Adaptive, performance-oriented, and compression-assisted encryption scheme

1. A method for an adaptive, performance-oriented, and compression-assisted encryption scheme implemented on a host computer to adaptively improve utilization of CPU resources, the method comprising:

queueing a new data packet and determining a size of the new data packet;

based on, at least in part, historical data, determining a plurality of already encrypted data packets;

based on, at least in part, information stored for the plurality of already encrypted data packets, determining an average ratio of compression for the plurality of already encrypted data packets;

based on, at least in part, the size of the new data packet, retrieving a throughput of compression value and a throughput of encryption value;

based on, at least in part, the average ratio of compression, the throughput of compression value and the throughput of encryption value, determining whether the throughput of compression value exceeds a threshold based on the throughput of encryption value, thereby indicating a prediction that compressing the new data packet reduces overall load on CPU resources; and

in response to determining that the throughput of compression value exceeds the threshold, generating a compressed new data packet by compressing the new data packet.

2. The method of claim 1 , wherein the threshold is determined by calculating a difference between one and the average ratio of compression and dividing the throughput of encryption value by the difference.

3. The method of claim 1 , further comprising:

in response to determining that the throughput of compression value exceeds the threshold, encrypting the compressed new data packet after the compressing; and

in response to determining that the throughput of compression value does not exceed the threshold, encrypting the new data packet without first compressing the new data packet.

4. The method of claim 1 , further comprising:

upon receiving the new data packet, determining whether the new data packet belongs to a particular traffic flow, wherein determining whether the new data packet belongs to the particular traffic flow is based on, at least in part, content of a packet header of the new data packet; and

in response to determining that the new data packet belongs to the particular traffic flow, determining a particular subset of the historical data, and selecting the plurality of already encrypted data packets from the particular subset of the historical data.

5. The method of claim 1 , wherein the throughput of compression value is retrieved from a throughput of compression table that is indexed using a size of a data packet and an estimated compression ratio;

wherein the throughput of compression value represents a count of bytes compressed within a certain time period for a data packet that has the size of the new data packet and for the average ratio of compression;

wherein the throughput of encryption value is retrieved from a throughput of encryption table that is indexed using a size of a data packet;

wherein the throughput of encryption value represents a count of bytes encrypted within a certain time period for a data packet that has the size of the new data packet;

wherein the throughput of compression table and the throughput of encryption table are generated based on training data; and

wherein the historical data is collected based on the training data.

6. The method of claim 1 , wherein the average ratio of compression is computed as a weighted average ratio of compression.

7. The method of claim 1 , wherein the throughput of compression value depends on entropy density characteristics carried in the new data packet.

8. One or more non-transitory computer-readable storage media storing computer instructions which, when executed by one or more processors, cause the one or more processors to perform:

queueing a new data packet and determining a size of the new data packet;

based on, at least in part, historical data, determining a plurality of already encrypted data packets;

based on, at least in part, information stored for the plurality of already encrypted data packets, determining an average ratio of compression for the plurality of already encrypted data packets;

based on, at least in part, the size of the new data packet, retrieving a throughput of compression value and a throughput of encryption value;

based on, at least in part, the average ratio of compression, the throughput of compression value and the throughput of encryption value, determining whether the throughput of compression value exceeds a threshold based on the throughput of encryption value thereby indicating a prediction that compressing the new data packet reduce overall load on CPU resources; and

in response to determining that the throughput of compression value exceeds the threshold, generating a compressed new data packet by compressing the new data packet.

9. The one or more non-transitory computer-readable storage media of claim 8 , wherein the threshold is determined by calculating a difference between one and the average ratio of compression and dividing the throughput of encryption value by the difference.

10. The one or more non-transitory computer-readable storage media of claim 8 , storing additional instructions which, when executed by the one or more processors, cause the one or more processors to perform:

in response to determining that the throughput of compression value exceeds the threshold, encrypting the compressed new data packet after the compressing; and

in response to determining that the throughput of compression value does not exceed the threshold, encrypting the new data packet without first compressing the new data packet.

11. The one or more non-transitory computer-readable storage media of claim 8 , storing additional instructions which, when executed by the one or more processors, cause the one or more processors to perform:

upon receiving the new data packet, determining whether the new data packet belongs to a particular traffic flow, wherein determining whether the new data packet belongs to the particular traffic flow is based on, at least in part, content of a packet header of the new data packet; and

in response to determining that the new data packet belongs to the particular traffic flow, determining a particular subset of the historical data, and selecting the plurality of already encrypted data packets from the particular subset of the historical data.

12. The one or more non-transitory computer-readable storage media of claim 8 , wherein the throughput of compression value is retrieved from a throughput of compression table that is indexed using a size of a data packet and an estimated compression ratio;

wherein the throughput of compression value represents a count of bytes compressed within a certain time period for a data packet that has the size of the new data packet and for the average ratio of compression;

wherein the throughput of encryption value is retrieved from a throughput of encryption table that is indexed using a size of a data packet;

wherein the throughput of encryption value represents a count of bytes encrypted within a certain time period for a data packet that has the size of the new data packet;

wherein the throughput of compression table and the throughput of encryption table are generated based on training data; and

wherein the historical data is collected based on the training data.

13. The one or more non-transitory computer-readable storage media of claim 8 , wherein the average ratio of compression is computed as a weighted average ratio of compression.

14. The one or more non-transitory computer-readable storage media of claim 8 , wherein the throughput of compression value depends on entropy density characteristics carried in the new data packet.

15. The one or more non-transitory computer-readable storage media of claim 8 , wherein the computer instructions are incorporated into a hypervisor.