Spi differentiated thin pipes between endpoints with core balancing based on spi selection

Abstract

A sub-tunneling technique disclosed herein reserves a range of security parameters index (SPI) values when establishing a secure tunnel connection. At the sending tunnel peer, the network driver of the sending tunnel peer NIC ('sending NIC') maps network traffic flows to different SPI values within the range reserved for the secure tunnel connection. This effectively creates logical sub-tunnels within the secure tunnel connection and allows the sending NIC to distribute network traffic flows across the sub-tunnels. At the receiving tunnel peer, the network driver of its NIC (“receiving NIC”) masks lower bits of the SPI values to obtain a base SPI value corresponding to the secure tunnel connection to determine the security association for decrypting packets from the tunnel. However, the receiving NIC uses the various SPI values of the sub-tunnels to distribute the network traffic flows across the RX queues.