US 12,284,166 B2
Throughput for a single VPN connection using multiple processing cores
Abhishek Gupta, Redmond, WA (US); Shivakumar Thangapandi, Redmond, WA (US); and Vikrant Arora, Redmond, WA (US)
Assigned to MICROSOFT TECHNOLOGY LICENSING, LLC, Redmond, WA (US)
Filed by MICROSOFT TECHNOLOGY LICENSING, LLC, Redmond, WA (US)
Filed on Sep. 16, 2022, as Appl. No. 17/946,956.
Application 17/946,956 is a continuation of application No. 17/332,752, filed on May 27, 2021, granted, now 11,477,176.
Prior Publication US 2023/0076070 A1, Mar. 9, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/0485 (2013.01) [H04L 63/0272 (2013.01)] 15 Claims
OG exemplary drawing
 
10. A method for encrypting outbound data packets to be communicated over a single virtual private network (VPN) tunnel from a VPN gateway to a remote device, the method comprising:
determining a number of available processing cores to encrypt the outbound data packets being communicated to the remote device over the single VPN tunnel and to decrypt inbound data packets that are received from the remote device over the single VPN tunnel, wherein an individual processing core comprises an available processing core based on a determination that the individual processing core is operating at a capacity that is less than a threshold capacity;
responsive to determining the number of available processing cores, dividing the number of available processing cores into a first set of processing cores to encrypt the outbound data packets and a second set of processing cores to decrypt the inbound data packets;
creating multiple outbound security associations (SAs) for the single VPN tunnel;
associating a different processing core, of the first set of processing cores, with each of the multiple outbound SAs created for the single VPN tunnel;
receiving an outbound data packet to be encrypted, wherein the outbound data packet includes a header that specifies a destination Internet Protocol (IP) address;
selecting an outbound SA, from the multiple outbound SAs, for the outbound data packet based on the destination IP address specified in the header of the outbound data packet; and
routing, for encryption purposes, the outbound data packet to the processing core that is associated with the selected outbound SA.