Deterministic load balancing of IPSec packet processing

Patent metadata

Field	Value
Publication number	US-11336629-B2
Application number	US-202016802580-A
Country	US
Kind code	B2
Filing date	Feb 27, 2020
Priority date	Nov 5, 2019
Publication date	May 17, 2022
Grant date	May 17, 2022

Abstract

Certain embodiments described herein are generally directed to systems and methods for deterministic load balancing of processing encapsulated encrypted data packets at a destination tunnel endpoint. For example, certain embodiments described herein relate to configuring a destination tunnel endpoint (TEP) with an encapsulating security payload (ESP) receive side scaling (RSS) mode to assign each incoming packet, received from a certain source endpoint (EP), to a certain RSS queue based on an identifier that is encoded in an SPI value included the packet.

First claim

What is claimed is:

1. A method for deterministic load balancing of processing received encapsulated encrypted data packets at a destination tunnel endpoint (TEP), comprising:
engaging in a tunnel creation according to a security protocol with a source TEP for encrypting data packets communicated between a source endpoint and a destination endpoint;
selecting a central processing unit (CPU) from a plurality of CPUs of the destination TEP using a CPU selection function, the selected CPU being selected to process packets communicated over the tunnel from the source TEP to the destination TEP;
determining a receive side scaling (RSS) queue number associated with an RSS queue associated with a CPU core identifier (ID) of the selected CPU;
generating a security parameter index (SPI) value including the RSS queue number;
indicating the SPI value to the source TEP;
establishing an in-bound security association with the source TEP using the SPI value;
receiving an encrypted packet from the source TEP, wherein:
the encrypted packet is encrypted by the source TEP based on the in-bound security association; and
the encrypted packet includes the SPI value;

retrieving the encrypted packet from the RSS queue having the RSS queue number; and
processing the encrypted packet using the selected CPU.

2. The method of claim 1 , wherein the CPU selection function uses a CPU utilization level of each of the plurality of CPUs as input.

3. The method of claim 1 , wherein the CPU selection function uses a security association count of each of the plurality of CPUs as input.

4. The method of claim 1 , wherein the CPU selection function uses a round-robin algorithm.

5. The method of claim 1 , wherein the RSS queue number is a first number of bits of the SPI value, and wherein remaining bits of the SPI value represent a value.

6. The method of claim 1 , wherein generating the SPI value further comprises:
generating a second SPI value; and
replacing a number of bits in the second SPI value with bits of the RSS queue number to generate the SPI value.

7. The method of claim 1 , wherein receiving the encrypted packet from the source TEP comprises:
receiving the encrypted packet using a virtual network interface card (VNIC), the encrypted data packet comprising a first header and an encrypted payload, the first header comprising a source IP address of the source TEP, a destination IP address of the destination TEP, and the SPI value corresponding to the in-bound security association, the encrypted payload comprising a second header comprising a source IP address of the source endpoint and a destination IP address of the destination endpoint;
determining, at the VNIC, that the encrypted packet is an encapsulating security payload (ESP) encrypted packet;
determining, at the VNIC, that the encrypted packet is associated with the RSS queue based on the RSS queue number identifier; and
using, at the VNIC, an ESP RSS mode of the VNIC to store the encrypted packet in the RSS queue based on the RSS queue number.

8. A computer system, comprising:
a memory comprising executable instructions; and
a processor in data communication with the memory and configured to execute the instructions to cause the computer system to perform operations including:
engaging in a tunnel creation according to a security protocol with a source tunnel endpoint (TEP) for encrypting data packets communicated between a source endpoint and a destination endpoint;
selecting a central processing unit (CPU) from a plurality of CPUs of a destination TEP using a CPU selection function, the selected CPU being selected to process packets communicated over the tunnel from the source TEP to the destination TEP;
determining a receive side scaling (RSS) queue number associated with an RSS queue associated with a CPU core identifier (ID) of the selected CPU;
generating a security parameter index (SPI) value including the RSS queue number;
indicating the SPI value to the source TEP;
establishing an in-bound security association with the source TEP using the SPI value;
receiving an encrypted packet from the source TEP, wherein:
the encrypted packet is encrypted by the source TEP based on the in-bound security association; and
the encrypted packet includes the SPI value;

retrieving the encrypted packet from the RSS queue having the RSS queue number; and
processing the encrypted packet using the selected CPU.

9. The computer system of claim 8 , wherein the CPU selection function uses a CPU utilization level of each of the plurality of CPUs as input.

10. The computer system of claim 8 , wherein the CPU selection function uses a security association count of each of the plurality of CPUs as input.

11. The computer system of claim 8 , wherein the CPU selection function uses a round-robin algorithm.

12. The computer system of claim 8 , wherein the RSS queue number is a first number of bits of the SPI value, and wherein remaining bits of the SPI value represent a value.

13. The computer system of claim 8 , wherein generating the SPI value further comprises:
generating a second SPI value; and
replacing a number of bits in the second SPI value with bits of the RSS queue number to generate the SPI value.

14. The computer system of claim 8 , wherein receiving the encrypted packet from the source TEP comprises:
receiving, at the destination TEP, the encrypted packet using a virtual network interface card (VNIC), the encrypted data packet comprising a first header and an encrypted payload, the first header comprising a source IP address of the source TEP, a destination IP address of the destination TEP, and the SPI value corresponding to the in-bound security association, the encrypted payload comprising a second header comprising a source IP address of the source endpoint and a destination IP address of the destination endpoint;
determining, at the VNIC of the destination TEP, that the encrypted packet is an encapsulating security payload (ESP) encrypted packet;
determining, at the VNIC of the destination TEP, that the encrypted packet is associated with the RSS queue based on the RSS queue number; and
using, at the VNIC, an ESP RSS mode of the VNIC to store the encrypted packet in the RSS queue based on the RSS queue number.

15. A non-transitory computer readable medium having instructions stored thereon that, when executed by a computer system, cause the computer system to perform operations comprising:
engaging in a tunnel creation according to a security protocol with a source tunnel endpoint (TEP) for encrypting data packets communicated between a source endpoint and a destination endpoint;
selecting a central processing unit (CPU) from a plurality of CPUs of a destination TEP using a CPU selection function, the selected CPU being selected to process packets communicated over the tunnel from the source TEP to the destination TEP;
determining a receive side scaling (RSS) queue number associated with an RSS queue associated with a CPU core identifier (ID) of the selected CPU;
generating a security parameter index (SPI) value including the RSS queue number;
indicating the SPI value to the source TEP;
establishing an in-bound security association with the source TEP using the SPI value;
receiving an encrypted packet from the source TEP, wherein:
the encrypted packet is encrypted by the source TEP based on the in-bound security association; and
the encrypted packet includes the SPI value;

retrieving the encrypted packet from the RSS queue having the RSS queue number; and
processing the encrypted packet using the selected CPU.

Assignees

• Vmware Inc

Inventors

• Wang Yong
• Sharma Awan Kumar
• Khurana Manmeet
• Urhekar Shailesh
• Bhattacharya Sourabh

Classifications

• H04L63/0485 Primary

  Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up · CPC title

• H04L45/74 Primary

  Address processing for routing · CPC title

• H04L63/164

  at the network layer · CPC title

• H04L69/22

  Parsing or analysis of headers · CPC title

• H04L63/0272

  Virtual private networks · CPC title