IPsec Load Balancing Using Minimal Tunnel Decryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IPsec-based VPNs disrupt network performance by obfuscating information used for load balancing, leading to inefficiencies in managing secure network traffic flows.
Innovation Solution
A load balancer minimally decrypts encrypted packets using shared tunnel keys to identify N-tuples, allowing efficient load balancing across security appliances within a secure connection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IPsec encryption is applied to secure network traffic, then security is improved, but load balancing capability deteriorates due to obfuscated packet information
Solution Approach 1:
The patent extracts only the necessary portion of encrypted packet data (N-tuple information) required for load balancing decisions, rather than decrypting the entire packet. This allows load balancing to function with minimal decryption, maintaining security while restoring load balancing capability.
Solution Approach 2:
The patent introduces an intermediary mechanism that works with the encrypted packets without full decryption. The load balancer uses the encrypted N-tuple information as an intermediary to make routing decisions, bridging the gap between security requirements and load balancing needs.
2Measurement precision
If full decryption of encrypted packets is performed for load balancing, then load balancing accuracy is improved, but security deteriorates due to exposure of encrypted data
Solution Approach 1:
The patent extracts only the specific N-tuple information needed for accurate load balancing decisions while leaving the rest of the encrypted packet data intact. This extraction approach provides sufficient precision for load balancing without compromising security by exposing unnecessary encrypted data.
Solution Approach 2:
The patent applies partial decryption action - decrypting only the minimum necessary portion of the packet (the N-tuple) rather than performing excessive full decryption. This partial action achieves the required load balancing accuracy while maintaining security boundaries.
3Reliability
If encrypted network traffic is transmitted through security appliances, then security is maintained, but network performance deteriorates due to inability to effectively manage traffic flows
Solution Approach 1:
The patent extracts essential traffic flow identification information (N-tuple) from encrypted packets to enable effective traffic management and load balancing. This extraction restores network performance by allowing security appliances to manage encrypted traffic flows efficiently without compromising security.
Solution Approach 2:
The patent enables the encrypted traffic itself to carry usable information (encrypted N-tuple) that allows the network system to self-manage the traffic flows. The encrypted packets essentially serve their own management needs by containing extractable routing information.
Data Source
AI summary
While organizations can employ IPsec based VPNs to securely connect different sites (e.g., branch sites, data centers, and/or virtual private clouds), the security can disrupt network performance by obfuscating information used for load balancing. Disclosed is technology that employs minimal decryption in a secure manner to load balance multiple network traffic flows within a secure connection (“tunnel”) across security appliances that effectively operate as alternative endpoints for the tunnel. The security appliances within a load balancing pool are configured/programmed to share tunnel keys with each other after tunnel establishment and with the load balancer. The load balancer uses the tunnel keys to minimally decrypt in a lookaside memory encrypted packets to ascertain N-tuples. The load balancer then uses the N-tuples to load balance the flows within a tunnel across the security appliances.