IPSec Tunnel Lookup Acceleration via Inner IP Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network stack implementations face performance issues with IPSec tunnels due to the need for multiple route lookups, which introduce latency and scalability problems, especially when handling a large number of tunnels.
Innovation Solution
The proposed solution accelerates packet processing by using Security Association end points to bypass the route lookup for inner IP addresses, relying on IPsec policies to ensure routability and eliminate unnecessary route lookups, thereby reducing storage footprint and improving tunnel setup speed and throughput.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If route lookup is performed for inner IP address in IPSec tunnel processing, then packet routing accuracy is ensured, but processing latency increases and throughput decreases
Solution Approach 1:
The patent extracts the route lookup operation for inner IP addresses from the IPSec tunnel processing path. By removing this unnecessary lookup step while maintaining routing accuracy through alternative mechanisms (such as using outer IP address routing or pre-configured tunnel endpoints), the system eliminates a significant source of processing latency and improves overall throughput.
Solution Approach 2:
The patent performs routing decisions based on outer IP addresses before IPSec tunnel establishment, or pre-configures tunnel endpoints with their corresponding inner IP address mappings. This preliminary action eliminates the need for real-time inner IP route lookups during packet processing, thereby reducing latency while maintaining routing accuracy.
2Reliability
If multiple route lookups are performed for each IPSec tunnel packet, then routing correctness is maintained, but system scalability deteriorates when handling large numbers of tunnels
Solution Approach 1:
The patent removes the redundant inner IP route lookup from the IPSec processing path. By relying on outer IP address routing (which is already performed for standard packet routing) and pre-established tunnel endpoint mappings, the system maintains routing correctness while dramatically improving scalability to handle large numbers of concurrent tunnels.
Solution Approach 2:
The patent makes the outer IP address routing mechanism serve dual purposes: both standard packet routing and IPSec tunnel routing. This multi-functionality eliminates the need for separate inner IP route lookup tables and operations, improving both routing correctness and system scalability.
3Adaptability or versatility
If route table is used for both inner and outer IP address lookup, then comprehensive routing coverage is achieved, but storage footprint increases
Solution Approach 1:
The patent makes the outer IP address route table serve multiple functions: it handles both standard packet routing and IPSec tunnel endpoint routing. This eliminates the need for separate inner IP route tables, reducing storage footprint while maintaining comprehensive routing coverage through the unified outer IP routing mechanism.
Data Source
AI summary
A method and computer readable medium for providing accelerated lookup for ESP IPsec tunnels is presented. In one embodiment a method includes receiving an IP packet at a network stack; performing IPsec policy lookup of the IP packet to identify an ESP tunnel IP, thereby ensuring an inner IP is routable at an other end of the tunnel without installing a route for the inner IP at the network stack; performing a route lookup for the tunnel IP; and sending the IP packet across the ESP tunnel.