Virtual NIC RSS Hashing for Encrypted IPsec Packets
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IPsec protocols in virtualized environments, particularly in ESP tunnel mode, hinder the use of receive side scaling (RSS) for encapsulated encrypted data packets due to the same source and destination IP addresses in the new IP header, causing all packets to hash to the same value and be assigned to the same virtual RSS queue, thereby preventing distribution across multiple virtual CPUs for processing.
Innovation Solution
A method is introduced to calculate a hash value based on the Security Parameter Index (SPI) value of the encapsulated encrypted data packets, allowing them to be assigned to different RSS queues at a virtual network interface card (VNIC), enabling proper distribution and processing across multiple virtual CPUs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IPsec protocols are used in ESP tunnel mode with virtualized computing instances, then security protection for network packets is achieved, but receive side scaling (RSS) cannot be properly implemented because all encapsulated packets hash to the same value and are assigned to the same virtual RSS queue
Solution Approach 1:
The patent changes the hashing parameter from traditional IP header fields (source/destination IP addresses) to the Security Parameter Index (SPI) value in the ESP header. This parameter change allows encapsulated packets with identical outer IP addresses to be distributed across multiple RSS queues based on their unique SPI values, resolving the contradiction between maintaining security protection and enabling processing distribution efficiency.
2Productivity
If traditional RSS hashing is used based on IP header attributes, then packets are distributed across multiple CPUs, but encapsulated ESP packets with same source and destination IP addresses all hash to the same value and cannot be distributed
Solution Approach 1:
The invention changes the hashing parameter from outer IP header fields to the inner ESP header's SPI value. This allows the RSS mechanism to adapt to encapsulated packets by using a parameter that varies within the encrypted payload rather than the outer header, enabling both packet distribution and compatibility with IPsec tunnel mode.
Solution Approach 2:
The patent moves the hashing operation from the outer IP header dimension to the inner ESP header dimension. By extracting and hashing the SPI value from within the encrypted payload, the system creates a new dimension for packet classification that works specifically for encapsulated traffic while maintaining standard RSS functionality for other traffic types.
Data Source
AI summary
Certain embodiments described herein are generally directed to performing receive side scaling at a virtual network interface card for encapsulated encrypted data packets based on an security parameter index value of the encapsulated encrypted data packets.