Searching device and method for Ethernet internet protocol security (IPSec) database

Abstract

The invention discloses a searching device for an Ethernet IPSec database. According to the device, a processing unit configures a security database, a receiving module receives a data frame from the Ethernet and unpacks the data frame into an IP data packet, an IPSec database searching module conducts selector extraction and compression on the IP data packet unpacked by the receiving module, a compressed character serves as an input address of a security policy database (SPD) storage unit, the SPD storage unit outputs a security policy and submits the security policy to the IPSec database searching module for analysis, information that whether IPSec protocol processing is to be conducted or not and an input address of a security association database (SAD) storage unit can be obtained from the security policy, the SAD storage unit outputs a security association, and the IPSec database searching module analyzes the security association to generate a task descriptor. By the aid of the device, the requirements for high-speed searching can be met, and the security database can be configured simply and flexibly. The invention also discloses a corresponding security database searching method as well as a device and a method which are used for achieving Ethernet IPSec database searching.

Description

technical field [0001] The invention relates to Ethernet security technology, in particular to an Ethernet IPSec security database search device and method. Background technique [0002] Since the network protocol itself does not provide security features, in order to ensure the confidentiality, integrity and identity authentication of network information, in 1998 the Internet Engineering Task Force IETF proposed the IPSec (Internet Protocol Security) protocol for the network layer (IP), as a network The key technology of security, IPSec protocol has been widely used. In the IPSec security system, there are two databases, one is the security policy database SPD (Security Policy Database), and the other is the security association database SAD (Security Association Database). A security policy defines the characteristics of secure communication between two communicating entities; what protocol to use in what mode; and how to handle IP packets. SPD is used to realize the sto...

AI Technical Summary

Problems solved by technology

Although this hardware implementation can meet the requirements of high-speed table lookup, the configurability of SPD and SAD databases is poor, and the cost of TCAM memory is high and power consumption is high.

Images