IPsec Load Balancer SPI-Based Endpoint Routing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current load balancing technologies face challenges in efficiently distributing Internet Protocol Security (IPsec) traffic across multiple endpoints, as they rely solely on source IP addresses, which leads to all traffic from a single IP address being directed to the same endpoint, limiting the ability to distribute VPN traffic effectively.
Innovation Solution
A load balancer that receives IPsec packets with unrecognized source IP addresses and SPIs forwards them to multiple endpoints, determining the appropriate endpoint based on response messages, and updates a mapping table to direct subsequent packets to the correct endpoint, utilizing both IP addresses and SPIs for accurate routing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If load balancer directs all traffic from a single source IP address to the same endpoint, then traffic routing is simplified, but load distribution across multiple endpoints is reduced
Solution Approach 1:
The patent introduces a new dimension for traffic routing by using SPI (Security Parameter Identifier) in addition to source IP address. This allows the load balancer to differentiate between multiple IPsec tunnels from the same source IP and distribute them to different endpoints, resolving the contradiction between routing simplicity and load distribution effectiveness.
2Device complexity
If load balancer uses only source IP address for routing, then routing decision is simple, but multiple IPsec tunnels from same IP cannot be distributed
Solution Approach 1:
The patent segments the routing decision process into two parts: first using source IP address for initial endpoint selection, then using SPI for precise tunnel identification. This segmentation allows the system to handle both simple and complex routing scenarios efficiently, improving adaptability without significantly increasing overall system complexity.
Solution Approach 2:
By adding SPI as a second dimension to the routing decision (complementing source IP address), the system gains the ability to distinguish and distribute multiple IPsec tunnels from the same source IP to different endpoints, enhancing versatility while maintaining manageable complexity.
3Device complexity
If same server processes all IPsec tunnel traffic, then tunnel maintenance is simplified, but processing capacity is limited
Solution Approach 1:
The patent enables multiple endpoints to universally handle IPsec tunnel traffic by implementing a standardized mechanism where each endpoint can process tunnels it is assigned to. The load balancer distributes tunnels across endpoints based on SPI matching, allowing the system to scale processing capacity while maintaining simplified tunnel management through the mapping table mechanism.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A load balancer is provided that can direct Internet Protocol Security (IPsec) traffic received from a single IPsec tunnel initiator to one of a plurality of endpoints provided Virtual Private Network (VPN) gateways in a network. The load balancer uses IP (Internet Protocol) addresses and SPIs (Security Parameter Identifier) to identify an endpoint responsible for processing particular packets for the VPN. Messages received at the load balancer from the endpoints are utilized to map endpoints responsible for processing packets having a particular IP address and SPI for forwarding IPsec traffic to the correct endpoint.