hybrid IPsec Offloading for Controller Load Balancing

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current IPsec offloading technologies face limitations in processing overhead and scalability, particularly in multiple controller systems where hardware implementations can bottleneck due to resource constraints, while software implementations consume CPU resources and offer lower performance.

Innovation Solution

A hybrid IPsec offloading approach that dynamically balances IPsec security associations between hardware and software implementations, prioritizing hardware-based offloading until resource thresholds are reached, then switching to software-based offloading to optimize performance and scalability.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If hardware-based IPsec offloading is used, then processing efficiency is improved, but resource constraints cause bottlenecks in multiple controller systems

Engineering Contradiction:

Improveprocessing efficiencyVSAvoidscalability

Core Design Contradiction:

ProductivityVSAdaptability or versatility

Solution Approach 1:

The patent implements dynamic load balancing that automatically adjusts the distribution of IPsec security associations between hardware and software processing based on real-time resource utilization metrics. When hardware resources approach threshold levels, the system dynamically transitions excess SAs to software processing, preventing hardware bottlenecks while maintaining optimal processing efficiency.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The patent segments IPsec security associations into different processing paths based on controller priority and resource availability. High-priority controllers receive preferential treatment for hardware-based processing, while lower-priority controllers are routed to software processing when hardware resources are constrained, enabling scalable support for multiple controllers.

Inventive Principle:

Principle #1Segmentation

2Adaptability or versatility

If software-based IPsec offloading is used, then scalability is improved, but CPU resource consumption increases and performance decreases

Engineering Contradiction:

ImprovescalabilityVSAvoidperformance

Core Design Contradiction:

Adaptability or versatilityVSProductivity

Solution Approach 1:

The patent applies different processing qualities to different security associations based on controller priority and resource availability. Critical controllers receive high-performance hardware processing, while non-critical controllers use software processing, optimizing overall system performance while maintaining scalability.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The patent uses hardware processing capacity partially, reserving headroom for dynamic allocation. By operating hardware resources below maximum capacity and maintaining a pool of software processing capability, the system achieves both high performance and scalability without over-committing resources.

Inventive Principle:

Principle #16Partial or excessive action

3Quantity of substance

If multiple controllers are added to the system, then system capacity is improved, but hardware resource constraints are exacerbated

Engineering Contradiction:

Improvesystem capacityVSAvoidprocessing efficiency

Core Design Contradiction:

Quantity of substanceVSProductivity

Solution Approach 1:

The patent creates a universal processing architecture where both hardware and software pathways can handle IPsec security associations. This multi-functionality allows the system to accommodate multiple controllers by dynamically routing SAs to appropriate processing paths, preventing hardware resource exhaustion while maintaining processing efficiency.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS12132714B2Internet protocol security (IPsec) security associations (SA) balance between heterogeneous cores in multiple controller system

Publication Date: 2024.10.29 HEWLETT PACKARD ENTERPRISE DEV LP

AI summary

Systems are methods are provided for implementing load balancing of IPsec security associations (SAs) SAs between different heterogeneous cores, for example in a multiple controller systems. The balancing of IPsec SAs are performed using software implementations of IPsec offloading and/or hardware implementations of IPsec offloading. By balancing the processing functions related to orchestration of IPsec SAs between hardware (e.g., IPsec hardware accelerator) and software (e.g., IPsec software accelerator), the methods realize increased optimization, improved user experience, and enhanced product performance in networks using IPsec. For example, an IPsec session is initiated, and it is determined whether a resource limitation for a hardware-based IPsec accelerator has been reached. If the limitation for the hardware-based IPsec accelerator has been reached, processing for the IPsec SA for the initiated IPsec session is offloaded to a software-based IPsec accelerator.