IPsec Tunnel Load Distribution for Multicore Anti-Replay Scaling

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

IPsec processing, particularly anti-replay, is complex and difficult to scale in multi-core environments due to packet reordering and synchronization challenges.

Innovation Solution

Implementing a subspace ID approach to distribute IPsec processing load across multiple cores by encoding subspace ID information in unencrypted data packet headers, allowing for efficient load balancing and minimizing packet reordering and loss.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If IPsec processing is performed in multi-core environments, then processing capacity is improved, but packet reordering and synchronization complexity increase

Engineering Contradiction:

ImproveIPsec processing capacityVSAvoidsynchronization complexity

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The patent divides the IPsec processing workload into separate segments for encryption and decryption operations, assigning them to different cores. This segmentation allows independent processing of outbound and inbound traffic, improving overall processing capacity while reducing synchronization complexity through clear separation of duties between cores.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces a load balancer as an intermediary component that distributes packets between multiple cores. This intermediary manages the complexity of multi-core coordination by centralizing the decision-making logic for packet routing, thereby improving processing capacity while containing synchronization complexity within a single coordination point.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Productivity

If load distribution is implemented across multiple cores, then processing throughput is improved, but packet loss increases

Engineering Contradiction:

Improveprocessing throughputVSAvoidpacket loss

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent performs preliminary actions by pre-establishing security associations and configuring load distribution rules before actual IPsec processing begins. This preliminary configuration ensures that packet routing decisions can be made quickly without additional processing delays, improving throughput while maintaining reliability through pre-validated routing paths.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent implements feedback mechanisms that monitor packet distribution across cores and adjust load balancing decisions based on observed performance. This feedback loop allows the system to dynamically optimize throughput while detecting and correcting conditions that might lead to packet loss, thereby improving both throughput and reliability simultaneously.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS20260025368A1Load distribution of internet protocol security tunnel for multicore processing

Publication Date: 2026.01.22 CISCO TECHNOLOGY INC

AI summary

In one embodiment, a method includes receiving, by a first processor, a data packet for processing, the data packet including a header in an unencrypted portion of the data packet, the header having subspace ID information corresponding to a core from which the data packet was sent; saving, by the first processor, the subspace ID information; encoding, within the header, a selected subspace ID information identifying a core within the first processor to which subsequent data packets are to be received; and sending, by the first processor, in another data packet, the selected subspace ID information to a second processor that sent the data packet, the selected subspace ID information included in a header in an unencrypted portion of the data packet.