Mixed-Mode IPsec SAs for IPv4/IPv6 Load Balancing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing IPsec traffic processing systems face inefficiencies due to overutilization of paths and limited CPU utilization when handling both IPv4 and IPv6 traffic, leading to suboptimal performance in VPNs.
Innovation Solution
Implementing a method for load balancing data message flows across multiple mixed-mode IPsec security associations (SAs) that handle both IPv4 and IPv6 traffic, using a dual-stack virtual tunnel interface and a security parameter index (SPI) for encapsulation and distribution, enabling mixed-mode SAs during IKE negotiations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If separate SAs are negotiated for IPv4 and IPv6 traffic types, then protocol-specific security associations are established, but path overutilization occurs and CPU utilization is limited
Solution Approach 1:
The patent combines multiple protocol-specific SAs (IPv4 and IPv6) into a single mixed-mode SA that handles both traffic types. This merging allows traffic from multiple protocols to share the same security association and path, preventing path overutilization and improving overall path utilization efficiency while maintaining protocol-specific security requirements.
Solution Approach 2:
The mixed-mode SA is designed to serve multiple functions by handling both IPv4 and IPv6 traffic within a single security association. This universal SA can process different protocol types through a unified decryption pipeline, enabling multiple CPU cores to be utilized effectively and improving productivity without sacrificing protocol-specific reliability.
2Reliability
If dedicated SAs are used for each protocol, then protocol security requirements are met, but decryption performance is limited due to insufficient CPU utilization
Solution Approach 1:
The patent merges IPv4 and IPv6 decryption operations into a unified decryption pipeline within the mixed-mode SA. This allows multiple CPU cores to participate in decryption processing simultaneously, improving decryption performance and CPU utilization while maintaining protocol-specific security compliance through protocol-aware processing stages.
Solution Approach 2:
The mixed-mode SA implements dynamic protocol detection and routing within the decryption pipeline. The system can dynamically identify whether incoming traffic is IPv4 or IPv6 and route it to the appropriate processing stage, enabling flexible CPU core assignment and improving decryption performance while ensuring protocol-specific security requirements are met.
3Productivity
If mixed-mode SAs are implemented to handle both IPv4 and IPv6, then CPU utilization improves, but SA complexity increases
Solution Approach 1:
The mixed-mode SA is segmented into distinct processing stages for IPv4 and IPv6 handling. Each stage is responsible for specific protocol processing, which simplifies the overall configuration by providing clear separation of duties. This segmentation allows the system to maintain high CPU utilization through parallel processing while reducing SA configuration complexity through modular design.
Solution Approach 2:
The patent introduces an intermediary protocol detection mechanism that sits between the incoming traffic and the protocol-specific processing stages. This intermediary automatically identifies the traffic type and routes it to the appropriate processing path, reducing the complexity of SA configuration by eliminating the need for manual protocol-specific routing setup while maintaining high CPU utilization through efficient traffic distribution.
Data Source
AI summary
Some embodiments provide a method of load balancing data message flows across multiple secure connections. The method receives a data message having source and destination addresses formatted according to a first protocol. Based on the source and destination addresses, the method selects one of the multiple secure connections for the data message. Each of the secure connections handles a first set of connections formatted according to the first protocol and a second set of connections formatted according to a second protocol that is an alternative to the first protocol. The method securely encapsulates the data message and forwards the encapsulated data message onto a network. The encapsulation includes an identifier for the selected secure connection.