Building a High-Performance Data Channel for the Federal Cyber Range

To efficiently support large-scale simulation traffic in the Federal Cyber Range, it is necessary to establish a high-performance data channel between cyber ranges. This channel utilizes the VPN protocol for secure encryption, ensuring the secure transmission of user data. WireGuard has the characteristics of being faster and more streamlined than traditional VPN technology. To address the issue that the Network Interface Card does not support the distribution of encrypted VPN traffic, a traffic-splitting mechanism has been proposed for WireGuard VPN. This method is based on XDP technology and bypasses the kernel network protocol stack, which can reduce the processing delay of packets and distribute encrypted traffic evenly to different CPU cores. A scheduling algorithm based on the earliest departure time is used when sending packets. By combining the retransmission packet detection algorithm proposed in this paper, the priority of retransmission packets and other interested flows can be flexibly controlled. The system's test results from multiple perspectives such as bandwidth and delay show that compared with the Linux kernel module WireGuard solution, the bandwidth utilization rate of the link network is increased by more than 2.5 times, and the transmission delay is effectively reduced by more than 80%.