Hewlett Packard Enterprise Development LP

Huimeng Huang

Jianpo Han

Wei Peng Huang

Chunfeng Wang

Zhijun Ren

Qiwei Chang

Jishi Wang

Kiranmaye Sirigineni

Xueliang Zhang

Implementations of the present disclosure relate to packet fragmentation in Generic Routing Encapsulation (GRE). A method comprises in accordance with a determination that the target packet is to be fragmented, generating at least two packets from the target packet. The at least two packets comprise an Internet Protocol (IP) header, a GRE header and a fragment of the payload of the target packet, respectively. The GRE header comprises a fragment indication indicating that the respective packet comprises a respective fragment of the payload of the target packet. The method further comprises transmitting the at least two packets to a second network device. In this way, the packet fragment dropping due to security policies will be avoided.

Packet fragmentation in GRE

A packet that includes a header and a payload can be acquired. A first portion of the payload can be selected such that the first portion that is smaller than the payload. The header and the first portion of the payload can be encrypted based on an encryption algorithm to generate an encrypted packet. The encrypted packet can be transmitted to a node on a network.

Performance improvement for encrypted traffic over IPSEC

Systems are methods are provided for implementing load balancing of IPsec security associations (SAs) SAs between different heterogeneous cores, for example in a multiple controller systems. The balancing of IPsec SAs are performed using software implementations of IPsec offloading and/or hardware implementations of IPsec offloading. By balancing the processing functions related to orchestration of IPsec SAs between hardware (e.g., IPsec hardware accelerator) and software (e.g., IPsec software accelerator), the methods realize increased optimization, improved user experience, and enhanced product performance in networks using IPsec. For example, an IPsec session is initiated, and it is determined whether a resource limitation for a hardware-based IPsec accelerator has been reached. If the limitation for the hardware-based IPsec accelerator has been reached, processing for the IPsec SA for the initiated IPsec session is offloaded to a software-based IPsec accelerator.

Internet protocol security (IPsec) security associations (SA) balance between heterogeneous cores in multiple controller system

An example device comprising: a processor to configure a user anchor controller (UAC) for each network controller when an access point (AP) is connected to at least two network controllers; assign each user of the AP to one of the UACs; and automatically select an uplink for each user based on the user's corresponding UAC to transmit the user's data traffic.

Growing community of inventors

Beijing, China

Huimeng Huang