论文信息 - IPSec implementation on Xilinx Virtex-II Pro FPGA and its application

IPSec implementation on Xilinx Virtex-II Pro FPGA and its application

In this paper, we propose an IPSec implementation on Xilinx Virtex-II Pro FPGA. We move the key management and negotiation into software function calls that run on the PowerPC processor core. On the datapath, reconfigurable hardware logic implements time-critical functions for AES encryption and HMAC authentication. In our approach, the fast hardware processing is quasi-independent of the software processing. In traditional hardware systems, it is often the case that fast hardware modules wait for slow softwares to feed input data and retrieve output data. This causes the hardware component to stay in idle and suffer low utilization. Our contribution in this paper is to separate the IPSec data path from the control path, where the hardware has a full control of data processing and invokes the control software only when necessary. We illustrate the use of the IPSec implementation on a reconfigurable network device to secure the control and configuration channel.

John W. Lockwood | Jing Lu

[1] John W. Lockwood,et al. A Modular System for FPGA-Based TCP Flow Processing in High-Speed Networks , 2004, FPL.

[2] Patrick Schaumont,et al. Design and performance testing of a 2.29-GB/s Rijndael processor , 2003, IEEE J. Solid State Circuits.

[3] John W. Lockwood,et al. Field programmable port extender (FPX) for distributed routing and queuing , 2000, FPGA '00.

[4] John W. Lockwood,et al. An Extensible, System-On-Programmable-Chip, Content-Aware Internet Firewall , 2003, FPL.

[5] John W. Lockwood,et al. Deep packet inspection using parallel bloom filters , 2004, IEEE Micro.

[6] Ronald L. Rivest,et al. The MD5 Message-Digest Algorithm , 1992, RFC.

[7] John W. Lockwood,et al. Layered protocol wrappers for Internet packet processing in reconfigurable hardware , 2001, HOT 9 Interconnects. Symposium on High Performance Interconnects.

[8] John W. Lockwood,et al. Implementation of a content-scanning module for an Internet firewall , 2003, 11th Annual IEEE Symposium on Field-Programmable Custom Computing Machines, 2003. FCCM 2003..