Packet Flow Identifier for Parallel Anti-Replay Processing

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Anti-replay protection methods, such as those used in IPsec, can cause bottlenecks in packet processing, especially when parallelization of packet decapsulation is involved, leading to slowed processing even with multiple cores, as they require sequential checking of sequence numbers.

Innovation Solution

The method involves determining a flow identifier based on the sequence number to distribute packets across multiple processing entities, allowing for parallel processing and reducing the need for sequential checking by using the sequence number to select the appropriate processing entity for each packet.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If anti-replay protection is implemented using sequential sequence number checking, then security against replay attacks is improved, but packet processing speed deteriorates due to bottlenecks

Engineering Contradiction:

Improveanti-replay protectionVSAvoidpacket processing speed

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent divides the single sequential anti-replay checking process into multiple parallel checking streams, each handled by a separate processing entity. Packets are distributed to different processing entities based on sequence number ranges, allowing simultaneous anti-replay validation without bottlenecks.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent implements dynamic sequence number range assignment to processing entities. The lower bound values for sequence number ranges are adjusted based on current processing status and load, enabling flexible parallel processing while maintaining security. This dynamic allocation allows the system to adapt to varying packet rates and maintain both security and speed.

Inventive Principle:

Principle #15Dynamics

2Productivity

If multiple processing entities are provided for parallel packet processing, then processing capacity is improved, but coordination overhead increases due to sequence number management

Engineering Contradiction:

Improveprocessing capacityVSAvoidcoordination overhead

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The patent segments the sequence number space into distinct ranges assigned to different processing entities. Each entity independently manages its assigned range with a local lower bound counter, eliminating the need for complex inter-entity coordination. This segmentation reduces overhead while maintaining parallel processing capacity.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Each processing entity autonomously manages its own sequence number validation within its assigned range, maintaining its own lower bound counter without requiring centralized coordination. This self-service approach minimizes communication overhead and simplifies the system architecture while enabling parallel processing.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS10841840B2Processing packets in a computer system

Publication Date: 2020.11.17 SSH COMMUNICATIONS SECURITY

AI summary

There is provided a method for determining a sequence number for transmitting a packet from a first apparatus to a second apparatus as part of a flow of packets, determining a flow identifier for identifying a security association for the flow, wherein the flow identifier is determined in dependence on the sequence number, and transmitting the packet includes transmitting the sequence number and the flow identifier to the second apparatus.