Design and Implementation of High Performance IPSec Applications with Multi-Core Processors

In this work, we present P4-IPsec, a concept for IPsec in software-defined networks (SDN) using P4 programmable data planes. The prototype implementation features ESP in tunnel mode and supports different cipher suites. P4-capable switches are programmed to serve as IPsec tunnel endpoints. We also provide a client agent to configure tunnel endpoints on Linux hosts so that site-to-site and host-tosite application scenarios can be supported which are the base for virtual private networks (VPNs). While traditional VPNs require complex key exchange protocols like IKE to set up and renew tunnel endpoints, P4-IPsec benefits from an SDN controller to accomplish these tasks. One goal of this experimental work is to investigate how well P4-IPsec can be implemented on existing P4 switches. We present a prototype for the BMv2 P4 software switch, evaluate its performance, and publish its source code on GitHub [1]. We explain why we could not provide a useful implementation with the NetFPGA SUME board. For the Edgecore Wedge 100BF-32X Tofino-based switch, we presented two prototype implementations to cope with a missing crypto unit. As another contribution of this paper, we provide technological background of P4 and IPsec and give a comprehensive review of security applications in P4, IPsec in SDN, and IPsec data plane implementations. According to our knowledge, P4-IPsec is the first implementation of IPsec for P4-based SDN.

show abstract

“…hardware accelerators are available as ASIC [68], [69], NPU [70], [71], accellerated processing unit (APU) [72], or FPGA [73], [74].…”

Section: ) Software Implementations With Hardware Accelerationmentioning

confidence: 99%

P4-IPsec: Site-to-Site and Host-to-Site VPN With IPsec in P4-Based SDN

et al. 2020

View full text Add to dashboard Cite

show abstract

“…The evaluation has been done on the Intel IXP 2850 network processor. Moreover, some researches have been done using multicore processors in network security where high speed of packet classification is needed [11], [12], [13]. High-throughput and tremendous performance of multi-core processors make them an excellent candidate.…”

Section: Related Workmentioning

confidence: 99%

High-performance multi/many-core network processing architectures with shared and private queues

Falamarzi

Bahrambeigy

Ahmadi

et al. 2015

2015 7th Conference on Information and Knowledge Technology (IKT)

View full text Add to dashboard Cite

Nowadays, the efficient and probabilistic datastructure named Bloom filter is widely used in network processing applications. Moreover, the parallel nature of Bloom filter has made it suitable for multi/many-core architectures. In this paper, two schemes called multi-core architecture with shared queue and multi-core architecture with private queue (both employing Bloom filter cores) are proposed and implemented on FPGA. The inherent parallelism in querying of packets and different number of cores (such as 1, 2, 4, 8 and 16 cores) are considered. Experimental results show that the multicore architecture with private queue achieves higher throughput than the latter one. Furthermore, Bloom filter is also implemented on GPU (as many-core architecture) and the results are compared to the CPU only version. When the number of packets in GPU memory is 16384, the speedup achieved by GPU implementations using CUDA is about 274 times compared to CPU implementation. However FPGA results outperform GPU, so that the throughput of first architecture (shared queue) and second architecture (private queue) with 16 cores are respectively almost 5.5 and 7.1 times higher than GPU throughput.

show abstract