Receive-Side Scaling for Encrypted Packet Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing approaches for processing encapsulated encrypted packets in Software-Defined Networking (SDN) environments lack efficiency, leading to bottlenecks, especially when handling a large number of packets, due to a lack of parallelism in receive-side processing.
Innovation Solution
Implementing receive-side scaling (RSS) by distributing post-cryptography processing among multiple processing units based on the cleartext content of decrypted packets, allowing for improved parallelism and performance by assigning packets to processing units based on their decrypted inner content rather than non-encrypted outer headers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If existing approaches for processing encapsulated encrypted packets are used, then security is maintained through encryption, but processing efficiency deteriorates due to lack of parallelism
Solution Approach 1:
The patent segments packet processing into distinct cryptographic operations and post-cryptography operations, allowing them to be executed in parallel by different processing units. The receive-side scaling mechanism divides the processing workload across multiple cores, with cryptographic operations handled by one unit and post-cryptography operations (such as routing, filtering, and forwarding) handled by another unit, thereby improving overall processing efficiency without requiring a complete redesign of the processing architecture.
2Productivity
If receive-side scaling is implemented to improve parallelism, then processing throughput increases, but system complexity increases
Solution Approach 1:
The patent implements a universal receive-side scaling mechanism that can handle multiple types of packets and cryptographic operations through a common architecture. The processing units are designed to be multi-functional, capable of handling both cryptographic operations and post-cryptography operations, as well as different packet types and protocols, thereby achieving high throughput without proportionally increasing system complexity.
3Ease of operation
If packets are assigned to processing units based on outer headers, then routing is simplified, but parallelism is limited because inner content cannot be processed in parallel
Solution Approach 1:
The patent performs preliminary cryptographic operations (decryption, authentication) on encapsulated packets before the packets are assigned to processing units for post-cryptography operations. This preliminary action enables subsequent parallel processing of the inner packet content, as the cryptographic protection has already been removed and the inner headers and payloads are now accessible for parallel routing decisions and processing across multiple cores.
Data Source
AI summary
Example methods and computer systems for receive-side processing for encapsulated encrypted packets. One example may comprise: in response to receiving, over a tunnel, a first encapsulated encrypted packet that includes a first encrypted inner packet and a first outer header, generating a first decrypted inner packet by performing decryption and decapsulation; and based on content of the first decrypted inner packet, assigning the first decrypted inner packet to a first processing unit. The method may further comprise: in response to receiving, over the tunnel, a second encapsulated encrypted packet that includes a second encrypted inner packet and a second outer header, generating a second decrypted inner packet by performing decryption and decapsulation; and based on content of the second decrypted inner packet, assigning the second decrypted inner packet to a second processing unit, thereby distributing post-cryptography processing over multiple processing units.