Systems and methods for offloading IPSEC processing to an embedded networking device

Patent metadata

Field	Value
Publication number	US-10250571-B2
Application number	US-201615246440-A
Country	US
Kind code	B2
Filing date	Aug 24, 2016
Priority date	Aug 24, 2015
Publication date	Apr 2, 2019
Grant date	Apr 2, 2019

Abstract

A new approach is proposed that contemplates systems and methods to support a mechanism to offload IPSec/IKE processing of virtual machines (VMs) running on a host to an embedded networking device, which serves as a hardware accelerator for the VMs that need to have secured communication with a remote device/server over a network. By utilizing a plurality of its software and hardware features, the embedded networking device is configured to perform all offloaded IPSec operations on data packets transferred between the host and the remote device over the network as required for the secured communication before the data packets can be transmitted over the network. The embedded networking device, in effect, acts as a proxy on behalf of the VMs running on the host to perform the offloaded IPSec operations as well as serving as the network interface for the secured communication between the VMs and the remote device.

First claim

What is claimed is:

1. A system to support offloading of IPSec operations on network traffic comprising:
a host running one or more virtual machines (VMs) and configured to:
identify a VM running on the host that requires secured communication with a remote client device;
offload one or more Internet Protocol Security (IPSec) operations of a plurality of data packets exchanged between the VM and the remote client device to an external embedded networking device, wherein the embedded networking device is a hardware-based, software-programmable Network Interface Card (NIC), wherein the NIC is a multi-core network packet processing engine and the NIC includes a IPSec processing component, a network interface component, and a virtual switch component, each component running on independent cores of the multi-core network, and wherein the NIC is configured to:
encrypt the data packets in a tunnel mode if an IPSec policy is found;
send the encrypted data packets to a IPSec VM based on a destination Media Access Control (MAC);
decrypt IPSec-processed packets received by the NIC on a return path from the remote client device if a security association (SA) is found for a corresponding Security Parameter Index (SPI) in the IPSec-processed packets;
send the decrypted packets to the VMs via the IPSec VM after a MAC lookup of the decrypted packets;
perform the offloaded IPSec operations to process the data packets from the VM running on the host that requires secured communication with the remote client device;
support flexible packet processing at various input/output rates; and
transmit the IPSec-processed data packets to the remote client device over a network without returning the data packets back to the host before they are transmitted over the network.

2. The system of claim 1 , wherein:
the host is one of an x86 and ARM based devices.

3. The system of claim 1 , wherein:
the host and the embedded networking device are configured to communicate with each other over a Peripheral Component Interconnect (PCI) bus.

4. The system of claim 1 , wherein:
the host is configured to enable an application to offload its Secure Sockets Layer (SSL) processing to the embedded networking device by invoking one or more Application Programming Interface (API) having same syntax as that of the APIs used for network communications with the embedded networking device.

5. The system of claim 1 , wherein:
the VM running on the host further comprises an NIC driver configured to interact with the NIC, wherein the NIC driver is a virtual function (VF) driver configured to set up a communication path between its corresponding VM and the NIC to transmit data packets.

6. The system of claim 5 , wherein:
the NIC is configured to operate in a transport mode wherein the NIC is configured to
receive the data packets from the NIC driver of the VM directly;
identify one or more IPSec related policies maintained by the embedded networking device for IPSec processing if such IPSec processing is enabled according to the VF of the NIC driver;
encrypt the received data packets according to the identified IPSec policies if such policies are identified;
send the encrypted data packets to the remote client device.

7. The system of claim 6 , wherein:
the NIC is configured to
decrypt IPSec-processed packets received by the NIC on a return path from the remote client device if a security association (SA) is found for a corresponding Security Parameter Index (SPI) in the packets;
send the decrypted data packets to the VM after a Media Access Control (MAC) lookup by the embedded networking device.

8. The system of claim 7 wherein:
the NIC is configured to forward the received data packets to the corresponding VM or broadcast the packets to all of the VMs if SA is not found.

9. The system of claim 1 , wherein:
the NIC is configured to operate in a tunnel mode wherein one of the VMs is configured to serve as an IPSec VM to provide IPSec gateway service to a group of VMs, wherein the IPSec VM is configured in a gateway mode and acts in a tunnel mode for the other VMs running on the host.

10. The system of claim 9 , wherein:
the NIC is configured to:
receive the data packets from the group of VMs via a NIC driver of the IPSec VM running on the same host; and
lookup IPSec policies if IPSec is enabled for the data packets.

11. The system of claim 1 , wherein:
the embedded networking device is configured to perform switching/routing for the data packets of the VMs via the virtual switch, which determines where the data packets need to be switched/routed to per its routing tables/rules.

12. The system of claim 11 , wherein:
the embedded networking device is configured to
process the received data packets with the IPSec operations according to an IPSec policy if such policy identified;
forward the data packets to the virtual switch instead of sending them out to the remote client device directly after the data packets have been processed with the IPSec operations.

13. The system of claim 12 , wherein:
the embedded networking device is configured to
receive IPSec-processed packets by the virtual switch, which determines where the packets need to be switched to as per its routing tables/rules;
decrypt the IPSec-processed packets if a security association (SA) is found for the corresponding Security Parameter Index (SPI) in the packets;
forward the decrypted packets to the appropriate VM based on which VM originated the SA.

14. The system of claim 1 , wherein:
the embedded networking device is configured to manage both establishment and termination of connections for the secured communication between the VMs and the remote device and to pass appropriate information to the host.

15. The system of claim 1 , wherein:
the embedded networking device is configured to transmit standard network traffic from the VMs on the host that does not require IPSec processing to the remote device over the network unmodified or minimally processed.

16. A method to support offloading of IPSec operations on network traffic, comprising:
identifying a VM running on a host that requires secured communication with a remote client device;
offloading one or more Internet Protocol Security (IPSec) operations of a plurality of data packets exchanged between the VM and the remote client device to an external embedded networking device, wherein the embedded networking device is a hardware-based, software-programmable Network Interface Card (NIC), wherein the NIC is a multi-core network packet processing engine and the NIC includes a IPSec processing component, a network interface component, and a virtual switch component, each component running on independent cores of the multi-core network, and wherein the NIC is configured to:
encrypt the data packets in a tunnel mode if an IPSec policy is found;
send the encrypted data packets to a IPSec VM based on a destination Media Access Control (MAC);
decrypt IPSec-processed packets received by the NIC on a return path from the remote client device if a security association (SA) is found for a corresponding Security Parameter Index (SPI) in the IPSec-processed packets;
send the decrypted packets to the VMs via the IPSec VM after a MAC lookup of the decrypted packets;
perform the offloaded IPSec operations to process the data packets from the VM running on the host that requires secured communication with the remote client device;
support flexible packet processing at various input/output rates; and
transmit the IPSec-processed data packets to the remote client device over

Assignees

• Cavium Llc

Inventors

• Manapragada Ram Kumar
• Koppula Venkat
• Panicker Manojkumar

Classifications

• H04L67/2804

  Electricity · mapped topic

• H04L63/0428 Primary

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• G06F9/455

  Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• H04L63/164

  at the network layer · CPC title