基于FPGA的万兆网的IPsec ESP协议设计与实现

“Internet协议安全性(IPsec)”为IP层及其上层协议提供加解密和认证等安全服务。但对IPsec协议的处理已经成为高速网络实现的瓶颈。随着FPGA向着更大容量和更高速度方向发展,基于FPGA硬件实现的IPsec协议栈可以提供更高的网络性能。文中介绍了一种基于FPGA的万兆以太网IPsec ESP协议栈的设计,支持隧道模式和传输模式,具有抗重放能力。通过采用多级流水操作、多缓存乒乓操作、多进程并行处理等技术实现了万兆线速。

Design and Implementation of 10-Gigabit IPsec ESP Protocol based on FPGA

IPsec(Internet Protocol Security) provides security services such as encryption/decryption and authentication for IP and upper layer protocols,and however IPsec protocol processing now becomes the bottleneck in the implementation of high-speed networks. As FPGA moves toward larger scale and higher speed direction, the IPsec protocol implementation based on FPGA hardware could provide even better network performance. This paper gives a new design for implementing the 10-gigabit Ethernet IPsec ESP protocol based on FPGA, thus to support the tunnel mode and transport mode, and anti-replay ability. The 10-gigabit wire-speed can be achieved by using multi-stage pipelining, multi-cache ping-pong operation, and multi-process parallel processing technology.