Deterministic IPSec Load Balancing via SPI Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualized environments, IPsec protocols used for securing communication between endpoints lead to improper functioning of certain features, particularly due to the inability of virtual network interface controllers (VNICs) to perform receive side scaling (RSS) for encapsulated ESP encrypted data packets, resulting in uneven distribution of processing load across multiple virtual CPUs.
Innovation Solution
A method for deterministic load balancing of encapsulated encrypted data packets at a destination tunnel endpoint involves configuring the destination tunnel endpoint with an ESP RSS mode to assign incoming packets to specific RSS queues based on an identifier encoded in the Security Parameter Index (SPI) value, ensuring even distribution across multiple virtual CPUs by selecting a CPU using a CPU selection function and encoding the identifier in the SPI value during IPSec tunnel creation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If VNIC performs RSS for encapsulated ESP encrypted data packets using traditional IP address hashing, then packet distribution is attempted, but all packets from the same source TEP hash to the same queue resulting in uneven load distribution
Solution Approach 1:
The patent changes the hashing parameter from traditional IP address fields to the SPI value in the ESP header. By using SPI as the hashing key instead of source/destination IP addresses, the system achieves uniform packet distribution across multiple queues. This parameter change resolves the contradiction by enabling load-balanced processing while maintaining RSS functionality for encrypted traffic.
2Ease of operation
If VNIC uses traditional RSS hashing based on IP header attributes, then packet routing is simplified, but the encryption of packet payloads prevents access to necessary routing information
Solution Approach 1:
The patent uses the SPI value as an intermediary that carries routing information. The SPI acts as a mediator between the encrypted packet and the RSS mechanism, providing the necessary routing decisions without requiring decryption of the packet payload. This allows the system to maintain both encryption security and RSS functionality by using SPI as the key to access routing information.
3Device complexity
If all packets are processed by a single CPU, then processing is simple, but processing bottlenecks occur under high load conditions
Solution Approach 1:
The patent segments the processing workload by distributing packets to multiple CPU cores through RSS. Instead of a single centralized processing path, the system divides the packet processing task across multiple parallel CPUs. This segmentation resolves the contradiction by enabling high-throughput processing while maintaining manageable complexity through automated packet-to-CPU mapping via hashing.
Data Source
AI summary
Certain embodiments described herein are generally directed to systems and methods for deterministic load balancing of processing encapsulated encrypted data packets at a destination tunnel endpoint. For example, certain embodiments described herein relate to configuring a destination tunnel endpoint (TEP) with an encapsulating security payload (ESP) receive side scaling (RSS) mode to assign each incoming packet, received from a certain source endpoint (EP), to a certain RSS queue based on an identifier that is encoded in an SPI value included the packet.