Adaptive, performance-oriented, and compression-assisted encryption scheme

Patent metadata

Field	Value
Publication number	US-11726829-B2
Application number	US-202017011465-A
Country	US
Kind code	B2
Filing date	Sep 3, 2020
Priority date	Sep 29, 2017
Publication date	Aug 15, 2023
Grant date	Aug 15, 2023

Abstract

An approach for an adaptive, performance-oriented, and compression-assisted encryption scheme implemented on a host computer to adaptively improve utilization of CPU resources is provided. The method comprises queueing a new data packet and determining a size of the new data packet. Based on historical data, a plurality of already encrypted data packets is determined. Based on information stored for the plurality of already encrypted data packets, an average ratio of compression for the plurality of already encrypted data packets is determined. Based on the average ratio of compression, a throughput of compression value and a throughput of encryption value, a prediction whether compressing the new data packet will reduce a CPU load is derived. If it is determined that compressing the new data packet will improve utilization of the CPU resources, then a compressed new data packet is generated by compressing the new data packet.

First claim

What is claimed is:

1. A method for an adaptive, performance-oriented, and compression-assisted encryption scheme implemented on a host computer to adaptively improve utilization of CPU resources, the method comprising:
determining a size of a new data packet;
based on historical data, determining an average ratio of compression for a plurality of already encrypted data packets;
based on the average ratio of compression and the size of the new data packet, predicting whether compressing the new data packet will reduce overall load on CPU resources;
in response to determining that compressing the new data packet will reduce the overall load on the CPU resources, generating a compressed new data packet by compressing the new data packet; and
in response to determining that a throughput of compression value exceeds a threshold, encrypting the compressed new data packet after the compressing.

2. The method of claim 1 , further comprising determining a throughput of compression value and a throughput of encryption value based on the size of the new data packet, and wherein predicting whether compressing the new data packet will reduce the overall load on the CPU resources comprises predicting whether the throughput of compression value exceeds a threshold based on the throughput of encryption value.

3. The method of claim 1 , further comprising:
further comprising determining a throughput of compression value and a throughput of encryption value based on the size of the new data packet.

4. The method of claim 1 , further comprising:
upon receiving the new data packet, determining whether the new data packet belongs to a particular traffic flow, wherein determining whether the new data packet belongs to the particular traffic flow is based on content of a packet header of the new data packet; and
in response to determining that the new data packet belongs to the particular traffic flow, determining a particular subset of the historical data, and selecting the plurality of already encrypted data packets from the particular subset of the historical data.

5. The method of claim 1 , wherein the throughput of compression value is retrieved from a throughput of compression table that is indexed using a size of a data packet and an estimated compression ratio;
wherein the throughput of compression value represents a count of bytes compressed within a certain time period for a data packet that has the size of the new data packet and for the average ratio of compression;
wherein the throughput of encryption value is retrieved from a throughput of encryption table that is indexed using a size of a data packet;
wherein the throughput of encryption value represents a count of bytes encrypted within a certain time period for a data packet that has the size of the new data packet;
wherein the throughput of compression table and the throughput of encryption table are generated based on training data; and
wherein the historical data is collected based on the training data.

6. The method of claim 1 , wherein the average ratio of compression is computed as a weighted average ratio of compression.

7. The method of claim 1 , wherein the throughput of compression value depends on entropy density characteristics carried in the new data packet.

8. One or more non-transitory computer-readable media comprising computer executable instructions that, when executed by one or more processors, cause the one or more processors to perform the following:
determining a size of a new data packet;
based on historical data, determining an average ratio of compression for a plurality of already encrypted data packets;
based on the average ratio of compression and the size of the new data packet, predicting whether compressing the new data packet will reduce overall load on CPU resources; and
in response to determining that compressing the new data packet will reduce the overall load on the CPU resources, generating a compressed new data packet by compressing the new data packet; and
in response to determining that a throughput of compression value does not exceed a threshold, encrypting the new data packet before compressing the new data packet.

9. The one or more non-transitory computer-readable media of claim 8 , wherein the computer executable instructions further cause the one or more processors to perform determining a throughput of compression value and a throughput of encryption value based on the size of the new data packet, and wherein predicting whether compressing the new data packet will reduce the overall load on the CPU resources comprises predicting whether the throughput of compression value exceeds a threshold based on the throughput of encryption.

10. The one or more non-transitory computer-readable media of claim 8 , wherein the one computer executable instructions further cause the one or more processors to perform:
determining a throughput of compression value and a throughput of encryption value based on the size of the new data packet.

11. The one or more non-transitory computer-readable media of claim 8 , wherein the one computer executable instructions further cause the one or more processors to perform:
upon receiving the new data packet, determining whether the new data packet belongs to a particular traffic flow, wherein determining whether the new data packet belongs to the particular traffic flow is based on content of a packet header of the new data packet; and
in response to determining that the new data packet belongs to the particular traffic flow, determining a particular subset of the historical data, and selecting the plurality of already encrypted data packets from the particular subset of the historical data.

12. The one or more non-transitory computer-readable media of claim 8 , wherein the throughput of compression value is retrieved from a throughput of compression table that is indexed using a size of a data packet and an estimated compression ratio;
wherein the throughput of compression value represents a count of bytes compressed within a certain time period for a data packet that has the size of the new data packet and for the average ratio of compression;
wherein the throughput of encryption value is retrieved from a throughput of encryption table that is indexed using a size of a data packet;
wherein the throughput of encryption value represents a count of bytes encrypted within a certain time period for a data packet that has the size of the new data packet;

wherein the throughput of compression table and the throughput of encryption table are generated based on training data; and wherein the historical data is collected based on the training data.

13. The one or more non-transitory computer-readable media of claim 8 , wherein the average ratio of compression is computed as a weighted average ratio of compression.

14. The one or more non-transitory computer-readable media of claim 8 , wherein the throughput of compression value depends on entropy density characteristics carried in the new data packet.

15. A system comprising:
a host computer;
one or more central processing unit (CPU) resources;
one or more processors; and
a memory comprising computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform the following:
determining a size of a new data packet;
based on historical data, determining an average ratio of compression for a plurality of already encrypted data packets;
based on the average ratio of compression and the size of the new data packet, predicting whether compressing the new data packet

Assignees

• Nicira Inc

Inventors

• Wang Dexiang
• Qian Calvin
• Wing Dan
• Xu Gang
• Zan Bin

Classifications

• G06F9/5061 Primary

  Partitioning or combining of resources · CPC title

• G06F21/602 Primary

  Providing cryptographic facilities or services · CPC title

• G06N5/022

  Knowledge engineering; Knowledge acquisition · CPC title

• G06F9/505

  considering the load · CPC title