Techniques for load balancing in a packet distribution system

• US 10,686,763 B2
• Filed: 01/23/2017
• Issued: 06/16/2020
• Est. Priority Date: 12/23/2014
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Kantecki, Tomasz, McDonnell, Niall
• Primary Examiner(s): Cervetti, David Garcia
• Application Number:
  US15/413,151
• Publication Number:
  US 20170324713A1
• Time in Patent Office: 1,240 Days
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30

Abstract

Various embodiments are generally directed to techniques to distribute encrypted packets among multiple cores in a load-balanced manner for further processing. An apparatus may include a processor component; a decryption component to decrypt an encrypted packet to generate a decrypted packet from the encrypted packet, the encrypted packet comprising a header that comprises at least one field of information; a hash component to generate a header hash from the at least one field of information during decryption of at least a portion of the encrypted packet by the decryption component, the header hash comprising a smaller quantity of bits than the at least one field of information; and a distribution component to select a first core of multiple cores coupled to the processor component based on the header hash and to transmit the decrypted packet to the first core from the processor component. Other embodiments are described and claimed.

Claims

1. An apparatus to distribute packets comprising:

a decryption controller;

a processor component coupled to the decryption controller, the processor component comprising multiple cores and at least one first logic, the at least one first logic to;

receive an encrypted packet at a first core of the multiple cores, each of the multiple cores associated with a core value within a range of core values, and

provide, via the first one of the multiple cores, the encrypted packet to the decryption controller; and

a second logic arranged in the decryption controller, the second logic to;

decrypt the encrypted packet to generate a decrypted packet, the encrypted packet comprising a header and a payload, the header to comprise multiple fields of information concerning the encrypted packet, the payload to comprise data representing speech,

select at least one field of information from the multiple fields of information from which to generate a header hash, and

generate the header hash from the selected at least one field of information, the header hash comprising a smaller quantity of bits than the at least one field of information; and

a destination component for execution by the first core to;

determine a core of the multiple cores to receive the decrypted packet based on the header hash by determining which of the multiple cores is associated with the core value corresponding to a header value generated based on a subset of bits of the header, the header hash transmitted to the first core by the destination component along with the decrypted packet.

2. The apparatus of claim 1, comprising:

the multiple cores comprising a first core; and

an interface to couple one of the first core or a second core of the multiple cores to a network, the one of the first core or the second core to relay the encrypted packet to the processor component from the network.

3. The apparatus of claim 1, the multiple fields of information comprising an identifier of at least one of a source device of the encrypted packet, a destination device of the encrypted packet, an online transaction associated with the encrypted packet, an executable process associated with the encrypted packet, or a type of data within the payload of the encrypted packet.

4. The apparatus of claim 3, the header of each of multiple encrypted packets comprising multiple fields of information that comprise the at least one field of information, the multiple encrypted packets comprising the encrypted packet, and a hash component to dynamically select the at least one field of information from the multiple fields of information from which to generate the header hash for each encrypted packet of the multiple encrypted packets based on at least one of a source device of each encrypted packet, a destination device of each encrypted packet, an online transaction associated with each encrypted packet, an executable process associated with each encrypted packet or a type of data within the payload of each encrypted packet.

5. The apparatus of claim 1, comprising the multiple cores, each core of the multiple cores to perform further processing on multiple decrypted packets that comprise the decrypted packet, the further processing comprising at least one of re-encryption, a scan of data within the payload of each of the multiple decrypted packets, digital signal processing to alter a characteristic of the speech represented by the data within the payload of each of the multiple decrypted packets, or determining a destination of each of the multiple decrypted packets based on a header hash generated by a hash component during decryption to generate each of the multiple decrypted packets.

6. The apparatus of claim 1, comprising multiple interfaces, each interface to couple at least the first core of the multiple cores to a different branch of multiple branches of a network, and the destination component to select one of the interfaces based on the header hash and to route the decrypted packet to the selected one of the multiple interfaces.

7. An apparatus to distribute packets comprising:

a decryption controller;

a processor component;

multiple cores coupled to the processor component, each of the multiple cores associated with a core value within a range of core values;

a memory storing first instructions to be executed by the decryption controller to;

decrypt an encrypted packet, provided by a first core of the multiple cores, to generate a decrypted packet from the encrypted packet, the encrypted packet comprising a header and a payload, the header to comprise multiple fields of information concerning the encrypted packet, the payload to comprise data representing speech,

select at least one field of information from the multiple fields of information from which to generate a header hash,

generate the header hash from the selected at least one field of information, the header hash comprising a smaller quantity of bits than the at least one field of information; and

a destination component for execution by the first core to;

determine a core of the multiple cores to receive the decrypted packet based on the header hash by determining which of the multiple cores is associated with the core value corresponding to a header value generated based on a subset of bits of the header, the header hash transmitted to the first core by the destination component along with the decrypted packet.

8. The apparatus of claim 7, the multiple cores comprising a first core, comprising an interface to couple the first core to a network, the first core to relay the encrypted packet to the processor component from the network.

9. The apparatus of claim 7, further comprising a hash component to perform a checksum calculation on the at least one field of information to generate the header hash.

10. The apparatus of claim 7, each core of the multiple cores to perform further processing on multiple decrypted packets that comprise the decrypted packet, the further processing comprising at least one of re-encryption, a scan of data within the payload of each of the multiple decrypted packets, digital signal processing to alter a characteristic of the speech represented by the data within the payload of each of the multiple decrypted packets, or determining a destination of each of the multiple decrypted packets based on a header hash generated by a hash component during decryption to generate each of the multiple decrypted packets.

11. A computer-implemented method for distributing packets, comprising:

decrypting, at a decryption controller, an encrypted packet to generate a decrypted packet from the encrypted packet, the encrypted packet comprising a header and a payload, the header to comprise multiple fields of information concerning the encrypted packet, the payload to comprise data representing speech;

selecting, at the encryption controller, at least one field of information from the multiple fields of information from which to generate a header hash;

generating, at the decryption controller, the header hash from the selected at least one field of information, the header hash comprising a smaller quantity of bits than the at least one field of information;

transmitting the header hash to a first core of multiple cores from the decryption controller; and

determining, at the first core, a destination of the decrypted packet based on a core value within a range of core values associated with the multiple cores coupled to a processor component based on the header hash by determining which of the multiple cores is associated with the core value corresponding to a header value generated based on a subset of bits of the header.

12. The computer-implemented method of claim 11, the method comprising:

storing the encrypted packet in a receipt queue; and

retrieving the header from the receipt queue one time to decrypt the header and to generate the header hash from the at least one field of information.

13. The computer-implemented method of claim 11, the multiple fields of information comprising an identifier of at least one of a source device of the encrypted packet, a destination device of the encrypted packet, an online transaction associated with the encrypted packet, an executable process associated with the encrypted packet or a type of data within the payload of the encrypted packet.

14. The computer-implemented method of claim 13, the header of each of multiple encrypted packets comprising multiple fields of information that comprise the at least one field of information, the multiple encrypted packets comprising the encrypted packet, and the method comprising dynamically selecting the at least one field of information from the multiple fields of information from which to generate the header hash for each encrypted packet of the multiple encrypted packets based on at least one of a source device of each encrypted packet, a destination device of each encrypted packet, an online transaction associated with each encrypted packet, an executable process associated with each encrypted packet or a type of data within the payload of each encrypted packet.

15. At least one non-transitory tangible machine-readable storage medium comprising instructions that when executed by a decryption controller, cause the decryption controller to:

decrypt an encrypted packet, provided by a first core of multiple cores, to generate a decrypted packet from the encrypted packet, the encrypted packet comprising a header and a payload, the header to comprise multiple fields of information concerning the encrypted packet, the payload to comprise data representing speech;

select at least one field of information from the multiple fields of information from which to generate a header hash;

generate the header hash from the selected at least one field of information, the header hash comprising a smaller quantity of bits than the at least one field of information;

provide the header hash to the first core; and

select, via the first core, a core of multiple cores associated with a core value within a range of core values coupled to a processor component based on the header hash by determining which of the multiple cores is associated with the core value corresponding to a header value generated based on a subset of bits of the header.

16. The at least one non-transitory tangible machine-readable storage medium of claim 15, the decryption controller caused to perform a checksum calculation on the at least one field of information to generate the header hash.

17. The at least one non-transitory tangible machine-readable storage medium of claim 15, the multiple fields of information comprising an identifier of at least one of a source device of the encrypted packet, a destination device of the encrypted packet, an online transaction associated with the encrypted packet, an executable process associated with the encrypted packet or a type of data within the payload of the encrypted packet.

18. The at least one non-transitory tangible machine-readable storage medium of claim 17, the header of each of multiple encrypted packets comprising multiple fields of information that comprise the at least one field of information, the multiple encrypted packets comprising the encrypted packet, and the processor component caused to dynamically select the at least one field of information from the multiple fields of information from which to generate the header hash for each encrypted packet of the multiple encrypted packets based on at least one of a source device of each encrypted packet, a destination device of each encrypted packet, an online transaction associated with each encrypted packet, an executable process associated with each encrypted packet or a type of data within the payload of each encrypted packet.

19. The at least one non-transitory tangible machine-readable storage medium of claim 17, each core of the multiple cores to perform further processing on multiple decrypted packets that comprise the decrypted packet, the further processing comprising at least one of re-encryption, a scan of data within the payload of each of the multiple decrypted packets, digital signal processing to alter a characteristic of the speech represented by the data within the payload of each of the multiple decrypted packets, or determining a destination of each of the multiple decrypted packets based on a header hash generated during decryption to generate each of the multiple decrypted packets.

20. The at least one non-transitory tangible machine-readable storage medium of claim 15, at least the first core of the multiple cores coupled to different branches of multiple branches of a network by each interface of multiple interfaces, the processor component caused to:

select one of the interfaces based on the header hash; and

route the decrypted packet to the selected one of the multiple interfaces.

21. The at least one non-transitory tangible machine-readable storage medium of claim 20, at least the first core of the multiple cores coupled to a network, the processor component caused to:

select one of multiple virtual private networks (VPNs) formed through the network based on the header hash; and

route the decrypted packet to the selected one of the multiple VPNs.