IP Library Granted Patent US 9,553,853
Granted Patent B2
US 9,553,853 · App. 14/582,098 · Granted Jan 24, 2017

Techniques for load balancing in a packet distribution system

Inventors: Tomasz Kantecki (Ennis, IE); Niall D. McDonnell (Limerick, IE)
Assignee: INTEL CORPORATION
H04L63/0442
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 9,553,853
App. No.
14/582,098
Granted
Jan 24, 2017
Kind
B2
Abstract

Various embodiments are generally directed to techniques to distribute encrypted packets among multiple cores in a load-balanced manner for further processing. An apparatus may include a processor component; a decryption component to decrypt an encrypted packet to generate a decrypted packet from the encrypted packet, the encrypted packet comprising a header that comprises at least one field of information; a hash component to generate a header hash from the at least one field of information during decryption of at least a portion of the encrypted packet by the decryption component, the header hash comprising a smaller quantity of bits than the at least one field of information; and a distribution component to select a first core of multiple cores coupled to the processor component based on the header hash and to transmit the decrypted packet to the first core from the processor component. Other embodiments are described and claimed.

Claims (57)

1. An apparatus to distribute packets comprising:

a processor component; and

logic, at least a portion of which is in hardware, the logic to:

decrypt an encrypted packet of a plurality of encrypted packets to generate a decrypted packet from the encrypted packet, each of the plurality of encrypted packets comprising a header that comprises at least one field of information of a multiple of fields of information concerning the encrypted packet;

select the at least one field of information from the multiple fields of information from which to generate a header hash for each encrypted packet of the plurality of encrypted packets based on at least one of a source device of each encrypted packet, a destination device of each encrypted packet, an online transaction associated with each encrypted packet, an executable process associated with each encrypted packet or a type of data within a payload of each encrypted packet;

generate the header hash from the at least one field of information during decryption of at least a portion of the encrypted packet, the header hash comprising a smaller quantity of bits than the at least one field of information; and

select a first core of multiple cores coupled to the processor component based on the header hash and to transmit the decrypted packet to the first core from the processor component.

2. The apparatus of claim 1 , comprising:

the multiple cores; and

an interface to couple one of the first core or a second core of the multiple cores to a network, the one of the first core or the second core to relay the encrypted packet to the processor component from the network.

3. The apparatus of claim 1 , the at least one field of information comprising an identifier of at least one of the source device of the encrypted packet, the destination device of the encrypted packet, the online transaction associated with the encrypted packet, the executable process associated with the encrypted packet or the type of data within a payload of the encrypted packet.

4. The apparatus of claim 1 , comprising the multiple cores, each core of the multiple cores to perform further processing on multiple decrypted packets that comprise the decrypted packet, the further processing comprising at least one of re-encryption, a scan of data within a payload of each of the multiple decrypted packets, digital signal processing to alter a characteristic of speech represented by the data within the payload of each of the multiple decrypted packets, or determining a destination of each of the multiple decrypted packets based on a header hash generated during decryption to generate each of the multiple decrypted packets.

5. The apparatus of claim 1 , comprising the multiple cores and, the logic to determine a destination of the decrypted packet based on the header hash, the header hash transmitted to the first core along with the decrypted packet.

6. The apparatus of claim 5 , comprising multiple interfaces, each interface to couple at least the first core of the multiple cores to a different branch of multiple branches of a network, and the logic to select one of the interfaces based on the header hash and to route the decrypted packet to the selected one of the multiple interfaces.

7. An apparatus to distribute packets comprising:

a processor component;

multiple cores coupled to the processor component, the multiple cores comprising a first core; and

a memory storing first instructions to be executed by the processor to cause the processor to:

decrypt an encrypted packet of a plurality of encrypted packets to generate a decrypted packet from the encrypted packet, each of the plurality of encrypted packets comprising a header that comprises at least one field of information of a multiple of fields of information concerning the encrypted packet;

select the at least one field of information from the multiple fields of information from which to generate a header hash for each encrypted packet of the plurality of encrypted packets based on at least one of a source device of each encrypted packet, a destination device of each encrypted packet, an online transaction associated with each encrypted packet, an executable process associated with each encrypted packet or a type of data within a payload of each encrypted packet; and

generate the header hash from the at least one field of information during decryption of at least a portion of the encrypted packet, the header hash comprising a smaller quantity of bits than the at least one field of information;

the memory storing second instructions to be executed by the first core to cause the first core to select a second core of the multiple cores based on the header hash and to transmit the decrypted packet to the second core.

8. The apparatus of claim 7 , comprising an interface to couple the first core to a network, the first core to relay the encrypted packet to the processor component from the network.

9. The apparatus of claim 7 , the first instructions to be executed by the processor to cause the processor to perform a checksum calculation on the at least one field of information to generate the header hash.

10. The apparatus of claim 7 , each core of the multiple cores to perform further processing on multiple decrypted packets that comprise the decrypted packet, the further processing comprising at least one of re-encryption, a scan of data within a payload of each of the multiple decrypted packets, digital signal processing to alter a characteristic of speech represented by the data within the payload of each of the multiple decrypted packets, or determining a destination of each of the multiple decrypted packets based on a header hash generated during decryption to generate each of the multiple decrypted packets.

11. The apparatus of claim 7 , the memory storing second instructions to be executed by the second core to cause the second core to determine a destination of the decrypted packet based on the header hash, the header hash transmitted to the second core from the first core along with the decrypted packet.

12. A computer-implemented method for distributing packets comprising:

decrypting, at a processor component, an encrypted packet of a plurality of encrypted packets to generate a decrypted packet from the encrypted packet, each of the plurality of encrypted packets comprising a header that comprises at least one field of information of a multiple of fields of information concerning the encrypted packet;

selecting the at least one field of information from the multiple fields of information from which to generate a header hash for each encrypted packet of the plurality of encrypted packets based on at least one of a source device of each encrypted packet, a destination device of each encrypted packet, an online transaction associated with each encrypted packet, an executable process associated with each encrypted packet or a type of data within a payload of each encrypted packet;

generating, at the processor component, the header hash from the at least one field of information during decryption of at least a portion of the encrypted packet, the header hash comprising a smaller quantity of bits than the at least one field of information;

selecting a first core of multiple cores coupled to the processor component based on the header hash; and

transmitting the decrypted packet to the first core from the processor component.

13. The computer-implemented method of claim 12 , the method comprising:

storing the encrypted packet in a receipt queue; and

retrieving the header from the receipt queue one time to decrypt the header and to generate the header hash from the at least one field of information.

14. The computer-implemented method of claim 12 , the at least one field of information comprising an identifier of at least one of a source device of the encrypted packet, a destination device of the encrypted packet, an online transaction associated with the encrypted packet, an executable process associated with the encrypted packet or a type of data within a payload of the encrypted packet.

15. The computer-implemented method of claim 12 , comprising:

transmitting the header hash to the first core from the processor component; and

determining, at the first core, a destination of the decrypted packet based on the header hash.

16. At least one non-transitory machine-readable storage medium comprising instructions that when executed by a processor component, cause the processor component to:

decrypt an encrypted packet of a plurality of encrypted packets to generate a decrypted packet from the encrypted packet, each of the plurality of encrypted packets comprising a header that comprises at least one field of information of a multiple of fields of information concerning the encrypted packet;

select the at least one field of information from the multiple fields of information from which to generate a header hash for each encrypted packet of the plurality of encrypted packets based on at least one of a source device of each encrypted packet, a destination device of each encrypted packet, an online transaction associated with each encrypted packet, an executable process associated with each encrypted packet or a type of data within a payload of each encrypted packet;

generate the header hash from the at least one field of information during decryption of at least a portion of the encrypted packet, the header hash comprising a smaller quantity of bits than the at least one field of information;

select a first core of multiple cores coupled to the processor component based on the header hash; and

transmit the decrypted packet to the first core from the processor component.

17. The at least one non-transitory machine-readable storage medium of claim 16 , the processor component caused to perform a checksum calculation on the at least one field of information to generate the header hash.

18. The at least one non-transitory machine-readable storage medium of claim 16 , the at least one field of information comprising an identifier of at least one of a source device of the encrypted packet, a destination device of the encrypted packet, an online transaction associated with the encrypted packet, an executable process associated with the encrypted packet or a type of data within a payload of the encrypted packet.

19. The at least one non-transitory machine-readable storage medium of claim 18 , each core of the multiple cores to perform further processing on multiple decrypted packets that comprise the decrypted packet, the further processing comprising at least one of re-encryption, a scan of data within a payload of each of the multiple decrypted packets, digital signal processing to alter a characteristic of speech represented by the data within the payload of each of the multiple decrypted packets, or determining a destination of each of the multiple decrypted packets based on a header hash generated during decryption to generate each of the multiple decrypted packets.

20. The at least one non-transitory machine-readable storage medium of claim 16 , the processor component caused to:

transmit the header hash to the first core from the processor component; and

determine, at the first core, a destination of the decrypted packet based on the header hash.

21. The at least one non-transitory machine-readable storage medium of claim 20 , at least the first core of the multiple cores coupled to different branches of multiple branches of a network by each interface of multiple interfaces, the processor component caused to:

select one of the interfaces based on the header hash; and

route the decrypted packet to the selected one of the multiple interfaces.

22. The at least one non-transitory machine-readable storage medium of claim 21 , at least the first core of the multiple cores coupled to a network, the processor component caused to:

select one of multiple virtual private networks (VPNs) formed through the network based on the header hash; and

route the decrypted packet to the selected one of the multiple VPNs.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Feb 6, 2015
From: KANTECKI, TOMASZ; MCDONNELL, NIALL D.
To: INTEL CORPORATION
Reel/Frame 034913/0855 →
Continuity (1)
Related Publication 20160182509A1 · Jun 23, 2016