TECHNIQUES FOR LOAD BALANCING IN A PACKET DISTRIBUTION SYSTEM

• US 20170324713A1
• Filed: 01/23/2017
• Published: 11/09/2017
• Est. Priority Date: 12/23/2014
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: KANTECKI, THOMASZ, MCDONNELL, NIALL
• Granted Patent: US 10,686,763 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30

Abstract

Various embodiments are generally directed to techniques to distribute encrypted packets among multiple cores in a load-balanced manner for further processing. An apparatus may include a processor component; a decryption component to decrypt an encrypted packet to generate a decrypted packet from the encrypted packet, the encrypted packet comprising a header that comprises at least one field of information; a hash component to generate a header hash from the at least one field of information during decryption of at least a portion of the encrypted packet by the decryption component, the header hash comprising a smaller quantity of bits than the at least one field of information; and a distribution component to select a first core of multiple cores coupled to the processor component based on the header hash and to transmit the decrypted packet to the first core from the processor component. Other embodiments are described and claimed.

Claims

1. An apparatus to distribute packets comprising:

a processor component;

a decryption component to decrypt an encrypted packet to generate a decrypted packet from the encrypted packet, the encrypted packet comprising a header that comprises at least one field of information concerning the encrypted packet;

a hash component to generate a header hash from the at least one field of information during decryption of at least a portion of the encrypted packet by the decryption component, the header hash comprising a smaller quantity of bits than the at least one field of information; and

a distribution component to select a first core of multiple cores coupled to the processor component based on the header hash and to transmit the decrypted packet to the first core from the processor component.

2. The apparatus of claim 1, comprising:

the multiple cores; and

an interface to couple one of the first core or a second core of the multiple cores to a network, the one of the first core or the second core to relay the encrypted packet to the processor component from the network.

3. The apparatus of claim 1, the at least one field of information comprising an identifier of at least one of a source device of the encrypted packet, a destination device of the encrypted packet, an online transaction associated with the encrypted packet, an executable process associated with the encrypted packet or a type of data within a payload of the encrypted packet.

4. The apparatus of claim 3, the header of each of multiple encrypted packets comprising multiple fields of information that comprise the at least one field of information, the multiple encrypted packets comprising the encrypted packet, and the hash component to dynamically select the at least one field of information from the multiple fields of information from which to generate the header hash for each encrypted packet of the multiple encrypted packets based on at least one of a source device of each encrypted packet, a destination device of each encrypted packet, an online transaction associated with each encrypted packet, an executable process associated with each encrypted packet or a type of data within a payload of each encrypted packet.

5. The apparatus of claim 1, comprising the multiple cores, each core of the multiple cores to perform further processing on multiple decrypted packets that comprise the decrypted packet, the further processing comprising at least one of re-encryption, a scan of data within a payload of each of the multiple decrypted packets, digital signal processing to alter a characteristic of speech represented by the data within the payload of each of the multiple decrypted packets, or determining a destination of each of the multiple decrypted packets based on a header hash generated by the hash component during decryption to generate each of the multiple decrypted packets.

6. The apparatus of claim 1, comprising:

the multiple cores; and

a destination component for execution by the first core to determine a destination of the decrypted packet based on the header hash, the header hash transmitted to the first core by the distribution component along with the decrypted packet.

7. The apparatus of claim 6, comprising multiple interfaces, each interface to couple at least the first core of the multiple cores to a different branch of multiple branches of a network, and the destination component to select one of the interfaces based on the header hash and to route the decrypted packet to the selected one of the multiple interfaces.

8. An apparatus to distribute packets comprising:

a processor component;

a decryption component for execution by the processor component to decrypt an encrypted packet to generate a decrypted packet from the encrypted packet, the encrypted packet comprising a header that comprises at least one field of information concerning the encrypted packet;

a hash component for execution by the processor component to generate a header hash from the at least one field of information during decryption of at least a portion of the encrypted packet by the decryption component, the header hash comprising a smaller quantity of bits than the at least one field of information;

multiple cores coupled to the processor component, the multiple cores comprising a first core;

a distribution component for execution by the first core to select a second core of the multiple cores based on the header hash and to transmit the decrypted packet to the second core.

9. The apparatus of claim 8, comprising an interface to couple the first core to a network, the first core to relay the encrypted packet to the processor component from the network.

10. The apparatus of claim 8, the hash component to perform a checksum calculation on the at least one field of information to generate the header hash.

11. The apparatus of claim 8, each core of the multiple cores to perform further processing on multiple decrypted packets that comprise the decrypted packet, the further processing comprising at least one of re-encryption, a scan of data within a payload of each of the multiple decrypted packets, digital signal processing to alter a characteristic of speech represented by the data within the payload of each of the multiple decrypted packets, or determining a destination of each of the multiple decrypted packets based on a header hash generated by the hash component during decryption to generate each of the multiple decrypted packets.

12. The apparatus of claim 8, comprising a destination component for execution by the second core to determine a destination of the decrypted packet based on the header hash, the header hash transmitted to the second core from the first core by the distribution component along with the decrypted packet.

13. A computer-implemented method for distributing packets comprising:

decrypting, at a processor component, an encrypted packet to generate a decrypted packet from the encrypted packet, the encrypted packet comprising a header that comprises at least one field of information concerning the encrypted packet;

generating, at the processor component, a header hash from the at least one field of information during decryption of at least a portion of the encrypted packet, the header hash comprising a smaller quantity of bits than the at least one field of information;

selecting a first core of multiple cores coupled to the processor component based on the header hash; and

transmitting the decrypted packet to the first core from the processor component.

14. The computer-implemented method of claim 13, the method comprising:

storing the encrypted packet in a receipt queue; and

retrieving the header from the receipt queue one time to decrypt the header and to generate the header hash from the at least one field of information.

15. The computer-implemented method of claim 13, the at least one field of information comprising an identifier of at least one of a source device of the encrypted packet, a destination device of the encrypted packet, an online transaction associated with the encrypted packet, an executable process associated with the encrypted packet or a type of data within a payload of the encrypted packet.

16. The computer-implemented method of claim 15, the header of each of multiple encrypted packets comprising multiple fields of information that comprise the at least one field of information, the multiple encrypted packets comprising the encrypted packet, and the method comprising dynamically selecting the at least one field of information from the multiple fields of information from which to generate the header hash for each encrypted packet of the multiple encrypted packets based on at least one of a source device of each encrypted packet, a destination device of each encrypted packet, an online transaction associated with each encrypted packet, an executable process associated with each encrypted packet or a type of data within a payload of each encrypted packet.

17. The computer-implemented method of claim 13, comprising:

transmitting the header hash to the first core from the processor component; and

determining, at the first core, a destination of the decrypted packet based on the header hash.

18. At least one tangible machine-readable storage medium comprising instructions that when executed by a processor component, cause the processor component to:

decrypt an encrypted packet to generate a decrypted packet from the encrypted packet, the encrypted packet comprising a header that comprises at least one field of information concerning the encrypted packet;

generate a header hash from the at least one field of information during decryption of at least a portion of the encrypted packet, the header hash comprising a smaller quantity of bits than the at least one field of information;

select a first core of multiple cores coupled to the processor component based on the header hash; and

transmit the decrypted packet to the first core from the processor component.

19. The at least one tangible machine-readable storage medium of claim 18, the processor component caused to perform a checksum calculation on the at least one field of information to generate the header hash.

20. The at least one tangible machine-readable storage medium of claim 18, the at least one field of information comprising an identifier of at least one of a source device of the encrypted packet, a destination device of the encrypted packet, an online transaction associated with the encrypted packet, an executable process associated with the encrypted packet or a type of data within a payload of the encrypted packet.

21. The at least one tangible machine-readable storage medium of claim 20, the header of each of multiple encrypted packets comprising multiple fields of information that comprise the at least one field of information, the multiple encrypted packets comprising the encrypted packet, and the processor component caused to dynamically select the at least one field of information from the multiple fields of information from which to generate the header hash for each encrypted packet of the multiple encrypted packets based on at least one of a source device of each encrypted packet, a destination device of each encrypted packet, an online transaction associated with each encrypted packet, an executable process associated with each encrypted packet or a type of data within a payload of each encrypted packet.

22. The at least one tangible machine-readable storage medium of claim 20, each core of the multiple cores to perform further processing on multiple decrypted packets that comprise the decrypted packet, the further processing comprising at least one of re-encryption, a scan of data within a payload of each of the multiple decrypted packets, digital signal processing to alter a characteristic of speech represented by the data within the payload of each of the multiple decrypted packets, or determining a destination of each of the multiple decrypted packets based on a header hash generated during decryption to generate each of the multiple decrypted packets.

23. The at least one tangible machine-readable storage medium of claim 18, the processor component caused to:

transmit the header hash to the first core from the processor component; and

determine, at the first core, a destination of the decrypted packet based on the header hash.

24. The at least one tangible machine-readable storage medium of claim 23, at least the first core of the multiple cores coupled to different branches of multiple branches of a network by each interface of multiple interfaces, the processor component caused to:

select one of the interfaces based on the header hash; and

route the decrypted packet to the selected one of the multiple interfaces.

25. The at least one tangible machine-readable storage medium of claim 24, at least the first core of the multiple cores coupled to a network, the processor component caused to:

select one of multiple virtual private networks (VPNs) formed through the network based on the header hash; and

route the decrypted packet to the selected one of the multiple VPNs.