US 12,218,924 B2
Segmentation of encrypted segments in networks
Wenyi Jiang, Palo Alto, CA (US); Daniel G. Wing, Palo Alto, CA (US); Bin Qian, San Jose, CA (US); and Dexiang Wang, Sunnyvale, CA (US)
Assigned to NICIRA, INC., Palo Alto, CA (US)
Filed by NICIRA, INC., Palo Alto, CA (US)
Filed on Aug. 15, 2023, as Appl. No. 18/450,345.
Application 18/450,345 is a continuation of application No. 17/458,969, filed on Aug. 27, 2021, granted, now 11,729,155.
Application 17/458,969 is a continuation of application No. 15/796,656, filed on Oct. 27, 2017, granted, now 11,108,751, issued on Aug. 31, 2021.
Prior Publication US 2023/0396598 A1, Dec. 7, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); H04L 47/36 (2022.01); H04L 69/22 (2022.01); H04L 69/324 (2022.01)
CPC H04L 63/0485 (2013.01) [H04L 47/36 (2013.01); H04L 63/029 (2013.01); H04L 69/22 (2013.01); H04L 69/324 (2013.01)] 21 Claims
OG exemplary drawing
 
1. A method comprising:
receiving, at a first host, a first packet from a first compute node that is being sent to a second compute node of a second host, the first packet including a first header and a payload, wherein the payload is larger than a maximum transmission unit size for sending packets to the second compute node;
encapsulating the first packet with an outer header;
analyzing a length of at least a portion of the outer header in determining a size of an encrypted segment of the payload to include in a plurality of packets;
forming the plurality of packets, wherein each packet in the plurality of packets includes an encrypted segment of the payload, a respective encryption header for the respective encrypted segment, and a respective authentication value for the respective encrypted segment, wherein the payload of the first packet is segmented to form a plurality of encrypted segments based on the size of the encrypted segment;
sending the plurality of packets to the second host using the outer header;
receiving an indication that one of the plurality of packets was not received by the second compute node; and
sending a second packet including the encrypted segment that was not received in the one of the plurality of the packets to the second compute node.