Abstract
Providing secure, reliable communications is a big challenge to guarantee confidentiality, integrity, and anti-replay protection, especially between endpoints in current Internet. As one of the popular secure communication protocol, IPsec usually limits the throughput and increases the latency due to its heavy encryption/decryption processing. In this paper, we propose a hardware solution to accelerate it. To achieve high performance processing, we have successfully designed and implemented IPsec on Cavium OCTEON 5860 multi-core network processor platform.
We also compare the performance under different processing mechanisms and discover that pipleline works better than run-to-completion for different sizes of packets in our experiments. In order to achieve the best performance, we select different encryption algorithms and core numbers. Experimental results on 5860 processors show that our work achieves 20 Gbps throughput with AES128 encryption, 16 cores for 512-byte packet traffic.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Kounavis, M.E., Kang, X., Grewal, K., Eszenyi, M., Gueron, S., Durham, D.: Encrypting the internet. In: SIGCOMM 2010, pp. 135–146 (2010)
Liu, Q.: Study and Implementation on IPsec VPN Gateway Based on Netfilter Mechanism. Master Thesis of Chongqing University (2009)
Cavium Networks: Cavium Networks OCTEON Plus CN58XX Hardware Reference Manual, pp. 221–235 (2008)
Cavium Networks: OCTEON Processor Packet Flow, pp. 21–52 (2008)
Cavium Networks: OCTEON Technical Presentation, p. 26 (2007)
Intoto Inc.: Virtual Private Network White Paper (2002)
RFC 2402: IP Authentication Header (AH) (1998)
RFC 2406: IP Encapsulating Security Payload (ESP) (1998)
Sang, S.L., Sang, W.L., Yong, S.J., Ki, Y.K.: Implementing High Performance VPN Router using Cavium’s CN2560 Security Processor. World Academy of Science, Engineering and Technology 9, 1307–6884 (2005)
Cavium Networks: Cavium Networks Announces Industry’s First 10Gbps IPsec and SSL PCI-Express Security Accelerators (2005)
Promentum ATCA-7220, http://www.radisys.com.cn/Products/ATCA/Processing-Modules/Promentum-ATCA-7220.html
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2011 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Meng, J., Chen, X., Chen, Z., Lin, C., Mu, B., Ruan, L. (2011). Towards High-Performance IPsec on Cavium OCTEON Platform. In: Chen, L., Yung, M. (eds) Trusted Systems. INTRUST 2010. Lecture Notes in Computer Science, vol 6802. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-25283-9_3
Download citation
DOI: https://doi.org/10.1007/978-3-642-25283-9_3
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-25282-2
Online ISBN: 978-3-642-25283-9
eBook Packages: Computer ScienceComputer Science (R0)