WO2016150097A1

WO2016150097A1 - Service offloading method and system

Info

Publication number: WO2016150097A1
Application number: PCT/CN2015/088148
Authority: WO
Inventors: 郭瑞芳
Original assignee: 中兴通讯股份有限公司
Priority date: 2015-03-26
Filing date: 2015-08-26
Publication date: 2016-09-29
Also published as: CN106161340B; CN106161340A

Abstract

Disclosed are a service offloading method and system. The method comprises: generate at least one identical offloading table for all interface boards according to IPsec negotiation elements or dynamic user access information; each interface board selects a corresponding offloading table according to a message type of a message needing to be processed; and each interface board offloads and delivers the message to a corresponding security association (SA) resource service board according to the selected offloading table.

Description

Business distribution method and system

Technical field

This application relates to, but is not limited to, the field of communications.

Background technique

Internet Protocol Security (Ipsec) requires the establishment of a Security Association (SA) before protecting packets. The IPsec protocol architecture consists of two secure processing protocols and one key exchange protocol. The two security processing protocols are the IP Authentication Header Protocol (AH) and the IP Security Encapsulation Payload Protocol (ESP), and a Key Exchange Protocol (IKE) is used to establish a Security Association (SA).

With the large-scale use of IPsec, higher requirements are imposed on high-performance processing. The distributed form allows the IPsec service to be handed over to multiple processors, greatly improving processing performance. Currently, the widely used distributed processing technology is a device that uses a main control board and multiple interface boards and service boards. The IPsec related processing is mainly assigned to the service board. In addition, the IPsec support anti-replay function requires that the same IPsec session-related service message be processed on one processor.

Packets to be processed by the IPsec service include IP packets, IPsec packets (ESP or AH packets), and IKE negotiation packets.

In the IPsec project deployment, for the session peer, it can be divided into statically specified and dynamically changing usage scenarios. In the static designation mode, the peer network address and the interest stream are fixed. The dynamic change mode is mostly used in the dynamic user remote access scenario. The user network address and the number of users are dynamically changed.

For different IPsec application scenarios, how to distribute the IPsec service to the distributed mode main control board and multiple interface boards and service boards. How to split the packets related to IPsec services with different characteristics to a service board is required to be solved. problem.

Summary of the invention

The following is an overview of the topics detailed in this document. This Summary is not intended to limit the scope of the claims.

This document provides a service offloading method and system to solve the problem of packet shunting related to IPsec services with different characteristics.

A service offloading method, comprising:

Generating the same at least one offloading table for all interface boards according to the IPsec negotiation element or the dynamic user access information;

Each interface board selects a corresponding traffic distribution table according to the packet type of the packet to be processed.

Each interface board delivers the packet to the corresponding security association (SA) resource service board according to the selected traffic distribution table.

Optionally, the distribution table includes any one or any of the following:

a key exchange protocol (IKE) offload table that records the correspondence between the source, the destination network address, and the SA resource service board;

And a clear text distribution table that records the correspondence between the interest stream matching template and the physical address of the SA resource service board, where the interest stream matching module is an ACL or a private network address allocated for the dynamic access user;

A ciphertext split table that records the correspondence between the Secure Parameter Index (SPI) fixed bit and the SA resource service board.

Optionally, each interface board selects a corresponding traffic distribution table according to the packet type of the packet to be processed, including:

When the packet type of the packet is an exchange protocol (IKE) negotiation packet, the IKE offloading table is selected;

When the packet type of the packet is a plaintext packet, the plaintext distribution table is selected;

When the type of the packet is a ciphertext packet, the ciphertext distribution table is selected.

Optionally, generating the same at least one offloading table for all interface boards according to the IPsec negotiation element includes:

The main control board allocates address bits for the physical address of the online SA resource service board.

The main control board specifies the source and destination addresses of the session and other IPsec negotiation requirements, and uses the load balancing algorithm to calculate the physical address of the SA resource service board of the session with different source and destination addresses.

The main control board generates a distribution table and delivers the distribution table to all interface boards.

Optionally, after the step of generating the traffic distribution table by the main control board and delivering the information to all the interface boards, the method further includes:

The SA resource service board negotiates the SA entry and records the correspondence between the interest stream and the SA after negotiation.

Optionally, the method further includes:

The local interface delivers the specified flow of interest beyond the negotiation range to the SA resource service board for the specified interest flow that is out of the negotiation range.

The SA resource service board triggers the IPsec negotiation without the SA when the SA corresponding to the specified interest flow exceeding the negotiation range is not queried.

Optionally, the method further includes:

The main control board deletes the distribution table and sends it to all interface boards, indicating that all the interface boards delete the distribution table.

Optionally, generating the same at least one traffic distribution table for all interface boards according to the dynamic user access information includes:

The interface board receives the IKE negotiation request packet sent by the dynamic user, extracts the source address and the destination address in the IKE negotiation request packet, and calculates the physical address of the SA resource service board of the corresponding session according to the source address and the destination address. The IKE negotiation request message is delivered to the SA resource service board;

The SA resource service board negotiates to obtain an SA, and reports the physical address of the SA resource service board, the source address and the destination address of the negotiation parties, and the private network address allocated to the user to the main control board;

Optionally, the method further includes:

After the dynamic user is offline, the SA resource service board deletes the SA corresponding to the dynamic user, and notifies the main control board to delete the SA corresponding to the dynamic user.

A service offloading system includes a main control board, at least one interface board, and at least one SA resource service board;

The main control board is configured to: generate the same at least one offloading table for all interface boards according to the IPsec negotiation element or the dynamic user access information;

The at least one interface board is configured to: according to the packet type of the packet to be processed, select a corresponding traffic distribution table, and distribute the packet to the corresponding SA resource service according to the selected traffic distribution table. board.

Optionally, the main control board includes:

The first address bit allocation module is configured to: allocate an address bit for a physical address of the online SA resource service board;

The calculation module is configured to: specify the source and destination addresses of the session, and other IPsec negotiation requirements, and use the load balancing algorithm to calculate the physical address of the SA resource service board of the session with different source and destination addresses;

The first traffic distribution table is configured to generate a traffic distribution table and deliver the data to all interface boards.

Optionally, the interface board is further configured to: when the statically specified interest flow range of the local end is greater than the negotiation scope of the two parties, the specified interest flow exceeding the negotiation scope is delivered to the SA resource for the specified interest flow beyond the negotiation scope. Business board

The SA resource service board is further configured to: trigger an IPsec negotiation without SA when the SA corresponding to the specified interest flow exceeding the negotiation range is not queried.

Optionally, the main control board includes:

a second address bit allocation module, configured to: allocate an address bit for a physical address of the online SA resource service board;

The information receiving module is configured to: receive a physical address of the SA resource service board reported by the SA resource service board to the main control board, a source address and a destination address of the negotiation parties, and a private network address allocated to the user;

The second traffic distribution table is configured to generate a traffic distribution table and deliver the data to all interface boards.

A computer readable storage medium storing computer executable instructions for performing the method of any of the above.

The embodiment of the present invention provides a service offloading method and system, which generates the same at least one offloading table for all interface boards according to the IPsec negotiation element or the dynamic user access information, and the type of the packet of each interface board according to the packet to be processed. The corresponding traffic distribution table is selected, and each interface board delivers the packet to the corresponding SA resource service board according to the selected traffic distribution table. It implements the offloading and co-processing of packets related to different IPsec services, and solves the problem of packet shunting related to IPsec services with different characteristics.

Other aspects will be apparent upon reading and understanding the drawings and detailed description.

BRIEF abstract

1 is a schematic structural diagram of a distributed flow distribution device according to Embodiment 1 of the present invention;

2 is a schematic diagram of a process of statically designating a peer address mode splitting according to Embodiment 1 of the present invention;

3 is a schematic diagram of a process of dynamic user access offloading according to Embodiment 1 of the present invention;

4 is a flowchart of a service offloading method according to Embodiment 2 of the present invention;

FIG. 5 is a schematic structural diagram of a service offloading system according to Embodiment 3 of the present invention; FIG.

FIG. 6 is a schematic structural view of the main control board 501 of FIG. 5.

Embodiments of the invention

Embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be noted that, in the case of no conflict, the features in the embodiments and the embodiments in the present application may be arbitrarily combined with each other.

Embodiments of the present invention provide a service offloading method and system. Use the different traffic distribution table to offload Internet Protocol security (IPsec) service-related packets to the security association (SA) resource service board to solve the problem of distributed IPsec services. The problem of flow.

First, the first embodiment of the present invention will be described with reference to the accompanying drawings.

The embodiment of the invention provides a distributed offloading device, which is composed of a main control board and a plurality of interface boards and service boards. The IPsec SA negotiation is performed on the service board. The service board responsible for the session is the SA resource service board.

According to the type of packets to be processed by the IPsec service, the interface is configured to be offloaded to the SA resource service board by using different traffic distribution tables. That is, the key exchange protocol (Internet Key Exchange Internet, IKE) offloading table offloads the IKE negotiation message; the plaintext offloading table offloads the common IP packet; the ciphertext offloading table offloads the ciphertext message, which is the IPsec authentication header protocol (AuthenticationHeader, AH) And Encapsulating Security Payload (ESP) packets. The traffic distribution table is distributed on the interface board. The SA resource service board maintains only IPsec SA information.

The IKE traffic distribution table records the source and destination network addresses and the SA resource service board relationship. The plaintext traffic distribution table records the relationship between the interest stream matching template and the SA resource service board physical address. The interest stream matching template can be an access control list. The ACL can also be a private network address assigned to the dynamic access user; the ciphertext distribution table records the correspondence between the security parameter index (SPI) fixed bit and the SA resource service board. To speed up the query of the SA resource service board, each physical service board physical address is assigned a different bit representation when the distributed device service is on-line, and the bit is used in a fixed bit allocated to the session peer SPI; The cipher text is directly imported, and the SPI fixed bit in the cipher text is directly extracted, and the SA resource service board is queried for shunting.

The split table generation mode is different for statically specifying the peer address and dynamic user access scenarios.

With the embodiment of the present invention, the main control board is responsible for configuration management, and generates and deletes the flow distribution table. The interface board is responsible for sending and receiving packets, and the IPsec service packet is distributed to the SA resource service board according to the different types of packet query flow; the SA resource service board is responsible for IPsec SA negotiation and IPsec encryption and decryption processing.

As shown in Figure 1, the distributed offloading device includes a main control board and multiple interface boards and service boards to exchange packets through inter-board communication. The main control board includes a configuration management module and a traffic distribution management module. The interface board includes packets. The transceiver module and the traffic distribution management module; the service board includes an SA negotiation module and a message encryption and decryption module.

The traffic distribution management module on the main control board is responsible for calculating the address bits of the service board and statically specifying the mode. Load balancing calculates the SA resource service board, generates and deletes the traffic distribution table, and the traffic distribution management module on the interface board is responsible for: maintaining the traffic distribution table information and selecting different traffic distribution table delivery service boards and dynamic user access mode load balancing calculation according to the source message type. SA resource business board.

Figure 2 shows the process of statically specifying the peer address mode to offload:

Step 201: After the service board is online, the main control board offload management module allocates physical addresses of different service boards to address bits.

The traffic management module on the main control board senses the service board, and assigns a value to indicate the physical address of the service board, which is called the service board address bit. The service board address bit is used to allocate security to the session peer. The Security Parametres Index (SPI) is used to identify the SAs of different communication devices. That is, the packets sent from the peer device carry the SPI that the local end allocates to the peer. The SPI uniquely indexes the security association SA. When the local end receives the packet, the SPI can be found to find the corresponding SA. Different sessions correspond to different SAs, corresponding to different SPI) fixed bits.

Step 202: The IPsec configuration management module statically specifies the source and destination addresses of the two parties and configures other IPsec negotiation elements. The traffic management module uses the load balancing algorithm to calculate the SA source service board address for the session with different source and destination addresses. The traffic distribution table, the ciphertext distribution table, and the plaintext distribution table are delivered to all interface boards.

The IKE offloading table records the correspondence between the source and destination addresses of the session and the SA resource service board. The ciphertext offload table records the correspondence between the address bits of the service board and the SA resource service board. The plaintext offload table records the statically specified ACL flow and SA. Resource business board relationship.

Step 203: The SA resource service board negotiates a successful SA entry, and the encryption and decryption module records the interest flow and the SA after the negotiation.

The SA negotiation module allocates the fixed bit of the SPI as the service board address bit when the SPI is allocated. (If the SPI occupies 4 bytes, then 1 byte can directly use the bit allocated in step 201 (the bit in step 201) The bit is actually the in-position information of the service board. The other three bytes need to be allocated according to different values of different SAs. After the SPI is successfully allocated, the data packets sent by the peer device carry the SPI, and the local end receives the data. In the case of the packet, the 1 byte in the SPI is taken out, and it is found which service board should be delivered to the service board, that is, corresponding to step 204; the negotiation interest stream and the SA correspondence relationship are recorded.

If the local-defined static flow of interest is greater than the negotiated flow of interest, the interface-based traffic distribution module delivers the traffic to the SA resource service board. The corresponding SA triggers IPsec negotiation without SA.

Step 204: On the interface board, the IKE negotiation packet is delivered to the SA resource service board through the IKE offloading table; the plaintext is queried to the SA resource service board by querying the plaintext traffic distribution table; The bit queries the ciphertext split table and delivers it to the SA resource service board for decryption.

Step 205: The static configuration of the IPsec is deleted. The traffic distribution management module of the main control board deletes the traffic distribution table and delivers all interface boards.

Figure 3 shows the process of dynamic user access offloading:

Step 301: After the service board is online, the main control board offload management module allocates physical addresses of different service boards to address bits. Step 1 of the same static mode.

Step 302: The interface board receives the IKE negotiation request packet of the dynamic user, and the traffic management module extracts the source and destination address of the IKE packet, and uses a load balancing algorithm, such as the HASH algorithm, to calculate the physical address of the SA resource service board of the session; The negotiation packet is delivered to the SA resource service board.

Before IPsec protects a packet, you must first establish an SA. The process of establishing an SA is the IKE negotiation process. The new dynamic user needs to negotiate the SA and the traffic distribution table when applying for access. After the access is successfully applied to the private network address, the data traffic is split according to the traffic distribution table.

Step 303: The SA resource service board negotiation module negotiates the SA, and actively reports the traffic management module of the main control board, and carries the physical address information of the SA resource service board, the source and destination addresses of the two parties, and the private network address allocated to the user.

The SA negotiation module uses the fixed bit of the SPI as the service board address bit when allocating the SPI.

Step 304: The traffic distribution management module on the main control board generates an IKE traffic distribution table, a plaintext traffic distribution table, and a ciphertext traffic distribution table.

Generate an IKE offload based on the address of the SA resource service board and the source and destination addresses of the negotiation source. A plaintext offloading table is generated according to the address of the SA resource service board and the private network address assigned to the user; and the ciphertext distribution table is generated according to the SA resource service board address and the SPI fixed bit. In the dynamic user access scenario, the advantage of using the private network address assigned to the user as the traffic stream matching template in the clear text distribution table is to save the query speed of the ACL on the interface board.

Step 305: On the interface board, the IKE negotiation packet is delivered to the SA resource service board through the IKE traffic distribution table. The plain text is queried in the plaintext traffic distribution table, and the private network address of the user is delivered to different SA resource service boards for encryption. The fixed feature bit queries the ciphertext offload table and delivers it to the SA resource service board for decryption.

Step 306: The dynamic user goes offline, and the SA on the SA resource service board is deleted, and the main control board is divided into the flow management module.

Step 307: The main control board deletes the traffic distribution table and delivers all interface boards.

Embodiment 2 of the present invention will be described below with reference to the accompanying drawings.

The embodiment of the present invention provides a service offloading method, and the process of performing the offloading process on different IPsec packets by using the method is as shown in FIG. 4, and includes:

Step 401: Generate the same at least one offloading table for all interface boards according to the IPsec negotiation element or the dynamic user access information.

In the embodiment of the present invention, the flow distribution table includes any one or any of the following:

An IKE offload table that records the correspondence between the source and destination network addresses and the SA resource service boards.

And a clear text distribution table that records the correspondence between the interest stream matching template and the physical address of the SA resource service board, where the interest stream matching module is an ACL or a private network address allocated for the dynamic access user.

A ciphertext split table that records the correspondence between the SPI fixed bit and the SA resource service board.

For statically specifying the peer address scenario, this step includes:

1. The main control board allocates address bits for the physical address of the online SA resource service board.

2. The main control board specifies the source and destination addresses of the session and other IPsec negotiation requirements, and uses the load balancing algorithm to calculate the SA resource service board physics of the session with different source and destination addresses. address;

3. The main control board generates a flow distribution table and sends it to all interface boards;

4. The SA resource service board negotiates the SA entry and records the correspondence between the interest flow and the SA after negotiation.

If the local-defined static flow of interest is greater than the negotiated range of the two parties, the interface board delivers the specified flow of interest beyond the negotiation range to the SA resource service board, the SA resource service board. When the SA corresponding to the specified interest stream beyond the negotiation range is not queried, the IPsec negotiation without SA is triggered.

For dynamic user access scenarios, this step includes:

The interface board receives the IKE negotiation request packet sent by the dynamic user, extracts the source address and the destination address in the IKE negotiation request packet, and calculates the physical address of the SA resource service board of the corresponding session according to the source address and the destination address. And delivering the IKE negotiation request message to the SA resource service board;

3. The SA resource service board negotiates to obtain the SA, and reports the physical address of the SA resource service board, the source address and the destination address of the negotiation parties, and the private network address allocated to the user to the main control board;

4. The main control board generates a flow distribution table and sends it to all interface boards.

Step 402: Each interface board selects a corresponding traffic distribution table according to the packet type of the packet to be processed.

This step includes:

Step 403: Each interface board delivers the message according to the selected split table. Go to the corresponding SA resource service board.

The main control board can also delete the traffic distribution table and control the interface board deletion. The main control board deletes the traffic distribution table and sends the traffic distribution table to all the interface boards to indicate that all the interface boards delete the traffic distribution table. For dynamic user access scenarios, dynamic users are selected. After the offline, the SA resource service board deletes the SA corresponding to the dynamic user, and notifies the main control board to delete the SA corresponding to the dynamic user, and the main control board deletes the distribution table and delivers the distribution table to all interface boards. Instructing all the interface boards to delete the offloading table.

Embodiment 3 of the present invention will be described below with reference to the accompanying drawings.

An embodiment of the present invention provides a service offloading system, and the structure thereof is as shown in FIG. 5, including:

The main control board 501, at least one interface board 502, and at least one SA resource service board 503;

The main control board 501 is configured to generate the same at least one split table for all interface boards 502 according to the IPsec negotiation element or the dynamic user access information;

The at least one interface board 502 is configured to: according to the packet type of the packet to be processed, select a corresponding traffic distribution table, and distribute the packet to the corresponding SA resource according to the selected traffic distribution table. Business board 503.

Optionally, the structure of the main control board 501 is as shown in FIG. 6, and includes:

The first address bit allocation module 601 is configured to: allocate an address bit for the physical address of the online SA resource service board;

The calculation module 602 is configured to: specify the source and destination addresses of the session, and other IPsec negotiation requirements, and use the load balancing algorithm to calculate the physical address of the SA resource service board of the session with different source and destination addresses;

The first traffic distribution table generating module 603 is configured to generate a traffic distribution table and deliver the data to all interface boards.

Optionally, the interface board 502 is further configured to: when the statically specified interest flow range of the local end is greater than the negotiation scope of the two parties, the specified interest flow exceeding the negotiation scope is delivered to the SA for the specified interest flow that exceeds the negotiation scope. Resource business board 503;

The SA resource service board 503 is further configured to: When the SA corresponding to the interest stream is specified, the IPsec negotiation without SA is triggered.

Optionally, the main control board 501 further includes:

The second address bit allocation module 604 is configured to: allocate an address bit for the physical address of the online SA resource service board 503;

The information receiving module 605 is configured to: receive the physical address of the SA resource service board 503 reported by the SA resource service board 503 to the main control board 501, the source address and the destination address of the negotiation parties, and the private network address allocated to the user. ;

The second distribution table generating module 606 is configured to generate a distribution table and deliver the information to all interface boards 502.

The embodiment of the present invention provides a service offloading method and system, and calculates the same at least one offloading table for all the interface boards, and each interface board selects a corresponding splitting table according to the packet type of the packet to be processed. Each interface board delivers the packet to the corresponding SA resource service board according to the selected traffic distribution table. It implements the offloading and co-processing of packets related to different IPsec services, and solves the problem of packet shunting related to IPsec services with different characteristics.

One of ordinary skill in the art will appreciate that all or a portion of the steps of the above-described embodiments can be implemented using a computer program flow, which can be stored in a computer readable storage medium, such as on a corresponding hardware platform (eg, The system, device, device, device, etc. are executed, and when executed, include one or a combination of the steps of the method embodiments.

Alternatively, all or part of the steps of the above embodiments may also be implemented by using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or multiple modules or steps may be fabricated into a single integrated circuit module. achieve.

The devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.

Each device/function module/functional unit in the above embodiment can be stored in a computer readable storage medium when implemented in the form of a software function module and sold or used as a stand-alone product. in. The above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.

Industrial applicability

The embodiment of the present invention implements the offloading and collaborative processing of packets related to different IPsec services, and solves the problem of packet offloading related to IPsec services of different characteristics.

Claims

A service offloading method, comprising:

Generating the same at least one offloading table for all interface boards according to the IPsec negotiation element or the dynamic user access information;

Each interface board selects a corresponding traffic distribution table according to the packet type of the packet to be processed.

Each interface board delivers the packet to the corresponding security association (SA) resource service board according to the selected traffic distribution table.
The service distribution method according to claim 1, wherein the distribution table comprises any one or any of the following:

a key exchange protocol (IKE) offload table that records the correspondence between the source, the destination network address, and the SA resource service board;

And a clear text distribution table that records a correspondence between the interest stream matching template and the physical address of the SA resource service board, where the interest stream matching module is an access control list (ACL) or a private network address allocated for the dynamic access user;

A ciphertext split table that records the correspondence between the Secure Parameter Index (SPI) fixed bit and the SA resource service board.
The service offloading method according to claim 2, wherein each interface board selects a corresponding offloading table according to the packet type of the packet to be processed, including:

When the packet type of the packet is an IKE negotiation packet, the IKE offloading table is selected.

When the packet type of the packet is a plaintext packet, the plaintext distribution table is selected;

When the type of the packet is a ciphertext packet, the ciphertext distribution table is selected.
The service offloading method according to claim 1, wherein generating the same at least one offloading table for all interface boards according to the IPsec negotiation element comprises:

The main control board allocates address bits for the physical address of the online SA resource service board.

The main control board specifies the source and destination addresses of the session and other IPsec negotiation requirements, and uses the load balancing algorithm to calculate the physical address of the SA resource service board of the session with different source and destination addresses.

The main control board generates a distribution table and delivers the distribution table to all interface boards.
The service offloading method according to claim 4, wherein after the step of generating the offloading table by the main control board and delivering the information to all the interface boards, the method further includes:

The SA resource service board negotiates the SA entry and records the correspondence between the interest stream and the SA after negotiation.
The service offloading method according to claim 4, further comprising:

The local interface delivers the specified flow of interest beyond the negotiation range to the SA resource service board for the specified interest flow that is out of the negotiation range.

The SA resource service board triggers the IPsec negotiation without the SA when the SA corresponding to the specified interest flow exceeding the negotiation range is not queried.
The service offloading method according to claim 4, further comprising:

The main control board deletes the distribution table and sends it to all interface boards, indicating that all the interface boards delete the distribution table.
The service offloading method according to claim 1, wherein generating the same at least one offloading table for all interface boards according to the dynamic user access information comprises:

The main control board allocates address bits for the physical address of the online SA resource service board.

The interface board receives the IKE negotiation request packet sent by the dynamic user, extracts the source address and the destination address in the IKE negotiation request packet, and calculates the physical address of the SA resource service board of the corresponding session according to the source address and the destination address. The IKE negotiation request message is delivered to the SA resource service board;

The SA resource service board negotiates to obtain an SA, and reports the physical address of the SA resource service board, the source address and the destination address of the negotiation parties, and the private network address allocated to the user to the main control board;

The main control board generates a distribution table and delivers the distribution table to all interface boards.
The service offloading method according to claim 8, further comprising:

After the dynamic user is offline, the SA resource service board deletes the SA corresponding to the dynamic user, and notifies the main control board to delete the SA corresponding to the dynamic user.

The main control board deletes the distribution table and sends it to all interface boards, indicating that all the interface boards delete the distribution table.
A service offloading system includes a main control board, at least one interface board, and at least one SA resource service board;

The main control board is configured to: generate the same at least one offloading table for all interface boards according to the IPsec negotiation element or the dynamic user access information;

The at least one interface board is configured to: according to the packet type of the packet to be processed, select a corresponding traffic distribution table, and distribute the packet to the corresponding SA resource service according to the selected traffic distribution table. board.
The service distribution system according to claim 10, wherein the main control board comprises:

The first address bit allocation module is configured to: allocate an address bit for a physical address of the online SA resource service board;

The calculation module is configured to: specify the source and destination addresses of the session, and other IPsec negotiation requirements, and use the load balancing algorithm to calculate the physical address of the SA resource service board of the session with different source and destination addresses;

The first traffic distribution table is configured to generate a traffic distribution table and deliver the data to all interface boards.
The business distribution system according to claim 10, wherein

The interface board is further configured to: when the local-defined static interest flow range is greater than the negotiation scope of the two parties, the specified interest flow that exceeds the negotiation scope is delivered to the SA resource service board for the specified interest flow that is out of the negotiation range;

The SA resource service board is further configured to: trigger an IPsec negotiation without SA when the SA corresponding to the specified interest flow exceeding the negotiation range is not queried.
The service distribution system according to claim 10, wherein the main control board comprises:

a second address bit allocation module, configured to: allocate an address bit for a physical address of the online SA resource service board;

The information receiving module is configured to: receive the physical address of the SA resource service board reported by the SA resource service board to the main control board, negotiate the source address and destination address of both parties, and allocate the user Private network address;

The second traffic distribution table is configured to generate a traffic distribution table and deliver the data to all interface boards.
A computer readable storage medium storing computer executable instructions for performing the method of any of claims 1-9.