Deterministic IPSec Load Balancing via SPI Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IPsec protocols in virtualized environments fail to effectively distribute processing of encapsulated ESP encrypted data packets among multiple virtual CPUs due to the same source and destination IP addresses in the new IP header, leading to improper functioning of features like receive side scaling (RSS), resulting in non-uniform distribution of packets.
Innovation Solution
A method for deterministic load balancing involves initiating an IPSec tunnel, selecting a CPU core ID associated with a virtual CPU, and selecting an SPI value corresponding to that CPU core ID, which is indicated to the source tunnel endpoint for establishing an in-bound security association, ensuring that encapsulated ESP encrypted data packets are processed by specific virtual CPUs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IPsec protocols are deployed in virtualized computing instances to secure packet communication, then security protection is improved, but receive side scaling (RSS) and load balancing features fail to function properly
Solution Approach 1:
The system pre-establishes a mapping between SPI values and virtual CPU identifiers before IPsec processing begins. This preliminary action allows the destination tunnel endpoint to directly determine which virtual CPU should process each encapsulated packet based on its SPI value, enabling load balancing to function properly from the start without compromising security associations.
Solution Approach 2:
The patent introduces an intermediary mapping mechanism that translates SPI values (which are opaque to the virtualization layer) into virtual CPU identifiers. This intermediary layer allows RSS to work with IPsec-encrypted traffic by providing a bridge between the security protocol's addressing scheme and the virtualization layer's load balancing requirements.
2Ease of operation
If encapsulated ESP encrypted data packets use the same source and destination IP addresses in the new IP header, then tunnel endpoint identification is simplified, but packet distribution across multiple virtual CPUs becomes non-uniform
Solution Approach 1:
The system changes the parameter used for packet distribution from IP addresses to SPI values. Since SPI values are unique for each security association and can be controlled during SA establishment, they provide a better basis for hash-based distribution across multiple virtual CPUs, achieving uniform packet distribution while maintaining simplified tunnel endpoint identification.
Solution Approach 2:
The patent applies different qualities to different parts of the packet processing: the IP header maintains uniform source and destination addresses for simplicity, while the SPI value in the ESP header provides the differentiation needed for load balancing. This local quality differentiation allows both simplicity and distribution uniformity to coexist.
3Productivity
If virtual network interface controllers perform receive side scaling based on hash values of incoming packet headers, then processing distribution is improved, but encapsulated IPsec packets cannot be properly distributed due to identical IP addresses
Solution Approach 1:
The system changes the input parameters for hash computation from IP header fields to ESP header fields (specifically the SPI value). This parameter change provides sufficient entropy for accurate hash computation and proper packet distribution, overcoming the limitation of identical IP addresses in encapsulated packets.
Data Source
AI summary
Certain embodiments described herein are generally directed to deterministic load balancing of processing encapsulated encrypted data packets at a destination tunnel endpoint. In some embodiments, an IPSec component residing within a destination tunnel endpoint is configured to select a CPU core ID of a virtual CPU using a CPU selection function. In some embodiments, the IPSec component selects an SPI value corresponding to the CPU core ID. In some embodiments, the IPsec component indicates the SPI value to a source tunnel endpoint for use in establishing an in-bound security association, wherein the in-bound security association is used by the source tunnel endpoint to encrypt a data packet received from the source endpoint and destined for the destination endpoint.