IPsec Stream Pre-Processing for Lockless Parallel Packet Handling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for processing IPsec streams on multiple CPU cores face challenges in synchronization and resource integrity, leading to inefficient throughput and scalability issues, particularly in high-throughput environments like 5G communication systems.
Innovation Solution
A pre-processing module determines a security association for incoming IPsec streams, performing sequence number generation and anti-replay window checks before parallel processing, eliminating the need for locks and synchronization, thus optimizing cache memory utilization and achieving linear scalability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If conventional solutions (staging approach or Run to Completion with Locking) are used for processing IPsec streams, then standard compliance is maintained, but throughput and scalability are limited due to synchronization issues and memory access bottlenecks
Solution Approach 1:
The packet processing function is divided into two independent segments: pre-processing (SA determination and security parameter calculation) and parallel processing (encryption/decryption). This segmentation allows the pre-processing stage to prepare packets without requiring synchronization with parallel processing cores, eliminating memory access bottlenecks and enabling scalable throughput.
Solution Approach 2:
The security association determination and security parameter calculation are performed as preliminary actions before parallel processing begins. By determining the SA and calculating security parameters in advance during the pre-processing stage, the system eliminates the need for synchronization and locking mechanisms during the actual parallel processing, thereby improving throughput and scalability.
2Productivity
If locking and synchronization mechanisms are used to ensure data consistency, then reliability is maintained, but CPU cache memory utilization is inefficient and scalability is reduced
Solution Approach 1:
All data consistency requirements are addressed in the preliminary pre-processing stage where the security association is determined and security parameters are calculated. This preliminary action ensures data consistency is established before parallel processing begins, allowing subsequent parallel operations to proceed without locking mechanisms, thereby achieving both reliability and scalability.
Solution Approach 2:
The synchronization and locking mechanisms are extracted from the parallel processing pipeline and relocated to the pre-processing stage. By taking out these synchronization requirements and handling them beforehand, the parallel processing stage can operate independently on multiple CPU cores without contention, improving scalability while maintaining data consistency through the preliminary security parameter calculation.
3Productivity
If parallel processing is implemented without pre-processing, then processing speed increases, but synchronization issues and memory access bottlenecks arise
Solution Approach 1:
The processing pipeline is segmented into pre-processing and parallel processing stages. The pre-processing stage handles SA determination and security parameter calculation, while the parallel processing stage handles encryption/decryption. This segmentation maintains high processing speed by enabling true parallelism while improving synchronization efficiency by eliminating the need for locking mechanisms in the parallel stage.
Solution Approach 2:
By performing security association determination and parameter calculation as preliminary actions before parallel processing, the system enables faster parallel execution without synchronization overhead. The preliminary preparation of security parameters allows parallel cores to operate independently, maintaining processing speed while dramatically improving synchronization efficiency.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
Embodiments of the present disclosure relate to a method, apparatus and computer readable storage media for processing an Internet Protocol Security (IPsec) stream. A method comprises determining a security association for an incoming stream, the incoming streaming comprising a plurality of packets; performing pre-processing on the plurality of packets based on the security association; and in response to the pre-processing being performed on at least one of the plurality of packets, performing parallel processing on the at least one of the plurality of packets.