A 10 Gbps in-line network security processor based on configurable hetero-multi-cores

Yun NIU; Li-ji WU; Yang LIU; Xiang-min ZHANG; Hong-yi CHEN

doi:10.1631/jzus.C1200370

Your Location：

Home >

Browse articles >

A 10 Gbps in-line network security processor based on configurable hetero-multi-cores

Electronic Engineering | Updated：2022-05-19

- A 10 Gbps in-line network security processor based on configurable hetero-multi-cores
- A 10 Gbps in-line network security processor based on configurable hetero-multi-cores
- Frontiers of Information Technology & Electronic Engineering Vol. 14, Issue 8, Pages: 642-651(2013)
- Affiliations：
  
  1.National Laboratory for Information Science and Technology, Tsinghua University, Beijing 100084, China
  2.Institute of Microelectronics, Tsinghua University, Beijing 100084, China
- Author bio：
  
  [ "Yun NIU, niuy08@mails.tsinghua.edu.cn" ]
  Li-ji WU, lijiwu@mail.tsinghua.edu.cn
- Funds：
- DOI：10.1631/jzus.C1200370
  CLC： TN918
- Received：22 December 2012，
  
  Revised：2013-;7-12，
  
  Published：2013-08
- Accepted：
Scan QR Code
Yun NIU, Li-ji WU, Yang LIU, et al. A 10 Gbps in-line network security processor based on configurable hetero-multi-cores[J]. Frontiers of Information Technology & Electronic Engineering, 2013, 14(8): 642-651.
DOI：

Yun NIU, Li-ji WU, Yang LIU, et al. A 10 Gbps in-line network security processor based on configurable hetero-multi-cores[J]. Frontiers of Information Technology & Electronic Engineering, 2013, 14(8): 642-651. DOI： 10.1631/jzus.C1200370.

摘要

Abstract

This paper deals with an in-line network security processor (NSP) design that implements the Internet Protocol Security (IPSec) protocol processing for the 10 Gbps Ethernet. The 10 Gbps high speed data transfer

the IPSec processing including the crypto-operation

the database query

and IPSec header processing are integrated in the design. The in-line NSP is implemented using 65 nm CMOS technology and the layout area is 2.5 mm×3 mm with 360 million gates. A configurable crossbar data transfer skeleton implementing an iSLIP scheduling algorithm is proposed

which enables simultaneous data transfer between the heterogeneous multiple cores. There are

in addition

a high speed input/output data buffering mechanism and design of high performance hardware structures for modules

wherein the transfer efficiency and the resource utilization are maximized and the IPSec protocol processing achieves 10 Gbps line speed. A high speed and low power hardware look-up method is proposed

which effectively reduces the area and power dissipation. The post simulation results demonstrate that the design gives a peak throughput for the Authentication Header (AH) transport mode of 10.06 Gbps with the average test packet length of 512 bytes under the clock rate of 250 MHz

and power dissipation less than 1 W is obtained. An FPGA prototype is constructed to verify the function of the design. A test bench is being set up for performance and function verification.

关键词

Keywords

references

Z.H. Chen . . Research on Pattern Matching Algorithm in 40Gbps Application Awareness System . . MS Thesis, PLA Information Engineering University, Zhengzhou, China , , 2011 . . .

Y.H. Cho , , , W.H. Mangione-Smith . . Fast Reconfiguring Deep Packet for 1+ Gigabit Network . . Proc. 13th Annual IEEE Symp. on Field Programmable Custom Computing Machine , , 2005 . . p.215 - - 224 . . DOI: 10.1109/FCCM.2005.34 http://doi.org/10.1109/FCCM.2005.34 . .

Y.T. Fang , , , T.C. Huang , , , P.C. Wang . . Ternary CAM Compaction for IP Address Lookup . . 22nd Int. Conf. on Advanced Information Networking and Applications , , 2008 . . p.1462 - - 1467 . . DOI: 10.1109/WAINA.2008.168 http://doi.org/10.1109/WAINA.2008.168 . .

A. Ferrante , , , V. Piuri . . High-Level Architecture of an IPSec-Dedicated System on Chip . . 3rd EuroNGI Conf. on Next Generation Internet Networks , , 2007 . . p.159 - - 166 . . DOI: 10.1109/NGI.2007.371211 http://doi.org/10.1109/NGI.2007.371211 . .

A. Ferrante , , , V. Piuri , , , J. Owen . . IPSec Hardware Resource Requirements Evaluation . . Next Generation Internet Networks , , 2005 . . p.240 - - 246 . . DOI: 10.1109/NGI.2005.1431672 http://doi.org/10.1109/NGI.2005.1431672 . .

A. Ferrante , , , C. Satish , , , V. Piuri . . IPSec Database Query Acceleration . . 4th Int. Conf. on E-Business and Telecommunications , , 2007 . . p.188 - - 200 . . . .

P. Gupta , , , N. McKeown . . Designing and implementing a fast crossbar scheduler . . IEEE Micro , , 1999 . . 19 ( ( 1 ): ): 20 - - 28 . . DOI: 10.1109/40.748793 http://doi.org/10.1109/40.748793 . .

C.S. Ha , , , J.H. Lee , , , D.S. Leem . . ASIC Design of IPSec Hardware Accelerator for Network Security . . IEEE Asia- Pacific Conf. on Advanced System Integrated Circuits , , 2004 . . p.168 - - 171 . . . .

Hifn . . Flow Through Security Processor . . Available from , , http://www.acaltechnology.com/_files/legacy_news/HifnPB-9150-5.pdf http://www.acaltechnology.com/_files/legacy_news/HifnPB-9150-5.pdf , , 2008 . . .

IEEE Std 802.3 . . IEEE Standard for Ethernet . . IEEE Computer Society, NY, USA. , , 2012 . . .

R. Jain . . A comparison of hashing schemes for address lookup in computer networks . . IEEE Trans. Commun. , , 1992 . . 40 ( ( 10 ): ): 1570 - - 1573 . . DOI: 10.1109/26.168785 http://doi.org/10.1109/26.168785 . .

E. Khan , , , M.W. El-Kharashi , , , A.N.M.E. Rafiq , , , F. Gebali , , , M. Abd-El-Barr . . Network Processors for Communication Security: a Review . . IEEE Pacific Rim Conf. on Communications Computers and Signal Processing , , 2003 . . p.173 - - 176 . . . .

A.X. Liu , , , C.R. Meiners , , , E. Torng . . TCAM razor: a systematic approach towards minimizing packet classifiers in TCAMs . . IEEE/ACM Trans. Network. , , 2010 . . 18 ( ( 2 ): ): 490 - - 500 . . DOI: 10.1109/TNET.2009.2030188 http://doi.org/10.1109/TNET.2009.2030188 . .

Y. Liu , , , L.J. Wu , , , Y. Niu , , , X.M. Zhang , , , Z.Q. Gao . . A High-Speed SHA-1 IP Core for 10 Gbps Ethernet Security Processor . . 8th Int. Conf. on Computational Intelligence and Security , , 2012 . . p.237 - - 241 . . DOI: 10.1109/CIS.2012.60 http://doi.org/10.1109/CIS.2012.60 . .

N. McKeown . . iSLIP scheduling algorithm for input- queued switches . . IEEE/ACM Trans. Network. , , 1999 . . 7 ( ( 2 ): ): 188 - - 201 . . DOI: 10.1109/90.769767 http://doi.org/10.1109/90.769767 . .

Y. Nishida , , , K. Kawai , , , K. Koike . . A 2Gbs Network Processor with a 24mW IPsec Offload for Residential Gateways . . IEEE Int. Solid-State Circuits Conf. , , 2010 . . p.280 - - 281 . . DOI: 10.1109/ISSCC.2010.5433917 http://doi.org/10.1109/ISSCC.2010.5433917 . .

J.D. Pape . . Implementation of an On-Chip Interconnect Using the i-SLIP Scheduling Algorithm . . MS Thesis, the University of Texas, Austin, USA. , , 2006 . . .

N.R. Potlapally , , , S. Ravi , , , A. Raghunalhan , , , R.B. Lee , , , N.K. Jha . . Impact of Configurability and Extensibility on IPSec Protocol Execution on Embedded Processors . . 19th Int. Conf. on VLSI Design , , 2006 . . p.299 - - 304 . . DOI: 10.1109/VLSID.2006.102 http://doi.org/10.1109/VLSID.2006.102 . .

RFC2401 . . Security Architecture for the Internet Protocol. Internet Engineering Task Force (IETF) . . Washington D.C., USA. , , 1998 . . .

C.H. Wang , , , C.Y. Lo , , , M.S. Lee , , , J.C. Yeh , , , C.T. Huang , , , C.W. Wu , , , S.Y. Huang . . A Network Security Processor Design Based on an Integrated SOC Design and Test Platform . . Proc. 43rd Annual Design Automation Conf. , , 2006 . . p.490 - - 495 . . DOI: 10.1145/1146909.1147039 http://doi.org/10.1145/1146909.1147039 . .

H.X. Wang , , , G.Q. Bai , , , H.Y. Chen . . Zodiac: System Architecture Implementation for a High-Performance Network Security Processor . . IEEE 19th Int. Conf. on Application-Specific Systems, Architectures and Processors , , 2008 . . p.91 - - 96 . . DOI: 10.1109/ASAP.2008.4580160 http://doi.org/10.1109/ASAP.2008.4580160 . .

H.X. Wang , , , G.Q. Bai , , , H.Y. Chen . . Design and implementation of a high performance network security processor . . Int. J. Electron. , , 2010 . . 97 ( ( 3 ): ): 309 - - 325 . . DOI: 10.1080/00207210903289383 http://doi.org/10.1080/00207210903289383 . .

L. Wang , , , Y. Niu , , , L.J. Wu , , , X.M. Zhang . . Design of an IPSec IP-Core for 10 Gigabit Ethernet Security Processor . . Proc. 10th IEEE Int. Conf. on Solid-State and Integrated Circuit Technology , , 2010 . . p.539 - - 541 . . DOI: 10.1109/ICSICT.2010.5667343 http://doi.org/10.1109/ICSICT.2010.5667343 . .

L.J. Wu , , , Y.J. Ji , , , X.M. Zhang , , , X.Y. Li , , , Y.S. Yang . . Power analysis resistant AES crypto engine design for a network security co-processor . . J. Tsinghua Univ. (Sci. Tech.) , , 2009 . . 49 ( ( S2 ): ): 2097 - - 2102 . . . .

Views

Downloads

CSCD

Alert me when the article has been cited

Submit

Tools

Publicity Resources

No data

Related Author

No data

Related Institution

No data

Chat

Address：Zhejiang University Press, 148 Tianmushan Road, Hangzhou, China Postal code：310028
Tel：+86-571-88273162 Email：fitee@zju.edu.cn
It is recommended to read the content of this site in Chrome&IE9+. Please switch to extreme mode in browser 360.
Cookies We use cookies to help provide and enhance our service and tailor content. By continuing, you agree to the use of cookies.

⁰