IPSec Tunnel Stream Routing to Preserve Decryption Order
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing IPSec tunnel processing performance is limited by hardware and existing methods fail to address the message disorder caused by multiple decryption units processing messages out of sequence, which affects the 5G network's high data transmission rate requirements.
Innovation Solution
A method where a virtual SPI identifier is determined based on the stream identifier and IPSec tunnel SPI identifier, ensuring each encrypted message is sent to the same decryption unit, thereby maintaining message order and improving processing performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If multiple decryption units are used to process messages in parallel, then processing performance is improved, but message disorder occurs
Solution Approach 1:
The patent introduces a virtual SPI identifier as an intermediary mechanism that mediates between multiple decryption units and data streams. This virtual identifier acts as a mediator that directs messages from the same data stream to the same decryption unit, preventing message disorder while allowing multiple decryption units to operate in parallel for improved performance.
Solution Approach 2:
The patent segments the decryption function by creating multiple decryption units, each responsible for specific virtual SPI identifiers. This segmentation allows parallel processing of different data streams while maintaining order within each stream by assigning dedicated decryption units to specific virtual SPI identifiers.
2Reliability
If a single decryption unit processes all messages sequentially, then message order is maintained, but processing performance is limited
Solution Approach 1:
The patent adds a new dimension to the decryption architecture by introducing virtual SPI identifiers that create logical channels. This dimensional addition allows messages from different data streams to be processed in parallel across multiple decryption units while maintaining sequential order within each logical channel, effectively resolving the performance-order tradeoff.
Solution Approach 2:
The virtual SPI identifier mechanism provides universal functionality across multiple decryption units, allowing each unit to handle multiple data streams identified by different virtual SPI identifiers. This multi-functionality enables parallel processing while maintaining message order through the unified virtual identifier system.
Data Source
Figure 1~3
Figure 4~6
Figure 7~8
AI summary
A data transmission method and apparatus, a related device, and a storage medium are provided. The method includes that: a virtual Security Parameter Index (SPI) identifier is determined according to a stream identifier of a data stream and an SPI identifier of an Internet Protocol Security (IPSec) tunnel through which the data stream is transmitted; the virtual SPI identifier is added in each encrypted message in the data stream; and the data stream is transmitted to a receiver through the IPSec tunnel, wherein the virtual SPI identifier is used for the receiver to transmit each encrypted message in the data stream to a same encryption unit for decryption processing.