Lockless IPsec Processing via Atomic SA Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In distributed processing environments, IPsec packets from the same stream require serialized processing due to the use of locks, which limits processing efficiency by preventing concurrent processing across multiple cores.
Innovation Solution
Implementing atomic operations to allow parallel processing of IPsec packets without taking a lock on data structures related to Security Associations, enabling multiple processing cores to process packets in parallel while maintaining data coherence.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If locks are used to enforce serialization for IPsec packets from the same stream, then data coherence is maintained, but processing efficiency deteriorates due to prevention of concurrent processing across multiple cores
Solution Approach 1:
The patent segments the Security Association data structure into multiple per-core instances, where each processing core has its own copy of the SA data. This allows each core to process packets independently without requiring locks, as modifications to one core's SA copy do not affect other cores. The segmentation eliminates the need for serialized access while maintaining data coherence within each core's processing context.
Solution Approach 2:
The patent implements local quality by allowing each processing core to have its own local copy of the Security Association data structure with locally optimized access patterns. Each core can modify its local SA copy without affecting other cores, enabling parallel processing while maintaining data integrity within each core's local context. This localizes the data access and eliminates the need for global locking mechanisms.
2Reliability
If locks are used to prevent concurrent access to Security Association data structures, then data integrity is maintained, but processing performance deteriorates due to serialized processing requirements
Solution Approach 1:
The Security Association data structure is segmented into multiple per-core instances, allowing each processing core to access and modify its own local copy without requiring locks. This segmentation enables parallel access across multiple cores while maintaining data integrity within each core's processing context, eliminating the performance penalty of serialized access.
Solution Approach 2:
The patent creates copies of the Security Association data structure for each processing core. Each core operates on its own copy, which eliminates the need for locking mechanisms and allows simultaneous access by multiple cores. The copying approach maintains data integrity by ensuring that each core works with a consistent snapshot of the SA data without interfering with other cores.
3Stability of the object's composition
If serialized processing is used for IPsec packets from the same stream, then correct packet ordering is maintained, but processing speed deteriorates due to inability to process packets concurrently
Solution Approach 1:
The patent segments the processing state into per-core instances, allowing multiple cores to process packets concurrently. Each core maintains its own processing state and can independently handle packets without requiring serialized access. This segmentation enables parallel processing while maintaining correct packet ordering within each core's processing stream through local sequence number tracking.
Data Source
AI summary
According to one embodiment of the invention, a plurality of IPsec packets belonging to a single IPsec tunnel are received. Different ones of the plurality of IPseck packets are distributed to different ones of a plurality of processing cores of a network element. At least some of those IPsec packets are processed in parallel and without taking a lock on a Security Association (SA) data structure storing a SA associated with the plurality of IPsec packets. The SA is atomically accessed and atomically updated.