Secure IPsec Datagram Distribution Using MCPHINT Core Hints
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multi-core CPUs, IPsec datagrams from the same source tend to be distributed to the same core, leading to core overload and slowed processing due to the encryption of port numbers, which are not available for hash-based distribution.
Innovation Solution
Adding a special datagram distribution information, MCPHINT, to the unencrypted portion of IPv4 and IPv6 headers to uniquely identify logical streams, allowing immediate distribution to specific CPU cores without decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IPsec datagrams are distributed using hash-based distribution on source and destination IP addresses and port numbers, then datagrams from the same logical stream are distributed to the same core, but port numbers are encrypted in IPsec and not available for hashing
Solution Approach 1:
The source device performs preliminary action by generating a hash of the source and destination port numbers before encryption, and stores this hash value in the IP header or IP option field. This allows the destination device to retrieve the hash without decryption, enabling core selection before the expensive decryption operation occurs.
Solution Approach 2:
An intermediary hash value is introduced as a mediator between the encrypted port numbers and the core selection process. The hash serves as a substitute key that provides the necessary information for distribution without requiring access to the actual encrypted port numbers.
2Stability of the object's composition
If all IPsec datagrams from the same source are distributed to the same core, then logical stream order is maintained, but core overload occurs and processing speed decreases
Solution Approach 1:
The system segments the distribution decision-making process into two parts: (1) source device generates and stores hash values for each logical stream, and (2) destination device uses these pre-computed hashes for rapid core selection. This segmentation avoids the need to maintain all streams on a single core while preserving stream integrity.
Solution Approach 2:
The source device performs preliminary hashing of port numbers and stores the results in the IP header before transmission. This preliminary action enables the destination device to perform fast hash-based core selection without needing to decrypt packets or perform complex stream identification, thereby improving processing throughput.
3Measurement precision
If decryption is performed before distribution, then accurate stream identification is possible, but processing time increases and core overload worsens
Solution Approach 1:
The source device performs the time-consuming hash computation in advance and stores the result in the IP header. This eliminates the need for decryption before distribution, allowing the destination device to perform fast hash-based core selection on unencrypted packets, thereby reducing processing time and avoiding core overload.
Data Source
AI summary
A first computational device, connected over a network to a second computational device, generates unique datagram distribution information and places it into an unencrypted portion of a plurality of secure IP datagrams comprising a first stream, and sends the plurality of secure IP datagrams over the network to the second computational device. The second computational device is configured to examine each one of the plurality of the secure IP datagrams for the unique datagram distribution information, and uses the unique datagram distribution information to distribute all of the plurality of the secure datagrams to a first one of a plurality of CPU cores comprising the second computational device.