IPsec Gateway Packet Decryption With Per-Flow Core Distribution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing IPsec tunnel encryption protocols cause resource waste and out-of-sequence issues in data cores due to per-packet forwarding of encrypted service packets, leading to increased processing pressure and reduced efficiency.
Innovation Solution
Implement a hardware decryption module in a gateway apparatus to decrypt IPsec-encrypted packets, followed by per-flow distribution to data cores based on inner packet characteristics, ensuring sequential and balanced resource utilization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If per-packet forwarding is used for IPsec-encrypted service packets, then all encrypted packets with identical outer layer 5-tuple are uploaded to the same data core for decryption, but this causes significant processing pressure on that single data core while other data cores remain idle, leading to resource waste
Solution Approach 1:
The patent segments the processing of encrypted packets by extracting the inner packet 5-tuple (source IP, destination IP, source port, destination port, protocol) from each encrypted packet and using it to determine the target data core. This segmentation allows different inner packets to be distributed to different data cores based on their inner 5-tuple characteristics, even though the outer layer 5-tuple is identical. The IPsec service module performs this segmentation and distribution, preventing single-core overload and improving overall system productivity.
2Stability of the object's composition
If per-flow forwarding is used, then encrypted service packets with identical outer layer 5-tuple are distributed to the same data core, but this results in the same data core being overloaded while other data cores are underutilized
Solution Approach 1:
The patent applies local quality by making the data core selection criterion packet-specific rather than flow-specific. Instead of using outer layer 5-tuple (which is identical for all packets in a flow) to determine the data core, the system extracts and uses the inner packet 5-tuple characteristics. This allows each packet to be routed to an appropriate data core based on its specific inner characteristics, improving resource utilization while maintaining flow consistency through the IPsec tunnel.
3Reliability
If all encrypted service packets are processed by a single data core, then decryption and decapsulation can be completed, but this creates a bottleneck that reduces overall packet processing throughput
Solution Approach 1:
The patent performs preliminary action by having the IPsec service module extract the inner packet 5-tuple information and determine the target data core before the actual decryption process. This preliminary classification and distribution of encrypted packets to different data cores based on inner packet characteristics prevents the bottleneck that would occur if all packets were processed sequentially by a single core. Multiple data cores can then perform decryption in parallel, significantly improving throughput while maintaining reliability.
Data Source
Figure 1~2
Figure 3a
Figure 3b
AI summary
Disclosed are a method and an apparatus for packet processing, the method applied to a first gateway apparatus with a hardware decryption module, an IPsec service module, and a plurality of data cores, the method comprises: receiving, by the IPsec service module, a service packet sent by a second gateway apparatus through an IPsec tunnel; invoking, by the IPsec service module, the hardware decryption module in response to a determination that the service packet is encapsulated with, Encapsulating Security Payload, ESP protocol; decrypting, by the hardware decryption module, the service packet, and obtaining an inner packet of the service packet; obtaining, by the IPsec service module, a data core associated with the inner packet on a per-flow basis so that the inner packet is to be forwarded via the associated data core.